We are in the
midst of our SOX audit.
As my bosses
are not ard, I was ‘interview’ by the auditors for the controls in
place for my department.
Auditor :
Control point 28 - Training. Do you have any policy in place
of what kind of training should be conducted ?
Me : No
policy. All training schedule and materials/contents from Japan
Office
Auditor : Then
any policy, for the companies in the region, to state who should
attend the training ?
Me : No
policy. The Senior Management in each companies will decide who
should attend the training.
Auditor : So
you send out invitation ? Any policy who to send to, from you to
them ?
Me : No
policy. My boss asks me to send.
Auditor : Then
any policy to monitor if all companies reply to indicate they
attend or not ?
Me : Why do we
need ALL these POLICY for all these thing ? Issit necessary
?
Auditor : Just
wonder if your organization have policy in place. Then we can sight
them.
Rest of the
conversation will start with “any policy in place…”
I came out of
the meeting room and told my IA…Wah lau, these auditors everything
also policy.
My IA asks me
to ask them back if their Company has all these policy in place…If
yes, ask them to share.
