We are in the
midst of our SOX audit.
As my bosses are not ard, I was
‘interview’ by the auditors for the controls in place for my
department.
Auditor : Control point
28 - Training. Do you have any policy in place of what kind of
training should be conducted ?
Me : No policy. All training
schedule and materials/contents from Japan Office
Auditor : Then any policy, for
the companies in the region, to state who should attend the
training ?
Me : No policy. The Senior
Management in each companies will decide who should attend the
training.
Auditor : So you send out
invitation ? Any policy who to send to, from you to them
?
Me : No policy. My boss asks me
to send.
Auditor : Then any policy to
monitor if all companies reply to indicate they attend or not
?
Me : Why do we need ALL these
POLICY for all these thing ? Issit necessary ?
Auditor : Just wonder if your
organization have policy in place. Then we can sight
them.
Rest of the conversation will
start with “any policy in place…”
I came out of the meeting room
and told my IA…Wah lau, these auditors everything also
policy.
My IA asks me to ask them back
if their Company has all these policy in place…If yes, ask them to
share.
Unfortunately that's quality control for you. The company
requires proper process document to ensure all employees understand
them and follow them so the company can get consistent outcome.
