Public companies and their auditors have to take responsibility for their internal controls. Specifically those relating to financial reporting. The controversial Sarbanes-Oxley Act of 2002 imposes this requirement.

Rule 13a-15 (f) of the SEC rules defines "Internal Control Over Financial Reporting" as

"a process designed by, or under the supervision of, the issuer's principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer's board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of finacial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles.

There are some important points to note. Not least that Sarbanes-Oxley only pertains only to those which affect financial reporting.

In particular SEC rule 13a-15 (f) continues to policies and procedures which:-

".. Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispotions of the assets of the issuer. This relates to the use for which assets are put.

Provide reasonable assurance that transactions are recorded as necessary to tor permit preparation of financial statements in accordance with generally accepted accounting principles , and that receipts of and expenditures of the issuer are being made only in accordance wtih authorizations of management directors of the issuer. I.e. internal controls have to exist to stop the CEO saying "I know nothing!"

Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuers asset that could have a material effect on the financial statements. Controls to stop managers or staff buying, selling or using assets unwisely.

Reading the above, it might seem an onerous requirement. However if one considers Enron and WorldCom, it does not seem such a high price to pay.