Remember, there is a tendency for an organization to go on autopilot if the internal auditor is not vigilant. As for the certifications required by section 302 of Sarbanes-Oxley, you should be part of the disclosure committee. You should also establish a robust audit program for the company’s disclosure controls framework.
•  If you are an internal auditor of a nonpublic financial services company, you should view this as an opportunity to convince the board and management to adopt a rigorous self-assessment process for controls covered by sections 302 and 404 of Sarbanes-Oxley as a best practice. Second, internal auditors must be willing to sacrifice everything to maintain their independence within the organization.