Introduction - Governance, Risk, and Compliance Topic for Oracle Applications - page 8

They need to review Management Discussion and Analysis ( MD&A ) with
management and auditors. This is where management gives guidance on where
the business is going. Such guidance is also given in Earnings Announcements,
press releases, and guidance provided to rating agencies.
They need to monitor the system of internal control and compliance with legal and
regulatory requirements. In order to do this, they need to monitor the system of risk
assessment and risk management. This may be synonymous with overseeing the
internal audit function, but in recent years many enterprises have set up a separate risk
management program office reporting it to the management. This oversight means
that the audit plan and the scope of the audits are signed off by the audit committee.
In order to ensure that the tone at the top is appropriate, received, and understood
the audit committee is generally responsible for an ethics program, and responsible
to manage whistle-blower complaints.
Signing Officers
The CEO and CFO of the company are responsible for signing the Sarbanes-Oxley
Section 302 Certifications.
These certifications, referred to by the Securities and Exchange Commission as
"Rule 13a-14(a)/15d-14a Certiications", must be signed separately by the CEO and
the CFO, and filed as an exhibit to quarterly reports on Form 10-Q or 10-Q(SB) and
to annual reports on Form 10-K or Form 10-KSB, as Exhibit 31, or, for foreign private
issuers, as an exhibit to Form 20-F. The SEC has specified the form and wording of
these certifications, which cannot be changed.
Briefly, the Signing Officer certifies that he has reviewed the report, that he believes
that it does not contain any misleading misstatement or omission, and that it fairly
presents the company's financial position and results of operations. The officer also
certifies his responsibility for the company's disclosure controls and procedures
and internal controls over financial reporting and as to their effectiveness.
Chief Audit Executive
The Chief Audit Executive is a part of the company but generally has reporting
relationships to the Audit Committee of the board of directors.
The duties of the Chief Audit Executive include:
• Status, strategy, and organization of the Internal Audit Department
• Management/supervision of the internal audit activity