The simple act of complying with GAAP is much more onerous than SOX. Any finance person worth their salt can navigate SOX easily. Only inexperienced finance people have problems with SOX, but then again, similar things can be said about inexperience programmers as well.
I'm afraid this illustrates how poorly informed you are - you clearly are not an accountant with significant experience (just saying). This goes doubly so of your wife - if this is her level of understanding that is very worrisome - the idea that she is licensed with this attitude is scary - it's what you don't know that can bite you.
Some facts for those that may read the above and get the wrong idea. EVERY major big four firm and their clients and all other major players have had great difficulty in this area. It's super painful because the question is not - are the numbers right - which pretty much everyone in accounting would understand putting efforts towards, but a very meta (and wide) question on systems getting to the numbers (with turns out to be subjective).
What's crazy is I can step back from this type of thing and without even going into a company spot lots of issues likely illustrating poor control or even worthy of enforcement action (actual enforcement) from the outside. Seriously, go to a consumer complaint website - if you see a ton of the same complaint it's worth a look.
This is why CFPB was such a powerful idea. Yes - they overreached slightly but 90%+ great work - and very focused on bad actors which was wonderful to everyone trying to do right thing. Absolutely should have kept going with that idea.
Just a flavor... pay close attention to words like all and every which open up each item to huge scope - the auditor here picked a random month to test a system and actually went in person to a meeting where reconciliations were performed. Now repeat this 100x for each client. Every firm out there doing audits has had issues like this (many).
These are the MOST experienced people - so I laugh when I hear that "only inexperienced people" have problems.
KPMG:
A.1. Issuer A
In this audit, the Firm failed to obtain sufficient appropriate audit evidence to support its opinions on the financial statements and on the effectiveness of ICFR.
The Firm identified this manual control and certain other manual review and reconciliation controls as compensating controls, but failed to sufficiently test these controls.
Specifically —
o To test the review and approval of changes to the financially
significant applications, the Firm tested a sample of changes to
determine whether they had been appropriately approved. The
Firm's testing was not sufficient as ... its sample was limited to changes made in only
one month (the third month before year end) and the Firm failed to
consider whether this month was representative of changes made
throughout the year.
o To test the manual review and reconciliation controls, the Firm
obtained certain monthly operating review reports and
reconciliations and attended certain monthly management meetings
where the reports and reconciliations were discussed. The Firm's
testing was not sufficient, as (a) it did not test controls over the
completeness and accuracy of the data in the reports, and (b) it
failed to test whether these controls identified all of the relevant
issues for investigation and, if so, whether such issues were
appropriately investigated and resolved.
reply