>The auditors don't look at the first mapping "reality -> accounting books" but only at the second one "accounting books -> financial statements"? That's not e

>The auditors don't look at the first mapping "reality -> accounting books" but only at the second one "accounting books -> financial statements"? That's not entirely correct. A good portion of SOX audit efforts in the US, for instance, is spent on examining configuration of the various systems on which financial reporting is dependent (e.g. examining exactly how segregation of duty controls are implemented in the ERP system). A good portion of time is also spent examining if human-executed processes (e.g. employee on boarding/off boarding, granting permissions to data and financial system capabilities, manual review of backup job reports, etc) are actually being carried out in a manner that complies with the organization's SOX controls.