In 2002, Congress passed the Sarbanes-Oxley Act which, in part, requires all publically held entities to provide an annual assessment and attestation of the adequacy and effectiveness of its key internal controls over the financial reporting process. Shortly thereafter, the University of Pittsburgh Audit Committee of the Board of Trustees and management determined that it was essential to implement key elements of the Sarbanes-Oxley Act of 2002 even though not-for-profit organizations do not fall under this law.

Section 404 of Sarbanes-Oxley requires management to document and evaluate the design and operation, and report on the effectiveness, of its internal controls over financial reporting. The Sarbanes-Oxley Department has implemented the spirit of section 404 by working with University central administrative departments to identify, document/update, and assess key operating controls that have a major impact on financial reporting. These key operating controls are then reviewed and tested by Internal Audit to assess current operating effectiveness.