Sarbanes Oxley Advisory and Audit (SOX)
Build and test the internal controls over financial reporting that SOX compliance requires, whether you’re preparing for your first audit or maintaining an existing program.
|800+ businesses served since 2020
Governance that has to hold up to scrutiny
Sarbanes-Oxley compliance is required for publicly traded companies, overseen by regulators such as the US Securities and Exchange Commission (SEC) and the Public Company Accounting Oversight Board (PCAOB). At its core is Internal Control over Financial Reporting (ICFR) — controls that need people, process and technology working together.
We help you build that framework, or keep testing and refining one you already run.
- SOX/ICFR scoping and readiness assessment
- Documentation, walkthroughs and talkthroughs
- Diagnostics and improvement of existing controls
- Control testing, IT and non-IT
- Remediation support
- Training and awareness
SOX gets harder at different points for different companies
Designing the framework
Building an internal control framework from nothing can strain resources if it isn’t planned for properly.
Efficient ICFR testing
Keeping testing and results analysis efficient year over year, without it becoming a full-time drag.
Deficiencies and one-off transactions
Evaluating controls for nonrecurring transactions and responding properly to significant deficiencies.
Four steps to a program that runs itself
Assess readiness
Scope your ICFR framework and identify unmitigated risk.
Test controls
IT and non-IT control testing that stands up to your independent auditor’s review.
Flag deficiencies
Clear reporting on what’s not sufficiently controlled, and why it matters.
Remediate and train
Design and implement fixes, and build the awareness to keep them in place.
Questions companies ask first.
Who is required to comply with SOX?
Publicly traded companies in the US, overseen by regulators such as the SEC and PCAOB. Companies preparing to go public or merging with a listed entity often start SOX readiness work ahead of that event.
What does ICFR testing actually involve?
Evaluating the design and operating effectiveness of controls over financial reporting — both IT and non-IT — and documenting the results in a form your independent auditor can rely on.
Can you help fix control deficiencies you find, not just report them?
Yes. We work alongside your team to design, select and implement remediation actions that close the gap efficiently.
Tell us what you need.
A short call to understand where you stand and how we would run this for you. No obligation.
Prefer to browse first? See all our services or contact us directly.
Explore more of what we do.