Faulkner Governance Risk & Compliance Faulkner Governance Risk & Compliance

Austin, Texas. Remote or on site, nationwide.

Plain words.
Kept dates.
No surprises.

We get a company’s controls over financial reporting, technology and AI ready for whoever is coming to test them: the external auditor, the bank examiner, the state, the board. Tested before they test you, by someone who spent thirteen years in public accounting doing the testing.

Start with a scoping call
First stepA free two hour scoping call.
FeeIn writing before any work begins.
GuaranteeIf your external auditor, an examiner or a regulator writes up a deficiency on a control we documented and tested, we remediate it at no charge.
I

When to call

  • The audit planning meeting is on the calendar.

    We go through last year’s findings and this year’s request list with you first, so you know which requests will be hard and what you want to say about scope.

  • The board asked what controls sit under the AI policy.

    A policy on paper and a tested control are different things. We inventory the AI in use, build the controls COSO’s February 2026 guidance describes, and test them, so the audit committee hears about AI the way it hears about every other control.

  • The examiner asked what replaced the CAT.

    The FFIEC retired its Cybersecurity Assessment Tool on 31 August 2025. We baseline you to NIST CSF 2.0, with a crosswalk from the old maturity statements, written so the examiner can read it.

  • A deficiency letter arrived.

    From the auditor or from an examiner. We write the remediation plan and the memo the audit committee reads, design a compensating control your team runs while the fix is built, and tell you plainly whether the fix can run long enough to be tested before it is tested again.

  • A state put a date on your AI.

    Texas and Illinois since 1 January 2026, Colorado and California from 1 January 2027. One control test answers all four, and we run it before the date, not after the first complaint.

  • The bank crossed one billion dollars of assets.

    Since 1 January 2026 the FDICIA annual audit and audit committee requirements start at one billion dollars of assets, and management’s internal control assertion at five billion. We set the program up before the first year it applies.

  • An IPO date is set.

    A material weakness found before the offering is disclosed in the registration statement and in the quarterly certifications that follow it, and management’s first assessment of internal control is due with the second annual report after the offering. We find the control gaps, in the business processes and in IT, while there is time to fix them.

  • The biennial plan is due in June.

    Texas state agencies, public universities and junior colleges file an information security plan with the Department of Information Resources by 1 June of every even numbered year. We assess the controls against TAC 202 and the Texas Cybersecurity Framework well before it is due, so the plan describes controls that work.

  • The person who ran compliance left.

    A fractional lead keeps the calendar, the evidence requests and the relationship with the auditor or the examiner running while you hire, or instead of hiring.

  • The control count keeps growing and nobody can say why.

    Three hundred key controls in Optro or Workiva, half of them duplicates or orphans. We rationalize the population, fix the risk statements and the mapping, and set the platform up so the audit committee view comes out of the system.

II

Where we come in

Service details

  • Audit readiness and ICFR

    For public companies, IPO candidates and PE backed companies getting the SOX program ready for the external auditor: readiness, ITGC and business process testing, remediation, PCAOB grade testing for management, a fractional lead, SOX platform optimization, pre IPO readiness and ERP go live controls.

  • AI controls and governance

    For any company using AI in its business or its close, in Texas or in a state with a date on the calendar: AI controls an audit committee can be shown, on COSO’s 2026 guidance and the NIST framework.

  • Cybersecurity framework assessments

    For banks, credit unions and technology companies that need a cybersecurity baseline an examiner or a customer will accept: NIST CSF 2.0, CIS Benchmarks, ISO 27001 and SOC 2 readiness, NYDFS Part 500.

  • Regulated ICFR beyond SOX

    For banks, insurers and grant recipients with an internal control mandate that comes from a regulator rather than the SEC: FDICIA, the Model Audit Rule, Single Audit.

  • Public sector

    For Texas state agencies, universities and the organizations around them, on the biennial information security plan and under the state’s AI law.

III

How an engagement runs

  1. A free two hour scoping call.

    We look at your applications, your key controls and your calendar, and say what we would do and what we would leave alone. Where a scope needs more than a call, a two week scoping sprint is the paid first step, credited in full against the engagement it scopes.

  2. A fixed price and a short letter.

    The letter names the deliverables, the dates and the fee.

  3. The work, with a written status every week.

    One page: what was done, what is blocked, and what you need to decide.

  4. The handoff and the retest.

    Your team gets the workpapers, the evidence index and the gap list. We retest what was remediated and confirm the result in writing.

Sample weekly statusPDF · one page
IV

AI in the work

We put AI models on the parts of control work that are volume: reading a change population against its tickets, reconciling a user list to the HR file, checking a report’s logic against its source, drafting a narrative from a walkthrough, keeping the evidence index current. The person running your engagement reviews every result before it reaches a workpaper, and the workpaper says what was machine assisted.

Less of your team’s timeControl owners answer fewer questions, once, because the first pass on the evidence is done before we ask.
Revenue protectedFindings surface in weeks, not at the opinion, so a deficiency is fixed before it reaches the audit committee, a lender or a registration statement.
Cheaper every yearThe scripts, checks and workpapers are yours. The second year’s program starts from them, not from scratch.

Your information stays in your systems. Where a model is used it runs inside an environment you control or under an agreement that bars training on your data, and nothing of yours is kept once the engagement ends.

V

The guarantee

Ready before you are tested.

  1. If your external auditor, an examiner or a regulator writes up a deficiency on a control we documented and tested, we remediate it at no charge.

  2. If a control fails testing for a reason in our work, that deliverable’s fee is refunded.

  3. Twenty percent of each fixed fee is held back, and invoiced only after your external auditor, an examiner or a regulator completes testing of the controls in scope with no deficiency attributable to our documentation or testing.

The engagement letter or statement of work sets the terms.

Capability statementPDF · one page
VI

How we charge

Fixed feeDefined work product.
HourlyAdvice.
RetainerA fractional compliance lead, monthly.

The free scoping call sets the scope and the letter puts the number in writing. Fixed fees invoice on the milestones in the statement of work, less the twenty percent holdback above.

VII

Why not your auditor, and who does the work

Your external auditor or your examiner can tell you a control failed. Neither will design or build the fix for you, and for the auditor, independence rules forbid it. That work is ours, with management, and the opinion stays theirs. Our work is advisory and not an attest engagement; the audit is performed by your CPA firm. We have no software to sell, so any tool we suggest is one you buy for your own reasons. The work is senior from the first call to the retest, with no handoff to junior staff after the letter is signed. Where a scope needs more hands, we add them only with your written consent, and the same person stays on the work.

Start with a scoping call

Send the date on your calendar and a sentence on what is coming up.