Faulkner Governance Risk & Compliance Faulkner Governance Risk & Compliance

Experience

Years deciding what passes inspection. Now on your side of the table.

I

Who does the work

Every engagement is run by the owner, whose thirteen years in public accounting were spent in Big Four and national firm risk practices: internal audit, SOX and ICFR, and technology risk engagements for public and high growth technology companies, advising CFOs, controllers, heads of internal audit, CIOs and audit committees. The owner built and led an Austin risk consulting practice and directed global delivery teams for public and pre IPO clients. The same testing discipline now runs across all five lines of the practice: audit readiness and ICFR, AI controls, cybersecurity frameworks, regulated ICFR and public sector work.

More about who does the work

II

Where the standard comes from

The same person defended audit scope, methodology, evidence and conclusions through annual PCAOB inspections with zero comments, and led the internal quality inspections across engagement teams. That is the standard we build to from management’s side: evidence prepared the way an inspector expects to find it.

III

Where we look first

Earlier, at the Big Four, the work was IT audit and support of financial statement audits: SOX readiness, ITGCs and IT governance, application controls, and fieldwork over ERP platforms and system implementations. Access and system changes are still where we look first. Scoping runs top down, from the financial statements to the controls that matter. Testing starts with the IT general controls, because the business process controls, the automated controls and the reports they use depend on them.

IV

What the practice holds

The person who does the work holds the CISA and the CCSK, and served as Vice President and board member of the ISACA Austin Chapter. We are based in Austin, Texas, and work remote or on site nationwide.

Standards, frameworks and tools

  • SOX 404
  • PCAOB auditing standards
  • COSO 2013, and the 2026 guidance on internal control over generative AI
  • COBIT 2019
  • NIST CSF 2.0
  • NIST 800-53
  • NIST AI RMF
  • ISO 27001
  • ISO 42001
  • CIS Benchmarks and Controls
  • FFIEC IT Examination Handbook
  • FDICIA
  • Model Audit Rule
  • Uniform Guidance Single Audit
  • SOC 1 and SOC 2
  • The major ERP platforms and custom built systems
Capability statementPDF · one page
Start with a scoping call

Send the date on your calendar and a sentence on what is coming up.