All guides
-
SOX compliance checklist: what your auditor will test in year one
A SOX compliance checklist for a newly public company should cover nine things: who must comply and when, scoping from the financial statements down, entity level controls, process documentation, the IT general controls, segregation of duties, the key reports your controls rely on, the precision of management review controls, and how deficiencies are rated and fixed. For each one, the useful question is what the external auditor will test and what evidence will pass. A control that exists but cannot be evidenced is treated as a control that does not exist.
-
How to perform a SOX risk assessment and build the RCM
To perform a SOX risk assessment, work top down, starting with materiality set from the financial statements. Then identify the significant accounts, disclosures and relevant assertions, and map each one to the processes, locations and systems that produce it. Next, write down what could go wrong at each step, and choose the few controls that would catch it, along with the IT general controls those controls depend on. The risk and control matrix (RCM) is where the second half of that chain is recorded. The risk assessment is the reasoning behind it, and an auditor reads both.
-
Internal Control Documentation Best Practices That Survive Testing
The core of internal control documentation best practices is that a stranger can reperform the control from what you wrote. Each control description names who performs it, what they do, how often, how precise it is and what evidence it leaves. The narrative or flowchart shows where the transaction starts and how it reaches the ledger. The risk control matrix ties each control to the risk it answers. The evidence shows what the reviewer actually looked at, and the reports behind each control are proven complete and accurate.
-
ITGC testing for SOX: the domains, the samples, and why tests get rejected
ITGC testing for SOX covers four areas over the applications that feed your financial statements: access to programs and data, program changes, program development, and computer operations. For each in-scope application you design a test of each relevant control, pull a complete population, select a sample sized to the control's frequency and risk, and keep evidence that another tester could reperform. The domains are the easy part. Tests get rejected because the population was incomplete, the report behind the control was never validated, or the reviewer's evidence shows a signature and not the review.
-
How to prepare for an external audit, seen from the auditor's side
To prepare for an external audit, work backward from the planning meeting date: reconcile the balance sheet, organize the evidence the auditor will ask for, and document the key controls and the processes behind them. Then test the IT general controls before the auditor does. When an audit runs long, accounting questions are rarely the cause. The usual causes are late evidence, a system report nobody can prove is complete, or a control the auditor planned to rely on failing halfway through fieldwork.
-
2026 Audit Committee Agenda Priorities: What to Ask Management to Show You
The 2026 audit committee agenda priorities are eight items: the health of internal control over financial reporting and the deficiencies against it, the cost and quality of the SOX program, cybersecurity oversight and SEC disclosure, AI governance, third-party risk, fraud risk, the relevance and sourcing of internal audit, and the external auditor relationship. For each item, what helps is knowing which document management should put in front of the committee and which question tests whether that document is real, because a topic list alone does not help much.
-
SEC cybersecurity disclosure requirements and the controls behind them
The SEC cybersecurity disclosure requirements, adopted on 26 July 2023, ask public companies for two things. First, a Form 8-K describing any cybersecurity incident the company determines to be material, filed within four business days of that determination. Second, an annual description in the 10-K of how the company assesses, identifies and manages cybersecurity risk, and how the board and management oversee it.
-
Outsourced vs co-sourced internal audit, and the third option
The difference between outsourced vs co-sourced internal audit is who does the work and who stays in charge. With outsourced internal audit, an outside firm does most of the internal audit work, and a small internal team, sometimes one manager, still oversees it; with co-sourced internal audit, your own head of internal audit stays in charge and brings in outside specialists for particular areas or busy seasons. A third option suits many companies better: a fractional SOX lead. That is an outside person who runs the SOX compliance program on a set number of days each month, for a company that has the controls but not the person to run them.
-
State agency risk and compliance consulting in Texas: what to expect
Good state agency risk and compliance consulting in Texas should leave your agency or university with controls that have been assessed and tested against TAC 202 and the Texas Cybersecurity Framework, written up the way the biennial information security plan asks, and now extended to the AI systems your agency uses. You should expect a written scope, a fixed fee, named deliverables with dates, and evidence your own staff can keep current after the consultant leaves. Anything vaguer than that is a slide deck.
