Services
Five lines of work. One standard.
Each starts from a date on your calendar: the audit, the exam, the filing, the go live, the board meeting. Tell us the date and we will tell you what we would do and what we would leave alone. Scoping runs top down, from what will be tested to the controls that matter, and testing starts with the IT general controls, because everything else depends on them.
Audit readiness and ICFR
Management’s own testing, to the standard the auditor uses. Whether or not your auditor attests to your controls this year, management still assesses them, the audit committee still asks, and a lender, a sponsor or a registration statement still turns on the answer. We get the program ready before anyone tests it: which processes and applications are in scope, which controls actually operate, what evidence exists, what will fail, and the fix, retested before the auditor tests it. Seven services, and two named for the moments that start most findings.
SOX and ICFR readiness
A review of the internal controls over financial reporting the external auditor will test, done before they test them: entity level controls, the business process controls in the cycles that matter (revenue, purchasing, payroll, the financial close) and the IT general controls under them. We identify which processes and applications are in scope, which controls actually operate, what evidence exists today, and what will fail if nothing changes.
Sample gap listPDF · one page Sample summary for the audit committeePDF · one pageTeam, deliverables, duration
- What it takes from your team
- Last year’s scoping or the financial reporting process map, system access or screen shares, and about an hour a week from each control owner.
- What you receive
- A gap list with an owner and a date on every line, the in scope process and application list with the reason each one is in, and a one page summary for the audit committee.
- Typical duration
- Three to five weeks.
ITGC and business process controls, documented and tested
Documentation and testing of the controls in scope, starting with the IT general controls (access to programs and data, program changes, IT operations and program development), then the automated controls and the segregation of duties the applications enforce, then the business process controls that depend on them, with entity level controls alongside. Narratives, control matrices, walkthroughs and test workpapers built to the standard an external auditor applies to their own, so the auditor can use them. How much they rely on them is their decision. Where change control runs through pull requests and deployment pipelines, we test it there.
Team, deliverables, duration
- What it takes from your team
- A control owner for a walkthrough of each control, the reports, records and evidence for the period, and prior year workpapers if any exist.
- What you receive
- A control matrix, a narrative for each process, a walkthrough and test workpaper for each control, an evidence index, and a summary of exceptions with a recommendation for each.
- Typical duration
- Four to eight weeks, depending on the number of processes and applications and the length of the evidence period.
Deficiency remediation
Fixing the controls that failed. Where the design was the problem we redesign the control. Where the fix takes time we design a compensating control for your team to run. And we write the memo the audit committee reads.
Team, deliverables, duration
- What it takes from your team
- The auditor’s deficiency letter or management’s own findings, and the people who own the affected controls.
- What you receive
- A remediation plan for each deficiency, redesigned control descriptions, compensating controls where needed, a remediation memo written for the audit committee, and a retest before your auditor’s, so you hear the result first.
- Typical duration
- Two to six weeks, plus the time a new control has to run before it can be retested.
PCAOB grade testing for management
For controls already documented: management’s own testing, done to the standard an inspector applies to the auditor. Sample sizes and a depth of review that hold up. Evidence of review that shows what the reviewer looked at. The reports each control relies on, checked for completeness and accuracy. And the questions an inspection team asks that have not reached your team yet.
Team, deliverables, duration
- What it takes from your team
- The control population, the evidence for the period, and time with the people who perform and review the controls.
- What you receive
- Test workpapers built to the standard an external auditor applies to its own work, a list of the points your auditor would raise because an inspector would raise them with the auditor, and a plan to close each one before the audit.
- Typical duration
- Four to eight weeks.
Fractional SOX compliance lead
A set number of days a month running the SOX compliance program: the calendar, the control owners across finance and IT, the evidence requests, the auditor relationship, management’s assessment and the status the audit committee sees. For a company that has the controls but not the person. The same lead now carries an AI or cybersecurity control program where a company has one.
Team, deliverables, duration
- What it takes from your team
- A named executive sponsor, access to the systems and the people, and a seat at the audit planning meetings.
- What you receive
- The program, run month after month: a compliance calendar, evidence requests sent and tracked, a written status every month, and the same lead every time.
- Typical duration
- A monthly retainer.
SOX platform optimization
For a company whose controls live in Optro (the platform formerly AuditBoard), Workiva or a similar system and whose program has grown past what anyone designed. We read the key control population for duplicates and controls that no longer map to a risk, rewrite the risk statements so each one says who, what, how and why, correct the COSO mapping and the assertions, confirm every control has a named owner, and set the platform up so owner certification, testing status and the audit committee view come out of the system rather than out of a spreadsheet beside it.
Team, deliverables, duration
- What it takes from your team
- Read access to the platform, the current control matrix export, and thirty minutes with each control owner whose controls change.
- What you receive
- A rationalized key control list with every change explained, corrected risk statements and mappings loaded in the platform, an owner certification template, testing dashboards configured, and a one page recommendations memo on what to change next in the platform.
- Typical duration
- Six to twelve weeks, depending on the size of the control population.
Key reports and SOC 1 reviews
The reports each control relies on, tested for completeness and accuracy, with the parameters and the logic behind them documented so the test can be repeated. SOC 1 Type 2 reports from your service organizations (the reports many still call SSAE 18), issued under AT-C section 320, reviewed for the opinion, the scope, the period, the exceptions, the complementary user entity controls your team has to operate and the subservice organizations carved out of the report, with a bridge letter plan for the gap to your year end.
Team, deliverables, duration
- What it takes from your team
- The list of reports used in controls and where each one comes from, report parameters and logic where they exist, and the SOC 1 reports your service organizations provided, with their bridge letters.
- What you receive
- A key report inventory with a completeness and accuracy test for each report, a review memo per service organization with exceptions and complementary user entity controls mapped to your controls, and the list of gaps to close before your auditor asks, including the service organizations that provide no SOC 1 report.
- Typical duration
- Two to four weeks, alongside the evidence work or on its own.
Pre IPO readiness
The roadmap from where the controls are today to management’s first assessment: the scope, the gaps in the business processes and in IT, the order to fix them in, and the evidence a registration statement and the quarterly certifications that follow it will rest on. Found now, a material weakness is a project; found after the offering, it is a disclosure.
Team, deliverables, duration
- What it takes from your team
- The offering timetable, the finance and IT organization charts, the systems list and whoever owns the close.
- What you receive
- A dated readiness roadmap, the gap list with an owner and a date on every line, and the first year compliance calendar.
- Typical duration
- Four to eight weeks for the roadmap; the fixes run to the calendar it sets.
ERP go live controls
Before a new platform goes live: data conversion, the access granted for the cutover, change control through the project, the reports the business will rely on, and the segregation of duties the new system enforces or does not. Implementations are where many findings start, so we look before go live, not after the auditor does.
Team, deliverables, duration
- What it takes from your team
- The project plan and cutover date, the integrator’s design documents, and the people who own conversion, access and reporting.
- What you receive
- A go live control checklist with an owner and a date on every line, the conversion and access evidence an auditor will ask for, and a retest after cutover.
- Typical duration
- Three to six weeks around the go live date.
AI controls and governance
AI you can show your audit committee, in any state. A policy on paper and a tested control are different things, and we build the second. Everything here is written in the words a CFO and an audit committee already use, so AI governance sits inside the control program they already run rather than beside it.
Internal control over generative AI
Built on COSO’s guidance of 23 February 2026, the first to put generative AI inside the 2013 framework: an inventory of your AI use cases by COSO’s eight types, a risk assessment, a control set, test procedures and a monitoring report, so the audit committee hears about AI controls the way it hears about every other control. Written for the CFO who signs the certification, not for the vendor who sold the model.
NIST AI RMF alignment for the Texas defense
The Texas Responsible Artificial Intelligence Governance Act has been in force since 1 January 2026, enforced by the Attorney General with a sixty day cure period, and it gives a defense to a party that substantially complies with the most recent NIST Artificial Intelligence Risk Management Framework Generative AI Profile. We assess your program against the profile, keep the risk register, and write the alignment memo your general counsel can file.
AI in the financial close
Controls over AI used in reconciliations, journal entries, forecasting and disclosure drafting, scoped and tested as an extension of your SOX program, so the certification the CFO signs covers the close as it is actually run.
AI access and vulnerability controls review
Who and what can reach your models and your data: identity, data access, prompt and model boundaries, logging, and the controls that stop a model from doing what no person is allowed to do.
State AI law readiness, sold nationally
One control test underneath four sets of dates: California (risk assessments since 1 January 2026, automated decisionmaking duties from 1 January 2027, independent cybersecurity audits from 2028), New York (the Part 500 milestones of 1 November 2025 and the city’s hiring tool bias audits), Colorado (notice, explanation, appeal and recordkeeping from 1 January 2027) and Illinois (AI in employment decisions since 1 January 2026). Texas lives on this page.
ISO 42001 readiness
The gap assessment and the management system documentation for a company that wants the certificate. Listed last because the standard is young and few buyers are asking for it yet; when yours does, the control set above is most of the work.
Cybersecurity framework assessments
Your CAT replacement, done once. The FFIEC Cybersecurity Assessment Tool was retired on 31 August 2025, and examiners now ask what a bank or credit union has baselined to instead. The same discipline serves a technology company whose customer or assessor wants a framework they recognize. We assess against the framework, test the controls that matter rather than scoring a questionnaire, and leave a gap list with an owner and a date on every line.
NIST CSF 2.0 baseline for banks and credit unions
The crosswalk from the old CAT maturity statements to the 2.0 functions, the current profile, the target profile and the gap list, written so an examiner can read it.
CIS Benchmarks hardening review, per platform
Windows Server, Microsoft 365, Azure, AWS or Linux, scored against the benchmark, with the configuration gap list in the order to close it. Repeatable, and it feeds IT general control remediation.
ISO 27001 and SOC 2 readiness
The practitioner version, for a company whose assessor just failed it or whose customer just asked: the controls that are missing, the evidence that is thin, and the fix, tested before the assessor returns.
NIST 800-53 and FFIEC IT Handbook assessments
Named here because they are asked for by name: the control baseline mapped, tested and reported.
NYDFS Part 500 and California cybersecurity audit readiness
For insurers, banks and fintechs licensed in New York, the Part 500 assessment behind the April certification. For any company of size that sells to Californians, readiness for the independent cybersecurity audits due from 1 April 2028 by revenue tier, with the readiness work starting in 2027. The dates are on the New York and California pages.
Regulated ICFR beyond SOX
The thresholds changed. Your program should know. The same internal control over financial reporting discipline, for the institutions whose mandate comes from a regulator rather than the SEC.
FDICIA
From 1 January 2026 the annual audit and audit committee requirements apply at one billion dollars of assets, and management’s internal control assertion with the external auditor’s attestation at five billion, indexed from 1 October 2027. For banks at five billion and up, management’s assertion support and testing, outsourced. For banks crossing one billion, the audit committee and the control program set up.
Model Audit Rule
Internal control over financial reporting testing for insurers above five hundred million dollars of premium, and the documentation for those approaching it.
Single Audit
IT and compliance controls support for recipients that expend one million dollars or more of federal awards in a year, on its own or alongside the program.
Public sector
The plan is due in June. The controls are due now. Every Texas state agency, public university and junior college files a biennial information security plan with the Department of Information Resources by 1 June of even numbered years, under Texas Administrative Code chapter 202 and the Texas Cybersecurity Framework, and lives under the state’s AI law besides. Most do the self assessment with whoever is in the room.
TAC 202 and Texas Cybersecurity Framework assessments
Timed to the next biennial plan, due 1 June 2028, and the vulnerability report that goes with it: the controls assessed, tested and written up the way the plan asks.
AI governance for agencies
An inventory of the AI systems in use, the NIST alignment memo under the Texas Responsible Artificial Intelligence Governance Act, and the controls over automated decisions that touch the public.
Single Audit IT and compliance controls
For agencies and universities that expend federal awards, and for the local governments and nonprofits around them.
Two offers that cut across every line
Both are short, both are fixed, and both exist because the question comes up on every line.
Deficiency second opinion
Two days, fixed fee, on whether the auditor’s or the examiner’s deficiency classification holds and what a credible response looks like. Thirteen years in public accounting deciding what passes inspection is the product. Credited in full if it turns into an engagement.
Audit committee advisory
A quarterly read of the control program for a committee that does not have a controls person on it, on a retainer.
AI in the work
Every line above uses AI models on the volume: populations read against their tickets, user lists reconciled to the HR file, report logic checked against its source, narratives drafted from walkthrough notes, the evidence index kept current. That is why the durations above are weeks and why control owners hear from us once. The person running your engagement reviews every result before it reaches a workpaper, the workpaper says what was machine assisted, and your information stays in your systems: a model runs inside an environment you control or under an agreement that bars training on your data, and nothing of yours is kept once the engagement ends.
Why not your auditor, and who does the work
Your external auditor or your examiner can tell you a control failed. Neither will design or build the fix for you, and for the auditor, independence rules forbid it. That work is ours, with management, and the opinion stays theirs. Our work is advisory and not an attest engagement; the audit is performed by your CPA firm. We have no software to sell, so any tool we suggest is one you buy for your own reasons. The work is senior from the first call to the retest, with no handoff to junior staff after the letter is signed. Where a scope needs more hands, we add them only with your written consent, and the same person stays on the work.
Send the date on your calendar and a sentence on what is coming up.
hello@faulknergrc.com