SOX Readiness

Section 404(a) requires management to assess and report on the effectiveness of ICFR in the company’s annual report (Form 10-K). This requirement applies to all public companies. Section 404(b), which requires the external auditor to attest to management’s assessment, applies to accelerated filers and large accelerated filers. Newly public companies typically have a grace period before 404(b) applies, but management’s 404(a) obligation begins with the first annual report.

A control deficiency exists when a control is missing or not operating as designed. A significant deficiency is more serious and merits attention from those responsible for financial oversight, but does not rise to the level of a material weakness. A material weakness creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. Material weaknesses must be disclosed and typically trigger significant scrutiny from auditors, investors, and regulators.

Ideally 12 to 18 months before your target public date. Building a control environment from scratch takes time — you need to document processes, design controls, test them, identify gaps, and remediate issues before your external auditors begin their ICFR assessment. Starting early also gives you time to make controls genuinely operational rather than just documented on paper.

The first step is a clear-eyed analysis of the root cause — whether it is a gap in control design, an operating failure, a staffing or competency issue, or a combination. From there, we help design and implement a remediation plan, document the steps taken, and prepare the disclosure language. We also support re-testing once remediation is in place to demonstrate to your auditors that the weakness has been addressed.

We design control frameworks that are proportionate to the company’s size and complexity. Many smaller public companies can maintain an effective ICFR environment with a focused, well-designed set of controls rather than an extensive internal audit department. We help identify the controls that matter most for your financial reporting risks and build a lean, effective framework around those.

Yes. We work alongside your team to prepare the documentation, testing evidence, and control descriptions your auditors need to complete their assessment. Having well-organized, auditor-ready ICFR documentation significantly reduces the time and cost of the external audit.

ERP implementations are a common trigger for ICFR issues. Changing systems affects IT general controls, access controls, and the data flows underlying financial reporting. We help assess the ICFR implications of your system change, identify the controls that need to be updated or retested, and ensure the transition does not create gaps in your control environment.

Yes. We regularly work with foreign private issuers and companies with cross-border structures, including IFRS reporting, US GAAP reconciliations, and multi-entity consolidations for companies with domestic and international subsidiaries.

In most cases, we can begin within a few days of finalizing our agreement. Our onboarding process is straightforward — a brief discovery session, a clear statement of work, and secure access setup. We do not have lengthy intake procedures that delay the start of actual work.