SOX & Internal Controls

Section 404(a) requires management to assess and report on the effectiveness of ICFR in the annual report. This applies to all public companies. Section 404(b) requires the external auditor to attest to management’s assessment — this applies to accelerated and large accelerated filers but not to smaller reporting companies or non-accelerated filers. Newly public companies typically have a grace period before 404(b) applies, but 404(a) begins with the first annual report.

A material weakness is a deficiency, or combination of deficiencies, in ICFR that creates a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis. Disclosing a material weakness triggers significant scrutiny from auditors, investors, and regulators — and in some cases affects the company’s ability to raise capital or complete transactions. Remediating a material weakness quickly and completely is critical.

Ideally 12 to 18 months before your target public date. Building an effective ICFR framework takes time — you need to document processes, design controls, make them operational, test them, and remediate gaps before your external auditors begin their assessment. Companies that start early have smoother processes and lower audit costs.

We evaluate your existing financial reporting processes, identify the key risks to accurate financial reporting, assess the controls currently in place against those risks, and identify gaps. We then help you prioritize remediation efforts based on the significance of each gap to financial reporting and the likelihood of a misstatement. The output is a clear roadmap for building a compliant control environment.

Yes. We analyze the root cause, design a remediation plan, help implement the necessary control changes, document the steps taken, and support re-testing once remediation is in place. We also help prepare the disclosure language and any required communications to the audit committee or board.

Yes. IT general controls — including access controls, change management, and computer operations — are a critical component of ICFR for any company that uses financial systems to process or report data. We assess ITGCs, identify gaps, and help implement the controls needed to satisfy auditor requirements.

We design control frameworks proportionate to the company’s size. Many smaller public companies maintain an effective ICFR environment with a lean, well-designed set of controls rather than a large internal audit department. We identify the controls that matter most for your specific financial reporting risks and help build a framework that is defensible without being unnecessarily burdensome.

Yes. We regularly work with foreign private issuers and companies with cross-border structures, including IFRS reporting, US GAAP reconciliations, and multi-entity consolidations for companies with domestic and international subsidiaries.

In most cases, we can begin within a few days of finalizing our agreement. Our onboarding process is straightforward — a brief discovery session, a clear statement of work, and secure access setup. We do not have lengthy intake procedures that delay the start of actual work.