The Sarbanes-Oxley Act requires management of US-listed companies to assess and report on internal control over financial reporting, with auditor attestation for larger filers. Service organisations support their clients’ SOX compliance through SOC 1 reports.
We document processes and controls, test effectiveness and strengthen IT general controls.
Who it is for
- US-listed companies and their subsidiaries worldwide
- Service organisations supporting SOX clients
What you gain
- Clean ICFR assessments
- Strong IT general controls
How we get you compliant
Applicability and scoping
Confirm whether and how the law applies to you, entities, data, systems, roles and territories.
Data and process mapping
Build a record of processing or control inventory so obligations can be tied to real systems and owners.
Gap assessment
Measure current practice against each obligation and rank the gaps by legal and business risk.
Remediation roadmap
Policies, notices, contracts, technical controls and governance, sequenced so the highest risks close first.
Evidence and ongoing monitoring
A compliance calendar, metrics and periodic reviews so you can demonstrate compliance to a regulator or customer at any time.