Internal Controls & SOX Advisory

We assist management with drafting, updating, and reviewing the SOX Risk Assessment to determine the appropriate scope of the SOX program. We focus on a top-down risk assessment that considers materiality and qualitative risk factors in determining in-scope business processes, entities, and IT systems and tools.

We work with management to create initial SOX documentation or to update existing documentation. We document the company’s processes and controls in accordance with management’s and the external auditor’s requirements or preferences – whether in the form of narratives or flowcharts, technology summary, and risks & control matrices.

We conduct joint walkthrough interviews, including our IT professionals, as appropriate, with process and control owners to understand their business processes and controls in order to develop new SOX documentation or to confirm the accuracy of existing documentation. We can assist process and control owners in preparing for walkthrough interviews with the external auditors. We can also collaborate with the external auditors to conduct joint walkthroughs.

Using our risk-based methodology, we focus on efficient testing of key controls. We assess the design and operating effectiveness of controls in coordination with the external auditors to maximize auditor reliance, which may result in direct cost savings. We consider key IT systems, data sources, and SOC1 reports in our testing of the control environment.

We conduct segregation of duties analyses within and across business processes and systems to determine whether roles, responsibilities and systems access are appropriately segregated. We leverage the FastPath platform to analyze ERP’s role-based access, which allows for rapid identification of SOD conflicts within your unique control environment. Our approach focuses on the highest risk functions within your core business processes.

We assist management with evaluating deficiencies individually and in aggregate, considering quantitative and qualitative factors, to determine whether control deficiencies are deficiencies only, or include any significant deficiencies or material weaknesses.

We work with management to take a fresh look at the company’s in-scope SOX controls to identify opportunities for a more focused, more automated, and more efficient SOX control population. Controls rationalization can be especially valuable for established SOX programs to help streamline and focus on key SOX controls with an ever-changing environment.

We can serve as the project management office to oversee management’s control remediation activities and report progress to executive management. With our extensive experience, we can suggest potential solutions when management re-designs their processes and controls to address control deficiencies.

We work with management to develop a customized training plan that will layer the company’s unique environment and culture with CNM’s existing SOX training modules. We help management determine the most appropriate and efficient method of training delivery for their teams – whether through live training sessions, remote programs, or a hybrid approach. We can also assist management with customized training solutions to help our clients successfully navigate through the transition from 404(a) to 404(b) compliance.

We perform real-time reviews of our clients’ system implementations and provide management with ongoing support in identifying and correcting internal control gaps. We also provide management with guidance on optimizing the control environment within new system implementations.

We assist management with SOX Governance, Risk and Compliance (GRC) systems implementations in a variety of ways. We can advise on system design and field configurations that will serve the company’s current and future SOX program needs. We can serve as the project management office for the implementation. We can also help with detailed system implementation tasks, such as preparing information for system upload and reviewing the completeness and accuracy of the upload.