Risk Advisory
Good controls are quiet — until they are missing. We provide internal audit and SOX 404 testing for public and private companies, building control environments that are repeatable, documented and defensible to auditors, boards and acquirers.
What we do
Scope of the practice.
SOX 404 readiness & testing
Full ICFR programs: scoping, walkthroughs, control design assessment and testing — through remediation.
Internal audit co-sourcing
An internal audit function sized to your risk, from annual audit plans to targeted engagements.
Process walkthroughs
End-to-end documentation of how key processes actually run — the foundation of every credible control opinion.
Control design & remediation
Controls designed to be operable, and findings remediated with testing that proves the fix held.
Enterprise risk assessment
A structured view of what could go wrong, ranked — so audit and management effort lands where exposure is real.
Governance & board reporting
Findings and status reported in language a board can use: what was tested, what failed, what changed.
How engagements run
01 · Scope
We risk-assess the organization and scope the program to where the real exposure sits — not to a generic template.
02 · Test
We document and test key controls with clean, reusable workpapers your external auditors will recognize.
03 · Remediate
Findings become fixes, fixes get re-tested, and the program carries forward year over year with less friction each time.
Next step
Start with a conversation, not a proposal.
Tell us where you are and we will scope the right first move. No obligation, and what you share stays confidential.