At a large public retailer (over $45B in revenue), the SOX IT scope included more than 65 applications—many of them legacy mainframe systems. Due to significant turnover and limited documentation, the financially relevant functionality of each application was unclear. As a result, critical permissions and segregation of duties (SOD) risks were not well understood, and the SOX testing strategy lacked focus.
Working closely with IT Audit and business stakeholders, we led working sessions with business and IT owners for each in-scope application. Together, we identified and documented the financially relevant functionality across the portfolio. Over the course of the year-long engagement, we:
- Mapped functionality to identify financially significant access and SOD risks
- Designed testing procedures tailored to those risks
- Identified relevant databases to support automation of access and SOD testing
This foundational work enabled the client to refocus SOX efforts on what mattered most—reducing testing scope, improving audit quality, and enhancing risk coverage.
SOX Implementation & SOC 2 – Technology Company Preparing for IPO
A fast-growing SaaS company, preparing for IPO, needed to establish a SOX compliance program while also preparing for SOC 2—required by its enterprise customers. With primarily homegrown applications, it was critical to understand how customer data and financial transactions flowed through its systems.
We facilitated in-depth workshops with IT and business teams to:
- Map the functionality of key applications and data flows
- Understand how customer data was collected, processed, and stored
- Analyze integrations between applications, ERP, and CRM systems
We documented risks and controls across these systems and identified numerous gaps. Working with IT and business leadership, we:
- Developed and implemented remediating controls
- Provided project management support to ensure timely execution
- Helped the company prepare successfully for SOX and SOC 2 readiness
For business process controls outside of IT, we took an optimized SOX approach aligned with the company’s fast-moving culture. Rather than a checklist, we:
- Conducted a risk-based assessment to identify key risks of material misstatement
- Designed efficient, high-impact controls
- Developed a self-assessment process to monitor effectiveness
This tailored, risk-smart approach allowed the company to meet compliance requirements without disrupting growth.
SOX & Internal Audit Optimization – Mature Public Technology Company
A mature public technology company sought to reduce the cost of SOX compliance while unlocking more strategic value from internal audit, which was spending nearly 100% of its time on SOX.
Our two-pronged solution: optimize the SOX program and reallocate freed-up resources toward risk-focused audits.
To reduce SOX burden (achieving approximately 50% savings), we:
- Performed a detailed risk assessment to isolate financial reporting risks
- Conducted workshops with control owners to redesign controls—simplifying, strengthening, and eliminating redundant ones
- Reduced total key controls by nearly 50%
- Aligned with external audit on scope and approach
- Implemented a monitoring dashboard to track PBC status, testing progress, and remediation
Freed-up resources were then deployed to conduct an enterprise risk assessment and launch a 3-year audit plan focused on top strategic and operational risks. Resulting audits led to improvements across supply chain, R&D, M&A, compliance, and financial reporting—expanding internal audit’s value beyond compliance.