For CFOs, controllers and SOX program owners at pre-IPO, newly public and mid-sized public companies who need a SOX program that is effective, proportionate and ready for external auditor scrutiny.
A right-sized SOX program with clear owners that your external auditor can rely on.
A gap assessment and phased plan that gets you ready without over-building.
In-scope accounts, locations and processes defined and documented to support your auditor's planning.
Process documentation and risk and control matrices that control owners can actually use.
IT general controls coordination and SOC 1 reviews, including complementary user entity controls.
Design and operating-effectiveness testing documented to a standard external auditors can evaluate.
Severity assessment, root cause, remediation plans and evidence that the fix works.
Fewer surprises at year-end, through clear communication with your audit firm throughout the cycle.
Fewer, stronger controls that are cheaper to operate, test and audit.
A defined program to take you from gap assessment to a documented, testable control environment.
Testing and program management through the year, alongside your finance team.
Focused work on a specific deficiency, process or ITGC area.
Work performed by Aevum's principals in prior roles. Client names withheld; not Aevum engagements.
More reliable controls over financial reporting
Under SEC rules, a newly public company generally provides management's 404(a) assessment starting with its second annual report. Auditor attestation under 404(b) applies once the company becomes an accelerated filer, unless an exemption, such as emerging growth company status, applies. Starting readiness well ahead of the first required report is usually far less disruptive.
We design and document testing so that your external auditor can evaluate it for reliance. Whether and how much they rely on it is their decision, so we agree the approach with them early.
Where the risk assessment supports it, yes. Rationalizing duplicate or low-value controls often reduces testing effort and audit cost without weakening the control environment.
Yes. We coordinate ITGC scoping, documentation and testing, and review SOC 1 reports for your service providers, including the complementary user entity controls you need to operate.
Typically 2 to 4 weeks. A fixed-scope look at your priorities, with a roadmap you can act on whether or not we continue.