When SOX 404 and its auditor attestation apply to a company and what changes with filer status, growth, acquisition or regulation: emerging growth companies, accelerated filers, smaller issuers, banks and insurers.
What an emerging growth company still owes under SOX (management's 404(a) assessment, 302 certifications) and what it can defer (the 404(b) attestation), the revenue and time limits that end EGC status, and how to prepare ITGCs before it ends.
How a company learns it must get an auditor's ICFR attestation: public float tests, the twelve-month reporting rule, losing EGC status, and what changes in ITGC testing and evidence once the external auditor opines.
What smaller issuers exempt from the 404(b) attestation still have to do on IT general controls, how SEC guidance scales evaluation for smaller companies, and what the SEC estimated the exemption saves.
What the first integrated audit of ICFR asks of IT teams: walkthroughs, testing of ITGCs over automated controls and reports, written representations, deficiency communications, and why first-year costs run higher than later years.
How FDIC Part 363 brings SOX-style ICFR reporting and auditor attestation to insured banks above its asset threshold, what it adds for regulatory reporting, and how public bank holding companies combine Part 363 and SOX 404 reports.
How the NAIC Model Audit Rule asks large insurers for a management report on internal control over financial reporting, the premium threshold, how it compares with SOX 404 for public insurers, and the IT general controls it brings into scope.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.