SOX IT Assistance for Small Cap and First Year Filers

SC&H understands the challenges that small cap and first year filers face during their first year of SOX compliance. These challenges include:

• Fully understanding the SOX IT compliance process and creating the best road map for achieving compliance.
• Properly interpreting the technical SOX literature, including how to use a “top-down, risk-based” approach to determine the key from non-key SOX IT controls.
• Implementing proper IT segregation of duties with an IT department of ten or fewer persons. 
• Defining IT controls necessary for SOX compliance within the existing IT policies and procedures.
• Implementing the key SOX IT controls over outsourced IT contractors, such as Value Added Resellers (VARs) that support change management and other IT controls.

The SC&H SOX IT Methodology

Following industry best practices, SC&H’s SOX IT methodology includes a top-down, risk-based approach to minimize the compliance efforts and costs for small cap and first year filers (see SC&H SOX IT Technical Guidance download). SC&H customizes our SOX IT methodology to assist small cap public companies in developing a process for sustainable Sarbanes-Oxley compliance. SC&H’s SOX IT methodology includes the following three IT control areas:

1. IT Entity Level Controls:  SC&H performs a risk assessment to determine the key IT entity level controls for SOX compliance.
2. IT General Controls:  SC&H determines the key IT general controls for SOX compliance.
3. IT Application Controls:  SC&H IT auditors coordinate with management’s SOX finance team to determine the responsibilities for identifying and testing IT application controls.  SC&H has created a list of common IT application controls for each major business cycle.

Benefits of Using SC&H

• Reduced SOX IT controls: Our top-down, risk-based approach leads to testing only the necessary key IT controls.
• Streamlined IT Policies and Procedures We ensure that every key SOX IT control has a clear and concise IT procedure that sets an effective control design.
• Fewer IT control exceptions: We show you how to implement IT control self assessments that, when performed by the IT control owners, will reduce control exceptions during management’s independent testing.
• Decreased Disruption of your IT department: By managing the communication and overall SOX IT compliance process with your external auditor, we allow your IT staff more time to accomplish the IT department’s goals.
• Reduced External Audit Fees: Whether your company’s external auditor is a “Big Four” or regional accounting firm, our methodology and testing procedures allow your external auditor to place the highest degree of reliance on our work, thus reducing their fees.

Take the first step toward these valuable benefits by contacting SC&H to review your compliance needs.