# Internal controls and SOX testing support for CPA-led firms

Canonical: https://finbryn.com/us/services/audit-compliance-support/sox-testing-support

Finbryn provides SOX testing support for US CPA-led firms: walkthrough documentation, control testing workpapers, PBC trackers and deficiency logs built on COSO's 2013 Internal Control Integrated Framework (checked 2026-10-02). Your partner reviews, concludes and signs; we prepare the file.

A small or mid-sized firm's SOX 404, ICFR or COSO advisory work arrives in bursts. A client's testing window opens, three engagements land in the same quarter, and the people who would normally prepare walkthrough files are already in the middle of busy-season work. What the partner needs is the workpapers drafted so the review can start.

That is the slot we fill. We work as overflow preparers inside the firm's own templates and file structure. You send the control matrix, the sample selections and the system access your client has approved. We return populated workpapers, a PBC tracker and a deficiency log, each one cross-referenced to the control it supports. Every conclusion stays with your reviewer. Nothing we draft goes to your client, their management or their audit committee until your partner has read it and put their name to it.

This page is for firms only. We do not sell SOX testing to public companies directly, and we do not accept an engagement where the signing partner cannot be named in the engagement letter.

Engagements like this usually come with a hard date: the client's year-end, the external auditor's interim visit or a lender's covenant calendar. We plan the batches backward from that date and tell the engagement lead early if the testing window looks short for the number of controls in scope. We also keep a short status note for the engagement lead after each batch: controls drafted, controls awaiting evidence and exceptions logged, so nobody has to ask where the file stands.

What you get: Walkthrough narratives and flowcharts drafted in your template; Control testing workpapers with sample, evidence references and exceptions; A PBC tracker by control and client owner; A deficiency log with the evaluation column left for your partner; Roll-forward workpapers with a change log

Software we work in: Excel, Google Sheets, Box, SharePoint

## What we prepare for the firm

Each deliverable below is a draft built to your template. The partner or senior manager on the engagement reviews it before it becomes part of the file.

- **Walkthrough documentation.** A narrative and flowchart draft for each in-scope process (order to cash, procure to pay, payroll, financial close, treasury, IT general controls support schedules), built from your interview notes or recorded client walkthroughs.
- **Control testing workpapers.** One workpaper per control: attributes tested, sample selection per your methodology, evidence references, exceptions noted and the tickmark legend you already use.
- **PBC tracking.** A live request list by control and by client owner, with received, outstanding and rejected items, so the engagement team sees at a glance what is blocking testing.
- **Deficiency logs.** Each exception written up with the control, the facts found, the likely root cause and a blank evaluation column for your partner to classify.
- **Roll-forward and re-test files.** Copies of prior-period workpapers updated for changes in the process, with a change log so the reviewer sees only what moved.

We do not select the sample size, classify a deficiency as a significant deficiency or a material weakness, or write the conclusion paragraph. Those are judgments and they belong to your reviewer.

## How the work is split between your team and ours

The line is simple. We prepare the evidence and the drafts; your team makes every judgment and signs.

On day one your engagement lead sends the scoping memo, the methodology references your firm follows and the template set. We set up a shared folder in your firm's own cloud storage, so the workpapers live in your environment, not ours. Access to your client's systems is granted by the client and agreed by your partner, never requested by us directly.

Testing runs in cycles. We draft a batch of workpapers, your reviews the batch and leaves notes in the review column, and we clear the notes in the next turn. A reviewer who only leaves light notes on a clean workpaper is getting the use out of the arrangement. A reviewer who has to rebuild it is not, and if that happens twice on one engagement we say so and adjust the template with you before continuing.

Because the firm remains the engagement's responsible party, our files carry your firm's reference numbers and preparer initials field, completed with our team's code. The reviewer initials and dates are left for your staff.

Your engagement letter should tell the client a third-party provider assists, as AICPA ET 1.150.040 expects before client information reaches us.

## Where this fits in the SOX and COSO picture

Section 404(a) of the Sarbanes-Oxley Act requires management of a public company to assess internal control over financial reporting. Section 404(b) adds an auditor attestation for larger filers. Management's assessment usually follows the COSO framework, which sets out five components and 17 principles, and the testing behind it is where outside advisory firms get hired.

If your firm advises a client on that assessment, the work looks the same as it does for any controls engagement: understand the process, identify the key controls, test design and operating effectiveness, log the exceptions. If your firm is also the client's external auditor, SEC Rule 2-01(c)(4) generally bars internal audit outsourcing tied to the client's internal accounting controls, and any management function, and PCAOB Rule 3525 adds audit committee pre-approval steps for any internal control service still allowed. Your partner makes that call and records it in the engagement letter before we start. We do not work on your firm's own audit of an issuer, including an AS 2201 integrated audit: a firm with a substantial role in an issuer audit must register with the PCAOB under Rule 2100, and Finbryn is not registered.

The PCAOB's AS 2201 describes how an auditor approaches an audit of internal control integrated with the financial statement audit. Firms that work on the advisory side often mirror its structure so that the client's documentation is ready when the external auditor asks for it. We build to whichever structure your methodology names.

## What we do not do

We do not give an opinion on internal control, issue an assurance report or sign anything. We do not evaluate whether a deficiency is a material weakness. We do not speak to the client's audit committee, to the SEC or to the PCAOB. We hold no attestation credential, and we do not present the work as a SOC 1 or SOC 2 examination.

We also keep the scope narrow on purpose. A firm that needs forensic work, a fraud investigation or an actuarial valuation as part of a controls engagement should engage a specialist for that piece. We will say so rather than stretch.

The one thing we ask for in return is clarity. Tell us which framework and which methodology the file follows, which template set applies and who reviews each section. The workpapers that come back will then match what your reviewer expects to open.

## The process

1. **Scoping with the engagement lead**: Your partner or manager shares the scoping memo, methodology reference and template set, and names the reviewer for each section.

2. **Access and folder set-up**: A shared folder is created inside your firm's cloud storage. Client system access, if any, is granted by the client through your team.

3. **Walkthrough drafting**: We draft narratives and flowcharts from your interview notes, then your team corrects anything the client's process owners dispute.

4. **Testing batch**: We populate workpapers for the controls in the batch, record exceptions and update the PBC tracker.

5. **Reviewer notes and clearance**: Your reviewer annotates the batch. We clear each note and log the change, so the next review round starts from a clean file.

6. **Deficiency log handover**: Exceptions are written up with the facts and left unclassified. Your partner evaluates and concludes.

## Common problems we fix

| The problem | How we fix it |
| --- | --- |
| Busy season leaves nobody free to prepare walkthrough files for a client's testing window | Overflow preparers draft the narratives and flowcharts inside your template, so your reviewer starts on a draft instead of a blank page. |
| PBC requests sit in an email thread and nobody knows which control is waiting on which item | A request tracker by control and client owner, updated each testing batch, shows what is received, outstanding or rejected. |
| Exceptions are described differently by each preparer and the reviewer has to normalize them | Every deficiency is logged in one format: control, facts, evidence reference, likely root cause, and an empty evaluation field for the partner. |
| Prior-year files are copied forward and nobody records what changed in the process | Roll-forward workpapers carry a change log, so the reviewer reads only what moved since last period. |

Pricing: Scoped per engagement once we know the number of in-scope controls, the template set and the testing window. It runs separately from the monthly tiers on the /us/pricing rate card, and the fee is confirmed in writing before any workpaper is drafted. ([See pricing](https://finbryn.com/us/pricing))

## Glossary

- **ICFR**: Internal control over financial reporting: the processes a company uses to give reasonable assurance that its financial statements are reliable.

- **SOX 404**: The section of the Sarbanes-Oxley Act that requires management's assessment of ICFR and, for larger filers, an auditor's attestation on it.

- **Walkthrough**: Tracing one transaction through a process from initiation to the financial statements to confirm the team's understanding of the process and that its controls are designed and in place.

- **PBC list**: Provided by client: the list of documents and data the engagement team requests from the client to complete testing.

- **Deficiency log**: A running record of control exceptions found in testing, kept until the partner has evaluated each one.

## Frequently asked questions: Internal controls and SOX testing support for CPA-led firms

**Q: Who is this for?**

A: Small and mid-sized US firms with partners who sign accounting and advisory work and who run SOX 404, ICFR or COSO engagements for clients. As of 2026-10-02 we do not take engagements from public companies directly.

**Q: Does your team sign the workpapers or give an opinion?**

A: No. We prepare drafts in your template. Your partner reviews, evaluates deficiencies, concludes and signs, and the engagement letter names that partner before we start.

**Q: Which framework do the workpapers follow?**

A: Whichever your methodology names. Most firms use COSO's 2013 Internal Control Integrated Framework, and we map each control to its component and principle when asked.

**Q: Do you hold an attestation credential or a SOC report?**

A: No. We make no claim to a SOC 1 or SOC 2 report, to an attestation credential or to staff holding one. The work is preparation under your reviewer.

**Q: Can our workpapers stay inside our own environment?**

A: Yes. We work in a shared folder created in your firm's own cloud storage, so the working file stays in your firm's storage and you can remove our access at any time.

**Q: What if our firm also audits the client?**

A: If your firm is also the client's external auditor, SEC Rule 2-01(c)(4) generally bars internal audit outsourcing tied to the client's internal accounting controls, and any management function, and PCAOB Rule 3525 adds audit committee pre-approval steps for any internal control service still allowed. Independence is your partner's call. We ask for that determination to be stated in the engagement letter before work begins, and we do not draft anything until it is.

**Q: How is this priced?**

A: Per engagement, based on the number of in-scope controls and the testing window. The rate card is on the [pricing page](/us/pricing) and the exact fee is confirmed in writing first.

**Q: What goes on a SOX readiness checklist?**

A: Scope the significant accounts and processes, document the key controls against the COSO 2013 framework, test design and operating effectiveness, log deficiencies and track remediation. Management's assessment follows SEC rules, and where Section 404(b) requires an auditor attestation, the auditor follows PCAOB AS 2201 (sources checked 2026-10-16). Finbryn prepares the test workpapers and gives no assurance or opinion.

**Q: Do you sign the workpapers or give an opinion?**

A: No. We prepare drafts in your template; your partner reviews, concludes and signs.

**Q: Do you sell this to public companies directly?**

A: No. It is offered to US firms that run the engagement and own the conclusion.

Related services:
- [Internal controls documentation](https://finbryn.com/us/services/audit-compliance-support/internal-controls-documentation)
- [Working paper preparation](https://finbryn.com/us/services/audit-compliance-support/working-papers)
- [PBC list management](https://finbryn.com/us/services/audit-compliance-support/pbc-lists)

## Sources

1. [COSO, Internal Control Integrated Framework guidance](https://www.coso.org/guidance-on-ic) (2026-10-02)
2. [PCAOB, AS 2201: An Audit of Internal Control Over Financial Reporting](https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201) (2026-10-02)
3. [17 CFR 210.2-01, Qualifications of accountants](https://www.ecfr.gov/current/title-17/chapter-II/part-210/section-210.2-01) (2026-10-02)

Reviewed October 2026

[All services in Audit and compliance support](https://finbryn.com/us/services/audit-compliance-support)

## Contact
- Phone: +1 (312) 313-7376
- Email: hello@finbryn.com
- Booking page: https://finbryn.com/us/book