From the practice
What the auditor wishes you knew before the kickoff.
One article a week on passing audits in the mid-market. No promotions.
CyberBusiness email compromise: the controls that stop the wireA wire leaves because a payment process allowed it, not because an email was clever. The controls that stop business email compromise, and what the SEC said public companies owe here. · The Clean Opinion · 7 min read
SOX 404Co-sourced internal audit in a first SOX year: who owns whatA co-source provider can bring method and testing capacity to a first SOX year. The firm signing your audit report is generally not available to staff this work, and management's assessment stays with management. · The Clean Opinion · 7 min read
SOC 2What a trust services criterion is, and what it is notCriteria and controls are not the same thing. Here is where the trust services criteria come from, what a single criterion is, and what the difference changes about how you scope a SOC 2. · The Clean Opinion · 6 min read
CyberWhat Item 1.05 of Form 8-K actually requires you to discloseWhat the form requires you to describe after a material cybersecurity incident, where the SEC's compliance guide draws the line on technical detail, and how the filing gets amended as the facts arrive. · The Clean Opinion · 7 min read
SOX 404De-SPAC and SOX 404: what the transition period leaves openThe newly public transition period is conditioned on the registrant's prior-year reporting history, and the SEC staff's own manual says the rules do not directly address reporting obligations after a reverse acquisition. Here is what the combined company owes in the closing year, and why the staff exception that does exist is not a free year. · The Clean Opinion · 7 min read
SOC 2The Type 2 observation window, and who sets its lengthThe observation window is the span of dates a Type 2 report's conclusion attaches to. Deciding how long it runs involves you, your auditor and your buyer, and the start date is set by your evidence rather than your engagement letter. · The Clean Opinion · 7 min read
CyberCyber insurance: what underwriters ask before they quoteA cyber insurance application is a set of representations about controls that either exist or do not. What underwriters ask for, what evidence answers each question, and where a rushed form causes trouble later. · The Clean Opinion · 7 min read
SOX 404Newly public: the SOX obligations that start before 404 doesThe transition period for newly public companies covers management's 404 report and the auditor's attestation on it — not the certifications, the quarterly disclosure controls conclusion or the audit committee clock. Here is what falls due from the first quarter as a filer. · The Clean Opinion · 7 min read
SOC 2Why a SOC 2 report does not end the security questionnaireA questionnaire is a set of assertions you sign; a SOC 2 report is a document whose conclusion you did not write. Buyers ask for both because each one closes a gap the other leaves open. · The Clean Opinion · 7 min read
CyberThe incident response plan a mid-market company can runMost incident response plans fail at the first phone call, not at the technical work. What a plan has to contain so that the people named in it can actually use it in the middle of the night. · The Clean Opinion · 7 min read
SOX 404What an ITGC is, and why it never touches a numberAn IT general control does not stop a misstatement by itself; it makes another control trustworthy. That relationship is what decides which controls are in scope and how severely a failure is scored. · The Clean Opinion · 7 min read
SOC 2SOC 1 vs SOC 2: which report is your customer asking for?The default ask is a SOC 2, but the report that fits depends on whether your service touches a customer's financial statements. Here is how to tell which one is actually needed. · The Clean Opinion · 7 min read
CyberWhat a vendor risk assessment should actually askMost vendor questionnaires collect documents rather than answers. These are the questions that change a buying decision, and the evidence that should come with them. · The Clean Opinion · 7 min read
CyberCybersecurity assessment vs penetration test: what buyers meanOne answers whether an attacker can get in; the other answers whether your controls are designed and operating. Buying the wrong one is the most common way to spend a security budget without answering the question in front of you. · The Clean Opinion · 7 min read
SOX 404SOX 404(a) vs 404(b): what changes when the auditor has to agree404(a) is a conclusion management reaches; 404(b) is an independent opinion on the same controls, formed under a standard you do not set. Which gate you fall on turns on filer status and emerging growth company status, and the difference in the work is an evidence standard rather than extra paperwork. · The Clean Opinion · 7 min read
SOC 2AI agents and SOC 2: the audit trail your auditor is about to ask forShadow AI feeding customer data into unvetted vendors is now a recurring SOC 2 finding. Here is what auditors ask about model use, prompt logs, and third-party LLMs. · The Clean Opinion · 7 min read
SOX 404ITGC scoping for SOX: the four controls your auditor tests firstLogical access, privileged access, deprovisioning, and change management. Get these four right and most of the ITGC conversation goes away. · The Clean Opinion · 8 min read
CyberA breach is a financial reporting problem now, not just a security oneThe disclosure clock runs from management's materiality determination, not from the intrusion. That makes the CFO's judgement — and the evidence behind it — part of the incident response. · The Clean Opinion · 9 min read
SOC 2SOC 2 Type 1 vs Type 2: which one actually unblocks the deal?Type 1 gets you into the conversation in weeks. Type 2 closes the larger accounts later. Most companies pick wrong because they start the week procurement asks. · The Clean Opinion · 9 min read
SOX 404First year public: the SOX 404 timeline nobody hands youWhich fiscal year your first management assessment actually applies to, why the answer turns on reporting history rather than your IPO date, and where newly listed companies run out of time. · The Clean Opinion · 11 min read
SOC 2How to run an access review an auditor will acceptIncomplete access reviews are the exception we see most often in a first-year SOC 2. Here is what the criteria actually require, what they leave to you, and what evidence survives testing. · The Clean Opinion · 8 min read