From the practice
What the auditor wishes you knew before the kickoff.
One article a week on passing audits in the mid-market. No promotions.
SOX 404The SEC wants to move the 404(b) line. Here’s what changes for you — and what doesn’t.The 2026 filer-status proposal would raise the large-accelerated-filer threshold and give newly public companies a longer on-ramp before auditor attestation. Management’s own 404(a) assessment isn’t going anywhere.Carl Grifka · 7 min read
SOX 404ITGC scoping for SOX: the four controls your auditor tests firstLogical access, change management, deprovisioning, and information used in controls. Get these four right and most of the ITGC conversation goes away. Get them wrong and nothing else you documented matters.Carl Grifka · 8 min read
CybersecurityA breach is now a financial-reporting problem. Here’s what the CFO owns.Four business days to disclose a material cyber incident, ransomware attacks up sharply in 2026, and regulators treating a breach that touches the books as a control deficiency. The CISO/CFO wall is gone.Carl Grifka · 7 min read
SOC 2AI agents and SOC 2: the audit trail your auditor is about to ask forShadow AI feeding customer data into unvetted vendors is now a recurring SOC 2 finding. Here is what auditors are asking about model use, prompt logs, and third-party LLMs — and the minimum that passes.Carl Grifka · 7 min read
SOC 2SOC 2 Type 1 vs Type 2: which one actually unblocks the deal?Type 1 gets you into the conversation in weeks. Type 2 closes the larger accounts later. Most companies pick wrong because they start the week procurement asks.Carl Grifka · 7 min read
SOX 404Your first year as a public company: the SOX 404 timeline nobody hands youWhat has to exist by the first annual report, what the auditor will test, and where newly listed companies run out of time.Carl Grifka · 9 min read
Vendor reviewsHow to run an access review an auditor will acceptQuarterly access reviews are the single most common exception in first-year SOC 2 reports — and the easiest to fix properly.Carl Grifka · 6 min read