ICOFR and SOX 404
Controls that pass an audit, and a team that runs them
Every public company must assess its internal control over financial reporting. Companies that grow into accelerated filer status add an auditor attestation.
Everest builds the ICOFR program and fills the fractional CFO, controller and SEC reporting roles that run it, so the controls are designed by the people who live with them. One team, one plan, no handoff between consultants and staff.
A clean 404(a) assessment, by design
Every step is designed and tested for a clean management assessment. For 404(b) filers, the same work runs with your auditor for a clean attestation.
Governance and program structure. Program charter, steering committee, ICOFR policy and quarterly reporting to the Audit Committee, all built on the COSO framework.
Risk assessment and scoping. Materiality, significant accounts and in-scope processes set once and refreshed yearly, so effort goes where misstatement risk sits.
Entity-level and IT controls. Entity-level controls mapped to the five COSO components, plus IT application and general controls over the GL, banking and payroll systems.
Process documentation. Process maps, risk and control matrices, and a cover sheet for every control, built with your process owners rather than handed to them.
Testing and deficiency evaluation. Walkthroughs, design and operating tests, then a six-step evaluation that separates control deficiencies from significant deficiencies and material weaknesses.
Reporting and audit readiness. Clear status to the steering committee and Audit Committee, coordination with your assessment firm and auditor, and support for management’s annual assertion.
A sprint to a clean assessment
We lead the program to completion at the lowest practical cost, keeping down the risk of a material weakness, a restatement or a late filing.
One team, one plan. The people who design the controls also run the close, the 10-Q and the 10-K. Nothing gets lost between consultant and staff.
Right-sized roles. A fractional CFO, controller or SEC reporting lead for the days you need, instead of full-time hires you can’t yet fill or afford.
Built to last. Controls owned by your team and tested on a calendar, so the program keeps running after we step back and a permanent hire inherits a clean setup.
Proof
Track record, one example of many: a clean Year 1 404(a) management assessment on a 12-process build with more than 200 controls, and three material weaknesses remediated in 9 months.
See Public Company.
Last updated November 2026.
Let's talk
If your numbers aren’t giving you decisions you can act on, we should talk. We’ve sat in your seat. Now we’re in your corner.
