SOX
IT general controls, change management, and access governance to support SOX 404 readiness and clean financial audits.
SOX
Service · Compliance / GRC
Compliance, built into how your systems run.
Governance, risk, and compliance across SOX, GDPR, and CCPA, designed into delivery, with controls, evidence, and audit readiness maintained as systems operate, not reconstructed at audit time.
What
SOX, GDPR, and CCPA controls, evidence, and audit readiness, built into delivery.
Who it’s for
Regulated enterprises that need audits to be confirmations, not scrambles.
Coverage
Controls maintained as systems operate, not reconstructed at audit time.
Outcome
Faster audit readiness; posture that holds year-round.
01 · What we cover
Three frameworks, one disciplined approach.
We map each framework to concrete controls, owners, and evidence, so obligations are demonstrable, not aspirational.
GDPR
Data-protection controls, data-subject request handling, records of processing, and privacy-by-design across the data lifecycle.
GDPR
CCPA
Consumer-rights workflows, data inventory and mapping, and disclosure controls aligned to California privacy requirements.
CCPA
An audit should be a confirmation, not a scramble.
Controls · evidence · access reviews · monitoring
03 · The detail
Controls and evidence, maintained as you operate.
For the teams who need the specifics before they engage.
ITGC controlsAccess, change, and operations controls — the foundation auditors test first.
Evidence & readinessContinuous evidence collection so an audit is a confirmation, not a scramble.
Access reviewsPeriodic access certification and least-privilege enforcement across systems.
Data privacyData mapping, minimization, and retention aligned to GDPR and CCPA.
Continuous monitoringControl monitoring and remediation tracking between audit cycles.
FrameworksSOX, GDPR, and CCPA mapped to concrete controls, owners, and evidence.
“Through acquisitions, divestitures, platform changes, and two decades of evolving business needs, their team has delivered consistently.”Carol Riegert · SVP, CIO · Oxford Global Resources
04 · Our own posture
We hold ourselves to the standard we deliver.
The same controls and evidence discipline we bring to client environments governs our own, and independent auditors test it at every stage.
Independent assurance
Attested, and advancing.
- SOC 1Attested · A-LIGN
- SOC 2 Type IAttested 2025 · A-LIGN
- SOC 2 Type IIAudit in final stages
- ISO 27001 & 42001In progress