ITGC audit services
We test the four IT general control domains behind your financial reporting: access, change management, program development, and computer operations. Findings are documented with evidence for your SOX 404(a) assessment.
IT general controls are the controls your financial reporting rests on. When access, change management, or computer operations controls fail, every application control and system-generated report above them becomes suspect. An ITGC audit tests those controls across the systems that feed financial reporting, from the ERP down to the databases and operating systems underneath, and documents findings for management's assessment under SOX Section 404(a). BD Emerson is not your external financial statement auditor and does not issue an opinion on internal control over financial reporting. We test the controls and report findings with evidence. Your team remediates, and we verify the corrective action closed the finding.
Four situations bring companies to an ITGC audit: public companies supporting their Section 404(a) assessment, pre-IPO companies building their first SOX year, subsidiaries of public parents responding to group audit requests, and companies whose external auditor found ITGC deficiencies last year and who want them independently retested before the next cycle.
The engagement produces a risk and control matrix for your ITGCs, test plans with sampling, workpapers with evidence references, findings with root cause and financial reporting exposure, and retest verification after management remediates. Fieldwork aligns to your fiscal year so testing covers the period your external auditor examines, and most companies pair interim testing during the year with an update through year-end. Companies that co-source internal audit with BD Emerson fold ITGC testing into that annual plan.
Service organizations that run financially relevant processes for their customers get asked for SOC 1 reports. BD Emerson performs SOC examinations through its CPA attest arm.
Every in-scope system earns its place by feeding a line item or a key report. We map the applications, databases, and operating system layers to the financials before testing starts, so effort lands where misstatement risk actually lives.
A control that cannot show it operated gets treated as a control that did not operate. We test against the records your environment already retains: tickets, approvals, system configurations, access logs, and HR data.
Each finding states the control, the condition we found, the root cause, its pervasiveness, and the financial reporting exposure. Classifying a deficiency as significant or material stays with management and its external auditor; we supply the evidence that call depends on.
We do not remediate findings, because testing your own fixes is not independence. When your team closes a finding, we retest the control and document whether the corrective action worked.
BD Emerson's audit practice operates separately from its consulting and technology businesses. The team that tests your controls has no build work to defend and no remediation project to sell.
ITGC testing is one engagement within our audit practice, which sells audit work and nothing else.
Our auditors test where controls actually enforce: in the application, in the database beneath it, and in the operating system beneath that. A clean application layer over an open database is still a finding.
Test plans, samples, and evidence references are documented so your external audit firm can evaluate the work under its own standards. The reliance decision is theirs; complete workpapers make it a faster one.
Great consulting firms for scaling security, compliance, and appsec.
.avif){kind=small}
Outstanding partner in Technical and Cyber Due Diligence
.svg){kind=small}
Appsec maturity and application hardening.
.avif){kind=small}
BD Emerson helped us simplfiy our compliance management.
BD Emerson did such a phenomenal job. What started as privacy support quickly became a full partnership across compliance, engineering, and even business operations. They’re embedded with our team. They understand our product. They move fast. They’re simply invaluable.
Great consulting firms for scaling security, compliance, and appsec.
Outstanding partner in Technical and Cyber Due Diligence
Appsec maturity and application hardening.
BD Emerson helped us simplfiy our compliance management.
BD Emerson did such a phenomenal job. What started as privacy support quickly became a full partnership across compliance, engineering, and even business operations. They’re embedded with our team. They understand our product. They move fast. They’re simply invaluable.
We had a hard time finding the right company to partner with in support of our compliance journey. Some vendors sell the idea that they do the work, but then you end up doing everything. The ambiguity is what killed our last project. BD Emerson’s team has such great technical knowledge and understands the standard so well that they made us comfortable with moving fast. This has led to us closing major enterprise customers that were previously out of reach because of security and compliance.
Lead an enterprise initiative to overhaul the organization's technology stack from ecommerce, corporate tech, and corporate security.
Supported ISO 42001 exercise and served as internal auditor.
Rubrik's privacy and compliance team began with the backbone of BD Emerson. BD Emerson supported building out the privacy program, GRC (ISO 27001, SOC 2, CMMC, FedRAMP), and the appsec function.
We needed a partner who could move quickly, without sacrificing precision. BD Emerson brought the expertise, structure, and speed we were looking for. Their team became an extension of ours, embedding themselves across the organization, guiding us step by step, and giving us confidence in areas we hadn’t tackled before. The internal audit they conducted was so detailed that even the external auditors called it out. Achieving ISO 27001 with zero nonconformities says everything you need to know about the quality of the partnership.
We had a hard time finding the right company to partner with in support of our compliance journey. Some vendors sell the idea that they do the work, but then you end up doing everything. The ambiguity is what killed our last project. BD Emerson’s team has such great technical knowledge and understands the standard so well that they made us comfortable with moving fast. This has led to us closing major enterprise customers that were previously out of reach because of security and compliance.
Lead an enterprise initiative to overhaul the organization's technology stack from ecommerce, corporate tech, and corporate security.
Supported ISO 42001 exercise and served as internal auditor.
Rubrik's privacy and compliance team began with the backbone of BD Emerson. BD Emerson supported building out the privacy program, GRC (ISO 27001, SOC 2, CMMC, FedRAMP), and the appsec function.
We needed a partner who could move quickly, without sacrificing precision. BD Emerson brought the expertise, structure, and speed we were looking for. Their team became an extension of ours, embedding themselves across the organization, guiding us step by step, and giving us confidence in areas we hadn’t tackled before. The internal audit they conducted was so detailed that even the external auditors called it out. Achieving ISO 27001 with zero nonconformities says everything you need to know about the quality of the partnership.
BD Emerson didn’t just help us meet our compliance goals; they integrated security and privacy into the core of our operations. I highly recommend BD Emerson to anyone seeking SOC 2 or GDPR compliance, or simply looking to enhance their security team and boost customer trust in their product and services. Their dedication and expertise have been invaluable to our success.
.avif){kind=small}
BD Emerson understood our business requirements and worked side-by-side with us. The policies and controls we developed together not only meet compliance standards but improve how we operate day to day.
.avif){kind=small}
From day one, BD Emerson brought urgency, clarity, and a sharp understanding of what truly matters to our business — earning and keeping customer trust. They went beyond helping us meet compliance requirements; they helped build a foundation for secure, scalable growth. That kind of partnership is rare.
BD Emerson didn’t just help us pass an audit—they helped us build a sustainable culture of security.
BD Emerson was essential in helping our company navigate the daunting process of leveling up our security infrastructure. BD Emerson’s impressive expertise and confidence throughout the process helped our team exceed HIPAA and SOC 2 Type 1 standards quickly, distilling what can be an overwhelming process into a streamlined, organized effort. From day one they began adding value and getting us on course. With their help we delivered on a massive security overhaul with both extreme efficiency and thorough attention to details. Because of BD Emerson’s support, we’ve increased our clients’ trust in Titan Intake and the life-changing work it accomplishes for those seeking specialist referrals.
BD Emerson didn’t just help us meet our compliance goals; they integrated security and privacy into the core of our operations. I highly recommend BD Emerson to anyone seeking SOC 2 or GDPR compliance, or simply looking to enhance their security team and boost customer trust in their product and services. Their dedication and expertise have been invaluable to our success.
BD Emerson understood our business requirements and worked side-by-side with us. The policies and controls we developed together not only meet compliance standards but improve how we operate day to day.
From day one, BD Emerson brought urgency, clarity, and a sharp understanding of what truly matters to our business — earning and keeping customer trust. They went beyond helping us meet compliance requirements; they helped build a foundation for secure, scalable growth. That kind of partnership is rare.
BD Emerson didn’t just help us pass an audit—they helped us build a sustainable culture of security.
BD Emerson was essential in helping our company navigate the daunting process of leveling up our security infrastructure. BD Emerson’s impressive expertise and confidence throughout the process helped our team exceed HIPAA and SOC 2 Type 1 standards quickly, distilling what can be an overwhelming process into a streamlined, organized effort. From day one they began adding value and getting us on course. With their help we delivered on a massive security overhaul with both extreme efficiency and thorough attention to details. Because of BD Emerson’s support, we’ve increased our clients’ trust in Titan Intake and the life-changing work it accomplishes for those seeking specialist referrals.
