Readiness starts with system access
The first SOX question an auditor asks is often simple: who can do what in the accounting system, and who checks? In a growth-stage company the answer usually includes a controller with administrator rights, an AP lead who can create and pay vendors, and several integration accounts nobody has reviewed since implementation. Mapping that access, then deciding which conflicts to remove and which to cover with a review, is the right first piece of SOX work because every later control depends on it. The Segregation-of-Duties Conflict Finder is a quick way to see the pattern in your own team.
Readiness runs in four steps
- Trace the processes that feed the financial statements. Revenue, purchase to pay, payroll and equity, treasury, the close and IT general controls.
- Test what exists against the ledger. A full-population scan of journal entries and approvals comes before any process narrative is written.
- Fix design gaps first. Start with access and approvals, because testing a badly designed control only documents the problem.
- Run a dry year of testing. Keep evidence your auditor can reperform, and fix what fails before it counts.
Our SOX & ICFR Readiness work follows this sequence and hands the program to your team, with a runbook for each control owner.
Agents count as users too
An AI agent that codes invoices or posts accruals acts through an account with permissions. If that account can also approve, the approval control is gone, however accurate the agent is. We inventory AI tools and agents in finance, place each one in the segregation-of-duties matrix, set human approval thresholds and make sure every action leaves a log you keep as long as the transaction records.
The illustrative scenario The agent that approved itself shows how this goes wrong at a Series C company and how it is fixed. Before AI agents run your close sets out the controls worth putting in writing first.