The mountain, mapped

apply pcaob as 2201 to classify internal control deficiencies as material weakness, significant deficiency, or control deficiency from the internal auditor's practitioner perspective. covers deficiency identification, severity evaluation, aggregation rules, compensating controls, and coordination with the external auditor's integrated audit. practitioner-grade for sox program leads, internal audit directors, and caes at public companies.

design, execute, and document a sox section 302 sub-certification protocol for public companies. covers the sub-certification chain from ceo/cfo to business unit leaders, the internal audit review role, deficiency disclosure upstream obligations, and the legal exposure chain. practitioner-grade for sox program leads, internal audit directors, and caes supporting the quarterly certification cycle.

design and execute a third-party vendor audit program for internal audit. covers the decision framework for soc 2 type ii report reliance vs. independent testing, complementary user entity controls (cuecs), vendor risk tiering, carve-out vs. inclusive audit scope, and the evidence standard for using soc reports in the sox icfr assessment. practitioner-grade for internal audit directors, sox program leads, and caes managing vendor assurance programs.

design and operate a sox-compliant whistleblower hotline program using navex ethicspoint (or equivalent). covers the 30-day acknowledgement obligation, investigation protocol, triaging allegations, escalation to audit committee, and integration with the fraud risk assessment. practitioner-grade for internal audit directors, ethics and compliance leads, and caes at public companies.