Describe the control issue in plain language. See which frameworks it touches, how the answer changes by country, and how to close the gap with the people you already have.
Use it as your internal pre-audit, before the auditor is in the room.
Check an issue free See pricingFree preview with your work email. No account or password needed.
Large companies still do. A team reads the standards, chases the evidence, and argues about scope for weeks. Smaller companies never could afford that, so they guess.
That model is breaking from both ends. Headcount is coming down, and AI agents are moving into the workflows those controls were written for. In 2025, Gartner predicted that 40% of enterprise applications would feature task specific AI agents by the end of 2026, up from under 5% in 2025 (Gartner, August 2025). Every one of those agents inherits a control that used to belong to a person, and most of them have no named owner.
Meanwhile the questions haven't changed. Who has access. Who approved the change. Show me the evidence.
If any of these describe you, someone will test your IT controls: a regulator, an auditor, a card brand or a customer. The question isn't whether, it's whether you find the gaps first.
Every company that files reports with the SEC must assess its internal control over financial reporting each year, under Sarbanes-Oxley section 404(a). Larger filers, generally those with $75 million or more in public float, also need their outside auditor to attest to it under 404(b).
SEC filer definitionsThe same internal control reporting rules reach every company that files periodic reports with the SEC, which can include companies with publicly registered bonds or notes but no public stock.
SEC rule on internal control reportingPCI DSS applies to any organization that stores, processes or transmits cardholder data, or can affect the security of that environment. It's enforced through card brand agreements rather than law.
PCI Security Standards CouncilThe HIPAA Security Rule applies to health plans, clearinghouses, providers that bill electronically, and the business associates that handle health information for them.
HHS, the Security RuleContractors and subcontractors that handle federal contract information or controlled unclassified information must achieve a set CMMC level.
DoD CIO, About CMMCNo law requires a SOC 2 report, but customers increasingly ask for one before they sign, because it shows how a provider controls the risks of the service it runs for them.
AICPA, SOC 2Lenders, investors and acquirers often require audits too. Requirements depend on your entity, data and activities, so confirm what applies with your auditor or counsel. See rules by country.
Most control problems are known inside the company long before an auditor writes them up. The difference is who finds them first, and what it costs by then.
of material weaknesses disclosed by US public companies in 2025 cited IT, software, security or access issues, up from 31% in 2021. Most centered on IT general controls, especially managing user access.
KPMG, Trends in Material Weaknesses: 2025 studyof companies that disclosed a material weakness between 2021 and 2025 disclosed one in more than one year. Once a weakness appears, it often comes back.
KPMG, Trends in Material Weaknesses: 2025 studyNon-compliance cost organizations 2.71 times as much as compliance, an average of $14.82 million a year against $5.47 million, in a 2017 study of 53 multinationals.
Globalscape and Ponemon Institute, 2017was the average saving when an organization's own team found a breach, compared with the attacker disclosing it.
IBM, Cost of a Data Breach Report 2025was the global average cost of a data breach in 2026, a record and up 12% from the year before.
IBM, Cost of a Data Breach Report 2026Projects with excellent change management were about seven times more likely to meet their objectives than those with poor change management, 88% against 13%. A new control only works if people adopt it.
Prosci, change management researchRead the rules at the source: Sarbanes-Oxley Act of 2002 (GovInfo) · PCAOB AS 2201, audits of internal control · Rules by country · Compliance updates
In your own words. Typos and voice to text are fine. You don't need to know which control it falls under.
The frameworks implicated, what doesn't apply to a company like yours, and which countries in scope change the answer.
One combined plan with no new hires, compensating controls an auditor may accept, the evidence to keep, the questions the auditor is likely to ask, and a 30, 60 and 90 day sequence.
One issue is mapped across every framework at once, so a single fix answers more than one requirement. Every version and date comes from a reference table maintained by a person, with the date it was last checked. See rules by country and compliance updates.
One page that shows how frameworks, control domains, evidence and ownership connect. Every FindingFirst report and roadmap is built on this structure.
A report tells you what's wrong. The audit readiness roadmap tells you what to fix first, by when, and who owns it. Tell us your frameworks, your audit date and which controls you already run, and the plan is dated back from your audit.
See a full sample roadmap, then move its audit date and watch every task reschedule.
Fixes your team can make within 30 days, with no new tools.
Policies, access reviews and change approval, set up the way auditors test them.
Run each control long enough to prove it works, and keep the proof as you go.
Rehearse the questions your auditor is likely to ask, with the evidence ready.
Premier subscribers get the same plan mapped to the systems they run, such as Microsoft Entra ID, Okta, ServiceNow, Jira and AWS: where to set up each control and which report to keep as evidence.
Each roadmap is built from the information you provide in your intake, and its accuracy depends on those answers. It is a planning tool to help your team prepare, not a certification or a guarantee of audit results. Only your auditor can confirm whether your controls meet a framework's requirements.
If your audit is less than 90 days away, you have several frameworks in scope, or a task marked Needs review doesn't have a clear answer for your company, our advisory team can review your plan with you.
Book a free consultationWhat it does is show you the questions early, while you still have time to answer them.
Start with the free preview. Pay only when you want the plan.
Founding price for the first 50 companies. $2,990 after that.
Billed once a year and renews automatically until you cancel. One company per subscription. Reports follow the 60 a month limit.
Claim a founding spotConsultants and audit firms: an Advisor plan for multiple client companies is on the way. Ask about it.
Most companies preparing for an audit buy one of three things. Each does a different job, so here's what each costs and what you get for it.
| Option | Price examples | What you get |
|---|---|---|
| Compliance automation platform | $7,500 to $25,000+ a year, annual subscription | Software that connects to your systems and monitors controls automatically. Priced by company size and framework, and the audit is extra. |
| Consultant readiness assessment | $5,000 to $15,000 per assessment | A consultant reviews your environment once and writes up the gaps. Help after that is billed by the hour. |
| Template kit | About $250, one time | Generic policies and checklists. No plan, no dates and nothing specific to your systems. |
| FindingFirst Premier | $1,990 a year, founding, annual subscription | Roadmaps dated back from your audit, with guidance for your systems, a tracker and 5 users. It doesn't connect to your systems or monitor them automatically, so it plans the work rather than running it. |
Prices are selected published examples, checked November 2026. Platform prices are observed entry prices and reported contract ranges, before audit fees. Actual prices vary by company size and scope. Many teams use FindingFirst to plan first, then decide whether they need a platform.
The tool handles most issues on its own. When the fix needs judgment, design or a conversation with your auditor, our advisory team can take it from there, from a single finding to a full control or operating model redesign.
Engagements are led by our lead advisor, an advisory architect with more than 15 years in IT governance, IT service management and audit.
At a Fortune Global 500 automotive manufacturer, they built IT service management from the ground up across the US, Canada and Mexico, including the processes and a team of 43. They owned JSOX compliance and stood up security operations. Within six months, audit findings dropped 75% and administrative overhead fell 30%. They also designed HR service delivery, customer service and field service processes.
Today they advise organizations running several initiatives at once, helping leadership decide what to do next and in what order. They build organizational change management into every design, so teams adopt the new way of working instead of working around it. They've worked with ServiceNow since 2013.
Our work is industry agnostic. The controls auditors test, and the processes that run them, look much the same in manufacturing, healthcare, financial services and technology.
For a control issue, an upcoming audit, a project you're planning or a proposal you need. Tell us what's going on and leave with a clear next step.
Book a free consultationHands-on time on a finding, an auditor response or a roadmap, or scoping a proposal, RFP response or statement of work. 1 hour minimum, invoiced after the session on Net 7, 15 or 30 terms. For proposals, we build your scope after the session, within 1 business day of receiving the documents we need.
Book a working sessionTimes show in your own time zone. Paid sessions and project work follow our consulting terms.
Describe one issue and see what it touches. It takes about two minutes.
Check an issue free