A consulting advisory for SOX 404, Enterprise Risk Management, IT General Controls, AI governance, and Pre-IPO readiness, built on 25+ years of Internal Audit leadership across public, private, and global organizations.
From S-1 filing to clean 10-K, including the material weaknesses that have to be closed before they become disclosures.
sideLook offerings
Consulting, the free SOX AI Assistant, SOX Compliance News, sideLook Access, and Training & Workshops.
Every engagement is led personally, with no handoffs to junior staff, no over-scoped deliverables, no billable bloat.
Right-size your control environment. We refine selection and testing strategies, eliminate redundant controls, and expand automation, reducing burden without sacrificing assurance.
Move from reactive to proactive. Align risk appetite to business strategy with ERM and Business Continuity frameworks that executives and the audit committee can actually use.
Strengthen ITGC, application controls, and IPE testing. Pragmatic reviews across access, change management, operations, AI governance, and cybersecurity posture.
Owns how the organization discovers, governs, deploys, monitors, and adopts AI. We turn a fast-moving AI landscape into an inventory, a policy, and a control set your auditors and board can follow.
The jump from private to public is larger than most leadership teams anticipate. We prepare finance, IT, and operations for the rigor of public-company audit and SOX Year 1.
Experience shaped by complex organizations across financial services, technology, manufacturing, media, and the public sector.
Matters are addressed against the conditions that exist now, not fixed theories or rigid rules. Realistic, measured, and built to last.
We start by measuring the control population against expected ranges for each process, identifying redundancies and extraneous controls that create noise without adding assurance.
In collaboration with your teams, we reduce and consolidate controls, expanding automation wherever the opportunity exists, lowering cost while strengthening outcomes.
We work directly with control owners to confirm that controls are inherent to the process, not bolt-ons, so the framework operates naturally in day-to-day work.
Narratives and risk matrices are rewritten for clarity. The result is a faster, better-aligned control framework your teams will actually maintain.
Engagements are scoped and priced around a defined outcome, so you know the deliverable, the timeline, and the cost before the work begins.
sideLook is built for companies running one SOX program, not for engagements needing dozens of simultaneous testers across dozens of countries — for that, a Big 4 firm is the right call.
How engagements are scoped
Fixed scope
Every engagement is defined around a deliverable, such as a rationalized control set, a Year 1 SOX program, or an IPO-readiness framework. Project-based and fixed in scope, never open-ended hourly work that drifts.
Typical length
6–12 months
SOX Year 1 programs typically run six to twelve months from readiness assessment through a clean external-audit reliance. Control rationalizations run three to six months.
Who does the work
Senior only
You work directly with the partner who scopes the engagement, performs the analysis, and stands in front of your audit committee. No leverage pyramid behind the deliverable.
Junior-staffed teams, partner oversight billed at leverage multiples.
SOX Year 1 programs typically land here, depending on scope and systems footprint. Senior-only work at a scope you approve in writing before the first hour is billed.
“Big 4 SOX Year 1 programs typically run $200K to $1M+ with junior-staffed teams. sideLook engagements deliver senior-only work at a fraction of that overhead because you are not paying for a pyramid.”
Fees vary by scope and complexity; every proposal is fixed-scope and approved in writing before work begins.
A quick, directional range for readiness work, audit fees, and ongoing cost based on your systems footprint and ITGC maturity.
Year 1 total
$187.5K to $550K
Significant ITGC gaps
This calculator uses widely observed industry ranges for SOX readiness and audit fees. The cost model and logic are original to sideLook Consulting.
Paste control narratives or upload walkthrough notes. Get key risks, control gaps, a remediation plan, evidence to request, and a draft management response in minutes.
A career spent between the lines of risk and operations.I'm Gary Berrigan and sideLook Consulting emerged due to a reduction in force while I was still working with clients. I began with them and grew from there. No matter the size of my employer or client, I have always found a bloated program, multiple redundancies and audit fatigue. I am there to right size compliance frameworks and give back time to control owners.
My career began with the FBI as an analyst and continued as a fraud investigator with KPMG, New York Life Insurance, and Interpublic Group. Since Sarbanes-Oxley took effect, I've partnered with companies large and small, with the privilege of global travel and deep cross-industry experience.
I've led Internal Audit functions, SOX programs, and ISO frameworks for multinational and emerging businesses. I collaborate closely with C-level executives, audit committees, control owners, and independent auditors to evaluate controls, streamline compliance, and drive process improvement.
I bring a rare combination of controls governance, enterprise risk, regulatory fluency, and cross‑functional leadership built over nearly two decades in SOX, ITGC, ERM, and audit transformation. From FBI Academy training in white‑collar crime to leading SOX automation and AI‑aligned governance programs for complex organizations, I have the ability to design compliant AI governance frameworks, assess and mitigate AI risk, and drive adoption across business units.
Active member, ISACA, IIA and ISC2.
From Fortune 500 multinationals to pre-IPO companies preparing for their first 10-K, where the patterns rhyme and the controls must fit the business.
Selected programs measured by lower cost, stronger auditor reliance, and control environments built to last.
The challenge
A global SOX program burdened by legacy controls inherited across multiple acquisitions.
“A 37% reduction in key controls is not a shortcut; it is the result of understanding which controls are genuinely load-bearing and which exist because no one ever questioned them.”
The challenge
Build a SOX-compliant internal audit function from scratch for a $700M IPO spanning 14 manufacturing facilities in four countries, under compressed timelines and pressure to implement a major ERP system.
The challenge
A publicly traded SaaS company running SOX, ISO 27001, and SOC 2 obligations in parallel, creating duplicated effort and control-owner fatigue.
The challenge
Design and execute a first-year SOX rollout for one of the world's largest advertising holding companies while managing an active fraud audit program across the United States and Europe.
Review the full control inventory. Map every control to its COSO component, risk area, and owner before making recommendations.
Separate genuinely load-bearing controls from legacy or redundant activity with a clear, defensible rationale.
Recommend consolidations, automations, and eliminations, socialized with external auditors before implementation.
Document the new control set, train owners, and establish an ongoing review cadence as the business evolves.
The things CFOs, controllers, and audit committee members raise before engaging an advisory firm, addressed directly.
A one-page view of the nine financial reporting cycles and entity-level controls in a SOX 404 assessment.
A 14-slide presentation on PCAOB standards modernization, effective dates, technology-assisted audit evidence, and IT controls.
Daily briefing
Keep up with SOX compliance news alongside your management-side work. Read the daily briefing at soxcompliance.news.
An introductory call is the fastest way to find out whether we're a fit, and you'll leave with at least one useful idea either way.