PKM’s outsourced IT internal audit services are typically provided to clients who have established internal audit departments but are without internal IT audit resources. Unlike the IT general controls review, described above, as an outsourced internal audit resource, we are typically in the position of assisting clients in the execution of their internal audit plan based on an internally developed risk assessment. In some cases, we even assist management in the development of this risk assessment. This process can be structured to encompass the testing requirements under Sarbanes-Oxley (SOX 404).