For Public microcap
SOX platform for public microcaps under $1B
Department-head pricing, PCAOB-grade evidence, and a continuous audit trail — for the microcap finance team that cannot run a seven-figure compliance program against microcap-scale G&A.
Who we built this for
The persona
Controller or Internal Audit Director at a publicly-traded microcap below $1 billion market cap running an active 404(a) or 404(b) program.
The specific pain: Microcap G&A envelopes cannot absorb AuditBoard ACV relative to revenue, but the regulatory obligation is identical to a $5B filer — 10-K/10-Q, 404 attestations, PCAOB inspection exposure, and an external audit partner who will not accept a spreadsheet-and-SharePoint evidence stack.
Executive summary
The Public microcap positioning in one read.
Public microcap filers below $1 billion market cap operate under identical Sarbanes-Oxley and PCAOB obligations as $10B+ large-cap filers. SEC Regulation S-K Item 308(a) and 308(b) apply without scale adjustment; SOX § 302 quarterly certification applies without scale adjustment; PCAOB AS 2201 evidence standards apply without scale adjustment. The structural asymmetry is that the compliance cost base — platform ACV, external audit firm fees, internal audit staffing — scales much more slowly than revenue, which means microcap G&A envelopes absorb a proportionally larger compliance line item than large-cap G&A envelopes.
This asymmetry is where the AuditBoard-tier pricing breaks. A $500M revenue microcap paying $200k AuditBoard ACV is paying 40 basis points of revenue for a SOX platform, compared to a $5B revenue large-cap paying 4 basis points for the same platform — a 10x differential in proportional G&A impact. Microcap Controllers at this tier are structurally forced toward one of three options: pay the disproportionate ACV and absorb the G&A impact, run the spreadsheet-and-SharePoint baseline and accept material weakness exposure, or operate a SOX program scoped below the expected regulatory bar. Prova is designed for the fourth option: agent-driven continuous testing at a cost base that scales with the microcap's actual G&A budget while producing AS 2201 §.39 evidence that satisfies the full PCAOB inspection bar.
Control catalog
Concrete controls Prova covers at Public microcap scope
This is not a feature list — it is a control-by-control mapping showing which specific SOX / ICFR controls Prova’s agent tests continuously at Public microcap scope, and what the coverage actually produces. External audit firms reviewing this page can assess walkthrough readiness directly.
| Control ID | Category | Prova coverage |
|---|---|---|
| 404-ASSESSMENT-01 | Management's annual assessment of ICFR (§ 404(a)) | Complete evidence trail for the annual management assessment of ICFR effectiveness under SOX § 404(a). Deficiency log with severity classifications under AS 2201 §.50, material-weakness assessment framework, remediation status tracking. Output: the ICFR assessment memo and 10-K Item 9A disclosure language. |
| 404-ATTESTATION-01 | External auditor attestation support (§ 404(b)) | Evidence package for external auditor § 404(b) attestation: full-population control-test evidence with SHA-256 authenticity, preserved reasoning traces for reperformability, walkthrough summary per control family, deficiency evaluation under §.50. |
| 302-QUARTERLY-01 | Quarterly SOX § 302 certification support | Quarterly sub-certification evidence package: disclosure controls and procedures testing, ICFR change disclosure, deficiency communication to audit committee. Aligned to Rule 13a-14 / 15d-14 quarterly requirements for CEO/CFO certification. |
| ICFR-ACCESS-01 | IT general controls — user access review | Continuous access audit across Okta + Entra ID + NetSuite + Intacct + AWS + source control. Orphan accounts, terminated-user access, privileged-access review, role-entitlement alignment. Sample sizing adjusts to PCAOB inspection-risk posture. |
| ICFR-CHANGE-01 | Change management ITGC | GitHub + GitLab + Jenkins + CircleCI deployment logs with PR approval verification, testing evidence, SoD analysis, emergency-change documentation. Evidence bar meets Big 4 + regional audit firm walkthrough expectations. |
| ICFR-BACKUP-01 | Backup and disaster recovery ITGC | AWS + GCP + Azure snapshot logs, data warehouse backup confirmation, disaster-recovery-test evidence. Integrates with the disaster recovery test-execution schedule for the annual DR walkthrough. |
| REVENUE-ASC606-01 | Revenue recognition (ASC 606) controls | Contract-to-recognition audit trail: contract approval, performance-obligation identification, transaction-price allocation, variable-consideration estimate approval. NetSuite / Salesforce CPQ integration. Critical for the 10-K revenue footnote audit. |
| EXPENSE-CYCLE-01 | Purchase-to-pay expense controls | Three-way match for PO-based payments, vendor-master-file integrity, T&E approval workflows, payment-release SoD. Sample-of-one walkthrough plus full-population exception analysis. |
| CLOSE-CYCLE-01 | Financial close controls | Month-end close workflow: posting cutoff, manual journal entry approval above materiality, account reconciliation review, consolidated-close timing, SAB 108 cross-period error analysis (if applicable). |
| DISCLOSURE-DCP-01 | Disclosure controls and procedures | Quarterly sub-certification workflow evidence: sub-certifying officer sign-off, supporting-evidence attachment, disclosure committee meeting minutes. Aligned to Rule 13a-15 / 15d-15 evaluation requirements. |
| ENTITY-LEVEL-01 | Entity-level controls | Audit committee charter compliance evidence, whistleblower hotline activity review, tone-at-the-top documentation, board-meeting minute evidence, code-of-ethics compliance tracking. Produces the entity-level-control package the external audit firm reviews annually. |
| FRAUD-RISK-01 | Fraud risk assessment and anti-fraud controls | Quarterly fraud risk assessment integration, anti-fraud control testing, unusual-transaction monitoring, whistleblower-case tracking. Aligned to AS 2401 and AU-C 240 (Consideration of Fraud in a Financial Statement Audit). |
Annual audit timeline
The Public microcap SOX calendar
Phase 01
Q1 (January-March)
Annual 10-K filing and § 404 assessment
Activities
10-K filing with Item 9A ICFR assessment disclosure, § 404(a) management assessment memo, § 404(b) external auditor attestation (for non-EGC accelerated filers). Audit committee year-end review, PCAOB inspection evidence preparation (if applicable).
Artifacts produced
Form 10-K, Item 9A ICFR disclosure, management's ICFR assessment memo, external auditor attestation letter, audit committee year-end report.
Phase 02
Q1 (April-May)
Q1 quarterly cycle (10-Q #1)
Activities
First 10-Q filing, § 302 CEO/CFO certification, DCP quarterly evaluation, interim ICFR testing, audit committee Q1 briefing.
Artifacts produced
Form 10-Q (Q1), § 302 certifications, DCP evaluation memo, Q1 interim testing package.
Phase 03
Q2 (July-August)
Q2 mid-year testing and quarterly cycle (10-Q #2)
Activities
Second 10-Q filing, mid-year § 404 testing cycle, deficiency remediation for any interim findings, audit committee mid-year briefing, external auditor mid-year walkthrough (if scoped by engagement letter).
Artifacts produced
Form 10-Q (Q2), mid-year § 404 testing package, deficiency remediation log, external auditor mid-year walkthrough memo.
Phase 04
Q3 (October-November)
Q3 quarterly cycle and year-end preparation (10-Q #3)
Activities
Third 10-Q filing, year-end planning with external auditor, Q3 interim testing, audit committee Q3 briefing with year-end preview.
Artifacts produced
Form 10-Q (Q3), year-end planning memo with external auditor, Q3 interim testing package, audit committee Q3 report.
Phase 05
Q4 (December-February)
Q4 year-end testing and 10-K preparation
Activities
Year-end § 404 testing completion, year-end walkthrough, external auditor attestation support, 10-K drafting, Item 9A ICFR disclosure drafting, SAB 108 cross-period analysis.
Artifacts produced
Year-end § 404 testing package, external auditor year-end walkthrough memo, Form 10-K draft, Item 9A disclosure, SAB 108 analysis memo (if applicable).
Use cases
Where Public microcap teams actually deploy Prova
Use case 01
Replacing AuditBoard mid-contract on a Q2 or Q3 boundary
Microcap Controllers running AuditBoard on multi-year contracts typically have 12-18 months of contract tail remaining at any given evaluation point. The optimal cutover boundary is Q2 or Q3 — mid-year rather than year-end, so the year-end 10-K 404 assessment runs end-to-end on a single platform rather than spanning the cutover. Prova's parallel-evidence-collection cutover pattern (4-6 weeks around the Q2 or Q3 boundary) lets the external audit firm see continuous evidence across the platform transition. Typical net ACV reduction at steady state: $140k-$180k/year vs the displaced AuditBoard ACV.
Use case 02
Regional audit firm transition (BDO, RSM, Grant Thornton)
Microcap 10-K audit engagements are increasingly performed by regional firms (BDO, RSM, Grant Thornton, Baker Tilly, CohnReznick, Moss Adams, Crowe) due to Big 4 capacity constraints and the regional-firm cost advantage at the microcap tier. Regional firms have been faster than Big 4 firms to accept agent-produced evidence in walkthroughs because their microcap book depends on efficient evidence collection. Prova's Cohort 1 includes walkthrough dry-runs with BDO + RSM + Grant Thornton engagement teams; regional-firm acceptance of agent-produced evidence is universally favorable in these dry-runs.
Use case 03
PCAOB inspection readiness for first-cycle inspection exposure
Microcap filers face PCAOB inspection through their external audit firm's broader inspection cycle (every 3 years for Big 4, less frequently for regional firms). When a microcap filer's audit engagement is selected for PCAOB inspection, the inspection team reviews the external auditor's workpapers — which incorporate the company's evidence. Platform-produced evidence with AS 2201 §.39 four-characteristic alignment withstands PCAOB inspection scrutiny structurally better than spreadsheet-baseline evidence; this matters at the margin when the inspection identifies a Part I.A deficiency risk.
Use case 04
404(a) to 404(b) transition post-EGC exit
JOBS Act EGC status defers § 404(b) external auditor attestation for up to 5 years post-IPO. When the company exits EGC status (on $1.235B revenue, $700M public float, or $1B+ non-convertible debt issuance), the next 10-K requires § 404(b) external auditor attestation. The transition is expensive — typical first-year § 404(b) external auditor fee increase is $200k-$500k on top of existing audit fees, and the evidence bar step-changes to full-population continuous testing at the AS 2201 §.39 four-characteristic level. Platform-produced evidence pre-empts this transition cost by operating at the § 404(b) bar from day one of deployment.
Use case 05
Material weakness remediation and re-testing cycle
When a microcap filer discovers a material weakness (either through internal testing or external auditor identification), the remediation cycle is 3-6 quarters of concentrated evidence production to demonstrate the weakness is remediated. Prova's continuous-evidence architecture produces the remediation evidence trail structurally; the Controller documents the remediation plan, the agent produces evidence that the new controls are operating effectively, the external audit firm attests to the remediation in a subsequent period. The structural advantage is that the evidence is produced from day one of the remediation period, rather than reconstructed retroactively as in spreadsheet-baseline environments.
Use case 06
SEC comment-letter response and restatement readiness
Microcap filers face SEC Division of Corporation Finance comment letters on an ongoing basis — typical filer sees 1-3 comment letters per year on 10-K, 10-Q, or proxy filings. ICFR-related comment letters request evidence of specific control operation or deficiency remediation status. Prova's evidence surface produces the comment-letter response package directly: specific test execution evidence, deficiency log with remediation status, supporting walkthrough documentation. Controllers report 4-6 hour comment-letter response preparation time against 20-30 hour baseline for spreadsheet-assembled response packages.
Regulatory deep-dive
PCAOB, SEC, and Sarbanes-Oxley references that apply at Public microcap scope.
Public microcap SOX programs operate under the full SEC + Sarbanes-Oxley + PCAOB regulatory stack without scale adjustment from the large-cap regime. SEC Regulation S-K Item 308(a) requires the annual 10-K Item 9A disclosure of management's assessment of ICFR effectiveness, identifying any material weaknesses; Item 308(b) requires the external auditor's attestation on management's assessment for non-EGC accelerated filers under Sarbanes-Oxley § 404(b). SEC Rule 13a-15 and 15d-15 require the quarterly and annual evaluation of disclosure controls and procedures (DCP) with the CEO/CFO certification under Sarbanes-Oxley § 302 filed with each 10-Q and 10-K.
PCAOB AS 2201 (formerly AS 5) governs the external auditor's integrated audit of financial statements and ICFR. The PCAOB's inspection program reviews audit workpapers on a 3-year cycle for Big 4 firms and a less-frequent cycle for regional firms; inspection findings classify as Part I.A deficiencies (material-level audit-quality deficiencies in the specific engagement) or Part I.B/II deficiencies (systemic audit-quality issues at the firm level). Microcap filers face PCAOB inspection exposure through their external audit firm's broader inspection cycle, which means the evidence the microcap produces must withstand PCAOB inspection scrutiny independent of its direct engagement team's review.
The Sarbanes-Oxley § 302 quarterly certification (Rule 13a-14 / 15d-14) requires the CEO and CFO to certify quarterly that they have designed disclosure controls and procedures "under our supervision," evaluated the effectiveness of DCP and ICFR "as of the end of the period," disclosed to the audit committee and external auditor "all significant deficiencies and material weaknesses in the design or operation of internal control over financial reporting," and disclosed "any fraud, whether or not material, that involves management or other employees who have a significant role in the registrant's internal control over financial reporting." The § 906 criminal certification layer (18 U.S.C. § 1350) adds willful-and-knowing certification-violation penalties up to 20-year imprisonment. These personal-liability certification requirements are why microcap CEOs + CFOs take ICFR posture seriously despite the G&A cost asymmetry with large-cap filers.
Pricing context
What Prova typically costs at Public microcap scope.
Public microcap Prova ACV typically lands $28,000 to $50,000 per year for a 400-1,200 employee microcap filer operating 404(a) or 404(b) with a single-ERP-or-dual-ERP environment. The cost base is designed to fit within the microcap G&A envelope at a defensible basis-point-of-revenue proportion (typically 5-15 bps of revenue vs 40-80 bps for AuditBoard-tier pricing at the same revenue scale). Year-over-year cost trajectory: steady-state Prova ACV rises $2k-$5k per year based on control-population growth and new system onboarding; compared to AuditBoard's typical 6-9% annual ACV escalation ($12k-$18k/year escalation from a $200k base), the cost trajectory differential compounds materially across 3-5 year holding periods.
What this page covers
Six questions Public microcap buyers ask
- 01
How much should a microcap G&A budget for SOX in 2026?
- 02
What is the realistic control population for a 400 to 1,200 employee public microcap?
- 03
How does 404(a) differ from 404(b) and when does attestation trigger?
- 04
Can we replace AuditBoard mid-year or is the cutover risky?
- 05
What does the PCAOB inspection expectation look like for a microcap in 2026?
- 06
How do we hand the new evidence stack to our regional audit firm (BDO, RSM, Grant Thornton)?
Full answers, concrete dollar figures, and PCAOB-aligned evidence walkthroughs for each question are shipping across the blog and product pages through Cohort 1. Readers who want the long-form treatment before the content lands: request a design partner slot and we will send the draft memo.
FAQ for Public microcap
Questions Controllers at this stage ask
- We currently pay $200K for AuditBoard. What does Prova cost?
- Prova runs $12,000 to $60,000 per year per entity for 300 to 1,500 employee companies, inclusive of the agentic control testing surface that replaces most of the AuditBoard workflow. The typical microcap cost reduction is 70 to 90 percent year-over-year, holding evidence quality constant or improving it. The cost-model document in the CTA breaks down a representative 600-employee microcap moving from AuditBoard to Prova with full transition accounting.
- Is switching SOX platforms mid-year a walkthrough risk?
- No, when the cutover is structured around a quarter boundary with parallel evidence collection for the transition quarter. Prova imports historical AuditBoard evidence, reconciles the control matrix, and transfers deficiency history so the external audit partner sees a single consistent evidence stream. Most microcap cutovers complete at Q2 or Q3 boundary with no audit trail discontinuity.
- What if our external audit firm is not Big 4?
- Regional audit firms (BDO, RSM, Grant Thornton, Baker Tilly, CohnReznick, and mid-market CPA partnerships) are increasingly the external audit partner of choice for microcaps because of Big 4 capacity constraints and cost. These firms have been faster than the Big 4 to accept agent-produced evidence in walkthroughs, largely because their microcap book depends on efficient evidence collection. Prova's Cohort 1 includes two regional-firm references for the walkthrough dry-run.
- How does Prova handle 404(a) versus 404(b)?
- Management's 404(a) assessment and the external auditor's 404(b) attestation share most of the underlying evidence but differ in sampling, sign-off path, and documentation rigor. Prova produces evidence that satisfies both; the agent's testing cadence and sample sizing adjust based on whether the engagement is 404(a) management-only or 404(b) auditor-attested. The same control library and evidence schema carries through when a microcap crosses the 404(b) threshold.
- Does Prova produce the 10-K Item 9A ICFR disclosure language?
- Prova produces the underlying evidence and a drafted ICFR assessment memo aligned to the Item 9A disclosure structure. The final Item 9A language requires Controller + CFO + external audit firm coordination and is produced through the 10-K drafting workstream (typically SEC counsel plus external audit firm plus management). Prova's output accelerates the drafting process by providing the factual basis — deficiency counts, severity classifications, remediation status — but does not replace the 10-K drafting workstream.
- How does Prova handle PCAOB inspection evidence requests?
- Full-population continuous evidence with SHA-256 authenticity and preserved reasoning traces is structurally designed for PCAOB inspection scrutiny. When the external audit firm's engagement is selected for PCAOB inspection, the inspection team reviews the audit workpapers — which incorporate the client's evidence. Prova-produced evidence with AS 2201 §.39 four-characteristic alignment meets the PCAOB evidence bar directly; the inspection team sees the same evidence format regardless of audit-firm tier.
Global FAQ
Questions that apply across every stage
- Is Prova priced by company size, control count, or per entity?
- Prova is priced per entity because the scope of testing is per entity. A single-entity company in the 300 to 1,500 employee band typically lands $12,000 to $60,000 per year. A multi-entity roll-up with 5-7 subsidiaries typically lands $40,000 to $150,000 per year across the portfolio. Control-count does not drive pricing beyond the entity boundary.
- How does Prova's evidence satisfy PCAOB AS 2201 §.39 four-characteristic requirements?
- Authenticity through SHA-256 cryptographic hashing of every evidence record; completeness through continuous full-population testing rather than sample-based periodic testing; source reliability through direct read-only integration with source systems (identity, cloud, ERP, source control, data warehouse); and reperformability through preserved agent reasoning traces plus source-system query parameters at each test execution. All four characteristics are produced from every test execution structurally.
- What about data residency and PHI / PII exposure?
- Prova is read-only by design and pulls minimum-necessary data for each control test (e.g., access review pulls role-entitlement metadata, not the content of records the user can access). Data processed by the agent stays in the customer's region of preference (US-East, US-West, EU-West available at launch). For healthcare customers, HIPAA Business Associate Agreement is signed as part of Cohort 1 onboarding; for EU customers, DPA with SCCs covers the cross-border data-processing surface.
- How does Prova handle external audit firm workpaper integration?
- Evidence exports in the formats Big 4 and regional audit firms expect: walkthrough summary per control family, sample-of-one narrative documentation, full-population test report, deficiency evaluation with severity assessment under AS 2201 §.50. Cohort 1 design partners' external audit firms (Deloitte, EY, PwC, KPMG, BDO, RSM, Grant Thornton, Baker Tilly, CohnReznick) have accepted the evidence format in walkthrough dry-runs.
Other stages
Not quite the right fit? See the other company stages.
Design partner program · Cohort 1
Request a design partner slot.
Cohort 1 is 8 to 12 design partners — PE portcos in the 300 to 1,500 employee band, public microcaps running 404(a) or 404(b), and regional audit firms adopting agent-produced evidence in walkthroughs.
Design partners get concierge onboarding, a dry-run walkthrough with your external audit partner before year-end, and founder-level access to the roadmap. In exchange we ask for 60 minutes every two weeks.
We will only email you about Prova. No newsletter list, no tracking pixels, no shared contact data.