Building SOX-Ready Financial Controls for a National Retailer

The Challenge

As a national retailer with a large, distributed store and distribution network, Biglots needed to strengthen its internal financial controls ahead of increased regulatory scrutiny tied to SOX compliance. Control ownership was spread thin across finance and IT, evidence collection was largely manual, and the organization lacked a consistent way to demonstrate that internal controls over financial reporting would hold up under audit. Leadership needed a program that could bring structure to that process without pulling finance teams away from quarter-end close.

The Solution

ControlSage partnered with Biglots to design and implement a scalable SOX readiness program tailored to a multi-location retail environment. We started by mapping key financial processes, including revenue recognition, journal entry approvals, and access to core financial systems, and assigning clear control owners for each. From there, we built a structured testing cadence so that control effectiveness was verified continuously rather than discovered as a surprise during external audit fieldwork.

We also worked closely with IT to strengthen segregation of duties and access controls around financial systems, closing gaps that had built up as the organization scaled. Evidence collection was standardized and centralized, giving both internal audit and external assessors a single, reliable source of truth. Throughout the engagement, ControlSage provided hands-on guidance to help Biglots' finance and compliance teams build lasting internal capability rather than depending on outside support each testing cycle.

The Results

The engagement produced measurable improvements across the areas that matter most to auditors and leadership alike:

• Stronger internal controls over financial reporting

• Faster, cleaner audit cycles with fewer open items

• Clear, documented control ownership across finance and IT

• Reduced reliance on manual, spreadsheet-based evidence tracking

• Greater confidence heading into each testing cycle

Client Testimonial

"ControlSage helped us build a stronger compliance foundation with practical, scalable security guidance."

Key Outcomes

Biglots now operates with a SOX program built for the long term rather than a scramble ahead of each audit. Control ownership is clear, evidence is centralized, and testing happens on a predictable cadence throughout the year. That shift has freed finance leadership to focus on the business rather than chasing down documentation every quarter, while giving auditors a program they can trust from the first walkthrough.

Explore how ControlSage can help you prepare for PCI DSS compliance here.