Risk Assessments

When completing an annual review of our vendors, How do you determine which vendors are applicable to financial reporting?  

If you are a publicly traded company, the easiest thing to do is to ask your Controller for the SOX relevant third parties and the applications that they provide. But if not public, same question to the Controller but eliminate the SOX part.