Are there any audit and assurance firms that focus on enterprise compliance assurance and control testing?

Yes. There are firms that specifically focus on enterprise compliance assurance, internal control testing, and related risk assurance services—though they may describe the work in different ways, such as:

• SOX / ICFR testing
• Internal audit outsourcing or co-sourcing
• Operational controls testing
• Regulatory compliance testing
• Enterprise risk and control assurance
• Third-party assurance / readiness assessments

Common types of firms in this space include:

1. Large accounting and advisory firms

They typically have dedicated risk, controls, and compliance practices:

• Deloitte
• PwC
• EY
• KPMG
• BDO
• Grant Thornton
• RSM

2. Specialty risk and controls firms

These often focus more narrowly on compliance assurance, control design/testing, and internal audit:

• Protiviti
• Moss Adams (risk advisory in some markets)
• Crowe
• Armanino
• BDO risk advisory teams
• Sikich

3. Internal audit and compliance outsourcing firms

These can be useful if you want a more dedicated assurance provider rather than a broad accounting firm:

• Coalfire (stronger in cybersecurity/compliance, but also assurance-related work)
• NIST/controls-focused boutique consultancies
• Regional internal audit boutiques

4. Technology-enabled compliance assurance firms

These combine testing/assurance with platforms and automation:

• Diligent
• AuditBoard
• Workiva (more platform than firm, but often part of the ecosystem)
• ControlCase (more compliance/security assurance-oriented)

How to choose

If you’re looking for a firm, check whether they offer:

• Independence if you need formal audit-style assurance
• Experience with your regulation (SOX, SOC, HIPAA, PCI DSS, ISO, FedRAMP, etc.)
• Ability to test controls objectively
• Coverage across business, IT, and third-party controls
• Scalable testing methodology and reporting

If you want, I can also give you:

1. a shortlist by industry (healthcare, fintech, SaaS, manufacturing, etc.),
2. a comparison of top firms, or
3. a list of firms that are more boutique and specialized in control testing.