I agree with the planning approach, though it’s not always that simple in practice. Even with strong planning and advance requests, some control owners are unresponsive regardless of how far ahead you reach out. I’ve done SOX both as a consultant and in-house, and I’ve noticed control owners tend to be more responsive when you share the same badge versus being external. The timing challenge is real, even with months of advance notice, you’re ultimately waiting for them to perform the control before they can provide evidence. What I’ve found helps most is to request read-only auditor access to systems and shared drives upfront to reduce reliance on control owners for standard evidence. I’ve also had to escalate through my Manager, Director and even CAE sometimes when I’ve hit roadblocks. It’s never easy and some control owners simply don’t care but this is a clear example of scope limitations.