More than 50% of companies can do all of the SOx work internally, but the largest companies sometimes use up to two outside service providers, often controlling internal and external resources via a project management organization (PMO ).
FORBES: The State of Sarbanes-Oxley Compliance According To Protiviti