SOX 404 explained: 404(a) vs 404(b), filer status, and 2026 requirements

On May 19, 2026, the SEC proposed collapsing five overlapping filer categories into two and raising the large accelerated filer threshold from $700 million in public float to $2 billion. By the Commission's own estimate, roughly 80.8% of public companies would land in the non-accelerated category, and every one of them would be exempt from the Section 404(b) auditor attestation. The comment period closed on July 20, 2026 and the rules remain at proposal stage.

Section 404 of the Sarbanes-Oxley Act is where most SOX effort and nearly all SOX cost originate. This guide covers what 404(a) and 404(b) each require, how filer status decides which one applies to you, when a newly public company enters scope, what a 404 program costs, and what the 2026 proposal would change.

What Section 404 requires

Section 404 asks a company to prove that the controls producing its financial statements work. It splits into two subsections with different owners.

Section 404(a) requires management to establish and maintain internal control over financial reporting, evaluate its effectiveness at fiscal year-end, and state a conclusion in the annual report. Every SEC reporting company carries this obligation. There is no size exemption and no revenue threshold.

Section 404(b) requires the independent auditor to attest to and report on the effectiveness of that internal control. This one is scoped by filer status, and the exemptions are wide.

The mechanics of the management assessment, from risk-based scoping through control rationalization to test of operating effectiveness, are covered in detail in the internal control over financial reporting article. For how Section 404 sits alongside Sections 302, 802, 806 and 906, see the SOX compliance guide.

The auditing standard governing 404(b) is PCAOB AS 2201, adopted as Auditing Standard No. 5 in November 2007 and renumbered in 2015 without substantive change. Amendments to AS 2201 and AS 2101 take effect on December 15, 2026, formalizing a top-down, risk-based scoping approach anchored on entity-level controls.

404(a) and 404(b): where the workload splits

The practical difference lies in who tests the controls and what standard of evidence they apply, more than in the volume of documentation produced.

Under 404(a) alone, management designs the scope, selects the key controls, tests them, and concludes. The judgment calls stay internal. Evidence sufficiency is management's own call, subject to audit committee challenge and to the auditor's financial statement audit, which considers controls to set control risk without giving an opinion on them.

Under 404(b), the external auditor performs an integrated audit and issues a separate opinion on internal control effectiveness. That changes three things. Scope becomes negotiable with the auditor instead of settled internally. Evidence has to satisfy PCAOB standards and survive PCAOB inspection. And a control that management considers adequately tested may need retesting, because auditors cannot rely on management's work without evaluating its competence and objectivity.

The gap shows up in the numbers. Analyzing 98 companies that lost their exemption, the US Government Accountability Office found a median audit fee increase of $219,000, or 13%, in the transition year, and a median increase of $80,000 in the preceding year, as companies paid auditors to assess controls in anticipation. Fees leveled off afterwards.

One asymmetry deserves flagging. KPMG's 2025 SOX Survey found that 56% of organizations had a larger in-scope control population than their external auditor did. Management routinely tests more than the auditor needs, which means part of the 404(a) burden is self-imposed, not required.

Filer status, step by step

Five categories currently overlap, which is the single biggest source of confusion in Section 404. The decision runs on two measurements taken at the last business day of the second fiscal quarter: public float and annual revenues.

Three points the table cannot carry.

Smaller reporting company status overlaps but does not map cleanly. An SRC has a public float below $250 million, or revenues below $100 million with either no public float or a float below $700 million. SRC status governs scaled disclosure. It affects 404(b) only through the March 2020 amendments, which excluded revenue-qualifying SRCs from the accelerated filer definitions.

Emerging growth company status expires. A company loses it on the fifth anniversary of its IPO, or earlier if annual gross revenue reaches $1.235 billion, if it issues more than $1 billion in non-convertible debt over three years, or if it becomes a large accelerated filer.

Exiting a category is harder than entering it. An accelerated filer stays one until its public float falls below $60 million. A large accelerated filer stays one until float drops below $560 million, at which point it becomes an accelerated filer, and it becomes non-accelerated only below $60 million. The exit thresholds sit well under the entry thresholds, so a company whose valuation falls does not shed 404(b) at the same line it acquired it.

Timing compounds the effect. Public float is measured on the last business day of the second fiscal quarter, and status determined at that date governs the annual report for the fiscal year then in progress. A company crossing $700 million in float at the end of June has already committed to a 404(b) attestation covering the twelve months ending in December, including the six months that had already elapsed before the measurement was taken. Companies tracking near a threshold therefore plan on the prior year's float, not the current one.

When a newly public company enters scope

Newly public companies consistently underestimate how fast Section 404 arrives. The sequence is fixed.

1. IPO. No Section 404 obligation attaches at listing.
2. First annual report. A newly public company is not required to provide management's assessment of ICFR in its first Form 10-K after going public. No 404(a) report, no 404(b) attestation.
3. Second annual report. Section 404(a) applies. Management assesses ICFR effectiveness and reports its conclusion.
4. Second annual report, if not exempt. Section 404(b) applies at the same time for a company that is an accelerated or large accelerated filer and no longer an emerging growth company.

That looks like breathing room, but it is not, because the assessment in the second 10-K covers controls as they operated throughout the whole fiscal year. Remediating a control gap discovered in month 11 does not fix the assessment period. Readiness work therefore starts before the IPO, not after it, and 12 to 18 months of lead time is the working benchmark.

The proposed 2026 rules would extend the runway considerably. Newly public companies would be exempt from large accelerated filer status for five years regardless of public float, which means 404(a) only for that period.

What SOX 404 compliance costs

KPMG's 2025 SOX Survey, covering roughly 150 SOX professionals, gives the most current benchmark and shows two years of sharp movement.

Forty-five percent of organizations reported higher costs in FY24 than the year before. The survey attributes the increase primarily to scope expansion, with the in-scope system count as the clearest driver.

These figures cover internal program cost. They exclude the external audit fee, which for 404(b) filers sits inside a single integrated audit fee that is never itemized. The GAO reached the same conclusion when it tried to isolate 404(b) costs in 2025: the fee cannot be disaggregated, so audit fee movement around a change in filer status is the only usable proxy.

Two survey findings point to recoverable cost. Only 28% of organizations use offshore resources, despite 42% naming cost reduction as a strategy. And 90% cannot quantify the fee savings from auditor reliance on management testing, which makes it difficult to justify the extra testing performed to earn that reliance.

Automation is falling while scope expands

The most counterintuitive line in the KPMG data deserves its own treatment. Between FY22 and FY24 the average number of in-scope systems rose from 17 to 40. Over the same period, automated controls fell from 21% of the control population to 17%.

Read together, those two numbers describe control portfolios growing faster than automation can absorb. Each new system in scope brings ITGCs, access reviews, and interface controls. Teams add manual controls because manual controls can be stood up in a week, while configuring and validating an automated control in a new system takes a quarter. The rational short-term choice compounds into a portfolio that costs more every year to test.

Manual controls also carry a specific evidential weakness. A manual review leaves evidence only if the reviewer documents what was reviewed, against what threshold, and what happened to the exceptions. KPMG's material weakness study for the same period found imprecise management review controls to be the most frequently cited financial close issue, which is what happens when a manual control operates without leaving a defensible trail.

Continuous controls monitoring attacks the problem from the testing side instead of the control side. Rather than automating each control one system at a time, it runs the test across the full transaction population on every data extraction. Coverage stops depending on sample size, and exceptions surface within days. The evidence of each test accumulates as a byproduct of running it. For a control portfolio that doubled its system footprint in two years, that arithmetic matters more than it did when 17 systems were in scope.

What's changing in 2026

Two developments land in the same year and pull in opposite directions.

The SEC proposal would shrink 404(b)

Release Nos. 33-11419 and 34-105515, proposed on May 19, 2026 and published in the Federal Register two days later, would restructure filer status around two primary categories.

• Large accelerated filers would be companies with $2 billion or more in public float, up from $700 million
• Non-accelerated filers would be everyone else, with the accelerated filer and smaller reporting company categories eliminated as standalone statuses
• A small non-accelerated filer subcategory, measured by total assets, would receive extended periodic reporting deadlines
• All non-accelerated filers, including the smallest, would be exempt from 404(b)
• Newly public companies would be exempt from large accelerated filer status for five years regardless of float

The scale is substantial. The SEC estimated that 80.8% of public companies would qualify as non-accelerated filers under the proposal, with the remaining 19.2% still accounting for around 93.5% of total public float. The Commission calculated that 26.7% more current registrants would fall outside 404(b) than do today.

Section 404(a) would be untouched. Management's assessment obligation applies to every reporting company under the proposal exactly as it does now.

Three practical points for anyone modeling the impact. The comment period closed on July 20, 2026 and the rules have not been adopted, so nothing changes until final rules take effect. Voluntary compliance stays available, and a company that drops its attestation should expect to explain the decision to investors and proxy advisers. And foreign private issuers using foreign reporting forms fall outside the new definitions, with non-EGC foreign private issuers above $75 million in float still subject to 404(b).

The transition mechanics are worth reading now, because they determine when relief actually arrives. Existing registrants would assess their status looking back to the fiscal year end preceding the effective date, using public float for that year and the prior one. If final rules took effect on January 15, 2027, a calendar-year registrant would assess as of December 31, 2026 and could complete that assessment at any point up to December 30, 2027. A company qualifying as a non-accelerated filer could then use the accommodations in its next filing after the assessment.

PCAOB standards tighten for the auditors who remain

Amendments to AS 2201 and AS 2101 take effect on December 15, 2026, alongside QC 1000, the PCAOB's firm-level quality control standard, which requires registered firms to design, operate, and annually report on a risk-based quality control system.

For companies still inside 404(b), the consequence is indirect. Firms operating under tighter quality control obligations push evidence requests downstream. Documentation demands on finance teams tend to rise in the audit cycles immediately following a standards change.

The combined picture is a narrowing 404(b) population facing a higher evidential bar, and a growing 404(a) population testing its own controls with no attestation to lean on.

Building a 404 program that proves effectiveness

Whichever side of the threshold a company lands on, the management assessment under 404(a) survives. Four moves make it defensible.

Scope from risk, not from habit. Start from material financial statement line items, trace each to the processes and systems feeding it, and identify the key controls addressing the assertion-level risks. Control rationalization matters more as the system count rises: a portfolio that grew alongside 40 in-scope systems usually contains controls that no longer address a material risk.

Test through the year. Concentrating testing before year end produces late discovery, and a gap found in month 11 cannot be remediated within the assessment period. Spreading testing across the year converts remediation from an emergency into a plan.

Make evidence a byproduct. The question an auditor or a regulator asks is which transactions the control ran on and what happened to the exceptions. Controls that generate that record automatically answer it; controls that depend on someone remembering to document a review usually do not.

Track recurrence. Across 2021 to 2025, 36% of companies reporting a material weakness reported one in more than a single year. A defect log showing which weaknesses came back, and why, is the fastest read on whether remediation addressed the process or only the symptom.

Tooling follows scope. A comparison of internal control software sets out the options, and Supervizor's compliance solution tests the full transaction population across procure-to-pay, order-to-cash, and record-to-report, retaining the evidence of each test.

Conclusion

Section 404 is heading toward a split outcome: fewer companies under auditor attestation, more companies testing their own controls with no external opinion behind them. The management assessment under 404(a) survives either way. The operational problem it faces is already visible in the data, with in-scope systems rising from 17 to 40 between FY22 and FY24 while the automated share of controls fell from 21% to 17%.