SOX 404: Who Needs the Auditor Attestation

SOX 404 is two obligations wearing one number, and confusing them is the most expensive mistake in the whole of Sarbanes-Oxley.

Section 404(a) requires management to assess the effectiveness of internal control over financial reporting. Section 404(b) requires an independent auditor to attest to and report on that assessment.

Every issuer does 404(a). Only some do 404(b) — and which group you fall into is decided by two numbers, not by how complex your business is.

Who needs the SOX 404 auditor attestation

SOX 404 obligations turn on filer status. On 12 March 2020 the SEC adopted amendments to the “accelerated filer” and “large accelerated filer” definitions in Rule 12b-2, effective 27 April 2020. Those amendments are what decide the question today.

The result, in the SEC’s own words: certain low-revenue issuers are not required to have management’s assessment of ICFR effectiveness attested to, and reported on, by an independent auditor as required by Section 404(b). But those issuers remain obligated to establish and maintain ICFR and, under Section 404(a), to have management assess its effectiveness.

The two numbers that decide it are public float, measured on the last business day of your most recently completed second fiscal quarter, and annual revenues in the most recent fiscal year for which audited financial statements are available.

The specific exclusion added in 2020: an issuer that is eligible to be a smaller reporting company and had annual revenues of less than $100 million is excluded from the accelerated and large accelerated filer definitions — and therefore from 404(b).

The SOX 404 thresholds that catch people out

Three details cause more confusion in SOX 404 scoping than the headline rule does.

Exiting a status uses different numbers from entering it. The 2020 amendments raised the transition thresholds: an accelerated filer becomes a non-accelerated filer below $60 million of public float, not $50 million, and a large accelerated filer exits that status below $560 million, not $500 million. Organisations that model only the entry thresholds get the timing of their exit wrong.

Smaller reporting company and accelerated filer are not mutually exclusive. Some smaller reporting companies are non-accelerated filers, and some are accelerated filers — a company with $75 million to under $250 million of float and revenues of $100 million or more is both an SRC and an accelerated filer, and does need 404(b).

There is a check box now. The amendments added a box to the cover pages of Forms 10-K, 20-F and 40-F indicating whether an ICFR auditor attestation is included in the filing. Your filer-status conclusion is stated on the front page of the annual report, where anyone can see it.

Business development companies have their own version of the test, using annual investment income in place of revenues, because BDCs are not eligible to be smaller reporting companies.

What SOX 404(a) requires either way

Exemption from the SOX 404 attestation is not exemption from the work. Management must still establish, maintain and assess ICFR, and the assessment has to rest on something.

• A recognised control framework. In practice this is COSO’s 2013 Internal Control — Integrated Framework, and COSO publishes transition guidance written specifically for SOX compliance.
• A defined scope — which entities, accounts, disclosures and processes are material enough to be in.
• Identified key controls mapped to the risks of material misstatement they address.
• Documented design and evidence that each control operated throughout the period.
• Deficiency evaluation — the discipline of classifying findings as a deficiency, a significant deficiency or a material weakness, and doing it consistently.
• A conclusion management is willing to sign.

Deficiency evaluation is where SOX 404(a)-only companies most often struggle, because there is no auditor forcing a consistent standard. A programme that has never concluded anything worse than “deficiency” is usually not applying the definitions.

Why the exemption is smaller than it looks

Being outside 404(b) removes an audit, not a system. Three pressures usually put the work back:

You may cross the SOX 404 threshold. Float and revenue move, and the control environment that supports an attestation takes far longer to build than the year of notice you get.

Investors and acquirers ask anyway. A diligence process does not care which SEC category you are in.

Section 302 does not go away. Certification obligations sit alongside 404 regardless of filer status.

How SOX 404 relates to other frameworks

Where to start with SOX 404

1. Determine filer status first — public float at the second-quarter date, revenues from the last audited year. It decides the cost of everything else.
2. Model the transition thresholds too, at $60 million and $560 million, not just the entry ones.
3. Pick and state your framework, which for nearly everyone is COSO 2013.
4. Scope by materiality, then identify key controls against risks of material misstatement.
5. Write the deficiency evaluation criteria down before you find anything.
6. Build ICFR as though 404(b) applied if you are anywhere near the thresholds.

This guide reflects the SEC’s small entity compliance guide on the accelerated and large accelerated filer definitions, as published, read at 15 August 2026. The guide summarises the rules and is not a substitute for the rule itself.

The SOX Compliance Toolkit provides 45 editable ICFR templates covering the scoping and materiality analysis, the risk and control matrices, control design and operating effectiveness testing, the deficiency evaluation records and management’s assessment.