ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
The SEC filer status changes proposed on 19 May 2026 would remove the auditor attestation on internal control over financial reporting from roughly four out of five public companies. That is not a tweak to a filing deadline. It is the widest change to the scope of Sarbanes-Oxley Section 404(b) since the 2020 revenue-test amendments, and it is still only a proposal — which means every SOX program currently has to plan for two possible worlds.
Here is what the proposal actually says, what it leaves alone, and what a finance team should do while the rule is pending.
By the SEC’s own description, public companies that file periodic reports are currently sorted into five partially overlapping filer statuses: large accelerated filers, accelerated filers, non-accelerated filers, smaller reporting companies and emerging growth companies. The overlap is the problem. Your filing deadlines come from one axis, your disclosure accommodations come from another, and the two do not line up.
| Filer status | Public float test | Form 10-K | Form 10-Q | 404(b) attestation |
|---|---|---|---|---|
| Large accelerated filer | $700 million or more | 60 days | 40 days | Required |
| Accelerated filer | $75 million to under $700 million | 75 days | 40 days | Required |
| Non-accelerated filer | Under $75 million | 90 days | 45 days | Not required |
| Smaller reporting company | Overlaps the three above | Follows filer status | Follows filer status | Only if also an accelerated filer and not an EGC |
| Emerging growth company | Overlaps the three above | Follows filer status | Follows filer status | Not required, up to five years after the IPO registration statement |
Two refinements already sit on top of that grid. The amendments the SEC adopted on 12 March 2020 excluded issuers eligible to be smaller reporting companies with annual revenues under $100 million from the accelerated and large accelerated filer definitions altogether, and therefore from 404(b). The same amendments raised the exit thresholds: an accelerated filer drops to non-accelerated status below $60 million of float rather than $50 million, and a large accelerated filer exits below $560 million rather than $500 million.
That is the structure the SEC filer status changes would collapse. If you need the current rules applied to your own numbers rather than the pending ones, our guide to SOX 404 and who needs the auditor attestation walks the existing float and revenue tests in order.
The proposal is Release No. 33-11419 (Exchange Act Release No. 34-105515), File No. S7-2026-18, issued on 19 May 2026 and published in the Federal Register two days later. The comment period ran for 60 days and closed in July 2026. Set side by side, the SEC filer status changes look like this.
| Element | Current rules | As proposed |
|---|---|---|
| Number of filer statuses | Five, partially overlapping | Two primary categories plus one sub-category |
| Large accelerated filer float threshold | $700 million | $2 billion |
| How float is measured | Last business day of the second fiscal quarter | Average price over the last 10 trading days of the second fiscal quarter |
| Persistence of the threshold | Single-year measurement | Must be met two years consecutively |
| Seasoning before large accelerated filer status | 12 months of reporting | 60 consecutive calendar months of reporting |
| Accelerated filer category | Exists | Eliminated |
| Smaller reporting company category | Exists | Eliminated |
| 404(b) auditor attestation | Large accelerated, accelerated and certain smaller reporting companies | Large accelerated filers only |
| Share of registrants inside 404(b) | 35.4% | 19.2% |
| Relief for the smallest filers | None beyond the 90-day 10-K | Small non-accelerated filers get 30 extra days on Form 10-K and five on Form 10-Q |
The sub-category is new and easy to miss. A small non-accelerated filer would be a company with total assets of $35 million or less for the two most recent years. On the SEC’s modeling, that bracket would capture 17.9% of public companies, or 22.2% of all non-accelerated filers.
Everything else in the SEC filer status changes is plumbing. The attestation is the money.
Under the proposal, every company that is not a large accelerated filer simply becomes a non-accelerated filer, and non-accelerated filers would not be required to obtain an auditor’s attestation on internal control over financial reporting. The SEC modeled the SEC filer status changes against the 5,976 registrants that filed on domestic forms in calendar year 2024: 19.2% would be large accelerated filers, down from 35.4% today, and 80.8% would be non-accelerated filers.
Read the float numbers next to the company numbers and the design intent is obvious. That 19% of registrants holds 93.5% of total public float; the remaining 81% holds 6.5%. The SEC proposes to keep the attestation where invested capital is concentrated and lift it everywhere else, rather than lowering the standard for everyone.
One caveat in the SEC’s own footnote deserves a read before anyone celebrates: 91 registrants, about 1.5% of the total, would become non-accelerated filers while co-filing with registrants that remain large accelerated filers, and may therefore stay implicitly subject to large accelerated filer deadlines. If you file jointly with a larger parent or affiliate, your nominal status may not govern your calendar.
The part of the SEC filer status changes that will surprise people is not the dollar figure. It is the clock.
Today a company can become an accelerated filer after 12 months of reporting and one filed annual report. Under the proposal, no company could become a large accelerated filer without at least 60 consecutive calendar months as a reporting company, regardless of how large its float is. Layer the two-consecutive-year float test on top and a business that lists at a $3 billion valuation would stay a non-accelerated filer, outside 404(b), for its first five years public.
That interacts directly with the emerging growth company on-ramp, which already shields qualifying issuers from the attestation for up to five years after their initial registration statement. For most newly public companies the two reliefs would simply run in parallel instead of the EGC clock expiring into an attestation requirement. Our post on SOX for newly public companies sets out the current IPO sequence that the proposal would stretch.
This is where SOX programs get into trouble, because an exemption from 404(b) reads like an exemption from the work and is not one.
Deficiency evaluation is the discipline that quietly degrades first. Without an auditor applying a consistent standard, the gap between a deficiency, a significant deficiency and a material weakness tends to widen in management’s favor. If the SEC filer status changes are adopted and your attestation falls away, that judgement becomes entirely yours — which is a reason to tighten the definitions, not relax them. Our breakdown of material weakness versus significant deficiency is the standard we would hold to either way.
You cannot plan against an unadopted rule, but you can stop being surprised by it. Six things are worth doing now.
The SEC published a three-page fact sheet on the proposal whose annex shows both proposed categories with their float and company percentages. It is the shortest authoritative summary available, and worth reading before any consultant’s interpretation of it.
No. The SEC filer status changes were issued on 19 May 2026 as a proposed rule, Release 33-11419, and the comment period closed in July 2026. The SEC’s rulemaking activity page still lists File No. S7-2026-18 as proposed. Until a final rule is adopted and a compliance date published, the current five-status framework and the existing 404(b) scope apply in full.
No, and this is the most common misreading. The SEC filer status changes would narrow Section 404(b) — the independent auditor’s attestation — to large accelerated filers only. Section 404(a), management’s own assessment of internal control over financial reporting, would continue to apply to every issuer exactly as it does today.
The category would disappear, but the accommodations would not. The proposal extends the disclosure scaling currently available to smaller reporting companies and emerging growth companies to all non-accelerated filers, which is a larger population than smaller reporting companies today.
Not under the proposal. You would need to meet the $2 billion threshold in two consecutive years, measured on a 10-day average, and to have completed 60 consecutive calendar months as a reporting company. Both conditions have to be satisfied.
Pausing is a bet on a proposal that may be amended before adoption. A more defensible position is to keep the program running and the evidence current, while identifying which parts of the file exist purely to support an external attestation — so you can scale back deliberately if and when the rule is finalized.
The honest summary is that the SEC filer status changes would hand most public companies a real reduction in external audit cost and no reduction at all in their underlying control obligation. Companies that treated 404(b) as the reason for their SOX program will have to rebuild the discipline the auditor was supplying. Companies that built the program for management’s own assessment will barely notice. Our SOX compliance cost breakdown separates the audit fee from the internal effort, and our guide to SOX compliance and ICFR readiness covers the five steps the proposal does not touch.
If you are building or tightening that program while the rule is pending, our Comprehensive SOX Compliance Toolkit provides 45 ICFR templates — risk and control matrices, control test plans, deficiency evaluation forms and management’s assessment documentation — for $99. They are written against Section 404(a), which is the obligation that survives either outcome.
October 25, 2026
October 24, 2026
October 24, 2026
October 23, 2026
October 23, 2026