SOX 404a vs 404b: The Complete 2026 Guide

Last updated 4 November 2026

SOX 404a vs 404b is two obligations wearing one number, and confusing them is the most expensive mistake in the whole of Sarbanes-Oxley. Section 404(a) requires management to assess the effectiveness of internal control over financial reporting. Section 404(b) requires an independent auditor to attest to and report on that assessment.

Every issuer does 404(a). Only some do 404(b) — and which group you fall into is decided by two numbers, not by how complex your business is.

SOX 404a vs 404b: the two obligations compared

	Section 404(a)	Section 404(b)
Who acts	Management, as a body	The registered public accounting firm
What is produced	Management’s annual report on ICFR, with a conclusion on effectiveness	An auditor’s opinion on the effectiveness of ICFR, in an integrated audit
Who it applies to	Every issuer filing periodic reports, with no exemption	Large accelerated filers, accelerated filers and certain smaller reporting companies
Who is exempt	Nobody	Non-accelerated filers, emerging growth companies, and smaller reporting companies with revenues under $100 million
Governing standard	A recognized control framework — in practice COSO 2013	PCAOB AS 2201, the audit of ICFR integrated with an audit of financial statements
Cost driver	Internal effort: scoping, documentation, testing, deficiency evaluation	External audit fee on top of all of the above
Consequence of a material weakness	Disclosed in management’s report as ICFR not effective	An adverse auditor opinion on ICFR alongside the disclosure

Read the SOX 404a vs 404b table in one direction and the point lands: 404(b) adds an auditor, not a requirement. The control system, the framework, the testing and the conclusion are all 404(a) obligations that exist whether or not anyone audits them.

Who needs the 404(b) auditor attestation

The SOX 404a vs 404b question turns entirely on filer status. On 12 March 2020 the SEC adopted amendments to the “accelerated filer” and “large accelerated filer” definitions in Rule 12b-2, effective 27 April 2020. Those amendments are what decide SOX 404a vs 404b today.

The result, in the SEC’s own words: certain low-revenue issuers are not required to have management’s assessment of ICFR effectiveness attested to, and reported on, by an independent auditor as required by Section 404(b). But those issuers remain obligated to establish and maintain ICFR and, under Section 404(a), to have management assess its effectiveness.

The two numbers that decide SOX 404a vs 404b are public float, measured on the last business day of your most recently completed second fiscal quarter, and annual revenues in the most recent fiscal year for which audited financial statements are available.

The specific exclusion added in 2020: an issuer that is eligible to be a smaller reporting company and had annual revenues of less than $100 million is excluded from the accelerated and large accelerated filer definitions — and therefore from 404(b).

The filer-status thresholds that catch people out

Three details cause more confusion in SOX 404a vs 404b scoping than the headline rule does.

Exiting a status uses different numbers from entering it. The 2020 amendments raised the transition thresholds: an accelerated filer becomes a non-accelerated filer below $60 million of public float, not $50 million, and a large accelerated filer exits that status below $560 million, not $500 million. Organizations that model only the entry thresholds get the timing of their exit wrong.

Smaller reporting company and accelerated filer are not mutually exclusive. Some smaller reporting companies are non-accelerated filers, and some are accelerated filers — a company with $75 million to under $250 million of float and revenues of $100 million or more is both an SRC and an accelerated filer, and does need 404(b).

There is a check box now. The amendments added a box to the cover pages of Forms 10-K, 20-F and 40-F indicating whether an ICFR auditor attestation is included in the filing. Your SOX 404a vs 404b conclusion is stated on the front page of the annual report, where anyone can see it.

Business development companies have their own version of the test, using annual investment income in place of revenues, because BDCs are not eligible to be smaller reporting companies.

How the 2026 SEC proposal would change SOX 404a vs 404b

On 19 May 2026 the SEC proposed to rebuild the filer-status framework entirely, in Release No. 33-11419 (File No. S7-2026-18). The proposal would eliminate the accelerated filer and smaller reporting company categories, raise the large accelerated filer public float threshold from $700 million to $2 billion, and exempt every non-accelerated filer from the 404(b) attestation. On the SEC’s own modeling, the share of registrants inside 404(b) would fall from 35.4% to 19.2%.

It is a proposal, not a rule. The comment period closed in July 2026 and the SEC’s rulemaking docket still lists it as proposed, so the thresholds above continue to govern. What it does change is the planning horizon: if you are an accelerated filer today purely because of the $700 million line, your attestation obligation may be temporary. Our guide to the SEC filer status changes sets out the proposed categories, the 60-month seasoning rule and the new small non-accelerated filer tier in full.

Nothing in the proposal touches 404(a). In the SOX 404a vs 404b split, every version of the rule leaves management’s own assessment where it is.

What SOX 404(a) requires either way

Whatever the SOX 404a vs 404b answer, exemption from the attestation is not exemption from the work. Management must still establish, maintain and assess ICFR, and the assessment has to rest on something.

• A recognized control framework. In practice this is COSO’s 2013 Internal Control — Integrated Framework, and COSO publishes transition guidance written specifically for SOX compliance.
• A defined scope — which entities, accounts, disclosures and processes are material enough to be in.
• Identified key controls mapped to the risks of material misstatement they address.
• Documented design and evidence that each control operated throughout the period.
• Deficiency evaluation — the discipline of classifying findings as a deficiency, a significant deficiency or a material weakness, and doing it consistently.
• A conclusion management is willing to sign.

Deficiency evaluation is where 404(a)-only companies most often struggle, because there is no auditor forcing a consistent standard. A program that has never concluded anything worse than “deficiency” is usually not applying the definitions. Our breakdown of material weakness versus significant deficiency sets out the criteria to write down before you find anything.

Why the 404(b) exemption is smaller than it looks

On the practical side of SOX 404a vs 404b, being outside the attestation removes an audit, not a system. Three pressures usually put the work back:

You may cross the threshold. Float and revenue move, and the control environment that supports an attestation takes far longer to build than the year of notice you get.

Investors and acquirers ask anyway. A diligence process does not care which SEC category you are in.

Section 302 does not go away. Certification obligations sit alongside 404 regardless of filer status, and they run quarterly rather than annually. Our comparison of SOX 302 vs 404 covers the two certifications and the one process that supports both.

How SOX 404 relates to other frameworks

Framework	Relationship
COSO	The criteria management assesses against. COSO 2013 is the framework in practical use, and its 1992 predecessor was superseded in December 2014
SOX compliance	The wider program and the ICFR cycle, covered in our step-by-step guide
ISO 27001	IT general controls sit underneath ICFR. An ISMS gives you access control, change management and operations evidence in an auditable form
COBIT 2019	Widely used to structure the IT general controls that SOX testing reaches

SOX 404a vs 404b: where to start

1. Determine filer status first — public float at the second-quarter date, revenues from the last audited year. It decides the SOX 404a vs 404b answer and the cost of everything else.
2. Model the transition thresholds too, at $60 million and $560 million, not just the entry ones.
3. Pick and state your framework, which for nearly everyone is COSO 2013.
4. Scope by materiality, then identify key controls against risks of material misstatement.
5. Write the deficiency evaluation criteria down before you find anything.
6. Build ICFR as though 404(b) applied if you are anywhere near the thresholds.

Frequently asked questions

SOX 404a vs 404b: what is the difference?

Section 404(a) is management’s own annual assessment of the effectiveness of internal control over financial reporting, and it applies to every issuer with no exemption. Section 404(b) is the independent auditor’s attestation to and report on that assessment, and it applies only to large accelerated filers, accelerated filers and certain smaller reporting companies. In the SOX 404a vs 404b comparison, 404(b) adds an external opinion on work that 404(a) already requires you to do.

Who is exempt from the 404(b) attestation?

Non-accelerated filers, emerging growth companies, and — under the 2020 amendments — issuers that are eligible to be smaller reporting companies and had annual revenues of less than $100 million in their most recent audited fiscal year. Those issuers remain fully subject to 404(a).

Does being exempt from 404(b) mean we can skip ICFR documentation?

No. Management still has to establish and maintain internal control over financial reporting and assess its effectiveness against a recognized framework. The documentation that disappears is the evidence produced purely to support an external auditor’s testing, not the control design, testing and deficiency records that underpin management’s own conclusion.

Does 404(a) apply to newly public companies in their first annual report?

SEC staff guidance has long provided that a newly public company need not include management’s report on ICFR until it has been required to file, or has filed, an annual report for the prior fiscal year. A company that was already an Exchange Act reporter before its IPO does not get that accommodation.

Will the SOX 404a vs 404b split change in 2026?

Possibly. The SEC’s May 2026 proposal would narrow 404(b) to large accelerated filers only, cutting the share of registrants inside it from 35.4% to 19.2%. It remains a proposal with no final rule, no compliance date and no transition guidance, so the current thresholds still apply.

This SOX 404a vs 404b guide reflects the SEC’s small entity compliance guide on the accelerated and large accelerated filer definitions, as published, read at 15 August 2026. The guide summarizes the rules and is not a substitute for the rule itself.

The SOX Compliance Toolkit provides 45 editable ICFR templates covering the scoping and materiality analysis, the risk and control matrices, control design and operating effectiveness testing, the deficiency evaluation records and management’s assessment.