ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
SOX compliance cost is decided by four things before anyone counts an hour: whether the company needs the section 404(b) auditor attestation or only management’s 404(a) assessment; whether it is in its first year, when the control environment is documented and tested from nothing, or in a steady-state year; how many significant accounts, locations and systems fall inside the scope; and how much of the work is done by internal staff rather than external advisers and co-sourced testers. The statute fixes none of the cost. Section 404(a) requires an annual internal control report; 404(b) requires the registered accounting firm to attest to management’s assessment, except for emerging growth companies and — under 404(c), added by Dodd-Frank — for issuers that are neither large accelerated nor accelerated filers; since the SEC’s 2020 amendments, a smaller reporting company with under $100 million in revenue is outside the accelerated-filer definition and therefore outside 404(b). What follows is our own estimate, labelled as such and built the way we build every cost guide on this site: the drivers, then the cost by company profile with the internal, external and audit components separated, then a worked example and the ways the total comes down. None of the figures are SEC or PCAOB figures.
| Driver | Effect | What you control |
|---|---|---|
| 404(a) or 404(b) | 404(b) adds the auditor’s integrated audit fee and raises the evidence standard management’s testing must meet | Filer status is set by public float and revenue, not by choice — but the timing of crossing a threshold can be planned |
| Year one or steady state | Year one includes risk assessment, documentation of every control, remediation of gaps and full testing; steady state reuses the documentation and tests a stable population | Starting before the first 404(b) year rather than in it |
| Scope | Significant accounts, processes, locations, systems and service organisations — each adds controls to document and test | Honest top-down scoping under AS 2201; consolidating locations and systems |
| Control mix | Automated controls tested once and benchmarked cost less than manual controls tested by sample every year | Automating key controls; reducing spreadsheet-based controls |
| Deficiencies | Remediation, re-testing and, for a material weakness, disclosure and the auditor’s additional work | Testing early enough to fix before year end |
| Staffing model | Internal SOX team versus external advisers and co-sourced testers at consulting day rates | Building internal capability after year one |
Our guide to SOX 404 covers the filer-status thresholds that decide the first driver; SOX scoping and materiality covers the third.
Year-one and steady-state estimates for three profiles, in US dollars, separating the internal programme (staff time at loaded cost), external advisory and testing, and the incremental audit fee for the integrated audit under 404(b). The ranges are typical for 2026 engagements with Big Four or national firms as auditor and a mix of advisers; a company using a Big Four firm for both advisory and audit-adjacent work sits at the top, one with a mature internal audit function at the bottom.
| Profile | Internal programme (year one) | External advisory and testing (year one) | Incremental integrated audit fee (404(b)) | Year-one total | Steady state per year |
|---|---|---|---|---|---|
| Smaller reporting company, 404(a) only, one location, one ERP | $150,000 – $350,000 (1–2 FTE plus process owners’ time) | $50,000 – $150,000 | None — no attestation | $200,000 – $500,000 | $120,000 – $300,000 |
| Accelerated filer, 404(b), 2–4 locations, one ERP plus sub-ledgers | $400,000 – $900,000 (2–4 FTE plus owners) | $150,000 – $500,000 | $200,000 – $600,000 | $750,000 – $2,000,000 | $500,000 – $1,200,000 |
| Large accelerated filer, 404(b), multinational, multiple ERPs | $1,500,000 – $4,000,000 (a SOX function) | $500,000 – $2,000,000 | $800,000 – $3,000,000+ | $2,800,000 – $9,000,000+ | $2,000,000 – $6,000,000 |
Two adjustments move a company within the range. A first-year company that has never documented its processes adds 30–50% to the internal and external lines for documentation and remediation. And a company with a recent material weakness adds the remediation programme and the auditor’s additional procedures, which can double the external line for the year. Our guide to material weakness vs significant deficiency covers what a weakness costs beyond the fee.
| Activity | Share of programme cost (our estimate) | Why |
|---|---|---|
| Scoping and risk assessment | 5–10% | Top-down identification of significant accounts, locations, processes and systems; fraud risk assessment |
| Documentation: narratives, flowcharts, control matrices | 15–25% in year one; 5% in steady state | Every in-scope process and control; the largest year-one item |
| Control testing — business process controls | 25–35% | Design walkthroughs and operating effectiveness samples across the period; our guide to SOX control testing covers the volumes |
| Control testing — IT general controls | 10–20% | Access, change, development and operations controls across in-scope systems; our guide to SOX ITGC covers the domains |
| Remediation and re-testing | 10–30% in year one | Gaps found in testing; highest where processes were undocumented |
| Deficiency evaluation, reporting, 302 and 404 certification support | 5–10% | Severity assessment, audit committee reporting, disclosure |
| Tooling | 3–8% | GRC platform, evidence management; optional for small programmes |
A newly accelerated filer, $400 million revenue, three locations, one ERP plus a revenue system and payroll SaaS, first 404(b) year, mixed internal and co-sourced team, Big Four auditor — our estimate, illustrative only:
| Line | Basis | Estimate |
|---|---|---|
| Internal SOX team | 3 FTE at $180,000 loaded | $540,000 |
| Process owner and IT time | ~1,200 hours at $110 loaded | $132,000 |
| External advisers — scoping, documentation, remediation support | 900 hours at $275 | $247,500 |
| Co-sourced testing | 1,400 hours at $200 | $280,000 |
| GRC tooling | Annual licence | $45,000 |
| Incremental integrated audit fee | Auditor’s ICFR opinion | $420,000 |
| Year-one total | $1,664,500 | |
| Steady state, year two | Team 2.5 FTE, testing 1,000 hours, advisers 200 hours, audit fee $380,000 | $1,150,000 |
How much does SOX compliance cost?
Our estimate: $200,000–500,000 in year one for a smaller reporting company under 404(a) only; $750,000–2 million for an accelerated filer with the 404(b) attestation; $2.8–9 million or more for a large accelerated multinational — falling by roughly a third to a half in steady state. The statute sets no fee; scope, filer status and staffing decide it.
Does 404(b) double the cost?
It adds the auditor’s integrated audit fee and raises the evidence standard, which together typically add 50–100% to a 404(a)-only programme of the same scope.
What is the biggest cost in year one?
Documentation and remediation: writing narratives, flowcharts and control matrices for every in-scope process, then fixing the gaps testing finds. Steady-state years drop both.
Can a small company avoid the auditor attestation?
Under 404(c) and the SEC’s 2020 amendments, an issuer that is neither a large accelerated nor an accelerated filer — including a smaller reporting company with under $100 million in revenue — is exempt from 404(b), and emerging growth companies are exempt for their EGC period. Management’s 404(a) assessment and the 302 certifications still apply.
What reduces the cost most?
Honest top-down scoping, automating and benchmarking key controls, testing early so deficiencies are fixed before year end, and building an internal team after the first year.
Budget the SOX compliance cost from its four drivers — attestation or not, first year or steady state, the scope of accounts, locations and systems, and who does the work — and reduce it where the standard lets you: scope top-down, automate and benchmark, keep the control count to key controls, test early, agree reliance with the auditor and bring the capability in-house, because the statute fixes the obligation and leaves every dollar of the cost to how the programme is designed.
The SOX programme plan and budget model, the scoping and risk assessment workbook, the control matrix and narrative templates, the test plans and the deficiency evaluation template are in the SOX Compliance Toolkit, or start with the free templates.
September 21, 2026
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026