What Is Section 404 of SOX? Requirements, Penalties, and Costs

Section 404 of SOX is the part of the Sarbanes-Oxley Act that makes every public company build a system of internal controls over financial reporting, have management assess whether that system works, and, for larger companies, have the outside auditor independently verify management’s conclusion. The rule has two halves. Section 404(a) puts the assessment obligation on management and applies to every SEC-registered filer. Section 404(b) adds an independent auditor attestation and applies only to bigger companies.¹ Congress added the section in 2002 after the Enron and WorldCom accounting frauds, and it has been the single most scrutinized compliance obligation in U.S. securities law ever since.

What the Statute Requires

Section 404(a) directs the SEC to require an “internal control report” in every annual report filed by a public company. The report has to acknowledge that management is responsible for building and maintaining adequate internal controls over financial reporting, and it has to contain management’s own conclusion about whether those controls were effective as of the last day of the fiscal year.¹

Section 404(b) layers on the external check. The same accounting firm that audits the financial statements must also examine management’s internal control assessment and issue its own report on it. The attestation follows standards set by the Public Company Accounting Oversight Board and cannot be performed as a separate engagement from the financial statement audit.¹ The auditor is meant to look at internal controls while auditing the numbers, not treat compliance as a side project.

Who Has to Comply

Every company that files annual reports with the SEC under the Securities Exchange Act must comply with Section 404(a). There is no size exemption from the management assessment. If your company files a 10-K, management owes the internal control report.

Section 404(b) is where size starts to matter. The SEC sorts filers by public float (the market value of shares held by outside investors) and annual revenue, and those categories determine whether the outside auditor attestation applies.

Large accelerated filers, with a public float of $700 million or more, get the full Section 404(b) requirement and the shortest filing deadlines.²
Accelerated filers, with a public float between $75 million and $700 million, also must comply with 404(b) unless they qualify for the low-revenue carve-out.²
Non-accelerated filers, with a public float below $75 million, are exempt from the Section 404(b) auditor attestation entirely.²

In 2020 the SEC gave relief to smaller companies that technically qualified as accelerated filers but had modest revenues. A company that qualifies as a smaller reporting company and has annual revenue below $100 million is reclassified as a non-accelerated filer even if its public float would otherwise push it higher. Those companies do not need the Section 404(b) external audit.²

Newly public companies get a separate break. An emerging growth company (EGC) under the JOBS Act is exempt from Section 404(b) until the earliest of several triggers: the last day of the fiscal year in which annual gross revenue reaches $1.235 billion, the end of the fiscal year containing the fifth anniversary of the IPO, the date the company has issued more than $1 billion in non-convertible debt over the prior three years, or the date it becomes a large accelerated filer.³ Once any of those thresholds is crossed, the company must begin complying with Section 404(b) for its next annual report.

What Management Must Do Under Section 404(a)

The internal control report in the 10-K is the visible output, but the work happens all year. Management must identify the financial reporting risks that matter most, design controls to address those risks, document how the controls operate, and test whether they actually worked during the period.

The SEC’s 2007 interpretive guidance made clear that management does not need to document every control in every process. The agency endorsed a top-down, risk-based approach: start with the financial statements, identify where material misstatements are most likely, and focus testing there. If an entity-level control adequately addresses a particular risk, management does not need to test every transaction-level control beneath it.⁴ That guidance was a deliberate attempt to reduce compliance costs, especially for smaller filers.

The final report must state that management is responsible for the company’s internal controls, reach an explicit conclusion about whether those controls were effective at year-end, and identify the framework management used for the evaluation.⁵ The SEC does not mandate a specific framework, but nearly every registrant uses the COSO Internal Control–Integrated Framework, updated in 2013, which organizes internal controls into five components (control environment, risk assessment, control activities, information and communication, and monitoring activities) supported by 17 underlying principles that all must be present and functioning.

How Section 302 Fits In

Section 404 does not stand alone. Section 302 of SOX requires the CEO and CFO to personally certify every quarterly and annual report filed with the SEC. Those certifications state that the signing officers designed the company’s internal controls, evaluated their effectiveness within 90 days of the filing, and presented their conclusions in the report.⁶

Section 302 also requires the CEO and CFO to disclose to the auditors and audit committee any significant deficiencies in the control design, any material weaknesses, and any fraud involving employees with a role in the internal control system.⁶ Where Section 404 creates an annual assessment, Section 302 keeps executives engaged with internal controls on a rolling quarterly basis.

What the Auditor Must Do Under Section 404(b)

For companies subject to Section 404(b), the external auditor performs what the profession calls an integrated audit and issues two opinions in one engagement: one on the financial statements and one on the effectiveness of internal controls over financial reporting.⁷ Evidence gathered while testing internal controls informs the auditor’s assessment of financial statement risk, and vice versa.

PCAOB Auditing Standard 2201 governs the work. The auditor uses a top-down approach, starting at the financial statement level, then drilling into significant accounts and disclosures to identify the controls that matter. The auditor tests whether those controls were properly designed and whether they operated effectively during the year. Management’s own assessment is a starting point, not a conclusion the auditor can adopt.

The audit report lands in one of three places. An unqualified opinion means internal controls were effective and no material weaknesses were identified. An adverse opinion means the auditor found at least one material weakness; that outcome is required whenever a material weakness exists, no matter how quickly the company plans to fix it. A disclaimer of opinion means the auditor could not gather enough evidence to reach any conclusion, usually because of a scope limitation.⁷ There is no qualified opinion for internal control audits under PCAOB standards.

The firm performing the attestation must be independent. SOX Section 201 bars the auditing firm from simultaneously providing the same client with bookkeeping, financial information systems design, appraisal and valuation services, actuarial services, internal audit outsourcing, management functions, or investment banking or brokerage services. Non-audit services that are not on that prohibited list still require pre-approval from the company’s audit committee.⁸

Material Weaknesses and Significant Deficiencies

The whole Section 404 exercise leads to one question: are there any material weaknesses? A material weakness is a deficiency in internal controls serious enough that there is a reasonable chance a material misstatement in the financial statements will not be caught in time.⁷ Under auditing standards, “reasonable chance” means the likelihood is at least reasonably possible, which is a lower bar than many people expect.

A significant deficiency is a control problem that is not severe enough to be a material weakness but still deserves the attention of those responsible for financial reporting oversight.⁷ Significant deficiencies must be communicated to the audit committee but do not trigger an adverse opinion and do not require disclosure in the 10-K. Material weaknesses must be publicly disclosed.

A material weakness disclosure is a public admission that the company’s financial reporting controls have a meaningful gap. Market reaction tends to be negative, and the disclosure can trigger increased regulatory scrutiny, higher audit fees in later years, and difficulty raising capital. Companies are expected to develop a remediation plan and report their progress in subsequent filings, though the SEC does not prescribe a specific timeline for the fix.

Criminal Exposure for False Certifications

Section 906 of SOX, codified at 18 U.S.C. § 1350, adds criminal penalties on top of the certification requirements. Every periodic report filed with the SEC must include a written certification by the CEO and CFO stating that the report fully complies with securities law and fairly presents the company’s financial condition.⁹

An executive who certifies a report knowing it does not comply faces a fine of up to $1 million, imprisonment for up to 10 years, or both. If the false certification was willful, the maximum penalties rise to a $5 million fine, up to 20 years in prison, or both.⁹ A knowing violation means the executive was aware the report did not comply. A willful violation requires intentional misconduct. These penalties attach personally to the officer, not to the company.

What Compliance Costs

Section 404 is expensive, and the burden falls harder on smaller companies. A 2025 Government Accountability Office analysis of SEC audit fee data from 2019 through 2023 found that companies subject to the Section 404(b) auditor attestation paid roughly 19% more in audit fees than exempt companies of similar size. The GAO also found that companies transitioning from exempt to non-exempt status saw a median increase of $219,000 (13%) in audit fees during the transition year, reflecting the added planning, control testing, and quality review the attestation requires.¹⁰

Audit fees are only part of it. Companies also spend on internal staffing, documentation, testing, and remediation. For large accelerated filers, total annual audit costs, including the Section 404(b) work bundled into the integrated audit, can run into the millions. For a company approaching the $75 million public float threshold, adding Section 404(b) is a real factor in decisions about growth and capital structure, and some companies have deliberately managed their public float below the threshold to avoid triggering the requirement.

1
Office of the Law Revision Counsel. 15 USC 7262 – Management Assessment of Internal Controls
2
U.S. Securities and Exchange Commission. Accelerated Filer and Large Accelerated Filer Definitions
3
U.S. Securities and Exchange Commission. Emerging Growth Companies
4
U.S. Securities and Exchange Commission. Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting
5
eCFR. 17 CFR 229.308 – (Item 308) Internal Control Over Financial Reporting
6
Office of the Law Revision Counsel. 15 USC 7241 – Corporate Responsibility for Financial Reports
7
Public Company Accounting Oversight Board (PCAOB). AS 2201 – An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements
8
U.S. Securities and Exchange Commission. Commission Adopts Rules Strengthening Auditor Independence
9
Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports
10
U.S. Government Accountability Office. Sarbanes-Oxley Act – Compliance Costs Are Higher for Larger Companies