Key Takeaways
- SOX 404(a) addresses management's assessment and reporting on internal control over financial reporting.
- SOX 404(b), when applicable, requires external auditor attestation.
- An exemption from 404(b) does not automatically remove management's obligations.
- Smaller reporting company status alone is not sufficient to determine whether auditor attestation is required.
What is the difference in responsibility?
Management is responsible for the company's controls and its assessment. External auditor attestation adds independent work and reporting when required; it does not transfer management's responsibility to the audit firm.
| Question | Section 404(a) | Section 404(b) |
|---|---|---|
| Who is responsible? | Company management | Independent external auditor |
| What is the focus? | Management's assessment and reporting on ICFR | Required auditor attestation on ICFR |
| Does it replace management's control ownership? | No | No |
| Does every company have the same timetable? | Applicability and transition rules matter | Filer status and exemptions also matter |
This is a high-level comparison for U.S. reporting-company planning, not a determination of a particular company's obligations.
Who may be exempt from 404(b)?
The SEC's filer and reporting status guidance explains the relationship between filer classifications and attestation. The SEC also describes an attestation exemption for emerging growth companies.
Do not use 'small company' or 'SRC' as a shortcut. The SEC's smaller reporting company guidance explains that an SRC can also be an accelerated filer. Initial classification, transition rules, and subsequent changes require careful evaluation.
Why is a company-specific timetable important?
Have finance leadership and securities counsel document the relevant status determination, reporting periods, transition provisions, and expected changes. Coordinate with the external auditor before assuming when the first attestation will be required. Avoid relying solely on a single public-float number without reviewing all applicable conditions.
This article intentionally does not provide a universal threshold calculator. The controlling definitions and the company's circumstances should drive the conclusion. Record the source and date used for the assessment.
What changes when external attestation applies?
The company should expect the external auditor to evaluate the evidence and perform procedures under the applicable standards. A management testing file may be useful input, but it is not automatically accepted as sufficient for the auditor's purpose.
Prepare clear control descriptions, scope rationale, populations, procedures, source evidence, results, and review history. Discuss timing and documentation needs early. Additional requests should be linked to the existing work so that the team does not lose track of which version supports which conclusion.
What does a control deficiency mean?
A test exception, a significant deficiency, and a material weakness are not interchangeable labels. Management and auditors evaluate the facts, severity, related deficiencies, and applicable reporting requirements. An adverse ICFR conclusion does not necessarily mean the financial statements contain a material misstatement.
PCAOB AS 2201 supplies the external-audit framework for these evaluations. Avoid claiming that every missing approval automatically requires a public disclosure or that software can prevent all adverse outcomes.
How to prepare without duplicating effort
Maintain a controlled RCM, clear testing periods, reliable evidence references, and a visible review process. Keep original exceptions connected to remediation and retesting. Separate management's assessment from the external auditor's independent evaluation even when both teams reference some of the same records.
IABuddy can support the SOX evidence and testing workflow. It does not determine filer status, provide a legal exemption, or issue an attestation opinion. Confirm applicability with qualified advisers and use the workspace to organize the work that follows.
Frequently asked questions
Are all smaller reporting companies exempt from SOX 404(b)?
No. SRC status and accelerated-filer status are distinct classifications, and some companies can be both. Review the SEC's current definitions and the company's circumstances before concluding that an exemption applies.
Does a 404(b) exemption mean a company can ignore internal controls?
No. An attestation exemption does not automatically remove management's internal-control and reporting responsibilities. Applicability and transition rules should be evaluated separately.
