Newly public: the SOX obligations that start before 404 does

Ask when SOX starts for a newly public company and the honest answer is that most of it has already started. The transition period is real, and it is narrower than its reputation: it reaches two items in one filing — management's annual report on internal control over financial reporting, and the auditor's attestation on that report.

The rest of the Sarbanes-Oxley control apparatus is not covered by that relief. Parts of it apply in full from the first periodic report, parts phase in on clocks of their own, and parts turn on filer status rather than tenure. Those clocks start at effectiveness, before anyone convenes a 404 kickoff meeting.

What the transition period actually covers

Two provisions do the work.

Rule 13a-15(a) requires every issuer with a class of securities registered under Section 12 to maintain disclosure controls and procedures — and to maintain internal control over financial reporting only "if the issuer either had been required to file an annual report … for the prior fiscal year or had filed an annual report with the Commission for the prior fiscal year." The ICFR obligation is conditioned on prior-year reporting history. The disclosure controls obligation is not conditioned on anything.

Instruction 1 to Item 308 of Regulation S-K then says a registrant "need not comply with paragraphs (a) and (b) of this Item" until that same condition is met. Paragraph (a) is management's annual report on ICFR; paragraph (b) is the auditor's attestation. In their place, the first annual report carries a prescribed statement: that it does not include them "due to a transition period established by rules of the Securities and Exchange Commission for newly public companies."

Which fiscal year the relief runs out in turns on reporting history rather than the IPO date, and is worked through in the first-year SOX 404 timeline. What follows is everything the relief does not reach.

The certifications start with the first periodic report

Rule 13a-14(a) requires the certifications in each Form 10-Q, 10-K, 20-F or 40-F, signed by the principal executive officer and the principal financial officer. There is no transition period for the obligation itself.

There is one narrow accommodation inside the certification, and it is easy to over-read. Officers "may omit the portion of the introductory language in paragraph 4 as well as language in paragraph 4(b) of the certification that refers to the certifying officers' responsibility for designing, establishing and maintaining internal control over financial reporting for the issuer until the issuer becomes subject to the internal control over financial reporting requirements in § 240.13a-15 or § 240.15d-15." That is the whole of it: the disclosure controls language elsewhere in paragraph 4 stands, as does everything in paragraphs 1 to 3.

Then Section 906. Rule 13a-14(b) requires every periodic report containing financial statements to be accompanied by the certifications required by 18 U.S.C. 1350, furnished as an exhibit. That statute has no newly public carve-out. The officer certifies that the report "fully complies with the requirements of section 13(a) or 15(d)" and that its information "fairly presents, in all material respects, the financial condition and results of operations of the issuer." Knowingly certifying a report that does not comport with the requirements carries a fine of not more than $1,000,000 or imprisonment of not more than 10 years, or both; willfully, $5,000,000 or 20 years.

In our view this should reorder a first-year plan: the signatures come due long before a 404 program exists, so the disclosure committee, the sub-certification pack and the quarterly close evidence all have to be working in the first quarter as a filer.

Disclosure controls are evaluated every quarter

Rule 13a-15(b) requires management to evaluate the effectiveness of disclosure controls and procedures "as of the end of each fiscal quarter" for a domestic issuer, and Item 307 of Regulation S-K requires the registrant to disclose its principal executive and principal financial officers' conclusions on that effectiveness as of the end of the period covered by the report. That is an evaluation and a published conclusion every quarter, from the first report onward, with no transition relief attached.

And then the paragraph Instruction 1 leaves out — which cuts the other way. Instruction 1 suspends only paragraphs (a) and (b) of Item 308, so paragraph (c), the change disclosure, looks like it survives the relief intact. Read the chain, though: paragraph (c) covers a change in ICFR "identified in connection with the evaluation required by paragraph (d) of § 240.13a-15," and paragraph (d) addresses the management of each such issuer that either had been required to file, or had filed, an annual report for the prior fiscal year — the same condition that gates the ICFR obligation itself. In our view that is a question for counsel rather than one to settle from the text alone: what turns on it is whether remediation during the transition year is disclosable while it happens.

The audit committee clock runs from the effective date

Rule 10A-3 is not a reporting rule; it works through the exchanges. The rules of each national securities exchange "must prohibit the initial or continued listing of any security of an issuer that is not in compliance with the requirements of any portion of paragraph (b) or (c) of this section."

For an issuer listing in conjunction with an initial public offering, paragraph (b)(1)(iv)(A) phases the independence requirement in two steps: "all but one of the members" may be exempt from the independence requirements "for 90 days from the date of effectiveness of such registration statement," and "a minority of the members" may be exempt "for one year from the date of effectiveness." Read together, that is generally one independent member at listing, a majority after the first 90 days, and a fully independent committee by the first anniversary of effectiveness.

The rest of Rule 10A-3 is not phased in. The committee must establish procedures for receiving, retaining and treating complaints "regarding accounting, internal accounting controls, or auditing matters" and for "the confidential, anonymous submission by employees of the listed issuer of concerns regarding questionable accounting or auditing matters." It must have authority to engage independent counsel and other advisers as it determines necessary, and the issuer must provide appropriate funding for the auditor, for those advisers and for ordinary administrative expenses. A whistleblower channel nobody staffed is due on day one, not in the first assessment year.

The filing calendar you inherit

The first Form 10-Q is timed by Rule 13a-13 rather than by the ordinary cadence. It covers "the first fiscal quarter following the most recent fiscal year for which full financial statements were included in the registration statement" — or, where the registration statement carried qualifying interim financial statements, the quarter after the one reported on there. It is due within 45 days after the effective date of the registration statement, or on the date it would have been due had the issuer already been filing Form 10-Q as of its last fiscal quarter, "whichever is later."

After that the ordinary deadlines apply, and they tighten as the company grows. The SEC's 2005 rule revising the accelerated filer definitions and filing deadlines set the annual report at 90 days for non-accelerated filers, 75 days for accelerated filers and 60 days for large accelerated filers for fiscal years ending on or after 15 December 2006, and the quarterly report at 45 days for non-accelerated filers and 40 days for accelerated and large accelerated filers. The float thresholds behind those categories have been amended since, so confirm current filer status rather than working from inherited assumptions.

Which category you land in also decides whether the auditor attests, which is the other gate — set out in 404(a) versus 404(b). Worth keeping in view even if attestation never reaches you. When the Commission narrowed those definitions in 2020, it said affected low-revenue issuers "will remain obligated, among other things, to establish and maintain ICFR and have management assess the effectiveness of ICFR," and lose only the auditor's report on that assessment.

A sequence that works

This is our own working plan, not a schedule the SEC publishes; no rule sets the order, and your auditor's view will move it.

• At listing. Disclosure committee, sub-certification pack, whistleblower intake, audit committee charter, adviser funding. Live immediately.
• Through the transition year. Scope the significant accounts, locations and systems, and document the processes and IT general controls behind them. That documentation is what makes the quarterly disclosure controls conclusion defensible in the meantime.
• Once the gap list exists. Remediate early enough that the fixed control operates across a period, and settle the Item 308(c) question before you have to answer it in a filing.
• The year before the first assessment year. Management testing with full populations, named performers and retained evidence.

What to do next

1. Settle the first assessment year in writing with counsel, using reporting history rather than the IPO date, and ask the de-SPAC question explicitly if a shell was involved.
2. Keep two lists, staffed separately — what is due this quarter, and what is due in the first assessment year. They fail for different reasons.
3. Start evidence retention now for access reviews and change management. No later effort creates a history that was not kept.

The SOX 404 deadline calculator lays the milestones back from your year-end, and the readiness scorecard flags which gaps are still fixable. This is general information rather than audit or legal advice; confirm your filer status and your first assessment year with your auditor or counsel.

Common questions

Does the newly public transition period delay all of our SOX obligations?

No. Instruction 1 to Item 308 of Regulation S-K excuses paragraphs (a) and (b) of that item — management's annual report on internal control and the auditor's attestation — until the company has been required to file, or has filed, an annual report for the prior fiscal year. The certifications, the quarterly disclosure controls conclusion and the audit committee listing standards all sit outside that relief.

Do we file Section 302 and Section 906 certifications with our first Form 10-Q?

Generally yes. Rule 13a-14(a) requires the certifications in each Form 10-Q and Form 10-K, and Rule 13a-14(b) requires every periodic report containing financial statements to be accompanied by the certifications required by 18 U.S.C. 1350, furnished as an exhibit. Neither defers the obligation itself for a newly public company.

What can officers leave out of the certification before the first 404 year?

One narrow thing. Rule 13a-14(a) lets the principal executive and principal financial officers omit the portion of the introductory language in paragraph 4, and the language in paragraph 4(b), that refers to their responsibility for designing, establishing and maintaining internal control over financial reporting — until the issuer becomes subject to the internal control requirements in Rule 13a-15 or Rule 15d-15. The disclosure controls language and paragraphs 1 to 3 stand.

Do we have to disclose changes in internal control during the transition year?

Read the chain before assuming either answer. Instruction 1 to Item 308 suspends only paragraphs (a) and (b), so paragraph (c) is not on its face suspended. But paragraph (c) covers a change identified in connection with the evaluation required by paragraph (d) of Rule 13a-15, and paragraph (d) addresses the management of each such issuer that either had been required to file, or had filed, an annual report for the prior fiscal year — the same condition that gates the internal control obligation itself. Settle the position with counsel rather than from the text alone.

How quickly does the audit committee have to become fully independent after an IPO?

Rule 10A-3(b)(1)(iv)(A) exempts all but one member from the independence requirements for 90 days from the effective date of the registration statement, and a minority of members for one year from that date. Rule 10A-3 works through the exchanges' listing rules, so confirm the mechanics in your own exchange's standards.

When is our first Form 10-Q due after the offering?

Rule 13a-13 sets it. The first quarterly report is due within 45 days after the effective date of the registration statement, or on the date it would otherwise have been due had the issuer already been filing Form 10-Q as of its last fiscal quarter, whichever is later.

Sources

1. 17 CFR 240.13a-14 — Certification of disclosure in annual and quarterly reports · U.S. Government Publishing Office (Code of Federal Regulations)
2. 17 CFR 240.13a-15 — Controls and procedures · U.S. Government Publishing Office (Code of Federal Regulations)
3. 17 CFR 240.13a-13 — Quarterly reports on Form 10-Q · U.S. Government Publishing Office (Code of Federal Regulations)
4. 17 CFR 240.10A-3 — Listing standards relating to audit committees · U.S. Government Publishing Office (Code of Federal Regulations)
5. 17 CFR 229.307 (Item 307 of Regulation S-K) — Disclosure controls and procedures · U.S. Government Publishing Office (Code of Federal Regulations)
6. 17 CFR 229.308 (Item 308 of Regulation S-K) — Internal control over financial reporting, with Instructions · U.S. Government Publishing Office (Code of Federal Regulations)
7. 18 U.S.C. 1350 — Failure of corporate officers to certify financial reports (Sarbanes-Oxley Act section 906) · U.S. Government Publishing Office (United States Code)
8. Revisions to Accelerated Filer Definition and Accelerated Deadlines for Filing Periodic Reports — SEC final rule, Federal Register, 27 December 2005 · U.S. Securities and Exchange Commission, via the Federal Register
9. Accelerated Filer and Large Accelerated Filer Definitions — SEC final rule, Federal Register, 26 March 2020 · U.S. Securities and Exchange Commission, via the Federal Register