First year public: the SOX 404 timeline nobody hands you

Nobody hands a newly public company a calendar for Section 404. The obligation is real, the dates are derivable, and the work behind them is neither obvious nor small. Here is the timeline to work from — and, first, the question most companies get wrong.

Which year does this actually apply to?

Section 404(a) requires management to assess and report on the effectiveness of internal control over financial reporting. Section 404(b) requires the external auditor to attest to it. The question is when the first one bites.

The answer does not turn on your IPO date. Instruction 1 to Item 308 of Regulation S-K reads:

"A registrant need not comply with paragraphs (a) and (b) of this Item until it either had been required to file an annual report pursuant to section 13(a) or 15(d) of the Exchange Act for the prior fiscal year or had filed an annual report with the Commission for the prior fiscal year."

Three things follow, and each one catches somebody:

1. The relief covers both paragraphs — (a) and (b). The first annual report generally carries neither management's report nor the auditor's attestation. Instead it carries a prescribed statement saying so, "due to a transition period established by rules of the Securities and Exchange Commission for newly public companies."
2. The test is prior-year reporting history, not recency of listing. A company whose equity IPO is its first listed offering but which already filed a Form 10-K — reporting under Section 15(d) from an earlier registered debt offering, say, or having registered on Form 10 — has already filed an annual report for the prior fiscal year, and does not get the relief.
3. A de-SPAC is generally not a newly public company. The registrant is the SPAC, which has been reporting for some time. SEC staff has addressed this directly in Regulation S-K C&DI 215.02: the surviving issuer in a reverse acquisition "is not a 'newly public company'." The staff said it would not object to the surviving issuer omitting management's assessment in the Form 10-K covering the fiscal year the transaction closed — but that is a conditional staff accommodation, it does not apply where the transaction closes shortly after year-end and an amended Form 8-K updates the year-end financials, and it does not relieve the Section 302 certification language.

If you went public through a merger with a shell, assume you are a year earlier than the IPO-based arithmetic suggests until securities counsel tells you otherwise.

What 404 actually requires

404(a), every year, for everyone in scope. Rule 13a-15(c) requires management to evaluate the effectiveness of ICFR as of the end of each fiscal year, and Item 308(a) requires the report to state management's responsibility, identify the framework used, and give the assessment.

Two provisions inside that are worth pinning up:

• You cannot conclude "effective" with a material weakness outstanding. Item 308(a)(3): "Management is not permitted to conclude that the registrant's internal control over financial reporting is effective if there are one or more material weaknesses."
• You have to be able to show your work. Instruction 2 to Item 308: "The registrant must maintain evidential matter, including documentation, to provide reasonable support for management's assessment."

The framework is your choice, within limits. Rule 13a-15(c) requires "a suitable, recognized control framework that is established by a body or group that has followed due-process procedures, including the broad distribution of the framework for public comment." It does not name COSO. Almost everyone uses COSO. The rule also provides that an evaluation conducted in accordance with the SEC's 2007 interpretive guidance — Release 33-8810, which sets out a top-down, risk-based approach — will satisfy the requirement.

404(b) depends on filer status, and on not being an EGC. Item 308(b) requires the auditor's attestation where the registrant is an accelerated or large accelerated filer and is not an emerging growth company. Both gates matter: an EGC that is a large accelerated filer still has no attestation requirement.

A correction worth making, because it appears everywhere. "Smaller reporting companies are exempt from 404(b)" is wrong as written. The exemption attaches to non-accelerated filer status. The two categories overlap but are not the same: a smaller reporting company with a float between $250 million and $700 million and revenues of $100 million or more is an accelerated filer, and 404(b) applies to it. The 2020 amendments in Release 34-88365 widened who qualifies as non-accelerated — describing the result as issuers that "will remain obligated … to establish and maintain ICFR and have management assess the effectiveness of ICFR, but they will not be required to have their management's assessment … attested to, and reported on, by an independent auditor." Check status against Rule 12b-2 each year.

The four things that have to exist

1. A documented control environment. Entity-level controls: who approves what, how the board oversees, how issues are escalated.
2. Process-level documentation for every significant account and disclosure — flowcharts or narratives that show where a number can go wrong and what stops it.
3. IT general controls over the systems those processes depend on: access, change management, operations. This is where most first-year findings live, and it is a defined term — the AICPA's SAS No. 145 defines general IT controls and lists user-access reviews, provisioning, deprivileging and change migration among them.
4. Evidence that the controls operated — not just existed — for the period under assessment. See Instruction 2 above; this is the part that cannot be reconstructed at the end.

Where companies run out of time

• ITGCs are discovered late. Finance owns SOX; IT owns the systems. The gap between them is where the exceptions are.
• Remediation has a lag. A control fixed in month ten only has two months of operation to test. This is the single most common reason a first-year assessment lands badly: not that the gap was unknown, but that it was closed too late to demonstrate operation.
• Spreadsheets count. If a material number lives in Excel, that spreadsheet is information used in a control and needs controls of its own.
• Turnover. The person who designed the control leaves; the evidence leaves with them.

A working calendar

This is a practitioner calendar — our working plan, not a schedule published by the SEC or the PCAOB. No rule sets these intervals. Your auditor's plan and your own complexity will compress or extend them, and if you are in 404(b) the auditor's own timetable under PCAOB AS 2201 will shape the back half.

Months before year-end	What should be done
12+	Scoping: significant accounts, locations, systems
9–12	Process and ITGC documentation; walkthroughs; gap list
6–9	Remediation of design gaps; controls begin operating
3–6	Management testing; fix operating failures while there is still runway
0–3	Auditor fieldwork; roll-forward testing

The shape matters more than the specific months: everything that has to operate has to start early enough to be tested, and management's own testing has to leave room to fix what it finds.

What to do first

1. Settle which fiscal year is your first assessment year, in writing, with counsel — using reporting history, not the IPO date, and with the de-SPAC question asked explicitly.
2. Name one person accountable for ITGC evidence across every in-scope system. Finance and IT each assuming the other has it is the most reliable source of first-year exceptions.
3. Start the access-review and change-management evidence now, whatever month you are in, because those controls have to operate across a period and no amount of later effort creates history.

If you are reading this partway through the year, the SOX 404 deadline calculator works out which year-end to plan against and lays the milestones back from it, and the readiness scorecard will tell you which gaps are still fixable in time.

Common questions

Does my first annual report after the IPO need a management report on internal control?

Generally no. Instruction 1 to Item 308 of Regulation S-K says a registrant need not comply until it has either been required to file, or has filed, an annual report for the prior fiscal year — and the relief covers both management's report and the auditor attestation. The first annual report carries a prescribed statement explaining the omission instead.

Does that relief apply to a de-SPAC?

Generally not, and this is the most expensive misunderstanding in this area. The registrant in a de-SPAC is the SPAC, which already has a reporting history, so the surviving company is not a newly public company. SEC staff has said it would not object to omitting management's assessment for the fiscal year the transaction closed, but that is a conditional staff position rather than an entitlement — and it is unavailable where the deal closes shortly after year-end and an amended Form 8-K updates the year-end financials.

Are smaller reporting companies exempt from the auditor attestation?

Not as such — the exemption attaches to non-accelerated filer status, not to smaller reporting company status, and the two are not the same. A smaller reporting company with a public float between $250 million and $700 million and annual revenues of $100 million or more can be an accelerated filer, and then 404(b) applies. Check filer status against Rule 12b-2 rather than assuming.

Which control framework do we have to use?

The rule does not name one. Rule 13a-15(c) requires the evaluation to be based on a suitable, recognized control framework established by a body that followed due process including public comment. COSO's Internal Control — Integrated Framework is the one almost everyone uses, and the SEC's 2007 interpretive guidance in Release 33-8810 describes an approach that satisfies the evaluation requirement.

What happens if we find a material weakness?

Management cannot conclude that internal control over financial reporting is effective. Item 308(a)(3) is explicit: management is not permitted to reach an effective conclusion if one or more material weaknesses exist, and the weakness has to be disclosed. This is why finding problems in month ten rather than month three matters so much.

Sources

1. Sarbanes-Oxley Act § 404, codified at 15 U.S.C. § 7262 — Management assessment of internal controls · Office of the Law Revision Counsel, U.S. House of Representatives
2. 17 CFR 229.308 (Item 308) — Internal control over financial reporting, including the Instructions to Item 308 · Electronic Code of Federal Regulations
3. 17 CFR 240.13a-15 — Controls and procedures · Electronic Code of Federal Regulations
4. 17 CFR 240.12b-2 — Definitions (accelerated filer, large accelerated filer, smaller reporting company) · Electronic Code of Federal Regulations
5. Commission Guidance Regarding Management's Report on Internal Control Over Financial Reporting (Release No. 33-8810) · U.S. Securities and Exchange Commission
6. Division of Corporation Finance, Compliance and Disclosure Interpretations: Regulation S-K — see Question 215.02 on reverse acquisitions · U.S. Securities and Exchange Commission
7. Accelerated Filer and Large Accelerated Filer Definitions (Release No. 34-88365) · U.S. Securities and Exchange Commission
8. AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements · Public Company Accounting Oversight Board