SOX 404(a) vs 404(b): what changes when the auditor has to agree

Two obligations share a section number, and that shared number is the source of a good deal of confusion. Management's annual assessment of its own controls and the auditor's attestation on those same controls are less alike than the numbering suggests. One is a statement you make, reached on your own timetable and your own standard of comfort. The other is an opinion someone else forms about the same controls, using a standard you do not set and cannot negotiate.

Two obligations, not two halves of one

Section 404 of the Sarbanes-Oxley Act, codified at 15 U.S.C. § 7262, does two separate things.

404(a) requires the annual report to contain an internal control report stating management's responsibility for maintaining adequate internal control, and containing "an assessment … of the effectiveness of the internal control structure." Rule 13a-15(c) supplies the timing and the method: management evaluates the effectiveness of internal control over financial reporting as of the end of each fiscal year, based on "a suitable, recognized control framework that is established by a body or group that has followed due-process procedures." Item 308(a) of Regulation S-K sets out what the report says; Item 308(a)(3) sets the limit every program eventually meets — a material weakness has to be disclosed, and management cannot conclude that internal control over financial reporting is effective while one exists.

404(b) requires the registered public accounting firm that audits the financial statements to "attest to, and report on, the assessment made by the management." Item 308(b) is where the exclusions sit: the attestation report is required where the registrant is an accelerated filer or a large accelerated filer, other than a registrant that is an emerging growth company.

Who is in which

Two gates, and they operate independently of each other.

Filer status. Section 404(c) provides that 404(b) does not apply to an issuer that is neither a large accelerated filer nor an accelerated filer as defined in Rule 12b-2. Under that rule, an accelerated filer generally has public float held by non-affiliates of $75 million or more but less than $700 million, measured as of the last business day of the most recent second fiscal quarter; has been subject to Exchange Act reporting for at least twelve months; has filed at least one annual report; and is not eligible to use the smaller reporting company revenue test. A large accelerated filer is the same picture at $700 million or more. The SEC's 2020 amendments added the revenue carve-out: an issuer eligible to be a smaller reporting company with annual revenues of less than $100 million in the most recent fiscal year for which audited financial statements are available is excluded from both definitions.

Emerging growth company status. The statute says 404(b) does not apply to an issuer that is an emerging growth company, and Item 308(b) repeats it. Under 15 U.S.C. § 77b(a)(19), that status ends on the earliest of four events: the last day of the fiscal year following the fifth anniversary of the date of the first sale of common equity securities; total annual gross revenues reaching the statutory $1,000,000,000 threshold, which the Commission indexes for inflation every five years to the Consumer Price Index; issuing more than $1,000,000,000 in non-convertible debt over the prior three years; or becoming a large accelerated filer.

Note what that last event does. Crossing into large accelerated filer status ends emerging growth company status and satisfies the filer-status gate at the same moment — both doors close together.

Separately, a newly public company generally gets a transition year under Instruction 1 to Item 308, which excuses both paragraph (a) and paragraph (b) until it has been required to file, or has filed, an annual report for the prior fiscal year. Which fiscal year that lands on is its own question, worked through in the first-year SOX timeline.

What actually changes in the work

The auditor's side runs on PCAOB AS 2201, and four features of that standard drive most of the added effort.

The opinion is on the controls. AS 2201 requires the auditor to plan and perform the audit to obtain evidence sufficient to obtain reasonable assurance about whether material weaknesses exist as of the date specified in management's assessment, and to express an opinion on the effectiveness of internal control over financial reporting. The auditor is not grading your assessment process from a distance.

Walkthroughs. The standard describes following a transaction from origination through the company's processes, using the same documents and information technology that company personnel use. Narratives that describe an idealised process rather than the one that ran tend to come apart here.

Direct testing. A control has to be tested directly. Its effectiveness cannot be inferred from the absence of misstatements found by substantive procedures — which means "the numbers were right" is not evidence that the control worked.

Limits on using your work. The auditor may use work performed by internal auditors and others, but must assess their competence and objectivity, should not use the work of persons with a low degree of objectivity, and — the part that matters for planning — as the risk associated with a control increases, the need for the auditor to perform their own work on that control increases. Your highest-risk controls are precisely where your own testing buys the least relief.

The real difference is the evidence standard

In our view, this is what separates a 404(a)-only program from one ready for attestation, and it is rarely about having more controls.

Testing performed only to support management's own conclusion tends to stop once management is satisfied. Testing that has to survive someone else's re-performance has to answer harder questions: where did the population come from and how do you know it was complete; what was the threshold the reviewer applied and what happened when an item breached it; who performed the control, and did that person have the authority and competence the standard expects. Instruction 2 to Item 308 already requires a registrant to maintain evidential matter supporting management's assessment. Under 404(b), somebody reads it.

None of this is new work for a company that has run its SOX program as though an auditor would eventually look at it. It is a great deal of work for one that has not.

The IT layer shows it first, because system evidence is either retained or gone. Which controls draw attention earliest is set out in the ITGC scoping article.

Cost, transition, and the year you cross

The SEC put a number on the other direction of this trade. In the 2020 release narrowing the accelerated filer definitions, the Commission estimated annual savings of roughly $210,000 for an affected issuer no longer subject to the attestation requirement — about $110,000 of it a reduction in audit fees, and roughly $100,000 in other compliance costs. Treat that as the Commission's estimate for the issuers that rule moved out of 404(b), not as a quote for your own audit. And note what the release is careful to say about those issuers: they remain obligated to establish and maintain internal control over financial reporting and to have management assess its effectiveness. Only the attestation falls away.

Leaving the categories is deliberately stickier than entering them. The 2020 amendments raised the exit thresholds to $60 million of float for accelerated filer status and $560 million for large accelerated filer status, and added a revenue test to the transition provisions. One strong year does not put you in permanently, but one soft year does not take you out.

Because float is measured as of the last business day of the second fiscal quarter, a calendar-year company generally learns around mid-year whether the year already running is its first attestation year. That is a narrow window in which to build operating history, which is why the readiness work has to be under way before the measurement date settles the question rather than started once it has.

What to do before you cross

1. Work out, in writing, which gate closes first — filer status or the end of emerging growth company status — and put the expected date in front of the audit committee. Confirm it with your auditor and counsel rather than with a spreadsheet.
2. Pick one cycle this year and test it the way an auditor would. Full population, documented completeness, named performer, retained evidence. What that exercise finds is what the first attestation year would otherwise find.
3. Fix the retention problem before the testing problem. Controls you cannot evidence for a past period cannot be re-tested later, and no amount of effort creates history that was not kept.
4. Talk to your audit firm about scope a year early. Accounts, locations and in-scope systems are cheaper to settle before fieldwork than during it.

To work out which fiscal year to plan against, the SOX 404 deadline calculator lays the milestones back from your year-end, and the readiness scorecard will show which gaps are still fixable in the time you have. This is general information rather than audit or legal advice; confirm your filer status and its timing with your auditor or counsel.

Common questions

Is 404(b) simply 404(a) with an auditor signing off on it?

No. Under PCAOB AS 2201 the auditor expresses an opinion on the effectiveness of internal control over financial reporting itself, obtaining evidence sufficient for reasonable assurance about whether material weaknesses exist as of the date specified in management's assessment. That is an independent conclusion on the same subject matter, not a countersignature on yours.

We are an emerging growth company that just became a large accelerated filer. Are we still exempt from 404(b)?

Generally no, and this is where companies get caught. Becoming a large accelerated filer is one of the four events in the statutory definition of an emerging growth company that ends that status, and large accelerated filer status independently triggers the attestation requirement. Both gates close at once. Confirm the timing with your auditor and counsel.

If we are exempt from 404(b), do we still have to assess our own controls?

Yes. The SEC said as much when it narrowed the accelerated filer definitions in 2020: affected issuers remain obligated to establish and maintain internal control over financial reporting and to have management assess its effectiveness. Only the auditor attestation falls away.

When do we find out whether the current year is our first 404(b) year?

Filer status under Rule 12b-2 turns on public float measured as of the last business day of the most recent second fiscal quarter, so the measurement generally happens around mid-year for a calendar-year company. In practice that leaves the back half of the year to get ready, which is late to be starting.

Can our own testing reduce the amount of work the auditor does?

Partly, and least where it would help most. AS 2201 lets the auditor use the work of internal auditors and others after assessing their competence and objectivity, but the need for the auditor to perform their own work on a control increases as the risk associated with that control increases.

Does a material weakness affect the 404(a) report even without an auditor attestation?

Yes. Item 308(a)(3) of Regulation S-K requires disclosure of any material weakness, and management cannot conclude that internal control over financial reporting is effective while one exists. That constraint applies to every registrant in scope for 404(a), attestation or not.

Sources

1. 15 U.S.C. § 7262 — Management assessment of internal controls (Sarbanes-Oxley Act § 404), including subsections (b) and (c) · U.S. Government Publishing Office (United States Code)
2. 17 CFR 229.308 (Item 308 of Regulation S-K) — Internal control over financial reporting, with Instructions · U.S. Government Publishing Office (Code of Federal Regulations)
3. 17 CFR 240.12b-2 — Definitions, including accelerated filer and large accelerated filer · U.S. Government Publishing Office (Code of Federal Regulations)
4. 17 CFR 240.13a-15 — Controls and procedures · U.S. Government Publishing Office (Code of Federal Regulations)
5. Accelerated Filer and Large Accelerated Filer Definitions — SEC final rule, Federal Register, 26 March 2020 · U.S. Securities and Exchange Commission, via the Federal Register
6. 15 U.S.C. § 77b(a)(19) — Definition of emerging growth company · U.S. Government Publishing Office (United States Code)
7. AS 2201: An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements · Public Company Accounting Oversight Board