SOX 404 Deadline Calculator

When does your first SOX 404 assessment actually apply?

Not on the date you went public. This calculator works out the first fiscal year-end that management's Section 404(a) assessment plausibly applies to, then lays out a working first-year calendar backwards from it. It produces a year-end to plan against, not a filing deadline, and it does not determine your filer status.

How this calculator works

The starting point is the first fiscal year-end falling on or after your public-company date, which is taken as the period your first annual report covers. Entering the date that annual report was or will be filed pins the period down directly instead of deriving it.

One fiscal year is then added, and this is the single most consequential assumption made here: that the transition relief for newly public companies applies. Instruction 1 to Item 308 of Regulation S-K suspends both management's report and the auditor attestation until the registrant has either been required to file, or has filed, an annual report for the prior fiscal year. The legal test is that reporting history, not how recently the company listed — so a de-SPAC survivor, whose registrant is the SPAC, is generally not treated as a newly public company at all, and a company with a prior filed annual report does not get the relief either. Those companies have a first assessment year a full year earlier than this arithmetic produces, and nothing here can detect the case. It is the assumption to confirm with securities counsel before relying on any date.

Seven milestones are laid out backwards from the year-end being planned against: scoping at twelve months, the risk-control matrix at eleven, documentation and walkthroughs at nine, design testing at eight, remediation closing at six, management's operating-effectiveness testing at three, and the assessment itself at year-end. That spacing is a working practitioner calendar rather than a regulatory schedule, and an auditor's plan may compress or extend it.

Where the year-end that comes out of this is fewer than ninety days away, it is treated as too close to plan a first-year programme against. It is reported separately, along with the milestones that would already have passed, and the plan moves to the following year-end.

Filer status is read back, never determined. Whatever is selected is taken at face value and used only to phrase a caveated note on the Section 404(b) auditor attestation. It is never checked against the revenue or public float entered, and it changes no date, no milestone and no rating. That note carries a standing caveat that the SEC's May 2026 proposal, Release 33-11419, would eliminate the accelerated filer and smaller reporting company categories altogether; the calculator applies the rules as they stood when it was last reviewed rather than the proposal.

A separate ITGC reading comes from four answers: whether one person owns ITGC evidence, the state of access-review and change-management evidence, and how many financial systems are in scope. It is a nine-point heuristic over those four answers and nothing else. It says nothing about the calendar, the scoping, or the financial controls themselves.

A worked example

A company that priced its IPO on 1 May 2026, closes its books on 31 December, has not determined its filer status, and has nobody owning ITGC evidence across its ERP, payroll and billing systems. Run on 10 September 2026.

The first fiscal year-end on or after 1 May 2026 is 31 December 2026, and adding one fiscal year for transition relief gives 31 December 2027 — 477 days out, so that is the year planned against. The ITGC reading is high from seven of nine points: three for no named owner, one for partial access-review evidence, two for no change-management evidence, one for three systems in scope. Notice that the reading is high while the calendar is comfortable. Fifteen months is generous runway; the rating is about posture, not time.

Common questions

Is this my 10-K filing deadline?

No. It produces a fiscal year-end that management's first Section 404(a) assessment plausibly applies to. The filing deadline for the annual report itself, which depends on filer status, is not calculated anywhere in this tool.

Does it tell me whether 404(b) auditor attestation applies?

No. It takes the filer status you select at face value and reads back a caveated note on what that status generally means. Filer status is determined by SEC rules applied to your own numbers, and the calculator never checks your selection against the revenue or public float you enter.

What if the transition relief does not apply to us?

Then the year-end shown is a year late. The relief keys off whether a prior-year annual report was filed, not off the listing date, so a de-SPAC survivor — where the registrant is the SPAC, which has been reporting for some time — is generally not a newly public company. Nothing in the arithmetic detects that. Confirm it with securities counsel before planning against any date here.

Where does the milestone calendar come from?

It is a working first-year calendar written from practice, not a schedule published by a regulator or a standard-setter. Your auditor's plan and your own complexity may compress or extend every date in it.

Why does it read high urgency when I have over a year?

Because the reading reflects posture as well as time. No named ITGC owner combined with missing evidence reads high even with fifteen months of runway, since the evidence has to operate for enough of the period to be tested and every month without it shortens the testable window.