Contact us
Home › SOX 404(b) Changes: Why Accountability Still Matters

Insights & Resources

•

SOX 404(b) Changes: Why Accountability Still Matters

SOX 404(b) Changes: Why Accountability Still Matters

Filed under

    The U.S. Securities and Exchange Commission’s (SEC) proposed filer status changes could reduce SOX Section 404(b) auditor attestation requirements for many public companies if adopted as proposed. An equally important headline is what stays the same: management remains responsible for internal control over financial reporting (ICFR), executive certifications, audit committee reporting and financial reporting accuracy. Demonstrating effective controls could actually become harder, not easier.

    What the SEC Has Proposed

    The SEC is proposing simplifying public-company filers into two categories: large accelerated filers and non-accelerated filers. Additionally, the proposal would raise the large accelerated filer public-float threshold from $700 million to $2 billion and provide a five-year on-ramp for new registrants. As proposed, only large accelerated filers would be subject to external auditor attestation over ICFR under SOX 404(b). For all filers, management’s SOX requirements under SOX 404(a) remain unchanged.

    The comment period ended July 20, 2026. Until the SEC adopts a final rule and establishes an effective date or transition approach, companies should treat the proposal as an important planning signal rather than a reason to pause performance of controls or public-company readiness efforts.

    What the SEC’s Filer Status Proposal Means for SOX Compliance

    Less auditor attestation does not mean less accountability. It shifts more attention to how management supports its own ICFR conclusions.

    Organizations would still be responsible for:

    • Maintaining effective internal controls
    • Assessing ICFR effectiveness, typically through Internal Audit
    • Supporting executive certifications
    • Evaluating and reporting deficiencies
    • Providing reliable financial reporting

    Why Internal Audit Will Become More Important

    Companies should use the proposal to reassess their assurance model, rather than simply reduce testing.

    If auditor attestation requirements narrow, internal audit functions may become an even more important source of assurance.

    Management’s 404(a) assessment becomes more visible when external attestation is no longer required. Internal Audit should increase independent evaluations of control design, operating effectiveness, deficiency remediation and governance processes in higher-risk areas that may have been historically tested or challenged by the external auditor.

    This creates an opportunity to strengthen assurance programs rather than simply reduce testing. Organizations should consider whether current testing strategies, documentation and oversight processes provide Audit Committees with sufficient confidence in reporting outcomes when external attestation is not required.

    What This Means for Companies on a Path to Public

    Path-to-public companies should not wait for a final rule before building the controls, documentation and governance needed for public-company credibility.

    For companies preparing for an IPO or another public-company reporting environment, the proposal could create a false sense of timing relief. A longer runway before auditor attestation applies would not eliminate the need to build scalable controls, define control ownership, document key processes, establish governance routines and prepare management to defend ICFR conclusions.

    What Organizations Should Consider Now

    Reassess Assurance Models

    • Which controls are truly key?
    • Where has management historically relied on external auditors for challenge and validation?
    • How would confidence be maintained if external attestation reduces?

    Strengthen Internal Audit Readiness

    • Does Internal Audit have capacity to independently assess the design and operating effectiveness of additional critical controls?
    • Is Internal Audit positioned to provide assurance over areas where external auditors historically spent significant effort?
    • Are Audit Committee reporting practices sufficient if 404(b) requirements are reduced?

    Looking Ahead

    The SEC’s proposed filer status changes may alter who is required to obtain auditor attestation under SOX Section 404(b), but they do not change the need for effective internal controls or reliable financial reporting.

    The key question is not how much SOX can be eliminated; it is how organizations will maintain confidence in financial reporting if external assurance becomes less prevalent. Those that strengthen management ownership, optimize controls and enhance internal assurance will be better positioned regardless of the final outcome of the proposal.

    If you are evaluating the implications of the SEC’s proposed filer status changes, Frazier & Deeter can help assess the impact on ICFR, internal audit and governance programs. Connect with our Risk Advisory team to start the conversation.

    Talk to a specialist

    Contributors

    Cameron Mackenzie, Principal, Frazier & Deeter

    Bo Harmon, Principal, Frazier & Deeter

    Explore related insights

    Explore Insights & Resources