The Sarbanes-Oxley Act, usually just called SOX, is a US federal law passed in 2002 in response to a wave of major accounting scandals, most notably Enron and WorldCom. Enron’s collapse alone wiped out billions in shareholder value and exposed how easily financial statements could be manipulated when internal oversight was weak and auditors weren’t independent enough to catch it.
Congress passed SOX to rebuild trust in public company financial reporting. It created new rules around corporate governance, auditor independence, executive accountability, and, most relevant to this guide, the internal controls a company uses to produce accurate financial statements.
Of the eleven titles in the Act, Section 404 has become the one companies talk about most, largely because it’s the most demanding and the most expensive to implement. It requires public companies to build, document, test, and maintain internal controls over financial reporting, commonly shortened to ICFR.
Key Takeaways
| Question | Short Answer |
| What is SOX? | A 2002 US federal law requiring public companies to maintain accurate financial reporting and strong internal controls |
| What does Section 404 require? | Companies must establish, document, and test internal controls over financial reporting (ICFR) |
| What’s the difference between 404(a) and 404(b)? | 404(a) is management’s own assessment of ICFR; 404(b) adds an independent auditor’s attestation on top of it |
| Who has to comply? | All companies registered with the SEC; 404(b) specifically applies to accelerated and large accelerated filers |
| Who’s exempt from 404(b)? | Non-accelerated filers and smaller reporting companies, under a permanent exemption created by the Dodd-Frank Act in 2010 |
| What framework do companies use? | Most use the COSO Internal Control Integrated Framework, built around five components and seventeen principles |
| What does it cost? | Large companies report average annual costs around $2 million to $2.3 million; smaller reporting companies, exempt from 404(b), typically spend far less |
| What happens if a company fails to comply? | Civil penalties from the SEC, and under Section 906, criminal fines and prison time for CEOs and CFOs who knowingly certify false financial reports |
Who Has to Comply with SOX
SOX applies to any company registered with the SEC, whether it’s a US domestic issuer or a foreign private issuer listed on a US exchange. There’s no blanket exemption from the Act itself, but several of its provisions scale down based on company size and filing status.
Broadly, companies fall into a few categories that determine exactly what’s required of them:
- Large accelerated filers. Public float of $700 million or more. Full 404(a) and 404(b) compliance.
- Accelerated filers. Public float between $75 million and $700 million. Full 404(a) and 404(b) compliance.
- Non-accelerated filers and smaller reporting companies. Public float below $75 million, or below $250 million under the SEC’s smaller reporting company definition. Required to comply with 404(a) only.
- Emerging growth companies (EGCs). Companies that went public within the last five years and meet certain revenue thresholds. Exempt from 404(b) during their EGC status window, similar to smaller reporting companies.
Private companies aren’t directly subject to SOX in the same way, but many still adopt SOX-style controls voluntarily, particularly if they’re planning an IPO, seeking private equity investment, or preparing to be acquired by a public company.
Section 404 Explained: 404(a) vs 404(b)
Section 404 splits into two distinct requirements, and mixing them up is one of the most common points of confusion for companies approaching compliance for the first time.
| Section 404(a) | Section 404(b) | |
| Who performs it | Company management | An independent, PCAOB-registered auditor |
| What it requires | Management’s own annual assessment of the design and operating effectiveness of ICFR | The auditor’s attestation on management’s assessment, plus their own independent opinion on ICFR effectiveness |
| Who it applies to | All SEC registrants | Accelerated filers and large accelerated filers only |
| Where it’s reported | Included in the annual Form 10-K | Included in the annual Form 10-K, alongside the 404(a) report |
| Relative cost | Lower, since it’s an internal process | Higher, as it requires a separate external audit engagement |
Under 404(a), a company’s CEO and CFO are responsible for identifying the key risks that could cause a material misstatement in the financial statements, documenting the controls designed to address those risks, testing whether the controls are actually working, and disclosing any material weaknesses they find.
Section 404(b) adds an extra layer: an outside auditor has to independently test those same controls and issue their own opinion, separate from management’s. This auditor cannot be the same firm handling the company’s internal audit function, since SOX also enforces strict auditor independence rules.
The COSO Framework
Most companies structure their internal controls around the COSO Internal Control Integrated Framework, published by the Committee of Sponsoring Organizations of the Treadway Commission. Using COSO isn’t legally mandatory, but it’s become the de facto standard, and the large majority of external auditors evaluate a company’s controls against it.
The framework is built around five interlocking components:
- Control Environment. The tone set by leadership around integrity, ethics, and accountability.
- Risk Assessment. Identifying and analyzing the risks that could prevent accurate financial reporting.
- Control Activities. The specific policies and procedures that address those risks, such as approval workflows and segregation of duties.
- Information and Communication. Making sure the right financial data reaches the right people at the right time.
- Monitoring Activities. Ongoing or periodic evaluations to confirm controls are still working as designed.
These five components break down further into seventeen principles that auditors use as a checklist when evaluating whether a company’s control environment genuinely supports reliable financial reporting, rather than just existing on paper.
Exemptions from Section 404(b)
The Section 404(b) auditor attestation requirement was the most expensive part of SOX from the start, and Congress eventually recognized that it placed a disproportionate burden on smaller companies. The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 made the exemption permanent for:
- Non-accelerated filers, meaning companies with a public float below $75 million.
- Smaller reporting companies, defined as companies with a public float below $250 million, or annual revenue below $100 million if public float can’t be determined.
It’s worth being precise about what this exemption does and doesn’t cover. Companies in these categories are exempt from the independent auditor’s attestation under 404(b), but they still have to comply with:
- 404(a), management’s own assessment of ICFR.
- Section 302, CEO and CFO certification of periodic reports.
- Section 301, audit committee independence and oversight requirements.
- Section 806, whistleblower protections.
Emerging growth companies get a similar break, but theirs is time-limited. EGC status typically lasts five years after an IPO, or ends earlier if the company’s revenue or public float grows past certain thresholds.
The SOX Section 404 Audit Process
For a company subject to both 404(a) and 404(b), the path to compliance generally follows a similar sequence, though the exact timeline depends heavily on how complex the organization is.
- Scope the ICFR program. Identify which business processes, systems, and locations are material to financial reporting and need to be in scope.
- Document key controls. Map out the controls already in place for each in-scope process, from journal entry approvals to IT access controls over financial systems.
- Perform a risk assessment. Identify where the biggest risks of material misstatement sit, and prioritize testing accordingly, an approach often called a top-down risk assessment.
- Remediate gaps. Fix or build controls where testing reveals weaknesses, well before the year-end assessment date.
- Test operating effectiveness. Confirm the controls aren’t just designed correctly but are actually functioning as intended, based on sampled evidence.
- Management’s assessment (404a). The CEO and CFO formally document their conclusion on ICFR effectiveness for inclusion in the 10-K.
- External auditor attestation (404b, if applicable). An independent PCAOB-registered auditor tests the same controls and issues their own opinion.
- File the annual report. Both the management assessment and, where required, the auditor’s attestation are included in the company’s Form 10-K.
- Repeat annually. SOX compliance isn’t a one-time project. Controls need continuous monitoring, and the assessment cycle repeats every fiscal year.
Companies preparing for an IPO are typically advised to start this process well in advance, often 12 to 18 months before their first fiscal year-end as a public company, to give themselves enough runway to build and test controls before the first attestation is due.
How Much Does SOX Compliance Cost
Costs vary enormously depending on company size, the number of systems in scope, and whether the company is already public or preparing to go public for the first time.
According to KPMG’s 2025 SOX survey, organizations reported an average annual SOX program cost of around $2.3 million, with an average of roughly 15,500 hours of internal and external effort. Costs have generally been rising year over year, driven partly by an increasing number of systems companies now bring into scope.
Smaller reporting companies, who are exempt from the 404(b) auditor attestation and only need to comply with 404(a), typically spend a fraction of that, since they’re not paying for a separate external audit of their controls on top of their existing financial statement audit.
| Company Type | Applicable Requirement | Typical Relative Cost |
| Large accelerated filer | 404(a) and 404(b) | Highest, often $2 million or more annually |
| Accelerated filer | 404(a) and 404(b) | High, scales with complexity and number of in-scope systems |
| Smaller reporting company | 404(a) only | Significantly lower, since no separate auditor attestation is required |
| Emerging growth company | 404(a) only, during EGC status | Lower during the exemption window, rising once EGC status ends |
Direct audit fees are only part of the picture. Many companies also budget for internal staff time, compliance software, external consultants during the early implementation years, and remediation work when testing uncovers control weaknesses.
What Happens If a Company Fails to Comply
SOX enforcement runs through three separate channels, and the consequences escalate quickly depending on what went wrong.
Civil penalties, enforced by the SEC, can include fines against the company, disgorgement of profits connected to the violation, and orders barring officers or directors from serving in similar roles at public companies again.
Criminal penalties under Section 906 apply personally to the CEO and CFO who sign a company’s financial certifications. If an executive knowingly certifies a report that doesn’t comply with SEC requirements, the penalty is a fine of up to $1 million and up to 10 years in prison. If the false certification is willful, meaning done with deliberate intent to deceive, the penalty rises to a fine of up to $5 million and up to 20 years in prison.
Document destruction under Section 802 carries its own criminal exposure, up to 20 years in prison for knowingly destroying or altering documents to obstruct a federal investigation, and specific requirements for auditors to retain workpapers for at least seven years.
These penalties are a big part of why SOX changed corporate behavior so significantly after 2002. Unlike most prior securities regulation, the personal criminal liability sits directly with the individuals signing the certifications, not just the company as an entity.
SOX vs SOC Reports: How They Fit Together
It’s easy to confuse SOX compliance with SOC reports, since both deal with internal controls, but they serve different purposes and often work together rather than replacing one another.
SOX Section 404 is a legal requirement tied to being a public company registered with the SEC. It focuses specifically on internal controls over financial reporting, and it’s mandatory, not optional, for companies that fall under it.
A SOC 1 report, by contrast, is a voluntary attestation issued by a CPA firm, typically obtained by a service organization whose systems affect a client’s financial reporting, such as a payroll processor or a cloud accounting platform. Many public companies actually rely on their vendors’ SOC 1 reports as part of their own SOX 404 evidence, since it demonstrates that outsourced processes are also under control.
A SOC 2 report covers a different set of criteria entirely, focused on data security, availability, and privacy rather than financial reporting, and it’s not something SOX itself requires. But a company going through SOX readiness will often already have much of the operational discipline SOC 2 also expects, since both rely on documented, tested, and monitored controls.
In short: SOX is the law a public company must follow, SOC 1 is often the evidence a public company collects from its vendors to help satisfy that law, and SOC 2 is a related but separate assurance report about data security that many of the same companies also pursue for commercial reasons.
Common Challenges
- Underestimating the timeline. Companies preparing for their first 404(b) audit often start too late, especially those going public through an IPO with a tight runway.
- Scoping too broadly or too narrowly. Bringing every system into scope wastes time and budget, while missing a genuinely material system creates real compliance risk.
- Manual, spreadsheet-heavy processes. A large share of SOX compliance hours still go toward manual documentation and testing, even though automated controls reduce both cost and error rates over time.
- Weak coordination between internal audit and external auditors. Redundant testing happens when the internal audit function and the external auditor aren’t aligned on scope and testing approach from the start.
- Treating year one as the finish line. SOX compliance is a recurring annual obligation, not a project with a defined end date, and controls need to keep working after the first successful audit, not just during it.
FAQs
What is the difference between SOX Section 404(a) and 404(b)?
Section 404(a) requires company management to assess its own internal controls over financial reporting. Section 404(b) adds an independent external auditor’s attestation on top of that assessment, and only applies to accelerated and large accelerated filers.
Is SOX compliance mandatory?
Yes, for any company registered with the SEC. There’s no way to opt out of SOX itself, though certain provisions like Section 404(b) are permanently exempted for smaller companies.
Who is exempt from Section 404(b)?
Non-accelerated filers with a public float below $75 million, and smaller reporting companies with a public float below $250 million, are permanently exempt from the 404(b) auditor attestation requirement under the Dodd-Frank Act. They still need to comply with 404(a).
What framework do auditors use to test SOX controls?
Most companies and auditors use the COSO Internal Control Integrated Framework, built around five components and seventeen principles, though COSO adoption itself isn’t a legal requirement.
What are the penalties for SOX non-compliance?
Penalties range from civil fines and officer bars enforced by the SEC, to criminal fines and prison time under Section 906 for CEOs and CFOs who knowingly or willfully certify false financial reports.
Do private companies need to comply with SOX?
Not directly, but many adopt SOX-style controls voluntarily when preparing for an IPO, private equity investment, or acquisition by a public company, since it demonstrates financial reporting maturity to investors and buyers.
How is SOX different from a SOC 1 or SOC 2 report?
SOX is a legal requirement for public companies focused on internal controls over financial reporting. SOC 1 and SOC 2 are voluntary attestation reports, with SOC 1 covering controls relevant to a client’s financial reporting and SOC 2 covering security, availability, and privacy controls.
Conclusion and Next Steps
Section 404 remains the most demanding part of SOX for most companies, largely because it asks for something harder than a one-time checklist: a control environment that keeps working, gets tested every year, and can withstand independent scrutiny. For companies approaching their first 404(b) audit, whether through an IPO or growth past the smaller reporting company thresholds, starting early and scoping carefully makes a bigger difference to cost and outcome than almost anything else in the process.
If you’re building out your internal control function ahead of a SOX readiness project, our guide to choosing an internal auditor is a useful next step, or explore vetted US audit firms experienced with SOX 404 engagements.