Internal Audit · Sarbanes-Oxley (SOX)
Sarbanes-Oxley Compliance Services
Readiness, Right-Sized Programs and 404(b) Transition Planning
The SEC proposed the most significant change to SOX reporting requirements in decades on 19 May 2026, and the comment period closed on 20 July 2026. If adopted, the proposal would collapse filer categories to two, raise the large accelerated filer threshold from 700 million dollars in public float to 2 billion, and limit external auditor attestation under Section 404(b) to large accelerated filers only. Management’s assessment under Section 404(a) does not change for anyone. Elevate Consult builds SOX programs that are right-sized for the filer status an organization actually holds, and plans for the one it may hold next.
2026 UPDATE
What the SEC proposed and what it means
Two filer categories instead of three
The proposal would simplify public company filers into large accelerated filers and non-accelerated filers, removing the middle accelerated filer category. The large accelerated filer public float threshold would rise from 700 million dollars to 2 billion, with a five year on-ramp meaning no company would reach large accelerated status within sixty months of its IPO.
404(a) is unchanged for every filer
Management’s own assessment of ICFR effectiveness remains a requirement regardless of filer status. Less external attestation does not mean less accountability: it shifts weight onto how management supports its own conclusion, and onto whatever internal assurance exists behind it.
PCAOB quality control changes affect 404(b) engagements indirectly
Registered audit firms must document and operate risk-based quality control systems under QC 1000 from 2026. The requirement does not apply to issuers directly, but audit procedures for 404(b) engagements sit under more rigorous firm-level oversight, which tends to surface in evidence expectations.
404(b) attestation would narrow substantially
Only large accelerated filers would remain subject to external auditor attestation over internal control over financial reporting. The SEC indicated that had the proposal been in effect at the time it was issued, roughly 80 percent of public companies would have qualified as non-accelerated filers, with the remaining fifth representing the large majority of total public float.
The proposal is not final
Until the SEC adopts a final rule with an effective date and transition approach, this is a planning signal rather than a reason to pause control performance or readiness work. Companies that step down in filer category still carry Section 404(a) and Section 302 in full.
What SOX actually requires
Three provisions, frequently conflated
Section 302 requires the CEO and CFO to certify each periodic filing, covering the accuracy of the financial statements and the effectiveness of disclosure controls. It applies quarterly and annually.
Section 404(a) requires management to assess and report annually on the effectiveness of internal control over financial reporting, using a recognized framework. The dominant framework is COSO 2013, which organizes control across five components and seventeen principles.
Section 404(b) requires the external auditor to attest separately to ICFR, conducted under PCAOB AS 2201. This is the provision the SEC proposal would narrow. Non-accelerated filers have always been exempt from it.
TWO TIERS
Control count, not control quality
SOX programs grow by accretion. Controls get added after a finding and rarely removed after the risk changes, in-scope systems multiply as the technology estate expands, and manual testing scales linearly with both. The result is a program that costs more each year while covering the same risks.
Rationalizing the control set and automating evidence collection are the two responses with the largest effect, and both require someone willing to defend removing a control rather than only adding one.
Section 302
All filers, quarterly and annually
CEO and CFO certification covering financial statement accuracy and the effectiveness of disclosure controls and procedures. Unaffected by the proposed filer status changes.
Section 404(b)
Accelerated and large accelerated filers today
External auditor attestation on ICFR under PCAOB AS 2201. The SEC proposal would limit this to large accelerated filers only, with the threshold raised to 2 billion dollars in public float.
PCAOB AS 2201
Governs the 404(b) attestation
The auditing standard the external auditor follows when attesting to ICFR. Its requirements drive much of what evidence a 404(b) company has to produce and retain.
Section 404(a)
All filers, annually
Management’s assessment of ICFR effectiveness using a recognized framework, included as the internal control report within the Form 10-K. Unaffected by the proposed changes.
COSO 2013 framework
The assessment basis
Five components and seventeen principles: control environment, risk assessment, control activities, information and communication, and monitoring activities. Documentation must align controls to the components rather than list them independently
Five year IPO on-ramp
Proposed
Under the proposal no company would reach large accelerated filer status within sixty months of its IPO, which changes the readiness calculus for companies currently planning a listing.
Our approach
Pragmatic, and sized to the obligation
Elevate builds SOX programs against the requirements that actually apply, which is a different exercise for a pre-IPO company, a newly public non-accelerated filer, and a large accelerated filer under 404(b).
Conformance with the current Standards
Work performed and documented so the function can state conformance with the Global Internal Audit Standards, including the evidence of conformance the Standards describe.
Risk-based planning
An audit plan built from the organization’s actual risk profile and strategic objectives rather than from last year’s plan with dates changed.
Findings that survive the conversation
Each finding stated with its condition, criteria, cause, effect and recommendation, with the criteria traceable to a standard, policy or regulation rather than to auditor preference.
Audit committee reporting
Ownership of the periodic risk assessment every applicable framework requires, and of the treatment decisions that follow from it.
Quality assessment readiness
Preparation for external quality assessment under the current Standards, including the gap review that should precede it.
Continuity across the engagement model
The same working papers, the same methodology and the same reporting structure whether the function is co-sourced or outsourced, so a change in staffing model is not a change in evidence.
ENGAGEMENT PHASES
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
GET STARTED
Ready to right-size your SOX program?
Whether the driver is a pre-IPO readiness assessment, a program that has grown past what the risk justifies, or planning for a change in filer status, Elevate Consult builds SOX compliance that meets the requirement without overinvesting in controls the obligation does not call for.
FAQ
Common Questions
What did the SEC propose to change about SOX?
On 19 May 2026 the SEC proposed simplifying public company filer categories into large accelerated filers and non-accelerated filers, raising the large accelerated filer public float threshold from 700 million dollars to 2 billion, and providing a five year on-ramp so no company reaches large accelerated status within sixty months of its IPO. As proposed, only large accelerated filers would be subject to external auditor attestation under Section 404(b). The comment period closed on 20 July 2026 and the proposal is not final.
If we become a non-accelerated filer, does SOX go away?
No. Section 302 certification and Section 404(a) management assessment apply to all filers regardless of category. What changes is the external auditor attestation under 404(b). The practical effect is that management’s own conclusion becomes the primary source of assurance, which raises rather than lowers the importance of how that conclusion is supported and documented.
When should a pre-IPO company start SOX readiness?
Typically eighteen to twenty four months before going public. The constraint is not documentation, which can be produced quickly. It is that controls need to operate for long enough to be tested, and remediation of a gap found late leaves no time for the remediated control to demonstrate operation before the first report. The proposed five year on-ramp would change the attestation timing but not the readiness timing.
What is the difference between 302, 404(a) and 404(b)?
Section 302 is the quarterly and annual CEO and CFO certification covering financial statement accuracy and disclosure controls. Section 404(a) is management’s annual assessment of internal control over financial reporting, included in the Form 10-K. Section 404(b) is the external auditor’s separate attestation on ICFR, conducted under PCAOB AS 2201, and it applies only to accelerated and large accelerated filers today.
Which framework should we use for the 404(a) assessment?
COSO 2013 is the dominant framework and the one external auditors expect. It organizes internal control across five components and seventeen principles, and documentation that maps controls to the principles is substantially easier to defend than a control list that stands on its own.
Why does our SOX program keep getting more expensive?
Because control sets grow and rarely shrink. Controls are added after findings and stay after the underlying risk changes, in-scope systems multiply as the technology estate expands, and manual testing effort scales with both. The two responses with the largest effect are rationalizing the control set against current risk and automating evidence collection. Both require someone with the standing to defend removing a control.