SOX 404 & internal control
We perform PCAOB integrated audits of internal control over financial reporting under AS 2201 and help smaller issuers understand what Section 404 requires of them and when. For companies that are not our audit clients, readiness work is available subject to an independence analysis.
Section 404 of the Sarbanes-Oxley Act has two parts, and they apply differently depending on your filer status. Getting the classification right is the first step, because it determines whether you need an auditor's opinion on internal control over financial reporting (ICFR) or only management's own assessment.
| Filer status (Exchange Act Rule 12b-2) | 404(a) management report | 404(b) auditor attestation |
|---|---|---|
| Large accelerated filer: public float of $700 million or more | Required | Required (unless an EGC) |
| Accelerated filer: public float of $75 million to under $700 million, and not an SRC under the revenue test | Required | Required (unless an EGC) |
| Non-accelerated filer, including SRCs that qualify under the revenue test | Required | Not required (SOX Section 404(c)) |
| Emerging growth company (EGC) | Required | Not required while EGC status lasts |
| Newly public company, first annual report | Not yet required | Not yet required |
A few points we see misunderstood:
Typical clients include OTC issuers crossing the $75 million float line, companies preparing an uplisting to Nasdaq or NYSE American, and EGCs approaching the end of their exemption.
How we can help depends on one question: are we, or will we be, your auditor?
A readiness assessment benchmarks your current controls against COSO 2013, identifies gaps, and gives management a prioritized list of observations to act on. We offer it only after an independence analysis, including any effect on a future audit relationship.
Independence note: An auditor cannot design or implement a client's internal controls or perform management functions. The SEC has stated that designing and implementing internal accounting controls impairs independence, and Rule 2-01 of Regulation S-X prohibits management functions. For any permissible ICFR-related non-audit service to an issuer audit client, PCAOB Rule 3525 requires us to describe the scope to the audit committee in writing, discuss the independence effects, and document that discussion. For audit clients, management owns remediation; we audit and report.
Management cannot conclude that ICFR is effective if one or more material weaknesses exist, and must disclose them in its report under Item 308(a). Item 308(c) also requires disclosure of material changes in ICFR during the fourth quarter, which is where remediation usually shows up. A credible remediation plan identifies the root cause, assigns owners, redesigns or adds controls, and lets the new controls operate long enough to be tested. If your prior auditor's work has been affected by PCAOB inspection or enforcement findings, see our PCAOB inspection remediation page.
Illustrative only. Your actual timeline depends on year-end, company size and control maturity, and is confirmed in your written proposal.
Independence checks, engagement letter, understanding of your filer status, scoping of significant accounts, locations and IT systems.
We walk through key processes and evaluate whether controls are designed to address the risks identified. Design deficiencies are raised early.
Testing of operating effectiveness for controls in place during the year, including IT general controls.
Update of interim testing to year-end, testing of the period-end close, and the substantive financial statement audit.
Severity evaluation, written communications to the audit committee, and issuance of the integrated audit report for your Form 10-K.
We agree a fixed fee in writing before fieldwork begins. The main drivers are:
See how we price, or our guide to PCAOB audit costs. We do not publish fee ranges: schedule a meeting so we can evaluate your company and present a formal proposal.
Asesoria Global, Sociedad Anónima is registered with the PCAOB (Firm ID 7184). You can check any firm's registration yourself; here is how.
The signing partner is involved from scoping through the evaluation of every deficiency, so severity judgments are made by the person who signs.
English and Spanish engagement teams work directly with controllers and process owners in Latin American operations.
Written scope and a week-by-week timeline in the proposal, independence checks before acceptance, and a reply to proposal requests within one business day. Smaller issuers can also see our small-cap audit approach.
FAQ
Generally no. An instruction to Item 308 of Regulation S-K lets a newly public company omit both management's ICFR report and the auditor's attestation until it has filed, or was required to file, an annual report for the prior fiscal year. The first 10-K must include a statement explaining that the transition period applies. The CEO and CFO certifications and disclosure-controls evaluation still apply.
Not automatically. The 404(b) attestation applies to accelerated and large accelerated filers. Since the 2020 amendments, a company that qualifies as a smaller reporting company under the revenue test (annual revenues under $100 million) is excluded from accelerated filer status, even with public float between $75 million and $700 million. A company that is an SRC only through the public float test may still be an accelerated filer.
Both are defined in Rule 1-02 of Regulation S-X and in AS 2201. A material weakness is a deficiency, or combination, creating a reasonable possibility that a material misstatement of annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe but still important enough to merit the attention of those overseeing financial reporting. Only material weaknesses must be publicly disclosed in management's report.
No. The SEC's independence rules treat designing and implementing internal controls as a management function that impairs independence. Your auditor can identify and communicate deficiencies and discuss them with management and the audit committee, but the company must own the design, documentation and remediation. Many issuers use internal staff or a separate advisor for that work.
Management must use a suitable, recognized framework, and most U.S. issuers use the COSO Internal Control - Integrated Framework (2013). The framework must be identified in management's report. When an auditor attestation is required, AS 2201 directs the auditor to use the same framework management used.
It depends on the root cause. A missing review control may be fixed within a quarter, while weaknesses tied to staffing, IT general controls or the financial close often take longer. Remediated controls generally need to operate for a sufficient period, and be tested, before management can conclude the weakness no longer exists at year-end.
In May 2026 the SEC proposed consolidating filer categories into large accelerated filers and non-accelerated filers and raising the large accelerated filer threshold (Release No. 33-11419). If adopted, fewer companies would need a 404(b) attestation. At our last review it remained a proposal, so the current Rule 12b-2 definitions still apply.
Keep reading
A registration number is the starting point, not the answer. This guide shows CFOs and audit committees how to use the PCAOB's own public databases and SEC EDGAR to check a prospective audit firm before signing an engagement letter.
There is no single price for a PCAOB audit. This guide explains what actually moves the fee, what a fixed-fee proposal should include, and how to benchmark what comparable companies pay using their own SEC filings.
