SOX 404(b) Auditor Attestation: 2026 Practitioner Walkthrough

SOX 404(b) Auditor Attestation: 2026 Practitioner Walkthrough

If your company is approaching the accelerated filer threshold, or you're preparing for your first integrated audit, the SOX 404(b) auditor attestation requirement is one of the most consequential compliance obligations you'll face. This walkthrough covers exactly who is subject to it, what the external auditor must do under PCAOB AS 2201, and how to run the integrated audit process without surprises.

Key takeaway: SOX 404(b) is not an extension of management's own 404(a) assessment. It is a separate, independent audit opinion on the effectiveness of your internal controls over financial reporting (ICFR). One material weakness means an adverse opinion, full stop.

Are You Subject to SOX 404(b) Auditor Attestation?

SOX 404(b), codified at 15 U.S.C. § 7262(b), requires the registered public accounting firm that audits your financial statements to separately attest to, and report on, management's ICFR assessment. Not every public company is in scope. Your filer category, measured as of the last business day of your second fiscal quarter (June 30 for calendar-year companies), determines whether you're subject to 404(b) for the following year's annual report.

Here's how the categories map to 404(b) obligations under SEC Rule 12b-2:

The most significant recent change is the 2020 SEC final rule (Release No. 33-10762), effective April 27, 2020, which removed from the accelerated filer category any SRC with annual revenues below $100 million. The SEC estimated this reclassified approximately 800 companies from accelerated to non-accelerated filer status, saving roughly $55.3 million in aggregate annual compliance costs. If your public float sits between $75 million and $700 million but your revenues are below $100 million and you qualify as an SRC, you are not subject to 404(b).

The non-accelerated filer exemption is statutory, not regulatory. The Dodd-Frank Act, Section 989G permanently wrote this into law in 2010, meaning the SEC cannot reverse it through rulemaking alone.

The EGC Exemption: When Does It Expire?

EGC status, created by the JOBS Act of 2012, exempts a company from 404(b) until the earliest of:

1. Five fiscal years after the IPO
2. Annual gross revenues reaching $1.235 billion or more (inflation-adjusted threshold)
3. Issuing more than $1 billion in non-convertible debt in the prior three years
4. Becoming a large accelerated filer

Companies often underestimate how quickly conditions 3 and 4 can trigger the loss of EGC status. If your public float crosses $700 million at June 30, you become a large accelerated filer for the following year, and the 404(b) exemption disappears with it. For a detailed timeline by filer type after an IPO, see SOX Compliance Timeline After an IPO: By Filer Type (2026).

The 2026 Regulatory Landscape: Could 404(b) Scope Shrink Further?

In May 2026, the SEC proposed Release No. 33-11419, which would limit 404(b) to large accelerated filers only and raise the large accelerated filer threshold from $700 million to $2 billion in public float. Under that proposal, only 19.2% of current public companies would remain subject to 404(b), down from 35.4% today. The proposal is not yet final. Companies near the accelerated filer threshold should monitor this rulemaking closely, but should not defer compliance planning on the assumption it will pass.

SOX 404(a) vs. 404(b): The Practical Difference

The confusion between these two subsections causes real compliance problems. Here's the distinction that matters in practice:

• 404(a): Management assesses the effectiveness of ICFR and reports on it in the annual 10-K. Required of all public companies. Governed by Rules 13a-15 and 15d-15 under the Exchange Act and Item 308 of Regulation S-K.
• 404(b): The external auditor independently audits ICFR and issues a separate opinion. Required only of accelerated and large accelerated filers. Governed by PCAOB AS 2201.

The auditor's opinion is not a review of management's process. As the PCAOB stated in the AS 2201 adopting release: "The auditor's attestation under Section 404(b) is not a review of management's process, it is an independent audit opinion on the effectiveness of internal control over financial reporting. The auditor must obtain sufficient evidence to support that opinion, regardless of what management has concluded."

For a side-by-side comparison of 404(a) and 404(b) with the SOX 302 certification, see SOX 302 vs 404 Certification: The Complete Comparison Guide.

What PCAOB AS 2201 Actually Requires the Auditor to Do

PCAOB Auditing Standard No. 2201 (AS 2201), "An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements," is the operative standard. It mandates a top-down, risk-based approach. Here's what that means in practice, step by step.

Step 1: Plan the Integrated Audit

The auditor must plan the ICFR audit as an integrated engagement with the financial statement audit. These cannot be run as separate engagements. Evidence from the financial statement audit informs the ICFR audit and vice versa. This integration is not optional under AS 2201 and is intended to reduce redundancy, though in practice it means your auditor needs access to the same documentation and personnel for both workstreams simultaneously.

Step 2: Use the Top-Down Approach

The auditor starts at the entity level, not the transaction level. Entity-level controls (tone at the top, control environment, period-end financial reporting process) are evaluated first because weaknesses there can affect the entire ICFR framework. The auditor then moves down to significant accounts, disclosures, and the relevant assertions (existence, completeness, valuation, rights and obligations, presentation).

For a detailed walkthrough of how significant accounts and processes are scoped, see SOX Scoping: Significant Accounts and Processes Walkthrough.

Step 3: Perform Walkthroughs

For each major class of transactions, AS 2201 requires the auditor to trace a transaction from origination through the company's information systems to its reflection in the financial statements. Walkthroughs are mandatory under AS 2201.13, not optional. They serve two purposes: confirming the auditor's understanding of the process and identifying where controls exist and where they don't.

A common pitfall: companies prepare for walkthroughs by assembling documentation after the fact. Auditors are trained to spot this. Process narratives, flowcharts, and control matrices should reflect how transactions actually flow, not how management wishes they did.

Step 4: Test Design and Operating Effectiveness

The auditor must test both:

• Design effectiveness: Is the control capable of preventing or detecting a material misstatement if it operates as intended?
• Operating effectiveness: Did the control actually operate as designed throughout the period?

A control that is well-designed but inconsistently applied fails the operating effectiveness test. For a detailed guide on how this testing works and what sample sizes apply, see Design vs Operating Effectiveness Testing Under SOX: 2026 Practitioner Walkthrough.

Step 5: Evaluate IT General Controls

IT general controls (ITGCs) are a frequent source of material weaknesses and a common area of PCAOB inspection findings. AS 2201 requires the auditor to evaluate ITGCs covering:

• Access controls: Who can access financial systems and data, and are those access rights appropriate?
• Change management: Are changes to financial applications properly authorized, tested, and implemented?
• Computer operations: Are batch jobs, interfaces, and data transfers monitored and controlled?

If ITGCs are weak, automated application controls that rely on those systems cannot be relied upon, which cascades into broader ICFR scope. PCAOB annual inspection reports consistently flag insufficient ITGC testing as a deficiency in auditors' 404(b) work. For SaaS-heavy environments, see ITGC Scoping for SOX in SaaS Environments: 2026 Practitioner Walkthrough.

Step 6: Evaluate the Period-End Financial Reporting Process

AS 2201 specifically requires the auditor to understand the period-end financial reporting process, including how transaction totals enter the general ledger, how journal entries are initiated and authorized, and how recurring and nonrecurring adjustments are recorded. This is an area companies routinely underestimate. Manual journal entries, especially those posted late in the close cycle, attract significant auditor scrutiny.

Step 7: Evaluate Preventive vs. Detective Controls

AS 2201 distinguishes between preventive controls (system-enforced segregation of duties, automated approval workflows) and detective controls (management review, reconciliations). A control environment that relies heavily on detective controls faces greater auditor scrutiny. Detective controls are generally considered less reliable because they catch errors after they occur rather than preventing them. If your ICFR program leans on management review controls, expect the auditor to test those controls more intensively and to ask hard questions about the reviewer's competence and the evidence of review.

Step 8: Form and Report the ICFR Opinion

The auditor's opinion under AS 2201 is binary at the overall level:

• Unqualified opinion: ICFR is effective as of fiscal year-end.
• Adverse opinion: One or more material weaknesses exist, and ICFR is not effective.

There is no qualified opinion on ICFR effectiveness. A single material weakness requires an adverse opinion. The auditor's attestation report must be filed as part of the Form 10-K under Item 308(b) of Regulation S-K and cannot be incorporated by reference from a proxy statement.

Material Weakness vs. Significant Deficiency: What's the Difference?

The severity classification of a control deficiency determines the auditor's opinion and your disclosure obligations. Under AS 2201:

• Material weakness: A deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis. A single material weakness triggers an adverse ICFR opinion.
• Significant deficiency: Less severe than a material weakness but still warrants attention by those responsible for oversight of financial reporting.

The auditor must communicate all material weaknesses and significant deficiencies to management and the audit committee in writing. Material weaknesses must also be disclosed publicly in the 10-K. For a full guide to disclosure mechanics and remediation sequencing, see Material Weakness Disclosure Requirements: 2026 SEC Compliance Guide.

Audit Analytics research shows that first-year 404(b) compliance is particularly challenging: companies newly crossing the accelerated filer threshold show elevated material weakness rates in their first year of compliance. Plan accordingly.

How to Manage the Integrated Audit: Practical Steps

Knowing what the auditor must do is only half the equation. Here's how to run the process on your side.

Build the Controls Testing Calendar Early

1. Map your close calendar to the audit calendar. The auditor needs to test controls throughout the year, not just at year-end. Agree on interim testing windows in Q2 and Q3 so deficiencies can be identified and remediated before year-end.
2. Assign control owners. Every key control needs a named owner who understands what the control is, how to evidence it, and what the auditor will ask. Ownership gaps are a leading cause of first-year material weaknesses.
3. Prepare evidence packages in advance. Auditors will request samples. Having a consistent, organized evidence repository (approvals, reconciliations, system reports) dramatically reduces audit friction.

Coordinate with Your External Auditor on Scope

• Share your internal controls documentation and risk assessment before the auditor begins fieldwork. The top-down approach means the auditor's scope decisions depend on your entity-level control assessment.
• Discuss reliance on internal audit work. AS 2201 permits the external auditor to use the work of internal auditors and others, but the external auditor must evaluate the competence and objectivity of those performing the work. A strong internal audit function can reduce external audit effort.
• Align on IT systems in scope. Every financial application that processes, stores, or transmits data relevant to ICFR needs ITGC coverage. Surprises here late in the audit are expensive.

Remediate Deficiencies Before Year-End

If walkthroughs or interim testing surface control gaps, the window to remediate before the year-end opinion is narrow but real. Prioritize:

• Segregation of duties conflicts in financial systems (access control remediation often requires IT involvement and lead time).
• Missing or inconsistent evidence of management review controls (the most common operating effectiveness failure).
• Journal entry authorization gaps (period-end process controls are a PCAOB inspection priority).

A control remediated and operating effectively for a sufficient period before year-end can be tested by the auditor and included in the scope of the clean opinion. A control remediated after year-end does not affect the current-year opinion.

Engage the Audit Committee

The audit committee has a governance responsibility to oversee the 404(b) process, not just receive the results. Best practice:

• Brief the committee on ICFR scope and risk assessment at the start of the audit cycle.
• Report interim findings, including significant deficiencies, before year-end so the committee can oversee remediation.
• Evaluate auditor independence and the rigor of the ICFR audit. PCAOB annual inspection reports are publicly available and identify common deficiencies in auditors' ICFR work, including insufficient testing of design and operating effectiveness, over-reliance on management testing, and inadequate ITGC evaluation. These are useful benchmarks for assessing whether your auditor is doing the job.

The Cost-Benefit Reality of 404(b) Compliance

Academic research estimates that 404(b) compliance increases audit fees by 20% to over 100% depending on company size and complexity. The 2020 SEC rulemaking estimated $55.3 million in aggregate annual savings from removing approximately 800 SRCs from 404(b) scope, which implies an average incremental cost of roughly $69,000 per company, though costs for larger accelerated filers are substantially higher.

The counterweight: research published in the Journal of Accounting Research found that companies subject to 404(b) show significantly lower rates of financial restatements compared to exempt companies. And a study of the 2010 Dodd-Frank exemption for non-accelerated filers found a negative average market reaction to the exemption announcement, with voluntary compliers showing no significant negative reaction, suggesting that auditor attestation signals ICFR quality to investors.

Some exempt companies do choose to obtain auditor attestation voluntarily, particularly those seeking to reduce information asymmetry with investors or preparing for a capital raise. If your company is exempt but considering voluntary compliance, the investor signaling benefit is real, but so is the cost and operational burden.

FAQ

What is the difference between SOX 404(a) and SOX 404(b)? SOX 404(a) requires management to assess and report on ICFR effectiveness in the annual 10-K. SOX 404(b) requires the external auditor to independently audit ICFR and issue a separate opinion. 404(a) applies to all public companies; 404(b) applies only to accelerated and large accelerated filers.

Who is exempt from SOX 404(b) in 2026? Non-accelerated filers (public float below $75 million), SRCs with annual revenues below $100 million, and EGCs (for up to five fiscal years post-IPO) are all exempt. The 2026 SEC proposal, if adopted, would further limit 404(b) to large accelerated filers with a public float above $2 billion.

What is PCAOB AS 2201 and why does it matter? AS 2201 is the PCAOB standard that governs how auditors conduct the 404(b) integrated audit. It mandates a top-down, risk-based approach, requires walkthroughs of all major transaction classes, and specifies how auditors must evaluate control design and operating effectiveness.

What happens if the auditor finds a material weakness? The auditor must issue an adverse opinion on ICFR effectiveness. There is no qualified opinion available. The material weakness must be disclosed publicly in the Form 10-K. For disclosure mechanics and remediation guidance, see Material Weakness in ICFR: Real Examples and Remediation Walkthrough.

When does a company become subject to 404(b)? Filer status is determined as of the last business day of the second fiscal quarter (June 30 for calendar-year companies). A company that crosses the $75 million public float threshold on that date becomes an accelerated filer for the following fiscal year and must comply with 404(b) for that year's 10-K. There is a one-year lag built into the system.

Can a company voluntarily comply with SOX 404(b) if exempt? Yes. Some exempt companies obtain auditor attestation voluntarily to signal ICFR quality to investors and reduce information asymmetry. Research suggests voluntary compliers experience less negative market reactions to exemption announcements than non-compliers, indicating the market values the signal.