SOX Compliance Timeline After an IPO: By Filer Type (2026)

The SOX clock starts before your S-1 is filed, not the day you ring the bell. The specific obligations that activate, and when, depend entirely on your filer classification. Get that wrong and you are either over-building controls you do not yet need, or racing toward a material weakness disclosure in your first 10-K.

This guide maps the SOX compliance timeline after an IPO to each filer type: Emerging Growth Company (EGC), Non-Accelerated Filer, Accelerated Filer, and Large Accelerated Filer. It covers the exact provisions, the public float thresholds that determine where you land, and the pre-IPO readiness phases that Big-4 firms consistently recommend. For a deeper dive into the 302 vs. 404 certification mechanics, see SOX 302 vs 404 Certification: The Complete Comparison Guide.

Key takeaway: Section 302 and 404(a) apply immediately upon going public, with no grace period. Section 404(b), the external auditor attestation, is phased in based on filer status, and many newly public companies qualify for an exemption they do not know about.

What Are the Three Core SOX Provisions and When Do They Activate?

All three provisions, 302, 404(a), and 404(b), have different activation timelines, and conflating them is the most common planning error newly public companies make.

Section 302 requires the CEO and CFO to certify, every quarter, that the financial statements are accurate and that disclosure controls and procedures are effective. Per Cherry Bekaert, this mandate kicks in immediately upon going public. There is no grace period, no EGC carve-out. The first 10-Q after the IPO requires a signed certification.

Section 404(a) requires management to establish, maintain, and formally assess the effectiveness of internal controls over financial reporting (ICFR), with the conclusion disclosed in the annual 10-K. This also applies from the first 10-K, regardless of size or EGC status.

Section 404(b) is the provision that separates filer types. It requires the independent external auditor to issue a separate opinion on ICFR under PCAOB Auditing Standard AS 2201. This is the most resource-intensive requirement, and it is the one the SEC has deliberately phased in for smaller and newer filers.

Note also that Section 302 covers disclosure controls and procedures (DC&P) under 17 CFR 240.13a-15, which is broader than ICFR. It encompasses all information required in Exchange Act reports, including the cybersecurity incident disclosures now required under the SEC's 2023 cybersecurity rules (effective December 2023). Newly public companies must integrate cybersecurity governance into their disclosure controls framework from day one.

How to Determine Your Filer Classification

Your filer classification determines whether and when Section 404(b) applies to you. It is set annually based on public float measured as of the last business day of your second fiscal quarter.

Under 17 CFR 240.12b-2 and the SEC's 2020 accelerated filer rule change (effective February 10, 2020), the thresholds are:

Two mechanics here are widely misunderstood.

First, the 2020 SEC rule change meaningfully expanded the 404(b) exemption. Before February 2020, any company with a public float between $75M and $700M was an Accelerated Filer subject to 404(b). The 2020 amendment added a revenue test: companies in that float range with annual revenues below $100M are now Non-Accelerated Filers, exempt from 404(b). The SEC estimated this change exempted approximately 710 additional companies, saving each roughly $1.3 million per year in external audit fees. If you are planning your IPO roadmap using pre-2020 guidance, your 404(b) obligations may be materially overstated.

Second, a newly public company cannot become an Accelerated Filer in its first year. Under 17 CFR 240.12b-2, a company must have been subject to Exchange Act reporting for at least 12 calendar months and have filed at least one annual report before it can qualify as an Accelerated Filer. This creates a natural one-year buffer before 404(b) can first apply to Accelerated Filers, regardless of float size.

The EGC Classification: What the Five-Year Exemption Actually Means

EGC status provides a genuine 404(b) exemption for up to five years post-IPO, but it is not a five-year pause on SOX readiness work.

Under the JOBS Act of 2012, a company qualifies as an Emerging Growth Company if its total annual gross revenues are below $1.235 billion (the inflation-adjusted threshold as of 2023, per the SEC's EGC overview). EGC status is lost when the company:

• Exceeds the $1.235B revenue threshold
• Issues more than $1 billion in non-convertible debt in the prior three years
• Becomes a Large Accelerated Filer
• Reaches the fifth anniversary of its IPO

Whichever of these happens first ends EGC status and triggers mandatory 404(b) compliance in the next annual report.

As EY notes, "the clock should actually start ticking even before they file", and this applies to EGCs as much as to anyone else. The five-year window is time to build toward 404(b) readiness, not to defer it. Companies that wait until year four to start building controls face an impossible timeline: PCAOB AS 2201 requires the auditor to assess whether controls operated effectively over the entire fiscal year, and controls cannot be retroactively documented.

For companies that IPO'd in 2020 or 2021, the five-year EGC clock is expiring now or in the next 12 months. The transition year requires a full 404(b) readiness assessment, external auditor engagement on scope, and at least one complete cycle of management testing before the auditor's first attestation.

SOX Compliance Timeline by Filer Type: Post-IPO Sequence

Large Accelerated Filer (Float Over $700M)

This is the most demanding profile. 404(b) applies with no exemptions and no grace period beyond the 12-month Exchange Act reporting requirement.

• IPO date: Section 302 certifications required from first 10-Q
• First 10-K: Section 404(a) management assessment required
• Second 10-K (or first 10-K after 12 months of Exchange Act reporting): Section 404(b) auditor attestation required
• Ongoing: Quarterly 302 certifications; annual 404(a) and 404(b)

For a company going public with a float above $700M, 404(b) readiness must be in place before the IPO, not after. KPMG recommends engaging the external auditor at least 12 months before the first 404(b) opinion is required.

Accelerated Filer (Float $75M, $700M, Revenues Over $100M)

• IPO date: Section 302 certifications required from first 10-Q
• First 10-K: Section 404(a) management assessment required
• After 12 months of Exchange Act reporting + float measurement confirms Accelerated Filer status: Section 404(b) applies
• Ongoing: Quarterly 302; annual 404(a) and 404(b)

The float measurement date is the last business day of the second fiscal quarter. A company that IPOs in Q1 may find its float is measured just a few months later, potentially confirming Accelerated Filer status sooner than expected. Model this date carefully during IPO planning.

Non-Accelerated Filer (Float Under $75M, or $75M, $700M with Revenues Under $100M)

• IPO date: Section 302 certifications required from first 10-Q
• First 10-K: Section 404(a) management assessment required
• Section 404(b): Exempt, until the revenue threshold is crossed
• Ongoing: Quarterly 302; annual 404(a); monitor revenue and float annually

The 2020 rule change is particularly valuable here. Many companies that would have been Accelerated Filers under the old rules now fall into this category. The exemption is not permanent: if revenues cross $100M and float remains above $75M, 404(b) becomes mandatory in the next annual report cycle.

Emerging Growth Company (Revenues Under $1.235B)

• IPO date: Section 302 certifications required from first 10-Q
• First 10-K: Section 404(a) management assessment required
• Section 404(b): Exempt for up to five years from IPO date (or until EGC status is lost)
• Year 4 post-IPO: Begin 404(b) readiness assessment; engage external auditor on scope
• Year 5 (or earlier if EGC status lost): Full 404(b) compliance required

Pre-IPO SOX Readiness Timeline: T-24 Months to IPO Date

Big-4 firms and IPO advisory specialists consistently recommend starting SOX readiness 18 to 24 months before the anticipated IPO date. Cherry Bekaert and KPMG both cite this window. Here is what that looks like in practice:

The S-1 itself does not require a 404(a) or 404(b) assessment. But auditors will flag control deficiencies identified during the IPO audit, and those findings can delay or complicate the offering. Starting late does not just create a compliance risk, it creates a transaction risk.

IT General Controls: The Most Underdeveloped Area in Pre-IPO Companies

IT general controls (ITGCs) are consistently the weakest link in pre-IPO SOX programs, and they are a primary focus of external auditors in any 404(b) audit.

According to KPMG's 2025 Trends in Material Weaknesses study, IT-related material weaknesses rose from 31% of all material weaknesses in 2021 to 58% in 2025. Technology is now the second leading driver of material weaknesses in SOX programs. For companies that have scaled quickly on informal IT practices, this is the area that most often produces adverse findings.

ITGCs cover three domains:

• Access management: Who has access to financial systems, how access is provisioned and deprovisioned, and whether segregation of duties is enforced
• Change management: How changes to systems that support financial reporting are tested, approved, and deployed
• Computer operations: Backup, recovery, job scheduling, and monitoring of financial systems

For SaaS-heavy environments, the scoping question is which cloud systems are in scope and how SOC 1 reports from vendors are used to reduce direct testing. For a detailed walkthrough of that process, see ITGC Scoping for SOX in SaaS Environments: 2026 Practitioner Walkthrough.

The Five Operational Pitfalls That Derail Newly Public Companies

1. Treating SOX as a Finance Project

SOX 302 certifications cover disclosure controls and procedures, which span finance, IT, legal, HR, and operations. Cherry Bekaert puts it directly: "The tone at the top of the organization must shift sufficiently to trickle down and ensure that control owners and operators will prioritize SOX compliance as a value-added activity." If the program is owned only by the controller's office, it will fail.

2. Misreading the 404(b) Trigger Date

The public float measurement date is the last business day of the second fiscal quarter, not the IPO date. A company that goes public in January may have its float measured in June, potentially confirming Accelerated Filer status months earlier than anticipated. Model this date explicitly in your IPO planning calendar.

3. Engaging the External Auditor Too Late

KPMG recommends at least 12 months of auditor involvement before the first 404(b) opinion. Auditors need time to understand the control environment, conduct independent walkthroughs, and test controls. Bringing them in six months before the attestation deadline is a common and expensive mistake.

4. Over-Scoping the Control Environment

PwC's IPO readiness guidance frames scoping as a risk-based exercise: identify the financial statement line items most susceptible to material misstatement, map them to processes and systems, and prioritize controls accordingly. Over-scoping creates unsustainable compliance burden without proportionate risk reduction. A newly public mid-size company does not need 500 controls.

5. Assuming EGC Status Means SOX Can Wait

The EGC exemption covers 404(b) only. Section 302 and 404(a) apply from day one. And the five-year clock runs regardless of whether you have built toward 404(b) readiness. Companies that IPO'd in 2020 and 2021 are hitting this wall now.

What Happens If You Disclose a Material Weakness in Your First 10-K?

A material weakness is the most severe category of ICFR deficiency under PCAOB AS 2201. It requires disclosure in the annual report, and for 404(b) filers, it triggers an adverse auditor opinion on internal controls. The consequences are real: stock price decline, SEC scrutiny, and litigation risk are all documented outcomes. KPMG's data shows that 33% of NYSE and NASDAQ IPOs have disclosed material weaknesses in their first year post-IPO, with 78% citing lack of accounting resources and expertise as the cause.

Remediation requires demonstrating that the corrected control has operated effectively for a sufficient period before the next annual assessment. That typically means the remediation must be in place and tested by Q3 of the fiscal year in which you intend to assert effectiveness. For a quarter-by-quarter remediation disclosure guide, see Material Weakness Remediation Disclosure Requirements.

Technology and Automation: Reducing the Cost and Time Burden

First-year SOX compliance for a mid-size newly public company can run $1M to $3M or more in external fees alone, based on the SEC's own economic analysis, which estimated $1.3M in average annual external audit fee savings per company newly exempted from 404(b) by the 2020 rule change. That figure implies 404(b) compliance costs roughly that amount annually.

GRC and SOX automation platforms, including AuditBoard, Workiva, and ServiceNow GRC, are increasingly used to reduce the documentation, evidence collection, and testing burden. The case for investing in these tools is strongest in the pre-IPO phase, when building a repeatable, auditable control framework from scratch. For an evaluation framework covering AI-assisted SOX tools specifically, see AI Tools for SOX Compliance and Internal Audit: 2026 Evaluation Framework.

As EY observes, companies that treat SOX readiness seriously tend to build centralized, automated financial reporting as a byproduct, which benefits the business well beyond the compliance requirement. "Demonstrating SOX compliance sends a signal that the organization has not pursued a 'growth at all costs' approach and understands how to prioritize risks, establish strong internal controls, and deploy a sound financial reporting system."

FAQ

When exactly does SOX compliance start after an IPO? Section 302 certifications are required from the first quarterly or annual filing after going public. Section 404(a) applies from the first 10-K. Section 404(b) is phased in based on filer classification, with a minimum 12-month Exchange Act reporting period before Accelerated Filer status can first apply.

What is the difference between SOX 404(a) and 404(b)? 404(a) is management's own assessment of ICFR effectiveness, required in every annual report. 404(b) is the external auditor's independent attestation on that assessment, required only for Accelerated and Large Accelerated Filers. EGCs and Non-Accelerated Filers are exempt from 404(b). See SOX 302 vs 404 Certification: The Complete Comparison Guide for the full breakdown.

How does the 2020 SEC rule change affect newly public companies? The February 2020 amendment added a revenue test to the Accelerated Filer definition. Companies with a public float between $75M and $700M but annual revenues below $100M are now Non-Accelerated Filers, exempt from 404(b). This change exempted approximately 710 additional companies and saves each roughly $1.3M per year in external audit fees.

What is the EGC revenue threshold in 2026? The inflation-adjusted threshold is $1.235 billion in total annual gross revenues, as updated by the SEC in 2023. Companies below this threshold qualify as EGCs and are exempt from 404(b) for up to five years from their IPO date.

How far in advance should we start SOX readiness work? The consistent recommendation from Big-4 firms and IPO advisory specialists is 18 to 24 months before the anticipated IPO date. Starting after the S-1 is filed leaves insufficient time for documentation, control testing, remediation, and external auditor alignment.

What are IT general controls and why do they matter for SOX? ITGCs cover access management, change management, and computer operations for systems that support financial reporting. They underpin the reliability of automated controls and are a primary focus of external auditors. IT-related material weaknesses accounted for 58% of all material weaknesses in 2025, up from 31% in 2021, per KPMG's data.