SOX 404 and internal control reporting

Section 404(a) of the Sarbanes-Oxley Act requires management of a public company to assess and report on the effectiveness of internal control over financial reporting, starting with the second annual report after the IPO. Section 404(b) requires the auditor to attest to that assessment, but emerging growth companies are exempt for up to five years, and smaller reporting companies with under $100 million in revenue remain exempt after that.

The management assessment is not trivial even without the auditor attestation. It requires documented processes, identified key controls, testing evidence, and a conclusion, across the close, revenue, equity, R&D accruals, and IT systems. Most companies bring in help for the first year and build the function afterward.

The practical advice is to design the control environment during audit readiness, so that the first 404(a) assessment describes controls that already operate rather than controls that had to be invented.