SOX Compliance 2026: What Public Companies Must Do — Sections 302, 404 & 906

Clearly In Scope

Partial Provisions Apply

Executives must personally certify the accuracy and completeness of quarterly (10-Q) and annual (10-K) financial statements. Signing a false certification knowingly is a federal crime carrying up to 10 years in prison.

Document, test, and assess all internal controls over financial reporting annually. Management must include an ICFR assessment in the 10-K. This is the largest cost driver in SOX compliance, consuming thousands of staff-hours at large companies.

Large accelerated filers (public float over $700M) must have their external auditor independently assess and attest to management's ICFR assessment. This requirement significantly increases external audit fees.

Audit Committee Independence

All audit committee members must be independent directors with no material relationship to the company. At least one member must be a financial expert. The committee is directly responsible for appointing, compensating, and overseeing the external auditor.

Code of Ethics for Senior Officers

A written code of ethics is required for the CEO, CFO, and principal accounting officer. Any waiver of the code must be publicly disclosed. The code must address conflicts of interest, accurate reporting, and compliance with laws.

Enhanced Financial Disclosures

Real-time disclosure of material changes in financial condition is required. This includes off-balance-sheet transactions, pro forma figures, and any information that a reasonable investor would find material. The SEC requires disclosure on Form 8-K within 4 business days.

All audit and review work papers, records that form the basis of the audit, and communications between auditors and management must be retained for 7 years. Knowing destruction of documents is a federal crime with up to 20 years in prison.

Whistleblower Protections

Written procedures must protect employees who report suspected fraud to the SEC or audit committee. Retaliation against a whistleblower is itself a federal crime. The SEC Whistleblower Program awards 10–30% of sanctions collected over $1M to qualifying whistleblowers.

Pre-Approval of Non-Audit Services

The audit committee must pre-approve all non-audit services provided by the external auditor. Certain services (bookkeeping, financial systems design, legal services) are prohibited entirely to preserve auditor independence.

Destroying, altering, or concealing documents during a federal investigation or proceeding carries up to 20 years in prison. This applies to all companies — public or private — once a federal investigation has commenced.

These Penalties Have Been Used

Enron's CEO received 24 years in prison (later reduced to 14). WorldCom's CEO received 25 years. HealthSouth's CEO received 7 years. Tyco's CEO received 8–25 years. The penalties are not theoretical — they are the entire reason SOX was written.

Most SOX provisions apply only to publicly traded companies, but Sections 1102 (obstruction of justice) and 1107 (whistleblower retaliation) apply to all companies — public and private. Private companies preparing for an IPO must begin building SOX-compliant internal controls 18–24 months before their target listing date, as underwriters and auditors require control documentation before the S-1 filing.

SOX Section 404 requires management to assess and attest to the effectiveness of internal controls over financial reporting (ICFR) annually in the 10-K filing, and for large accelerated filers ($700M+ public float) the external auditor must independently attest to that assessment — making 404 the most expensive SOX compliance component at an average of $2.9M per year. The control documentation, testing, and remediation process for Section 404 typically runs across the first three quarters of the fiscal year.

SOX filer categories are determined by public float: non-accelerated filers (under $75M) and accelerated filers ($75M–$700M) complete management's ICFR assessment but are exempt from external auditor attestation. Large accelerated filers ($700M+ public float) face both management assessment and independent external auditor attestation — the most rigorous and costly compliance tier under SOX.

Average ongoing SOX compliance costs $2.9M per year for large public companies and $500K–$2M for mid-size filers, with the first year typically running 2–3x higher due to initial control documentation. ComplianceStack reduces SOX compliance costs by automating control documentation, testing workflows, and evidence collection — allowing finance teams to operate SOX as a continuous program rather than a year-end scramble.

COSO (Committee of Sponsoring Organizations of the Treadway Commission) provides the internal controls framework used by the vast majority of public companies to satisfy SOX Section 404, defining five components: the control environment, risk assessment, control activities, information and communication, and monitoring. Both the SEC and PCAOB recognize COSO as an acceptable framework for ICFR compliance — and ComplianceStack's controls documentation is aligned to COSO requirements.

A SOX material weakness must be publicly disclosed in the 10-K filing and historically triggers a 3–8% stock price drop on the day of disclosure. Material weakness disclosure requires a formal remediation plan with a specific correction timeline, and serious or persistent weaknesses can trigger SEC inquiries, shareholder litigation, and heightened external auditor scrutiny in subsequent years.

SOX Section 802 mandates a minimum 7-year retention period for all audit and review work papers and records forming the basis of an audit — knowing destruction of these documents is a federal crime carrying up to 20 years in prison. External auditors typically review records going back 3–5 years during an engagement, making organized, accessible financial archives a prerequisite for a clean audit.

The SOX compliance calendar is anchored by the annual 10-K filing deadline: controls scoping and documentation runs Q1–Q2, control testing runs Q2–Q3, management assessment is completed in Q4, and external auditor attestation (for large accelerated filers) runs through year-end. Companies that run SOX as a continuous, year-round program avoid the costly year-end scramble that smaller finance teams face with ad-hoc compliance.

Companies can co-source or fully outsource SOX internal audit and testing work to Big 4 or regional accounting firms — but the CEO and CFO cannot delegate their personal Section 302 certification. The personal criminal liability under SOX Sections 302 and 906 remains with the executives regardless of who performs the underlying compliance work.

Any system that processes, stores, or transmits data used in financial reporting falls within SOX IT controls scope — including ERP systems (SAP, Oracle, NetSuite), financial close tools, spreadsheets used in reporting, identity and access management systems, change management processes for financial systems, and BI/data warehouse tools feeding financial reports. IT general controls over these systems — access management, change management, and computer operations — are a required component of SOX ICFR documentation.

A SOX risk assessment identifies the financial processes, accounts, and systems with the highest risk of material misstatement — these define the scope of the internal controls program. Under the COSO framework (the SEC-recognized standard), risk assessment evaluates each business process by likelihood of error/fraud and potential dollar impact, with high-risk processes like revenue recognition, inventory, and payroll receiving the most extensive control coverage. A poorly scoped risk assessment is one of the most common causes of material weaknesses discovered during external audit. ComplianceStack's SOX Gap Analyzer helps organizations scope their risk assessment accurately based on verified PCAOB deficiency benchmarks.

SOX attestation is the formal certification of internal controls over financial reporting (ICFR) effectiveness — management attestation under Section 404(a) requires the CEO and CFO to personally assess and certify ICFR effectiveness in the annual 10-K, while external auditor attestation under Section 404(b) requires independent auditor verification for large accelerated filers ($700M+ public float). False SOX attestation is a federal crime under Section 906: knowing violations carry up to $1M fine and 10 years in prison; willful violations carry up to $5M and 20 years.

• 1. Management attestation (§ 404(a)): The CEO and CFO must personally assess and attest that ICFR is effective as of fiscal year-end, included in the annual 10-K. Required of all public companies.
• 2. External auditor attestation (§ 404(b)): Large accelerated filers (public float $700M+) must also have their external auditor independently attest to management's ICFR assessment — the most expensive compliance tier.

Non-accelerated and accelerated filers are exempt from external auditor attestation. False attestation is a federal crime: knowing violations carry up to 10 years in prison; willful violations up to 20 years.