SOX Compliance Pulse — Issue #6: SOX Section 404 Internal Controls: PCAOB QC 1000 Deadline, ITGC Failures & the 2026 Compliance Shifts

Q: What is SOX Section 404 and who does it apply to?

SOX Section 404 requires public company management to assess the effectiveness of Internal Control over Financial Reporting (ICFR) annually (Section 404(a)). Large accelerated and accelerated filers must also obtain an external auditor attestation of ICFR effectiveness (Section 404(b)). Section 404 applies to all SEC-reporting companies, with different requirements based on filer status.

Q: What is PCAOB QC 1000 and what is the deadline?

PCAOB QC 1000 is a new quality control standard requiring registered audit firms to implement a functioning Quality Management System (QMS). The enforcement window opens December 15, 2026. Firms without a compliant QMS face PCAOB disciplinary proceedings, which could include suspension of registration and the ability to issue Section 404(b) audit opinions.

Q: What are the most common Section 404 deficiencies cited in PCAOB inspections?

The five most frequently cited deficiency categories in PCAOB inspections are: (1) inadequate testing of information produced by the entity (IPE), (2) insufficient segregation of duties evaluation over financial close, (3) over-reliance on entity-level controls without adequate process-level testing, (4) revenue recognition controls failures under ASC 606, and (5) inadequate testing of management assumptions in complex estimates.

Q: Are cybersecurity controls part of SOX Section 404 ICFR scope in 2026?

Yes. Following the SEC's cybersecurity disclosure rules (effective December 2023) and PCAOB enforcement guidance in Q1 2026, cybersecurity-related controls are formally within ICFR scope for accelerated filers. Controls over multi-factor authentication, privileged access management for financial systems, and incident response procedures addressing financial data integrity must now be documented and tested as part of Section 404 compliance.

Q: What is PCAOB AS 2901 and when does it take effect?

PCAOB AS 2901 is a modernized materiality standard that codifies how auditors must determine and document materiality thresholds in ICFR audits. It is effective for fiscal years ending on or after December 15, 2026. It requires auditors to document the basis for both quantitative and qualitative materiality thresholds at the engagement level, applying the standard of 'materiality from the perspective of a reasonable investor.'

ComplianceStack; ComplianceStack

SOX Enforcement Watch

The New SOX Sheriff Has Found Its Office

What changed: Prior to March 2026, SOX cases were handled by generalist enforcement attorneys juggling securities fraud, disclosure violations, and dozens of other matter types. Now there's a team whose entire job is internal controls and certification accuracy. That specialization historically correlates with higher case volume within 12–18 months of launch.

What They're Watching

Section 302 certification accuracy — CEO/CFO personal liability for false statements about disclosure controls
Section 404(a) management assessment quality — specifically whether the disclosure reflects what management actually did, not boilerplate
Timeliness of material weakness disclosure — companies that identify a weakness but delay disclosure face separate enforcement exposure

The ADM Precedent (January 27, 2026)

Archer-Daniels-Midland's $40M settlement with the SEC involved, in part, failures in intersegment transaction accounting controls — a Section 404 story. It put multi-segment registrants on notice: intercompany controls are no longer a rounding error in the enforcement calculus.

Bottom Line

The SEC SOX Group is now operational. PCAOB enforcement is maintained despite budget cuts. Companies with gaps in their Section 404 documentation have a narrowing window to self-correct before scrutiny increases. Q3 2026 is the window.

PCAOB: Budget Cut, Enforcement Maintained

The PCAOB absorbed a 9.4% budget reduction in 2026 — but enforcement staffing was explicitly protected. Inspection findings are taking longer to finalize in some cases, but the enforcement pipeline has not slowed.

9.4%

PCAOB 2026 Budget Cut

39%

2024 ICFR Deficiency Rate (↓ from 46%)

6+

Straight Cycles: IPE Top Deficiency

2024 inspection cycle results (published early 2025): Overall engagement deficiency rates dropped from 46% (2023) to 39% (2024) for large accelerated filers. That's the first meaningful improvement in three years. The PCAOB called it encouraging. They also called 39% unacceptably high.

The top three deficiency categories have barely moved in six years:

Inadequate testing of completeness/accuracy of information produced by the entity (IPE)
Insufficient evaluation of segregation of duties over financial close
IT General Controls failures — access management and change management

Controls Intelligence — Section 404 Deep Dive

Section 404 — Internal Control over Financial Reporting

Section 404 is the most operationally demanding part of SOX compliance. Section 404(a) requires management to assess ICFR effectiveness. Section 404(b) requires external auditor attestation (for accelerated and large accelerated filers). Two new standards are reshaping both.

The QC 1000 Clock Is Running

What it is: The PCAOB's QC 1000 is a comprehensive new quality control standard for registered audit firms. It replaces a patchwork of legacy QC standards and requires firms to implement a functioning Quality Management System (QMS) — with documented risk assessment, monitoring, and remediation processes — by December 15, 2026.

Why QC 1000 Matters for Section 404(b) Users

If your external auditor hasn't implemented QC 1000 by December 15, 2026, they're exposed to PCAOB disciplinary proceedings that could include suspension of registration. A suspended firm cannot issue ICFR attestation opinions. That's your Section 404(b) opinion.

What to ask your auditor — now:

"Walk us through your QMS implementation status against QC 1000."
"What's your internal deadline for having the QMS fully documented and tested?"
"How are you embedding QMS requirements into your ICFR attestation engagement?"

Audit committees should include QC 1000 readiness as a standing agenda item through Q3 2026.

AS 2901: Materiality Just Got Harder to Dodge

What it is: PCAOB AS 2901 is a modernized materiality standard, effective for fiscal years ending on or after December 15, 2026. It formally codifies how auditors must determine and document materiality thresholds in ICFR audits.

The key change: Auditors must now document the basis for both quantitative and qualitative materiality thresholds at the engagement level — not just at the financial statement level. The standard of "materiality from the perspective of a reasonable investor" is the operative benchmark.

If your ICFR scope has historically been set by a purely quantitative materiality number, expect that conversation to get more nuanced.

PCAOB Deficiency Patterns

The Five Deficiency Patterns PCAOB Keeps Citing

These five patterns appear in PCAOB inspection findings with near-clockwork regularity. If your program has gaps in any of these areas, you're walking into the same territory inspectors are already targeting.

1

IPE Testing — Information Produced by the Entity

The single most frequently cited deficiency — for six consecutive inspection cycles. If management uses a report to demonstrate a control operated (an exception report, an access log, a reconciliation), the auditor must test whether that report itself was complete and accurate. Not just trust its output. Many teams still don't do this adequately.

2

Segregation of Duties — The Cloud SOD Problem

Access provisioning in cloud environments changes constantly. A SOD analysis done at fiscal year-start is stale by Q2. Inspectors are finding that SOD controls documented in the control inventory describe processes that no longer match how access is actually managed. Mid-year personnel changes, contractor access, shared service center configurations — all create temporary or permanent SOD violations that aren't being caught.

3

Over-Reliance on Entity-Level Controls

Entity-level controls (ELCs) — tone at the top, audit committee oversight, control environment monitoring — can reduce but not eliminate process-level testing under AS 2201. They can only substitute for process-level controls if they operate at a precision level sufficient to detect the specific risk at the process level. Inspectors are finding audit teams using ELCs to justify insufficient process-level testing. That's not what the standard permits.

4

Revenue Recognition Controls (ASC 606)

Eight years after ASC 606 adoption, revenue recognition controls are still generating more deficiency findings than any other area except IPE. The recurring failures: inadequate controls over variable consideration estimation (rebates, returns, volume discounts), contract modification identification, and principal vs. agent determinations. If your revenue has any variability or complexity, this area warrants fresh scrutiny every year.

5

Complex Estimate Testing

Goodwill impairment, CECL reserves, pension obligations, fair value measurements — auditors continue to be cited for testing the mathematical accuracy of management's models without adequately testing the reasonableness of the inputs. The discount rate in a goodwill model is more important than the spreadsheet formula.

2026 Structural Compliance Shifts

The 2026 Shifts That Will Break Existing Control Frameworks

Three structural changes to the ICFR landscape are in effect now. Most internal audit and compliance teams are behind on all three.

1. Cybersecurity Is Inside ICFR Scope

Controls you now need in your ICFR inventory:

Multi-factor authentication over all in-scope financial systems
Privileged access management (PAM) for financial application administrators
Incident response procedures that address financial data integrity implications
Vendor SOC 2 reports + complementary user entity controls (CUECs) — a SOC 2 alone is not sufficient

Note: A SOC 2 Type II from your SaaS ERP vendor does not substitute for ICFR documentation. You must document and test your own complementary controls.

2. AI Tool Governance — You're Probably Behind

AI tools are being used inside finance functions at a majority of larger companies — for journal entry drafting, contract review, variance analysis, account reconciliations. The PCAOB hasn't issued formal AI guidance yet, but 2025–2026 inspection findings have begun citing inadequate controls over AI-assisted processes as a contributing factor in review control deficiencies.

Current best practice (KPMG, EY guidance, 2025–2026):

• Maintain a formal inventory of all AI tools used in financial reporting processes

• Establish human review controls over any AI-generated output feeding financial statements

• Apply change management controls to AI model updates — including vendor-side model version updates

• Ensure data inputs to AI tools are subject to the same access and integrity controls as your underlying financial data

The framework doesn't exist yet in formal standards. That's not a reason to wait.

3. Continuous Monitoring Replacing Sample Testing

The industry-wide shift from traditional sample-based testing (25–60 transactions per control) toward continuous monitoring architectures is accelerating. ERP platforms (SAP S/4HANA, Oracle Fusion, Workday) now natively export control operation logs. GRC platforms (AuditBoard, Workiva, ServiceNow GRC) support automated population pulls.

What this means in practice: For key automated controls, management should document and retain control operation logs for the full fiscal year — not just for the testing window. Auditors are increasingly requesting full population data rather than samples for automated controls. If your evidence retention processes were designed for sampling, they're likely insufficient for a continuous monitoring approach.

IT General Controls

ITGC: The Persistent Foundation Problem

ITGC failures propagate upward. If access management or change management controls are unreliable, every automated control that depends on them is questionable. Four ITGC failure patterns show up repeatedly in fast-scaling technology and fintech companies:

Access Management — The Multi-SaaS Problem

A company in 2026 might have SAP as the ERP, Workday for HR/payroll, Snowflake as the data warehouse, and Salesforce as the revenue sub-ledger source — each with separate user provisioning processes. The classic failure: terminated employee access is removed from the primary ERP within 24 hours, but persists in downstream SaaS applications for weeks.

Fix: Implement centralized Identity Governance and Administration (IGA) that automates de-provisioning across all in-scope systems on HR termination trigger. This is now a baseline expectation for large accelerated filers.

Change Management — The CI/CD Documentation Gap

Many companies deploy changes to financial applications weekly or daily via CI/CD pipelines. Their documented change management controls describe a legacy change advisory board process that no longer matches operational reality. The documented control is functionally fictitious.

Fix: Update your controls documentation to reflect the actual deployment pipeline. Embed controls in the pipeline itself — automated approval gates, required peer review, segregation between developers and deployment keys — rather than documenting a manual process that isn't happening.

Batch Processing — The Alert Nobody Reviewed

Automated batch processes (end-of-day feeds, intercompany eliminations, currency translations) run without human intervention. Companies document that "batch job failures trigger an alert email to the IT operations team." But they cannot evidence that those alerts were reviewed and responded to throughout the year. The control exists in the document. It doesn't exist in practice.

Vendor-Initiated Changes — The Invisible Risk

Cloud vendors push automatic version upgrades and feature rollouts outside your change management process. Most companies have no controls to assess whether vendor-initiated changes affect ICFR-relevant functionality. This is an emerging inspection focus.

Fix: Subscribe to vendor release notes. Document a risk assessment for each significant vendor release. Re-test automated controls when relevant system functionality changes.

Action Item of the Week

Run a Vendor Change Log Review for Your Top 3 ICFR-Relevant SaaS Applications

Pick the three SaaS platforms most critical to your financial reporting (likely your ERP, FP&A tool, and revenue/billing system). For each:

Pull the vendor's release notes for Q1 2026 — most publish these in their documentation portal or status page

Flag any changes to functionality related to user access, data exports, financial calculations, or audit trail logging

Document your assessment of whether any flagged change affected ICFR-relevant functionality

If yes, verify that the relevant automated controls were re-tested after the change

Then run your SOX Pulse readiness check to see how your Section 404 posture looks across the full framework → Get your personalized SOX readiness score at /sox-compliance-pulse

Regulatory Radar

Upcoming SOX-Relevant Deadlines

Date	Who	What
June 3, 2026	Smaller fintech filers	Reg S-P smaller entity relief expires — 27-day window to remediate data protection gaps that intersect with ICFR scope
~Aug 10, 2026	Large accelerated filers	Q2 10-Q filing deadline (~40 days after June 30 period end). Section 302 certifications required.
~Aug 14, 2026	Non-accelerated filers	Q2 10-Q filing deadline (~45 days after June 30 period end).
Dec 15, 2026	All accelerated filer audit firms	PCAOB QC 1000 enforcement window opens. Firms without compliant QMS face registration consequences.
Nov 30, 2027	Registered PCAOB firms	Form QC annual quality report first filing (for year ending December 15, 2026).

Regulatory Pipeline

PCAOB AS 2901 (Materiality): Effective for fiscal years ending December 15, 2026+. Auditors adjusting materiality memo processes now. Management should anticipate more detailed dialogue on qualitative materiality factors.
SEC's dedicated SOX enforcement group: Now fully operational as of Q2 2026. Expect increased issuer-level scrutiny of 404(a) assessment quality and 302 certification accuracy through end of 2026.
AI in financial reporting — guidance TBD: The PCAOB has signaled awareness of AI tool governance as an emerging ICFR issue but has not issued formal standards. Watch for concept release or proposed guidance in H2 2026.
COSO 2013 framework: Still the standard for Section 404(a) management assessments. No replacement is imminent. COSO has issued supplemental guidance on monitoring components and risk assessment in technology-intensive environments.