SOX Section 404 Requirements: Where ICFR Programs Break Down

Q: What does SOX Section 404 require?

SOX Section 404 (15 USC §7241(a)) requires management to assess and report on the effectiveness of internal control over financial reporting (ICFR) annually in the 10-K. Large accelerated filers ($700M+ public float) must also obtain independent external auditor attestation under 404(b). Filer obligations: Large Accelerated Filer (LAF, $700M+) = 404(b) auditor attestation + 404(a) management assessment + ICFR disclosure + material weakness trigger; Accelerated Filer ($75M–$700M) = 404(b) auditor attestation + 404(a) management assessment + ICFR disclosure; Non-Accelerated Filer (under $75M) = 404(a) management assessment only; Smaller Reporting Company (SRC) = exempt from 404(b) auditor attestation. Source: ComplianceStack SOX Compliance Pulse, Vol. 4 (June 23, 2026).

Q: What are the ICFR testing gaps that produce material weaknesses?

Five ICFR testing gaps consistently produce material weaknesses: (1) incomplete transaction-level control mapping — entity-level controls tested but transaction-level gaps undetected; (2) no testing of information relied on from IT general controls — ITGC results not linked to ICFR scope; (3) segregation of duties gaps in journal entry approval — same person initiates and approves; (4) subsequent-events review not integrated with ICFR — Q4 events not reflected in ICFR assessment; (5) management review controls run but not documented — operating effectiveness cannot be demonstrated. Each gap produces a specific disclosure trigger under ASC 250 and triggers the 8-K Item 4.02 obligation. Source: ComplianceStack SOX Compliance Pulse, Vol. 4 (June 23, 2026).

Q: What is the difference between a material weakness and a significant deficiency?

A material weakness is a deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis. A significant deficiency is a deficiency, or combination of deficiencies, in ICFR that is less severe than a material weakness yet important enough to merit attention by those responsible for oversight. Severity threshold: reasonable possibility vs. more than remote. Disclosure: material weakness requires 8-K Item 4.02 disclosure and 10-K ICFR report; significant deficiency can be disclosed internally but is not a standalone 10-K ICFR reportable condition. Both require management remediation planning. Source: ComplianceStack SOX Compliance Pulse, Vol. 4 (June 23, 2026).

Q: How does PCAOB AS 2201 (Amended) change ICFR audits effective December 15, 2026?

PCAOB AS 2201 (Amended), effective December 15, 2026, requires a top-down, risk-based ICFR audit approach. Key changes: (1) auditors must start with entity-level controls and scope down to specific accounts/disclosures based on risk — not the prior bottom-up approach; (2) walkthrough documentation must be updated for all in-scope controls; (3) deficiency evaluation thresholds tightened — more findings will be classified as significant deficiency rather than control deviation; (4) ITGC linkage to ICFR must be explicitly documented. For preparers: re-scope your controls inventory now, update walkthrough documentation, and link ITGC results to ICFR scope before December 15. Source: ComplianceStack SOX Compliance Pulse, Vol. 4 (June 23, 2026).

Q: What are the Q3 2026 ICFR deadlines for each filer type?

Q3 2026 ICFR deadlines: Q2 10-Q filing deadlines have passed for Accelerated/LAF (June 9–13) and SRC (June 16). Non-accelerated filers had until June 30. Next: Q3 10-Q certification deadlines for Accelerated/LAF filers fall in August (recommended August 7 sign-off; filing by August 14). SRC Q3 10-Q due August 14. Non-accelerated filers: August 29. Key: the December 15, 2026 PCAOB cluster means Q4 ICFR workpapers must be complete within 14 days of auditor field work (AS 1215 Amended) — not the prior 45 days. Start Q4 planning now. Source: ComplianceStack SOX Compliance Pulse, Vol. 4 (June 23, 2026).

ComplianceStack Research; ComplianceStack

Vol. 4 · June 23, 2026 Primary Keyword: SOX Section 404 requirements | Canonical: /sox-pulse-weekly/2026-06-23 ← SOX Pulse Hub

1 SOX Enforcement Watch

No New Named Enforcement Actions — Week of June 16–23, 2026

Bottom line: No new SEC or PCAOB SOX-specific enforcement actions published this week. The SEC's SOX enforcement group, announced March 31, 2026, is still in formation. This is the fourth consecutive quiet week. Named cases typically trail policy infrastructure by 12–18 months. The window for proactive remediation continues through mid-2026.

Live Data Note

This publication tracks named SEC and PCAOB enforcement actions from public releases. Enforcement data becomes searchable on SEC.gov typically 4–6 weeks after actions are filed. Weeks without named actions do not imply absent investigation activity. For real-time tracking, monitor SEC Enforcement Releases directly at sec.gov/divisions/enforce/enforceactions.html.

Reference baseline sources:

SEC Enforcement Releases: 2025-041 (Feng), 2025-095 (NuScale), 2025-068 (MicroStrategy), 2025-112 (MathWorks), 2024-089 (Primoris)
SEC Release 2026-46 (Filer Reform S7-2026-15)
PCAOB Quality Control Standards (QC 1000, AS 2201, AS 1215)

2 Controls Intelligence

Section 404 Deep Dive: ICFR Testing Gaps That Produce Material Weaknesses

Section 404 requires management to assess and report on the effectiveness of internal control over financial reporting (ICFR). The assessment itself is not the hard part. The hard part is the testing that supports the assessment — and the five gaps below represent where ICFR programs consistently break down, producing material weaknesses that trigger SEC inquiries and 8-K Item 4.02 disclosure obligations.

What Section 404 Requires (15 USC §7241(a))

Statutory basis: Section 404(a) requires management to assess and report on the effectiveness of ICFR annually in the 10-K. Section 404(b) requires independent external auditor attestation for large accelerated filers ($700M+ public float). The filer categories and their specific obligations are defined in SEC rules and PCAOB standards.

Filer Obligations Under Section 404

Filer Type	404(b) Auditor Attestation	404(a) Management Assessment	ICFR Disclosure	Material Weakness Disclosure Trigger
Large Accelerated Filer (LAF) $700M+ public float	Required — annual auditor attestation	Required — management assessment	Required — ICFR effectiveness disclosure	Any material weakness triggers 8-K Item 4.02 + 10-K ICFR report disclosure
Accelerated Filer $75M–$700M public float	Required — annual auditor attestation	Required — management assessment	Required — ICFR effectiveness disclosure	Any material weakness triggers 8-K Item 4.02 + 10-K ICFR report disclosure
Non-Accelerated Filer Under $75M public float	Not required	Required — management assessment	Required — ICFR disclosure in 10-K	Management must disclose any material weakness; 8-K Item 4.02 applies if discovered
Smaller Reporting Company (SRC) SRC designation	Exempt from 404(b) auditor attestation	Required — management assessment	Required — ICFR disclosure in 10-K	Material weakness disclosure still required if identified

Note: Proposed SEC rule S7-2026-15 (comment deadline July 6, 2026) would raise the LAF threshold from $700M to $2B public float, exempting ~2,200 additional companies from 404(b) attestation. If finalized, this would be the most significant filer reform since SOX 404 was implemented.

The Five ICFR Testing Gaps That Produce Material Weaknesses

ICFR Testing Gap Analysis — Where Programs Break Down

Gap 1 — Incomplete transaction-level control mapping: Entity-level controls (culture, tone at the top, audit committee oversight) are tested thoroughly, but the transaction-level controls (approval workflows, reconciliation procedures, cutoff testing) are not fully mapped. The result: a management assessment that covers entity-level controls but misses transaction-level gaps that can produce material misstatements.
Gap 2 — No testing of information relied on from IT general controls (ITGC): ITGC results (access controls, change management, operations, monitoring) are not linked to the ICFR scope. The financial systems and applications that feed into the financial statements are controlled by ITGC, but the ICFR test plan doesn’t include testing whether those ITGC are operating effectively. Result: the information produced by entity (IPE) that flows into financial reporting has no tested control environment.
Gap 3 — Segregation of duties gaps in journal entry approval: The same person initiates and approves journal entries, or the IT system doesn’t enforce segregation in the posting workflow. This is consistently cited in PCAOB inspection reports as a top deficiency. In practice: if one person can both create and approve an entry, they can post fictitious transactions without detection.
Gap 4 — Subsequent-events review not integrated with ICFR: The Q4 subsequent-events review is conducted as a standalone procedure after year-end, but its findings are not integrated into the ICFR assessment. New facts discovered in January and February — after the controls testing period ended — may represent control failures that should be reflected in the ICFR opinion.
Gap 5 — Management review controls run but not documented: The control activity runs (e.g., manager reviews the reconciliation, reviews the aged receivables report, approves the adjustment) but the execution is not documented. PCAOB inspectors consistently find that where there is no documentary evidence, there is no effective control. Operating effectiveness cannot be demonstrated without documentation.

What This Means for You

The five gaps above are not hypothetical. Each is cited in PCAOB inspection reports in multiple consecutive years. The question for your ICFR program is not “do we have a policy?” — it’s “can we demonstrate the control operated in the testing period with contemporaneous documentation?”

PCAOB AS 2201 (Amended) — Effective December 15, 2026

Top-down, risk-based ICFR audit approach — re-scope your controls inventory now

Top-down scope: Auditors start with entity-level controls and scope down to specific accounts/disclosures based on risk. This replaces the prior approach of starting at the account level and building up.
Walkthrough documentation: All in-scope controls must have updated walkthrough documentation reflecting the current process. Stale walkthroughs are a top PCAOB finding.
Deficiency evaluation thresholds tightened: More findings will be classified as significant deficiency rather than control deviation. The bar for passing ICFR without findings is higher.
ITGC linkage explicit: Auditors must explicitly document how ITGC results inform ICFR scope. ITGC failures that affect financial reporting must be reflected in the ICFR opinion.
AS 1215 (Amended): 14-day audit documentation deadline (from 45 days) — firms must finalize workpaper documentation within 14 days of field work completion.
QC 1000: Firm-wide quality control systems — ask your audit firm how their QMS addresses the December 15 effective date.

Source: PCAOB AS 2201 (Amended); PCAOB Quality Control page; SEC Staff Guidance 2007 (ICFR)

3 Action Item of the Week

Build Your ITGC Linkage Matrix Before Q3

📋 Map your ITGC to financial statement assertions before August filing deadlines.

ITGC deficiencies are the top PCAOB finding category for 6+ consecutive inspection cycles. If your ITGC results are not linked to ICFR scope, your 404(b) auditor will find the gap. Build the linkage matrix now.

Run your SOX Pulse → Free, no login

What to Build This Week

ITGC Linkage Matrix — 4-Step Process:

Map ITGC to financial statement assertions: Access controls (who can access GL, who can post entries), change management (who can modify financial system configurations), operations (batch processing integrity), monitoring (exception reporting). Each ITGC domain maps to specific financial statement assertions (completeness, accuracy, cutoff, existence).

Test ITGC operating effectiveness: For each ITGC in scope, document the test procedure, the sample size, the exception found (if any), and the conclusion. This feeds directly into the ICFR test plan and must be completed before year-end fieldwork.

Link ITGC results to ICFR scope: If ITGC access control has an exception, document whether it affects the ICFR conclusion. An ITGC failure that doesn’t link to a financial assertion may be a control deviation; one that does link may be a significant deficiency or material weakness.

Document in audit workpapers: The linkage matrix, test results, and conclusion must be documented in the ICFR workpapers. Post-December 15, AS 1215 requires this documentation within 14 days of field work completion — start building the documentation discipline now.

Why this week: Q3 10-Q filing deadlines begin in August. Accelerated filers recommended sign-off: August 7. Accelerated/LAF filing deadline: August 14. Non-accelerated: August 29. ITGC linkage matrix review should be complete before you begin Q3 close procedures.

Get your personalized SOX readiness score

Section 302/404/906 status — free, no login required

Run SOX Pulse →

4 Regulatory Radar

Q3 Deadlines & Upcoming Rule Changes

Q3 2026 Filing Deadlines

Filer Type	Q2 Status	Q3 10-Q Certification	Q3 10-Q Filing	Notes
Large Accelerated Filer	CompletePassed	August 7, 2026	August 14, 2026	Certification sign-off 7 days before filing
Accelerated Filer	CompletePassed	August 7, 2026	August 14, 2026	Same as LAF; 404(b) attestation required
Non-Accelerated Filer	June 30Passed	August 22, 2026	August 29, 2026	40-day window; 404(a) management assessment only
Smaller Reporting Co.	June 16Passed	August 7, 2026	August 14, 2026	SRC extension; 45-day window; 404(b) exempt

SEC Rulemaking Pipeline — Action Required Before July 6

1 Filer Status Framework Reform (File S7-2026-15)

Proposed: Raises LAF threshold from $700M to $2B public float; adds 60-month seasoning requirement (company must have been below threshold for 5 consecutive years); exempts ~2,200 additional companies from 404(b) auditor attestation. Economic analysis estimates $1.1B annual savings for newly exempt filers.

Comment deadline July 6, 2026: If your company would newly qualify as non-accelerated or LAF-eligible, submit a comment at sec.gov/rules/submitcomment.htm. This is the most significant filer reform in SOX 404 history.

2 Semiannual Reporting Proposal

Proposed: Allow companies to adopt semiannual (rather than quarterly) reporting. Effect: Section 302 certifications drop from 4/year to 2/year; Section 906 certifications similarly reduced. Does not affect Section 404 ICFR frequency.

Comment deadline July 6, 2026: If your organization has a position on reporting frequency, submit a comment.

December 15, 2026 — The PCAOB Standard Cluster

Six PCAOB standards change simultaneously — 6 months away

AS 2201 (Amended) — Top-down, risk-based ICFR audit approach. Re-scope your controls inventory now.
AS 1215 (Amended) — 14-day audit documentation deadline (from 45 days). Workpaper discipline required.
QC 1000 — Firm-wide quality control systems. Ask your audit firm how their QMS addresses this.
AS 2901 — Modernized materiality standard effective for fiscal years ending December 15, 2026+.
AS 1220 (Amended) — Engagement quality review standards updated for AS 2201 interdependency.

Source: PCAOB Quality Control page; SEC Press Release 2026-46; PCAOB Release No. 2024-005

← SOX Compliance Pulse Hub · View all weekly issues