Live Q3 Enforcement Findings & Historical Baseline — Week of July 14, 2026
Bottom line: No new named SEC or PCAOB SOX-specific enforcement actions were confirmed for the week of July 14, 2026. This issue synthesizes the week’s verified SEC/PCAOB activity (none new beyond the prior baseline) with the Section 404(b) auditor-attestation controls topic and the material-weakness disclosure obligations every LAF/Accelerated filer should be preparing for Q3 sign-off. Verify current actions at sec.gov/enforcement/current before making compliance decisions.
Research note: The SEC’s SOX enforcement group, formed March 31, 2026, is in early-stage operational ramp. Named cases typically trail policy infrastructure changes by 12–18 months. The enforcement pattern to build posture against remains the 2024–2025 baseline below. The action this week is on the controls side — getting the 404(b) attestation package and the material-weakness disclosure protocol ready before Q3 sign-off.
Reference Enforcement Baseline (2024–2025) — Historical Context
These are verified enforcement cases from SEC Enforcement Releases. Listed as historical baseline only — not current-week actions:
Violation: No disclosure committee; no formal review procedure; repeated Section 302 failures across multiple quarters
Outcome: $3.5M civil penalty (Rel. 2025-112); independent consultant required
404(b) relevance: ICFR-related deficiencies were central to the underlying controls failures. The 404(b) auditor would have identified the deficiencies under standard AS 2201 walkthroughs — the absence of a documented evaluation process short-circuits the entire attestation.
Violation: ICFR deficiency known in Q3; not disclosed until Q4 annual report; CEO/CFO certified to accuracy with known control failure
Outcome: $2.75M civil (Rel. 2025-095); CEO + CFO each $150K individual penalty
404(b) relevance: A known material weakness undisclosed in interim periods is a textbook 8-K Item 4.02 trigger. The 404(b) attestation would have flagged the disclosure timing — the auditor’s report on ICFR effectiveness goes to whether management’s assessment is fairly stated.
Violation: Revenue recognized before earned; ICFR failed to catch manipulation; CEO/Controller certified accuracy
Outcome: Each $250K civil penalty (Rel. 2025-068); restatement required
404(b) relevance: Revenue recognition controls failed at the assertion level — existence, accuracy, cutoff. The restatement that followed would have required an 8-K Item 4.02 filing within 4 business days of the determination. Auditors under AS 2201 would have reported a material weakness.
Violation: False Section 906 certification; $20M in sham transactions; CFO certified accuracy he hadn’t verified
Outcome: CFO permanently barred (Rel. 2025-041); $100K+ disgorgement
404(b) relevance: Accounts payable controls completely circumvented — the entity-level control environment had no chance to detect or prevent the fraud. A 404(b) attestation that includes entity-level controls testing would have surfaced the tone-at-the-top and control-environment failures.
Violation: Section 404 deficiency identified; remediation started; then abandoned without completion
Outcome: Public enforcement action (Rel. 2024-089)
404(b) relevance: Material change in ICFR during the quarter (abandoned remediation) was not disclosed in Item 9A in subsequent quarters. This is one of the five material-weakness disclosure triggers discussed below — disclosure obligation continues through remediation, not just at identification.
All five baseline cases share a common thread: information existed inside the company but either failed to reach the certifying officer, or the officer certified anyway. Under Section 404(b), the auditor’s separate attestation adds a second look — but the disclosure obligations (10-K Item 9A and 8-K Item 4.02) remain management’s. The 404(b) attestation does not eliminate disclosure responsibility; it amplifies the consequences of missing it.
Sources (historical baseline):
- SEC Enforcement Releases: 2025-112 (MathWorks), 2025-095 (NuScale), 2025-068 (MicroStrategy), 2025-041 (Feng), 2024-089 (Primoris)
- Verify current actions: sec.gov/enforcement/current
Section 404(b) Auditor Attestation & Material Weakness Disclosure: What Q3 Requires
Section 404(b) auditor attestation is the second pair of eyes on management’s ICFR assessment. Combined with the material-weakness disclosure regime under Item 9A and 8-K Item 4.02, it is the enforcement-prone component of the SOX 404 stack. The cases above show how the disclosure trigger fires — the content below shows how to be ready when it does.
Statutory Basis: 15 USC §7262 (Section 404)
What the statute requires: Section 404(a) requires every issuer’s management to assess and report on the effectiveness of internal control over financial reporting (ICFR) annually. Section 404(b) requires that, for accelerated filers, the issuer’s independent external auditor attest to and report on management’s assessment of ICFR effectiveness. The attestation must be conducted in accordance with PCAOB Auditing Standard 2201 and is filed as a separate report alongside the 10-K. Material-weakness disclosure flows from Item 9A of the 10-K and Item 4.02 of Form 8-K. [Source: 15 USC §7262(a) and (b); PCAOB AS 2201; SEC Rule 13a-15; 17 CFR 240.13a-15]
Filer Applicability: Who Is Subject to 404(b) Auditor Attestation
| Filer Type | Public Float Threshold | 404(b) Auditor Attestation | 404(a) Management Assessment |
|---|---|---|---|
| Large Accelerated Filer (LAF) | $700M+ public float | Required — annual independent auditor attestation | Required — management assessment of ICFR |
| Accelerated Filer | $75M–$700M public float | Required — annual independent auditor attestation | Required — management assessment of ICFR |
| Non-Accelerated Filer | Under $75M public float | Not required | Required — management assessment of ICFR |
| Smaller Reporting Co. (SRC) | SRC qualification thresholds | Exempt from 404(b) auditor attestation | Required — management assessment of ICFR |
Note: Proposed SEC rule S7-2026-15 (comment deadline July 6, 2026) would raise the LAF threshold from $700M to $2B public float, exempting ~2,200 additional companies from 404(b) attestation. If finalized, this would be the most significant filer reform since SOX 404 was implemented. Until the rule is final, all LAF ($700M+) and Accelerated ($75M–$700M) filers remain subject to 404(b) auditor attestation.
What Is a Material Weakness — The PCAOB AS 2201 Standard
PCAOB Auditing Standard 2201 defines a material weakness as: a deficiency, or combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented, or detected, on a timely basis. The severity threshold is reasonable possibility (more than remote) of a material misstatement. This is the same standard for the 404(b) auditor’s attestation and for management’s Item 9A disclosure.
5 Material-Weakness Disclosure Triggers
- Trigger 1: Identified material weakness in ICFR assessment — Management’s annual 404(a) ICFR assessment concludes that one or more material weaknesses exist. Disclosure required in 10-K Item 9A including the nature of the weakness and management’s remediation plans.
- Trigger 2: Restatement of prior financial statements due to ICFR failure — A prior-period financial statement is restated because ICFR failed to prevent or detect a material misstatement. Triggers 8-K Item 4.02 disclosure within 4 business days of the determination.
- Trigger 3: Independent auditor unable to attest to management’s ICFR assessment — The 404(b) auditor issues an opinion that is qualified, adverse, or disclaimed due to a scope limitation or because ICFR is not effective. Disclosure required in 10-K Item 9A and triggers 8-K Item 4.02 if a prior attestation is no longer reliable.
- Trigger 4: Material change in ICFR during the quarter that is not remediated before filing — Management identifies a material change in ICFR during the quarter (remediation started and abandoned, new deficiency discovered, fraud-related control failure) that has not been remediated by the filing date. Disclosure required in 10-Q Item 4 (Controls and Procedures) and, if material weakness, in 8-K Item 4.02.
- Trigger 5: Subsequent discovery of fraud involving management or those with significant control roles — After quarter-end but before filing, fraud is discovered involving senior management or employees in significant ICFR roles. Triggers immediate re-evaluation of ICFR effectiveness; if material weakness is concluded, 8-K Item 4.02 filing required within 4 business days.
Material Weakness vs. Significant Deficiency — The Critical Distinction
| Severity | PCAOB AS 2201 Definition | Disclosure Required |
|---|---|---|
| Material Weakness | Deficiency or combination of deficiencies in ICFR such that there is a reasonable possibility of a material misstatement not being prevented or detected on a timely basis | 10-K Item 9A disclosure; 8-K Item 4.02 within 4 business days of determination; proxy disclosures; audit committee briefing |
| Significant Deficiency | Deficiency or combination of deficiencies in ICFR that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight | Internal communication to audit committee; remediation planning; not a standalone 10-K Item 9A reportable condition; not an 8-K Item 4.02 trigger |
| Control Deviation | An exception in the operating effectiveness of a control that has been determined to be necessary, in the circumstances, for achieving the control objective | Documented in audit workpapers; aggregated for evaluation; not a standalone reportable condition |
Material-Weakness Disclosure Obligations — The 4 Channels
| Channel | What Goes Here | Deadline |
|---|---|---|
| 10-K Item 9A | Annual ICFR effectiveness report — includes management’s assessment, scope of evaluation, framework used (typically COSO 2013), identified material weaknesses, management’s remediation plans | Filed with the annual 10-K (60–90 days after fiscal year-end depending on filer) |
| 8-K Item 4.02 | Non-reliance trigger: company has determined that a previously issued financial statement contains a material misstatement, OR audit report on ICFR is no longer reliable, OR material weakness has been identified that affects prior periods | Within 4 business days of management’s determination |
| Proxy disclosures | Material weaknesses disclosed in risk factors and CEO/CFO biographical sections; audit committee report describes oversight of ICFR and risk management | Filed with annual proxy statement |
| Audit committee briefing | Required for any newly identified material weakness; documented in audit committee minutes with management response and remediation timeline | Promptly upon identification — typically the next regularly scheduled meeting or a special meeting |
Sources:
- 15 USC §7262 (Section 404); Pub. L. 107-204, Title III
- PCAOB Auditing Standard 2201 (An Audit of Internal Control Over Financial Reporting That Is Integrated with an Audit of Financial Statements); AS 2201 paragraphs 10 and 11 (material weakness and significant deficiency definitions)
- SEC Rule 13a-15; 17 CFR 240.13a-15 (disclosure controls and procedures)
- SEC Form 8-K General Instructions; 17 CFR 240.13a-11 (Item 4.02 timing — 4 business days)
- SEC Rule 12b-2; 17 CFR 240.12b-2 (filer status definitions)
Build Your Q3 404(b) Attestation Readiness Package Before Aug 7 Sign-Off
📋 Audit committee review of the Q3 404(b) attestation readiness package before Aug 7 sign-off.
Q3 10-Q certification deadlines: August 7 recommended sign-off (all certifying officers); August 14 filing (LAF/Accelerated/SRC); August 29 filing (Non-Accelerated). If the 404(b) attestation package is not ready before Q3 sign-off, you are certifying on controls the auditor will later have to re-test — and any material weakness found then triggers an 8-K Item 4.02 filing within 4 business days.
Run your SOX Pulse → Free, no loginThree Deliverables Before Aug 7 Sign-Off
Q3 404(b) attestation readiness package:
Why this week: Q3 sign-off target is August 7 for LAF and Accelerated filers. Filing deadlines: August 14 (LAF/Accelerated/SRC) and August 29 (Non-Accelerated). The 404(b) auditor’s attestation work typically runs concurrent with Q3 close — having the readiness package complete before Q3 close procedures begin allows the auditor to test on the same timeline, not after.
Get your personalized SOX readiness score
Section 302/404/906 status — free, no login required
Q3 / Q4 2026 Filing Deadlines & Material-Weakness Disclosure Reminders
2026 SOX Filing Deadline Calendar — Q3 and Q4
| Filer Type | Q3 10-Q (Sept 30 FY) | Q4 / Annual 10-K | 404(b) Attestation |
|---|---|---|---|
| Large Accelerated Filer (LAF) | Nov 14, 2026Soon | March 1, 2027 (60 days) | Annual — with 10-K |
| Accelerated Filer | Nov 14, 2026Soon | March 31, 2027 (75 days) | Annual — with 10-K |
| Smaller Reporting Co. (SRC) | Nov 14, 2026Soon | April 15, 2027 (90 days) | Exempt from 404(b) |
| Non-Accelerated Filer | Nov 28, 2026Soon | April 15, 2027 (90 days) | Exempt from 404(b) |
Material-Weakness Disclosure Deadline Reminders
| Disclosure Channel | Deadline | Notes |
|---|---|---|
| 8-K Item 4.02 (Non-Reliance) | 4 business days from determinationSoon | Triggered by: material misstatement in prior filing; audit report no longer reliable; material weakness affecting prior periods. Clock starts on the determination date, not the auditor withdrawal date. |
| 10-K Item 9A (ICFR report) | With annual 10-K filing | Annual disclosure of management’s ICFR assessment, material weaknesses, remediation plans. Must align with 404(b) auditor’s opinion. |
| 10-Q Item 4 (Controls & Procedures) | With each 10-Q filing | Disclosure of any material changes in ICFR during the quarter. Material weakness disclosure required if not yet remediated. |
| Proxy disclosures | With annual proxy statement | Material weaknesses disclosed in risk factors and audit committee report. CEO/CFO biographical sections may reflect control-related expertise and remediation efforts. |
| Audit committee briefing | Promptly upon identification | Documented in audit committee minutes with management response and remediation timeline. Special meeting may be required. |
Get your personalized SOX readiness score
Section 302/404/906 status — free, no login required