SOX section 302 makes the CEO and CFO personally certify each periodic report a company files with the SEC. Section 404 requires an annual assessment of internal control over financial reporting (ICFR) by management and, for some filers, an opinion from the auditor. One is a signed statement about each report. The other is a yearly evaluation of the control system behind the numbers.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of SOX sections 302, 404 and 906 and the related SEC rules, as described in secondary summaries. The statute and SEC rules are primary documents that were not opened for this guide; check their current text, especially the exact wording of the certification. We did compare the list of certification items in section 302 with the text of 15 U.S.C. 7241. No penalties or thresholds are quoted.
The short version
| Section 302 | Section 404 | |
|---|---|---|
| What it is | Certification of a periodic report | Assessment of ICFR |
| Who signs | CEO and CFO (principal executive and financial officers) | Management reports; the auditor reports separately if required |
| How often | With each periodic report | Once a year, as of year-end |
| Subject | The report and the disclosure controls | Internal control over financial reporting |
| Auditor involved | No separate auditor opinion | Auditor attests for certain filers only |
What section 302 requires
Section 302 sits behind a certification the signing officers include with each periodic report. In plain terms, the CEO and CFO certify that:
- they have reviewed the report;
- to their knowledge it contains no untrue statement of a material fact and leaves out nothing that would make it misleading;
- the financial statements and other financial information fairly present the company's financial position, results and cash flows;
- they are responsible for disclosure controls and for internal control over financial reporting, and have evaluated them;
- they have told the auditors and the audit committee about significant deficiencies, material weaknesses and any fraud involving management or employees with a significant role in internal control.
Disclosure controls are the procedures that make sure information the company must disclose is collected and reported on time. They are wider than ICFR. They cover narrative disclosures as well as the accounts.
The last point matters for audit teams. Under 302, deficiencies found during the quarter travel upward. That is why the quarter-end process often includes a sub-certification: each process owner or entity head signs a confirmation to the CFO. Sub-certifications are a company practice, not a statutory requirement in themselves.
What section 404 requires
Section 404 is the annual control assessment. Management must assess ICFR against a recognised framework such as COSO and report whether it is effective. For certain filers, the registered auditor must also give an opinion. The details are in our guide to management assessment vs auditor attestation.
How the two connect
The two sections feed each other.
- A 404 deficiency found at year-end often should have surfaced in 302 sub-certifications earlier in the year.
- A 302 certification is only credible if the signers have a control system they can rely on. The 404 work supplies that evidence.
- Both rely on the same classification of deficiencies. See how to classify a deficiency.
A related section: 906
Section 906 is a separate certification. It is a statement from the CEO and CFO that the periodic report fully complies with the relevant securities law requirements and fairly presents the financial condition and results of operations. It is distinct from 302, and is attached to the report as an exhibit. Because the wording and liability differ from 302, legal counsel should review it.
Who does the work in a team
| Task | Typical owner |
|---|---|
| Sub-certifications each quarter | Entity finance heads and process owners |
| Disclosure committee review | CFO, controller, legal, internal audit |
| Control testing for 404 | Internal audit or a SOX compliance team |
| Deficiency log and evaluation | SOX programme manager with the controller |
| Attestation (if required) | External auditor |
Common mistakes
- Treating 302 as a formality and signing without checking the deficiency log.
- Mixing up disclosure controls and ICFR. They overlap but are not the same thing.
- Running 404 testing only once, close to year-end, so no quarterly signal reaches the 302 signers.
- Forgetting that fraud involving employees with a significant role in internal control must be reported to the audit committee and auditors.
Frequently Asked Questions
Is section 302 quarterly and section 404 annual?
302 applies to each periodic report, so it recurs through the year. 404 is an annual assessment. Check the form types for the filer in question, because foreign private issuers file different reports from domestic filers.
Does a 302 certification need an auditor opinion?
No. The certification is by the officers. The auditor is not asked to opine on it.
Can a company pass 302 while failing 404?
They test different things. A company could disclose a material weakness in its annual ICFR assessment and still have officers who certify the report, as long as the disclosure is accurate and complete.
Do Indian subsidiaries sign 302 certifications?
Typically the parent's officers sign. Subsidiary heads often give internal sub-certifications to support them. See SOX for Indian subsidiaries.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error