SOX section 404 asks two different people to look at the same controls. Management must assess internal control over financial reporting (ICFR) and say whether it is effective; for many companies, the external auditor must then give a separate opinion on that ICFR. The first duty is often called 404(a). The second is called 404(b). They are different reports, written by different people, for the same year-end.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of SOX section 404 and PCAOB Auditing Standard 2201, as described in secondary summaries. The statute, SEC rules and the PCAOB standard are primary documents that were not opened for this guide, so check their current text. Filer-status tests and thresholds that decide who needs the auditor's attestation are left out on purpose; confirm them with the SEC.
What ICFR means
ICFR is the process a company uses to give reasonable assurance that its financial reporting is reliable and its financial statements are prepared in line with the applicable accounting framework. It covers things like approvals, reconciliations, access to systems and the period-end close. It does not cover every operational control in the business.
If you want the wider picture of how SOX compares with India's own regime, read SOX controls vs internal financial controls in India first.
Part one: management's assessment
Management means the people running the company, usually the CEO and CFO with a finance and internal audit team behind them. Under section 404(a), management must:
- state that it is responsible for establishing and maintaining ICFR;
- assess ICFR as of the fiscal year-end against a recognised framework;
- state its conclusion on whether ICFR is effective;
- name the framework it used. In practice this is almost always the COSO Internal Control framework. See COSO 2013 in practice.
Management cannot conclude that ICFR is effective if it has found a material weakness. A material weakness is a serious control failure; see how to classify deficiencies.
Management must also have evidence for its conclusion. That means documented controls, documented testing and a record of deficiencies and how they were fixed. "We believe it works" is not an assessment.
Part two: the auditor's attestation
Attestation means an independent opinion on someone else's assertion. Under section 404(b), the company's registered auditor examines management's assessment and gives an opinion on whether the company maintained effective ICFR. This is done under PCAOB Auditing Standard 2201, which treats it as an audit of ICFR integrated with the audit of the financial statements.
Key points about the auditor's work:
- It is a top-down approach: the auditor starts with the financial statements, finds the risks of material misstatement and then identifies the controls that address them.
- The auditor tests design and operating effectiveness of those controls. See walkthroughs and testing.
- The auditor forms its own opinion. It does not simply agree with management.
- A material weakness leads to an adverse opinion on ICFR, even if the financial statements themselves are not misstated.
Not every company needs this second report. The requirement depends on the type of SEC filer. The details are set by law and SEC rules, and they have been amended over the years, so check the current position for the company in front of you.
Side by side
| Management assessment (404(a)) | Auditor attestation (404(b)) | |
|---|---|---|
| Who | Management, usually CEO and CFO | The registered public accounting firm |
| What is produced | Management's report on ICFR | Auditor's report with an opinion on ICFR |
| Basis | A recognised framework, usually COSO | PCAOB AS 2201 |
| Independence | Not independent; management owns the controls | Independent of the company |
| Required for | Companies subject to the rule | Only certain filers; check current rules |
| If a material weakness exists | Cannot conclude ICFR is effective | Adverse opinion on ICFR |
Where the work overlaps
Auditors can use evidence produced by management and the internal audit team, depending on how objective and competent those people are. This is why many companies document and test early. Good management testing reduces surprises in the auditor's work. It does not replace the auditor's own judgement, especially for higher-risk areas.
A simple year plan
- Early in the year, confirm the scope: which entities, accounts and processes matter.
- Document the key controls and confirm that the design is sound.
- Test operating effectiveness at interim dates, then roll forward to year-end.
- Log every deficiency, evaluate it and fix what you can before year-end.
- Write the management report only after the evaluation is complete.
For automation ideas on the testing step, see ICFR automation with AI.
Frequently Asked Questions
Is 404(a) the same as 404(b)?
No. 404(a) is management's own report. 404(b) is the auditor's separate opinion on ICFR. A company can have the first without the second.
Does the auditor's attestation replace the financial statement audit?
No. Under AS 2201 the two audits are integrated and done together, but each produces its own opinion.
Can management conclude ICFR is effective if the auditor found a material weakness?
Management must reach its own conclusion on the evidence. But if a material weakness exists as of year-end, management cannot conclude that ICFR is effective.
Does SOX 404 apply to Indian companies?
Only where the company is an SEC registrant, or is a subsidiary consolidated into one. See SOX for Indian subsidiaries.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error