If you plan to list in the US, SOX readiness is a project that starts well before the first annual report. Newly public companies get a limited transition period for management's internal control report, but it is not a reason to wait. This roadmap sets out the phases, the owners and the evidence to build.
Last reviewed: 17 October 2026. Facts checked. We opened 17 CFR 229.308 (Cornell LII), including Instruction 1 on the transition period for newly public companies; 15 U.S.C. 7262 (Cornell LII); and the SEC's 2007 interpretive guidance (Release 33-8810, govinfo.gov; first 100,000 of about 161,000 characters read). The SEC small business page on newly public companies returned a 503 error. We did not open PCAOB AS 2201 (403 error), a Big Four guide or any emerging growth company definition, so we do not define EGC status or filer categories here. Check your status with US counsel.
SOX applies to companies subject to US securities law. An Indian company is covered only if it is an SEC registrant, or part of a group that is. Listing only in India does not bring SOX 404 in. For subsidiaries of US-listed groups, see SOX for Indian subsidiaries.
What the transition relief says
Item 308 has an instruction for newly public companies. A registrant that has not yet been required to file an annual report for the prior fiscal year need not include management's assessment or the auditor's attestation report. The first annual report must say that it does not include them because of a transition period established by SEC rules for newly public companies.
Section 404 itself says the auditor attestation does not apply to emerging growth companies, or to issuers that are neither large accelerated filers nor accelerated filers. We read both on Cornell LII.
Points we did not confirm on a page we opened: how the relief applies to a company that already filed Exchange Act reports before its IPO, and exact timing for the second annual report. Search results suggested the relief is limited to the first annual report and does not apply to prior filers. Treat that as unverified until your counsel confirms.
Also, the relief does not remove the need for controls. Management's certifications and the quality of your financial statements still depend on them. See SOX 302 vs 404.
The roadmap
| Phase | Aim | Outputs |
|---|---|---|
| 1. Gap assessment | Know where you stand | Scoping memo, gap list |
| 2. Design | Build the control framework | Risk control matrix, policies |
| 3. Implement | Put controls into daily work | Owners, calendars, evidence habits |
| 4. Test | Check design and operation | Walkthroughs, test workpapers |
| 5. Remediate | Fix what fails | Remediation log, retests |
| 6. Sustain | Run it every year | Calendar, training, reporting |
Phase 1: Gap assessment
Choose a framework. Management's report must identify the framework used. COSO is the usual one, see COSO 2013. Scope top-down: significant accounts, assertions and key controls. Set materiality. Use the COSO self-assessment tool to spot gaps.
Phase 2: Design
Build the risk control matrix with the SOX RCM template. Cover entity-level, process and IT controls, see SOX controls explained. Write review controls with thresholds, see management review controls.
Phase 3: Implement
Name an owner for each control. Put each on the close calendar. Teach owners what evidence to keep. Fix known weak points first: user access, change management, the financial close and reports used in controls. Our pieces on access, change and IPE help here.
Phase 4: Test
Walk through each key process, then test operation. Use independent testers. See walkthroughs and testing and the control test workpaper.
Phase 5: Remediate
Classify gaps, find root causes, fix and retest. See SOX remediation. The SEC guidance says management may not conclude controls are effective if a material weakness exists, so leave time.
Phase 6: Sustain
Run the cycle every year. Review scope when the business changes. Report status to the audit committee.
IPO-specific points
- Your auditor and counsel will ask about control weaknesses found during the IPO audit. Fix and track them early.
- Systems built for a private company often lack change and access controls. Fix these before listing.
- Finance team skills matter. Gaps in technical accounting are a common source of weaknesses.
- Group and subsidiary reporting needs to feed the consolidation with controls.
- Keep a single evidence repository from day one.
Frequently Asked Questions
Do I need SOX if I list only in India?
Not under US law. Indian listing brings other rules. See SOX controls vs IFC for the Companies Act link.
Does the transition period mean I can ignore controls?
No. It affects the timing of management's report. Controls still matter for your financial statements.
When should I start?
Early enough to design, run and retest controls before your first report is due. Agree timing with your advisers.
Do I need an auditor attestation?
Section 404 says it does not apply to emerging growth companies or to issuers below certain filer categories. Confirm your status with counsel.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error