SOX 404(b) Exemption for Non-Accelerated Filers and Emerging Growth Companies: What Still Applies

Many small registrants hear that they are "exempt from SOX 404" and conclude they have no internal control obligations. The exemption is narrower. It removes one requirement, the auditor's attestation on ICFR, and leaves management's own evaluation, the quarterly evaluations and the officer certifications in place. This post sets out what falls away and what stays, and how a CPA firm should scope work for such a client.

What the statute says

Section 404(a) of the Sarbanes-Oxley Act directs the SEC to require each annual report to state management's responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting, and to contain management's assessment, as of the end of the most recent fiscal year, of the effectiveness of that structure and procedures.

Section 404(b) requires the registered public accounting firm that prepares or issues the audit report to attest to, and report on, management's assessment. The text excludes issuers that are emerging growth companies. Section 404(c) says subsection (b) does not apply to any audit report prepared for an issuer that is neither a large accelerated filer nor an accelerated filer. The definitions of those filer categories are in Rule 12b-2. See /us/blog/accelerated-filer-large-accelerated-filer-smaller-reporting-company-icfr-thresholds.

Item 308 of Regulation S-K matches this: management's report is required in all cases, and the attestation report of the registered public accounting firm is required of accelerated and large accelerated filers, with emerging growth companies excluded.

What stays in place

1. Management's annual assessment. Item 308(a) requires management's statement of responsibility, the framework used, management's assessment of effectiveness as of fiscal year-end, and disclosure of any material weakness. Management is not permitted to conclude ICFR is effective if there is a material weakness.
2. A suitable framework. Rule 13a-15(c) requires evaluation using a suitable, recognized control framework established by a body that has followed due-process procedures. COSO's 2013 framework is the common one. The rule also says an evaluation performed in accordance with the SEC's interpretive guidance satisfies the requirement.
3. Quarterly evaluations. Rule 13a-15(b) requires management, with the principal officers, to evaluate disclosure controls and procedures as of the end of each fiscal quarter. Rule 13a-15(d) requires evaluation of any change in ICFR during each quarter that materially affected or is reasonably likely to materially affect ICFR. See /us/blog/rule-13a-15-quarterly-evaluations-disclosure-controls-and-changes-in-icfr.
4. Officer certifications. Section 302 certifications continue to cover design and evaluation of internal controls and disclosure of deficiencies and fraud to the auditors and audit committee. See /us/blog/sox-302-and-906-certifications-versus-section-404-reporting.
5. Audit committee requirements under Rule 10A-3 for listed issuers, including complaint procedures. See /us/blog/audit-committee-complaint-procedures-rule-10a-3-and-whistleblower-intake.

What the SEC guidance says about scaling

The SEC's interpretive guidance for management was written to let small registrants scale the evaluation. It says management may use a top-down, risk-based approach, that documentation is tailored to size and complexity, and that in smaller companies management's daily interaction with controls may provide sufficient evidence of operation when operations are centralized and personnel limited. See /us/blog/smaller-company-icfr-evidence-from-daily-interaction-with-controls. The guidance also says entity-level controls can be designed with enough precision to address a financial reporting risk, in which case management may not need to identify additional controls for it.

Worked scoping example

A non-accelerated filer with $60 million of revenue, a 12-person finance team and one ERP asks its CPA firm for help with its first management assessment.

There is no auditor attestation, so no PCAOB AS 2201 audit of ICFR. The external audit of the financial statements still considers controls as the auditor's standards require. The firm must keep its role clear. A firm that is the company's financial statement auditor faces independence limits on performing management functions, including preparing management's ICFR assessment. If the firm is not the auditor, it can assist management as an advisor, but management owns the assessment and the conclusion.

Emerging growth company notes

Emerging growth companies are excluded from the 404(b) requirement by the statute's text while they hold that status. The exclusion reaches only the auditor attestation. Management's assessment obligation under 404(a) is a separate requirement that the emerging growth company exclusion in 404(b) does not remove.

Common misunderstandings

• "Exempt" means no controls work. In fact management still evaluates, certifies and discloses.
• A clean financial statement audit equals effective ICFR. The auditor of a non-accelerated filer does not opine on ICFR.
• Quarterly change evaluations are only for large companies. They apply to every registrant under Rule 13a-15.

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• Sarbanes-Oxley Act section 404(a) to (c), 15 U.S.C. 7262: https://www.law.cornell.edu/uscode/text/15/7262
• SEC, 17 CFR 229.308, Item 308(a) and (b): https://www.ecfr.gov/current/title-17/section-229.308
• SEC, 17 CFR 240.13a-15(a) to (f): https://www.ecfr.gov/current/title-17/section-240.13a-15
• SEC, Release No. 33-8810, Sections II.A.1.c and II.A.2.b: https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error