A sub-certification is a signed, dated statement from someone below the CEO and CFO, covering a defined scope, that tells the two officers what they need to know before they sign the Section 302 certification in a Form 10-Q or 10-K. No statute or SEC rule requires one. The rules require the certification itself (Exchange Act Rule 13a-14), a quarterly evaluation of disclosure controls and procedures and of changes in internal control over financial reporting (Rule 13a-15), and two disclosures in the report (Regulation S-K Items 307 and 308(c)). Sub-certifications, the questionnaire behind them, the exception log and the disclosure committee are the machinery most registrants build so that the two signatures rest on something.
The certification cannot be delegated. Rule 13a-14(c) bars signing it under a power of attorney, and it is signed by whoever holds the two offices on the filing date, including an officer who arrived after the quarter ended. So the test of the process is not whether every manager signed. It is whether the quarter’s errors, control failures, control changes, frauds and disclosure items reached the officers, were decided, and went to the audit committee and the external auditor before the filing. A cascade that returns 100 percent clean certifications every quarter is usually producing signatures, not information.
This guide is the operating manual for that process: the cascade, the questionnaire, the calendar, the exception log, the disclosure committee and the Item 308(c) decision, with a model letter and a worked quarter. The side-by-side of Sections 302, 404 and 906 is in SOX 302 vs 404 vs 906, and the rest of the program is in the SOX compliance hub. Rules are cited as read on 10 November 2026; a pending SEC proposal on semiannual reporting has its own section near the end.
In this guide
- What the rules require, and what is practice
- Disclosure controls: what is evaluated each quarter
- Designing the cascade
- The questionnaire
- A model sub-certification letter
- The quarterly calendar
- The exception log and where items go
- The disclosure committee: charter, agenda, minutes
- Evaluating a change in internal control
- Internal audit’s role and its limits
- Worked quarter: Wexcombe Instruments
- Common failures
- If semiannual reporting is adopted
- Questions readers ask
- Related guides
What the rules require, and what is practice
Section 302 of the Sarbanes-Oxley Act (15 U.S.C. 7241) directed the SEC to require, by rule, that the principal executive and principal financial officers certify each annual and quarterly report. The statute speaks only of “internal controls”. It does not mention disclosure controls, sub-certifications or a disclosure committee. The SEC’s rules supply the detail (Rules 15d-14 and 15d-15 are the parallels for companies reporting under section 15(d)):
- The certification. Rule 13a-14 (17 CFR 240.13a-14) requires each principal executive and principal financial officer in office “at the time of filing” to sign one with every Form 10-Q and 10-K. Item 601(b)(31) of Regulation S-K fixes the wording, which must be used exactly, and calls for a separate certification from each officer, filed as Exhibit 31.
- Disclosure controls. Rule 13a-15(a) and (b) require the company to maintain disclosure controls and procedures, and require management, with both officers participating, to evaluate their effectiveness as of the end of each fiscal quarter. Item 307 puts the officers’ conclusion in the report: Part I, Item 4 of the 10-Q and Item 9A of the 10-K.
- Changes in internal control. Rule 13a-15(d) requires management to evaluate, each quarter, any change in internal control over financial reporting (ICFR) that has materially affected it or is reasonably likely to. Item 308(c) puts those changes in the same item of the report.
Everything else is practice. Adopting the rules in August 2002 (Release 33-8124), the SEC said it was not requiring any particular procedures for the evaluation and expected each company to develop a process suited to its business. It did recommend a committee responsible for “considering the materiality of information” and determining disclosure obligations on a timely basis, reporting to senior management, and it suggested members: the principal accounting officer or controller, the general counsel or a senior disclosure lawyer, the principal risk management officer, the chief investor relations officer and people from the business units. The release says nothing about sub-certifications. So there is no prescribed form to comply with, and no sub-certification moves any responsibility off the two people who sign.
What stands behind each clause
The comparison guide linked above reads the five paragraphs one by one. For running the process, the useful view is the document in the quarter’s file that supports each clause.
| Clause | In short | What supports it in the quarter’s file |
|---|---|---|
| 1 | The officer has reviewed the report | Draft circulated with time to read; the officer’s comments tracked; a certification meeting before filing |
| 2 | No untrue statement of a material fact and no misleading omission, to the officer’s knowledge | Disclosure committee minutes; disclosure checklist; legal and risk-factor sweep; sub-certification answers on unreported events |
| 3 | Financial statements and other financial information fairly presented in all material respects, to the officer’s knowledge | Close and review evidence; business unit finance certifications; every number in the notes, MD&A and earnings release tied to support |
| 4(a) | Disclosure controls designed so that material information reaches the officers | The cascade itself: certifier list, questionnaire, committee charter, Form 8-K escalation procedure |
| 4(b) | ICFR designed to give reasonable assurance | Scoping and control documentation from the SOX program, updated for the quarter’s changes |
| 4(c) | Disclosure controls evaluated as of period-end; conclusion in the report | Evaluation memo; committee minute; approved Item 4 wording |
| 4(d) | Any change in the quarter that materially affected ICFR, or is reasonably likely to, disclosed in the report | Change log; Item 308(c) memo with the reasoning on each significant change |
| 5(a) | All significant deficiencies and material weaknesses disclosed to the auditors and the audit committee | Deficiency evaluation memos; a dated letter or minute showing the communication was made before signing |
| 5(b) | Fraud involving management, or other employees with a significant ICFR role, disclosed, whatever the amount | Hotline and investigation summary; the same dated communication |
Two clauses carry more than they appear to. Paragraph 3 is not a statement about GAAP alone: the 2002 release says the fair-presentation statement is not limited by reference to GAAP, and it covers the other financial information in the report, MD&A included. Paragraph 4(a) is the clause the cascade serves: the officers certify that they designed disclosure controls so that material information about the company and its subsidiaries is “made known to us by others” while the report is being prepared. A newly public company may omit the ICFR wording in the paragraph 4 introduction and in paragraph 4(b) until it becomes subject to the ICFR requirements. The rest applies from its first report, which is why a pre-IPO readiness plan builds this machinery before listing.
Disclosure controls: what is evaluated each quarter
Rule 13a-15(e) defines disclosure controls and procedures as the controls and other procedures designed to ensure that information the company must disclose in the reports it “files or submits under the Act” is recorded, processed, summarized and reported within the SEC’s time periods, and is accumulated and communicated to management, including the two officers, in time for decisions about disclosure. Rule 13a-15(f) defines ICFR as the process that provides reasonable assurance about the reliability of financial reporting and the preparation of financial statements under GAAP. The two overlap and neither contains the other; the comparison guide sets them side by side. Three points drive the quarterly work.
- The scope is every report, not only the financial statements. The definition reaches Form 8-K as well as the periodic reports, and the 2002 release says the procedures should capture information relevant to assessing the need to disclose developments and risks in the company’s businesses.
- The evaluation is quarterly; the ICFR assessment is annual. In 2003 (Release 33-8238) the SEC decided not to require quarterly evaluations of ICFR as extensive as the annual one. What is evaluated every quarter is disclosure controls as a whole, plus changes in ICFR.
- The quarterly evaluation may be focused. The same release says management may judge that quarterly evaluations should concentrate on developments since the last evaluation and on “areas of weakness or continuing concern”.
The SEC has brought cases under Rule 13a-15(a) where the charge was the failed flow of information, not a wrong number. In June 2021 First American Financial agreed to pay $487,616 under an order finding that the executives responsible for its public statements about a data vulnerability had not been told that its security staff had identified it months earlier. In February 2023 Activision Blizzard agreed to pay $35 million under an order finding, among other things, that it lacked controls and procedures to collect and analyze employee complaints of workplace misconduct, so management did not assess whether any material issue required disclosure. Both settled without admitting or denying the findings.
How the evaluation is done
No rule prescribes a method. A workable one, run and minuted by the disclosure committee:
- Design current. Certifier list, questionnaire, committee charter and Form 8-K escalation procedure updated for the quarter’s new entities, systems and people.
- Components operated. Every sub-certification in before the committee met; disclosure checklist complete; legal, tax, treasury and IT inputs received; every number in the draft tied to support.
- Outcomes. Late or amended filings, corrected press releases, post-close adjustments, SEC comment letters, and any item that reached the committee from outside the cascade. Each of the last is a design gap to close.
- Read-across from ICFR. A material weakness almost always leads the officers to conclude that disclosure controls were not effective either. In the Q3 2026 edition of the site’s Material Weakness Tracker, 904 companies reported a material weakness and only 14 of them concluded that disclosure controls were effective in the filing that reported it.
- Conclusion. Effective or not effective as of quarter-end, with the basis minuted and the Item 4 wording approved. The SEC’s 2007 guidance for management (Release 33-8810) says an ICFR assessment should not be qualified with exceptions; apply the same discipline here.
Information outside the financial statements
Most of what a 10-Q discloses outside its financial statements is known first by people who are not accountants. This map shows who belongs in the cascade.
| Part of the filing | Information | Who knows first | How it reaches the committee |
|---|---|---|---|
| MD&A (10-Q Part I, Item 2) | Known trends, unusual items, liquidity pressures | Business unit heads, FP&A, treasury | Level 2 certification; unit review of the draft |
| Legal proceedings (Part II, Item 1) | New proceedings and material developments | General counsel; plant and regional managers | Legal certification; claims log; question 9 below |
| Risk factors (Part II, Item 1A) | Material changes since the 10-K | General counsel, risk, security, business heads | Risk-factor sweep before the second meeting |
| Other information (Part II, Item 5) | Form 8-K events not reported; directors’ and officers’ trading arrangements (Item 408(a)) | Corporate secretary | Quarterly confirmation from directors and officers |
| Form 8-K between quarters | A cyber incident judged material (Item 1.05: four business days from that determination); earnings release (Item 2.02); non-reliance on issued statements (Item 4.02) | Security, investor relations, controller | Escalation to the committee chair, outside the quarterly cycle |
Designing the cascade
A cascade should follow knowledge, not the organization chart: the people who sign are the people who would know. A mid-sized company usually needs three levels below the officers; a small one can run with two. Level 3 overlaps with the key control owners in the SOX 404 program, and SOX for control owners explains to them what they are signing.
| Level | Who signs | Scope | Basis | Due |
|---|---|---|---|---|
| 3 | Process and key control owners; plant and entity finance leads | Their own controls, transactions, systems and reports | Own knowledge | One working day after the books close |
| 2 | Business unit heads and controllers; heads of tax, treasury, litigation and claims, payroll, IT, sales operations and investor relations | Everything in the unit or function, including what level 3 reported | Own knowledge and a read of every level 3 return | Two working days later |
| 1 | Chief accounting officer or controller; general counsel; sometimes the COO and CIO | The consolidated statements and the report sections each owns | Level 2 returns, exception log, committee work | Before the certification meeting |
| Officers | CEO and CFO | The whole report: Exhibits 31 and 32 | The certification file | Filing date |
- Scope in writing. Each certification lists the entities, processes, controls, systems and report sections it covers. An unscoped “to the best of my knowledge” covers nothing, so named control ownership comes first.
- Include the functions outside finance. Sales for side agreements, legal for claims, HR for conduct cases, IT for changes and incidents.
- Date it properly. “As of quarter-end and through the date I sign”, with a bring-down the day before filing.
- Cover role changes. When a certifier moved or left in the quarter, the successor signs for the time in post and the level above states in writing how the earlier weeks were covered.
- No transfer of responsibility. The officers stay responsible for what they certify whatever the cascade returns, and the letter should say so.
The questionnaire
Four design rules decide whether a questionnaire produces information. Ask about events, not about compliance, so that “yes” always means there is something to report; require a description, amount, date and document for every “yes”; pre-populate what the SOX office already knows (open deficiencies, logged changes, pending claims) so the certifier confirms completeness instead of retyping; and change two or three questions each quarter to fit its risks. These fifteen extend the seven-topic template in the comparison guide:
| # | Question | Why it is asked | What a “yes” triggers |
|---|---|---|---|
| 1 | Did any key control you own not operate, operate late, or operate differently from its description? | Operating failures surface before testing finds them (clauses 4(b), 5(a)) | Deficiency log entry; deficiency evaluation drafted before the committee meets |
| 2 | Did anyone who performs or reviews a key control change, or was anyone absent for more than two weeks? | People changes are where controls lapse and where roll-forward conclusions break | Change log entry; check that the control ran through the handover |
| 3 | Did any system, report, interface, spreadsheet or service provider used in your controls change? | Feeds the Item 308(c) evaluation and the IT scope | Change log entry; IT and report impact check; 308(c) screen |
| 4 | Do you know of any error in financial information already submitted for this or an earlier period, above the low reporting threshold the controller has set? | Clause 3; the SOX office, not the certifier, decides what is too small to matter | Quantified; corrected or added to the unadjusted differences; cause traced to a control |
| 5 | Did you post, request or approve a manual journal entry after the close deadline, or one outside the normal approval route? | Late and top-side entries are the override route | Entry-level review by the controller, on the lines of journal entry testing |
| 6 | Are there side agreements, verbal commitments, concessions or non-standard terms not yet sent to accounting? | Revenue and liability completeness; sales knows first | Contract to technical accounting within two days; cutoff checked |
| 7 | Is any significant estimate or reserve in your area resting on an assumption you now think is out of date? | Clause 3; estimates drift by inertia | Controller review before the earnings release |
| 8 | Are there transactions with related parties, or with entities in which an employee has an interest, not previously reported? | Disclosure completeness | Legal and controller review; related-party schedule updated |
| 9 | Have you received a claim, legal letter, regulatory inquiry or notice of violation that the legal department does not already have? | Clause 2; contingencies and legal proceedings | General counsel the same day; contingency assessed |
| 10 | Do you know of or suspect fraud, theft, falsified records, or pressure to change a result, involving anyone? | Clause 5(b) turns on who was involved, not on the amount | No local investigation; routed under the fraud protocol; committee decides 5(b) status |
| 11 | Has anything happened since quarter-end that could affect the statements or disclosures: a lost customer, an outage, a cyber incident, a recall? | Subsequent events; Form 8-K triggers | Committee chair the same day; 8-K screen |
| 12 | Is anything in the draft report sections assigned to you inaccurate, incomplete or out of date? | Clause 2; section owners read their own text | Mark-up to the SEC reporting lead; section re-tied |
| 13 | Is any open deficiency or remediation action in your area behind its date? | Clause 5(a); a compensating control may be carrying more than assumed | Deficiency log updated; severity re-evaluated |
| 14 | Did anyone who reports to you fail to return a sub-certification, or return one you doubt? | Completeness of the cascade itself | Named follow-up; the gap covered in writing by the level above |
| 15 | Is there anything else the CEO and CFO should know before they sign? | Clause 4(a); the open door | Read by the committee chair personally |
An incomplete “yes” goes back to the certifier. A “no” from a certifier whose unit already has an item in the deficiency log, change log or claims log is challenged, which is the point of pre-populating. Returns and timestamps are kept with the filing’s support; most SOX platforms have a certification workflow for this.
A model sub-certification letter
The letter wraps the questionnaire. Keep it to one page, attach the answers and the exception schedule, and adapt the scope line for each level.
| Part | Wording |
|---|---|
| Heading | To the Chief Executive Officer and Chief Financial Officer, through the Disclosure Committee. From: [name, title]. Quarter ended [date]. Scope: [entities, processes, key controls, systems and report sections, listed in Appendix A]. |
| Basis | My answers rest on my own knowledge and on the sub-certifications I received from [number] people who report to me, each of which I have read. I have followed up every exception they reported. |
| Representations | To the best of my knowledge, as of the quarter-end and through today: the financial information I submitted is complete and accurate; the key controls in my scope operated as described; I have reported every change in people, systems and processes affecting those controls; and I know of no fraud, claim, commitment, error or event that should be reported, except as listed in Appendix B. |
| Questionnaire | My answers to the [15] questions are attached. Each “yes” is described in Appendix B with its amount, date and supporting documents. |
| Report sections | I have read the draft sections assigned to me [list] and they are accurate and complete, except as marked. |
| Bring-down | I will tell [SOX lead] immediately of anything arising between today and the filing date that would change an answer, and I will confirm on request the day before filing. |
| Understanding | I understand that the CEO and CFO will rely on this letter and that it does not reduce their responsibility for the certifications they sign. A reported exception is the expected result of a careful review. A false “no” is a breach of the code of conduct. |
| Signature | [Name, title, date]. Reviewed by [level above, date]. |
The quarterly calendar
The cycle has two anchors: the quarter-end (QE) and the filing date (F). Form 10-Q is due 40 days after the end of the quarter for large accelerated and accelerated filers and 45 days for all other registrants (General Instruction A.1, as of November 2026). When the last day falls on a Saturday, Sunday or holiday, Exchange Act Rule 0-3 allows filing on the next business day. For a calendar-year company the 2027 dates are 10 May, 9 August and 9 November at 40 days, and 17 May, 16 August and 15 November at 45. No 10-Q is filed for the fourth quarter: the same cycle runs into the 10-K, and fourth-quarter changes in ICFR are disclosed there. A separate SEC proposal of 19 May 2026 (Release 33-11419) would eliminate the accelerated filer category. It is not final as of November 2026; SOX 404(a) vs 404(b) covers filer status and the proposal.
The pattern below, in working days, is typical for a company that closes in six working days and files about five weeks after quarter-end. Scale it to your close calendar; the SOX compliance checklist shows where the four cycles sit in the year.
| When | Step | Who | Output |
|---|---|---|---|
| QE−5 | Refresh the certifier list against the entity list, key control owner list and leavers report; update the questionnaire; pre-populate known items | SOX lead | Approved list and questionnaire |
| QE+1 | Issue to level 3 | SOX lead | Workflow open |
| QE+6 | Books close; later entries need second approval | Controller | Locked trial balance |
| QE+7 | Level 3 returns due; every “yes” logged the same day | Level 3; SOX office | Exception log opened |
| QE+9 | Level 2 and functional returns due, after reading level 3 | Level 2 | Roll-up by unit |
| QE+11 | Triage: each item quantified and owned; deficiency evaluations drafted; changes screened for Item 308(c); reverse checks against the logs | SOX office, controller | Log with proposed dispositions |
| QE+13 | Disclosure committee, first meeting: results, judgments, exception log, draft earnings release | Committee | Minutes; release cleared, subject to any audit committee review |
| QE+15 | Earnings release furnished on Form 8-K | Investor relations, controller | Release |
| F−7 | Audit committee pack distributed | Corporate secretary | Pack |
| F−4 | Draft 10-Q tied out; disclosure checklist, legal and subsequent-events sweeps complete | SEC reporting lead, general counsel | Final draft |
| F−3 | Disclosure committee, second meeting: final 10-Q, disclosure controls conclusion, Item 308(c) decision, paragraph 5 list. Paragraph 5 items sent to the audit committee chair and the audit partner | Committee; CFO | Minutes; dated communication |
| F−2 | Audit committee meeting: results, ICFR status, paragraph 5 items, the auditor’s interim review communications | Audit committee | Minutes |
| F−1 | Bring-down from level 1 and 2 certifiers; certification meeting with the CEO and CFO on the file | SOX lead; officers | Bring-down confirmations |
| F | CEO and CFO sign Exhibits 31 and 32; 10-Q filed | Officers | Filing |
| F+5 | Close the log; record late returns and items found outside the cascade; fix the questionnaire | SOX lead | Lessons list |
The pack goes out at least seven days before the audit committee meets, as the audit committee annual agenda recommends, so what the second disclosure committee meeting decides follows as a one-page late paper.
The exception log and where items go
Every “yes”, and every item that arrives by another route, goes into one log, built like an issue log: number, date raised, source (question number, bring-down, hotline, internal audit, reverse check), certifier and unit, description, amount or exposure, category, owner, analysis, disposition, where it was routed, date closed and minute reference. Three rules keep it useful. Nothing is closed by the person who raised it. Every item has a written disposition before the certification meeting. Items that arrived from outside the cascade are tagged, because they measure the cascade.
The disclosure committee sees every item. Onward routing is fixed by the certification for two rows below (paragraph 5) and by practice for the rest.
| Item | Decided by | Audit committee | External auditor | Timing |
|---|---|---|---|---|
| Misstatement found before the release | Controller | In the results discussion if significant | Yes: corrected, or on the unadjusted differences schedule | Before the release |
| Control deficiency, not significant | SOX lead and controller | In the ICFR status summary | Through the shared deficiency log | Quarterly |
| Significant deficiency or material weakness | Controller and CFO; committee concurs | Yes: paragraph 5(a) | Yes: paragraph 5(a) | Before the officers sign |
| Fraud involving management or anyone with a significant ICFR role | General counsel and chief audit executive establish the facts; committee classifies | Yes, any amount: paragraph 5(b) | Yes: paragraph 5(b) | Before the officers sign; the chair at once if senior management is involved |
| Other fraud or theft | General counsel or compliance | Through the ethics and hotline report | As agreed with the audit partner; the interim representation letter asks about fraud | Quarterly |
| Change in ICFR | SOX lead proposes; committee decides | If disclosed under Item 308(c) | Yes: the auditor asks about changes each quarter | Before the second meeting |
| Legal, regulatory, cyber or other disclosure item | General counsel | If material | If it affects the statements or the report | Same day for a possible 8-K event |
| Event after quarter-end | Controller and general counsel | If material | Yes | Through the filing date |
The external auditor has its own duties, which bind the auditor and not management. Under PCAOB AS 4105 the auditor obtains written representations for each interim review (paragraph .24), covering among other things the disclosure of significant deficiencies and material weaknesses. Once the company has made its first annual ICFR assessment, the auditor also performs limited quarterly procedures on the disclosure about changes in ICFR (paragraphs .07 and .18). If it believes that disclosure needs modification for the certifications to be accurate, it tells management and then, failing an appropriate response, the audit committee, before the report is filed (paragraphs .29 and .30). It also reports significant deficiencies and material weaknesses it becomes aware of to the audit committee before the filing (paragraph .33). In practice the paragraph 5 communication and the Item 4 wording should be final before the auditor closes its review, not on the morning of filing.
The disclosure committee: charter, agenda, minutes
No rule sets a charter’s contents; two pages are enough. It should settle the six points below; the model agenda after them serves both meetings.
- Purpose and reporting line. The committee assists the CEO and CFO and reports to them, as the 2002 release pictured. In many designs the two officers are not members. Where the CFO chairs, the minutes should record the committee’s view before the CFO’s.
- Members. Controller or chief accounting officer (often the chair); general counsel or senior securities lawyer; heads of SEC reporting, FP&A, tax, treasury, investor relations, risk and IT or security; business unit finance leads as needed; the chief audit executive as a non-voting observer.
- Documents in scope. Forms 10-K and 10-Q, earnings releases and call scripts, Forms 8-K and the proxy statement.
- Cadence. Before each earnings release and each periodic filing, and within a day when a possible Form 8-K event arises. Form 8-K requires the materiality decision on a cyber incident to be made without unreasonable delay after discovery, so it cannot wait for quarter-end.
- Quorum and decisions. Finance and legal both present. Disagreements go to the CEO and CFO and are recorded.
- Annual review. The design of disclosure controls and the charter itself, reported to the audit committee.
| # | Agenda item | Lead | Decision or minute |
|---|---|---|---|
| 1 | Quorum, prior minutes, open actions | Chair | Actions closed or re-dated |
| 2 | Results, significant estimates, unusual transactions, non-GAAP measures | Controller | Judgments noted; follow-ups |
| 3 | Sub-certification status and the exception log, item by item | SOX lead | Disposition of each item |
| 4 | Deficiencies: evaluations and the paragraph 5 list | Controller | Classification; items for the audit committee and auditor |
| 5 | Changes in ICFR and the Item 308(c) decision | SOX lead, CIO | Disclose or not, with reasons |
| 6 | Fraud and conduct: hotline, investigations | General counsel, with the chief audit executive’s input | Paragraph 5(b) status of each |
| 7 | Legal, regulatory, cyber and risk-factor updates; Form 8-K screen | General counsel, security lead | Disclosure changes |
| 8 | Draft report: checklist, tie-out, subsequent events | SEC reporting lead | Open comments cleared |
| 9 | Disclosure controls evaluation and conclusion; Item 4 wording | Chair | Recommendation to the CEO and CFO |
| 10 | Bring-down plan and signing timetable | SOX lead | Dates confirmed |
The minutes are the evidence that the committee operates as a control, which is how the guide to entity-level controls treats it. They should show who attended, which versions of which documents were reviewed, each exception with its disposition and reasoning, the disclosure controls conclusion and its basis, the Item 308(c) decision and its reasoning, the paragraph 5 list with the date it was sent, and open items with owners. Approve them before the officers sign. How privileged advice is recorded is for counsel to settle.
Evaluating a change in internal control
Item 308(c) asks for any change in ICFR during the quarter that has materially affected, or is reasonably likely to materially affect, ICFR. In practice that is two questions. Is it a change in the control system (its design, people, systems or processes), as opposed to a control that failed to operate? And is the effect on ICFR as a whole material? The SEC staff’s FAQ on management’s report (revised 24 September 2007), question 7, says the disclosure covers a change “(including an improvement)” that was not necessarily a response to a material weakness, gives a new information system as the example, and says materiality is judged by the impact on ICFR under the general securities-law standard. For a company that has not yet issued its first management report, the same answer says the staff would not object if changes made in preparing for it went undisclosed, though a company that identifies a material weakness should consider carefully whether to disclose it and the changes made in response. Release 33-8238 adds that the rules do not explicitly require the reasons for a change, but the company must decide whether they are needed to keep the disclosure from being misleading. In the table, the new-system and acquisition rows rest on staff text; the rest is judgment.
| What happened in the quarter | A change in ICFR? | Usual call | Reasoning or source |
|---|---|---|---|
| New general ledger, consolidation or revenue system went live for significant accounts | Yes | Disclose | The staff’s example in FAQ question 7, where the system materially affects ICFR; improvements count |
| First phase of a multi-year rollout, covering an insignificant unit | Yes | Judgment; often disclosed from the first significant go-live | Record why this phase is not yet reasonably likely to materially affect ICFR |
| Acquisition closed; the target will be excluded from this year’s assessment | Yes | Disclose material changes due to the acquisition | FAQ questions 3 and 7; the exclusion and the annual-report alternative are in SOX after an acquisition |
| Controls built to remediate a disclosed material weakness started operating | Yes | Disclose the changes; do not call the weakness remediated until the controls are tested | Judgment, following FAQ question 7; wording and timing in remediation and retesting |
| Finance moved to a shared service center, or a process outsourced | Yes | Disclose if significant processes moved | Many key controls change performer, system and evidence at once |
| One control redesigned after a deficiency | Yes | Usually not material; record the reasoning | Judged on the effect on ICFR as a whole, not on the one control |
| One control owner replaced like for like | No change in design | Not disclosed; logged | Confirm the control ran through the handover |
| A key control failed to operate | Not in itself | Not a 308(c) item | The usual reading: a failure in operation goes to deficiency evaluation and, if severe enough, to paragraph 5 and the disclosure controls conclusion |
Two habits make the decision defensible. Keep one change log for the SOX program and the disclosure committee, the same log that drives the re-scoping triggers in SOX scoping, and write a line of reasoning on every entry above a set threshold. And treat the sentence “there were no changes” as a representation that has to be true. A company that brings a new ledger into use during the quarter and files boilerplate risks a wrong Item 4 and two certifications that vouch for it.
Internal audit’s role and its limits
The certifications belong to the officers and the process to management, usually a SOX office in the controller’s group. Internal audit adds most by auditing the process and least by joining it. What we can properly do:
- Assure the process. A periodic audit of its design and operation, using the six tests below, reported to the audit committee in the quarterly pack.
- Observe and inform the committee. The chief audit executive attends without a vote and gives the committee a short quarterly statement of findings, open investigations and allegations that bear on the filing. That is a statement about internal audit’s own work, not about management’s controls.
- Population. Reconcile the certifier list to the entity list, the key control owner list and HR leavers for two quarters.
- Timing. Were all returns in before the committee met, and was the paragraph 5 communication made before the officers signed?
- Forward trace. Every “yes” to the log, the minutes and a disposition.
- Reverse trace. Take known events from the deficiency log, the IT change log, the claims log, hotline cases and post-close entries, and look for each on a sub-certification. The misses are the finding.
- Item 4. Compare four quarters of “changes” disclosures with the change log and system go-live dates.
- Clean rate. Identify units that have never reported an exception and ask two certifiers in each what the questions mean to them.
What we should not do: sign a sub-certification for controls we do not own, chair or vote on the committee, decide what is disclosed, or administer the cascade and then audit it. Where internal audit also tests SOX controls for management, its results enter the deficiency log as management’s testing and the arrangement should be explicit, as the guide to the CFO and internal audit sets out. The Global Internal Audit Standards behind that line are Standard 2.1 (Individual Objectivity), Standard 2.2 (Safeguarding Objectivity), Standard 2.3 (Disclosing Impairments to Objectivity) and Standard 7.1 (Organizational Independence), applied in the guide to independence and objectivity. Coordination with the external auditor comes under Standard 9.5 (Coordination and Reliance); the auditor’s side is in getting external audit to rely on your testing.
Worked quarter: Wexcombe Instruments
Wexcombe Instruments is a hypothetical maker of industrial sensors: about $480 million of revenue, plants in Tulsa, Leeds and Monterrey, 14 legal entities and a December year-end. It is an accelerated filer, so its 10-Q for the quarter ended Wednesday 30 September 2026 was due on Monday 9 November 2026, 40 days later. The cascade has 58 certifiers: 41 at level 3, 14 at level 2 and 3 at level 1. The chief accounting officer chairs a seven-member disclosure committee, and the head of internal audit observes.
The certifier list was refreshed on Wednesday 23 September and the questionnaires went out on Thursday 1 October. The books closed on Thursday 8 October. Level 3 returns were due on Friday 9 October and level 2 returns on Wednesday 14 October (Columbus Day, 12 October, is a company holiday), and the SOX office finished triage on Friday 16 October. Fifty-three certifiers returned no exceptions and five returned at least one “yes”. Two more items arrived outside the questionnaire, making seven in the log.
| # | Source | Item | Analysis | Disposition |
|---|---|---|---|---|
| 1 | Question 1, Tulsa plant controller | August review of the excess and obsolete inventory reserve not performed; reviewer on leave, no backup | September review covered August activity; reserve recalculated centrally with no adjustment | Control deficiency; backup reviewer named. Not a 308(c) item |
| 2 | Question 3, corporate accounting manager | Consolidation moved from spreadsheets to a new system, first used for the August close | Every entity’s path to the consolidated statements changed; new automated eliminations and access controls | Disclosed under Item 308(c); new controls scheduled for testing in the fourth quarter |
| 3 | Question 6, EMEA sales director | Distributor agreement signed on 18 September with a side letter allowing returns for 120 days; not sent to accounting | $1.3 million of revenue deferred before the release; all 37 distributor agreements signed in 2026 reviewed, no other side letter | Significant deficiency in design: paragraph 5(a) |
| 4 | Question 10, Monterrey finance lead | Accounts payable supervisor paid $18,600 to a vendor she had created; dismissed locally in September, head office not told | The amount is trivial, but she approved vendor master changes, a key control | Paragraph 5(b); vendor master control evaluated as a deficiency |
| 5 | Question 11, security lead | Two mailboxes at the Leeds sales office compromised by phishing on 6 October | No financial system reached; assessed under the incident procedure | Not material; no Form 8-K; minuted |
| 6 | Reverse check against the IT change log | Purchasing approval workflow at Monterrey reconfigured on 14 September; the plant controller had answered “no” to question 3 | One approval threshold moved; the change was tested and approved | Certifier re-signed; not material; IT changes now pre-populated by unit |
| 7 | Bring-down undertaking, general counsel | Customer letter of 21 October claiming $6 million for sensor failures | Outside counsel’s assessment obtained | Contingencies note expanded; risk factors reviewed, unchanged |
The committee met on Tuesday 20 October, two days before the earnings release on Thursday 22 October, and again on Monday 2 November. Item 3 was the one that mattered. The controller rated it a significant deficiency because the only thing that caught the side letter was one person’s truthful answer to a quarterly question, and that is not a control precise enough for the $60 million a year Wexcombe sells through distributors. At the second meeting the committee concluded that disclosure controls were effective at 30 September, every item having reached it before the filing, and approved an Item 4 paragraph saying that the company had replaced its spreadsheet consolidation with a new system during the quarter and that no other change had materially affected, or was reasonably likely to materially affect, ICFR.
The same day the CFO sent the audit committee chair and the audit partner a letter listing the significant deficiency and the fraud. The audit committee, whose pack had gone out on Tuesday 27 October, discussed both on Tuesday 3 November. On Wednesday 4 November all 17 level 1 and level 2 certifiers confirmed by bring-down that nothing had changed, and the CEO and CFO went through the file with the committee chair. They signed on Thursday 5 November and the 10-Q was filed that day, 36 days after quarter-end and four days inside the deadline. The next certification is in the 10-K, due on Tuesday 16 March 2027, 75 days after year-end.
Common failures
- Compliance questions. “Have you complied with all policies?” has one possible answer.
- Nobody reads the “yes” answers. An exception with no disposition is worse than none: it shows the officers were told and nothing was done.
- Paragraph 5 by assumption. A significant deficiency discussed with the audit team in testing meetings but never formally communicated to the audit committee before signing.
- Fraud filtered by amount. Small frauds by people with a significant control role dropped as immaterial. Clause 5(b) has no size test.
- One committee meeting, the day before filing. Too late to change an earnings release that went out two weeks earlier.
- Signatures as insurance. Officers who treat a stack of sub-certifications as protection stop asking questions. Rule 13a-14 has no safe harbor for relying on one.
If semiannual reporting is adopted
On 5 May 2026 the SEC proposed, in Release 33-11414, to let a reporting company elect each year, by a check box on the cover of its Form 10-K, to file one semiannual report on a new Form 10-S in place of the three Forms 10-Q. Comments closed on 6 July 2026. As of 10 November 2026 the SEC’s rule page lists it as a proposed rule. It is not final, and everything above describes the quarterly rules in force.
As proposed, the certification would travel with the new form: Rule 13a-14 would list Form 10-S, and the release states that the current disclosure and certification requirements for disclosure controls and ICFR would apply to it. A semiannual filer would evaluate disclosure controls as of the end of each fiscal semiannual period, and changes in ICFR over each semiannual period: Item 308(c) would cover the first half in the Form 10-S and the second in the 10-K. Form 10-S would be due 40 or 45 days after the first half ends, by filer status, and a semiannual filer could still issue quarterly earnings releases voluntarily.
What would not change is the substance. The officers would certify the same things for a longer period, the duty in Rule 13a-15(a) to maintain disclosure controls and ICFR runs all year, the annual assessment stays, and Form 8-K, with the disclosure controls behind every earnings release, continues apart from technical amendments. As a practitioner judgment, a company that elected semiannual filing but still closed and published quarterly would want to keep a quarterly internal cascade: a certifier asked in July about a control that lapsed in February remembers less than one asked in April. Unless and until a final rule takes effect, keep working to the quarterly rules and re-check the SEC’s page before changing the calendar.
This guide is general and educational; it is not legal, accounting or securities advice.
Questions readers ask
Are sub-certifications required by SOX?
No. Section 302 and Rule 13a-14 require the CEO and CFO to certify each 10-Q and 10-K, and Rule 13a-15 requires a quarterly evaluation of disclosure controls. Neither mentions sub-certifications, which are a common practice for giving the officers a documented basis and do not reduce their responsibility.
Is a disclosure committee mandatory?
No. Adopting the certification rules in August 2002 (Release 33-8124), the SEC recommended a committee to consider the materiality of information and determine disclosure obligations, and said it was not requiring any particular procedures. Most registrants have one because the officers need the work it does.
Who should sign a SOX 302 sub-certification?
The people who would know: key control and process owners, business unit heads and controllers, and the heads of functions such as legal, tax, treasury, HR, IT and sales operations, each for a written scope. Internal audit should not sign for controls it does not own.
What is the difference between disclosure controls and ICFR?
Disclosure controls and procedures (Rule 13a-15(e)) are designed to ensure that everything the company must disclose in its SEC reports is captured, reported on time and communicated to management; they are evaluated every quarter and reach non-financial information. ICFR (Rule 13a-15(f)) provides reasonable assurance over financial reporting and is assessed annually, with changes evaluated quarterly.
What changes in internal control must be disclosed in a 10-Q?
Under Item 308(c), any change during the quarter that has materially affected, or is reasonably likely to materially affect, ICFR. SEC staff guidance gives a new information system as an example and says improvements count. On the usual reading, a control that only failed to operate is a deficiency to evaluate, not a change.
Does every fraud have to go to the audit committee and the auditor?
Not every fraud. Paragraph 5 of the certification covers any fraud, material or not, that involves management or other employees with a significant role in ICFR: the test is the person’s role, not the amount. Other frauds usually reach the audit committee in summary through ethics and hotline reporting.
Related guides
- SOX Compliance hub — every SOX and ITGC guide on the site, by stage of the SOX year.
- SOX 302 vs 404 vs 906 — the three sections side by side, the five certification paragraphs and the penalties.
- SOX 404 Explained — the annual program this quarterly cycle feeds.
- SOX Compliance Checklist — where the four quarterly cycles sit in the SOX year.
- Evaluating Control Deficiencies — from exception to significant deficiency or material weakness.
- Remediating a SOX Deficiency Before Year-End — timing and retest evidence for what the log produces.
- SOX After an Acquisition — the exclusion and the Item 308(c) disclosures that go with it.
- SOX 404(a) vs 404(b) — filer status, deadlines and the pending SEC proposal.
- Entity-Level Controls — the disclosure committee as a control and the evidence it needs.
- SOX for Control Owners — what level 3 certifiers are being asked to sign.
Leave a Reply