Only accelerated filers and large accelerated filers that are not emerging growth companies need the external auditor’s attestation on internal control over financial reporting (ICFR) under Section 404(b) of the Sarbanes-Oxley Act. As of November 2026 that means a company with a public float of $75 million or more on the last business day of its second fiscal quarter, at least twelve months of reporting with one annual report filed, annual revenues of $100 million or more (unless the float has reached $700 million), and no emerging growth company status. Section 404(a) is wider: management of every operating company that files annual reports with the SEC assesses ICFR as of the fiscal year-end and reports the result in the Form 10-K, starting with its second annual report.
Most errors come from the dates and the overlaps. The float is measured once, six months before the year-end it governs. A smaller reporting company can still be an accelerated filer. Emerging growth company (EGC) status can end at the second year-end after an IPO. The thresholds for leaving a category are lower than those for entering it. And in May 2026 the SEC proposed replacing the scheme; as of 10 November 2026 that proposal has not been adopted, so it has its own section below and appears in none of the tables of current rules.
This guide is the decision tree, with two worked timelines on calendar dates. It builds on the site’s guides to SOX 404 and to Sections 302, 404 and 906, which explain what the reports and certifications contain, and it sits with the other SOX guides in the SOX compliance hub.
In this guide
- The answer by filer category
- Smaller reporting companies and the $100 million revenue test
- The decision tree
- When status is measured, and when a change takes effect
- Newly public companies: the first two annual reports
- Emerging growth companies: four ways out
- What changes in the year 404(b) arrives
- Foreign private issuers, banks and voluntary attestation
- What the May 2026 proposal would change, if adopted
- Worked timeline: Halberd Software
- Worked example: a float that crosses $75 million
- The year before 404(b): a readiness checklist
- Common misreadings
- Questions readers ask
- Related guides
The answer by filer category
Four texts fix the answer: the statute, and three SEC texts that bind the registrant and its management. Section 404 itself addresses subsection (b) to the audit firm, carves emerging growth companies out of it and, in subsection (c), added by the Dodd-Frank Act in 2010, exempts any issuer that is neither an accelerated filer nor a large accelerated filer. Exchange Act Rule 12b-2 defines those two terms. Regulation S-K Item 308 turns the result into Form 10-K content, and General Instruction A of the form sets the deadline. Asset-backed issuers and registered investment companies are outside management’s annual ICFR assessment altogether (Exchange Act Rule 13a-15(a) and (c)) and outside this guide. The table gives the rules in force as of November 2026.
| Category | Test at the fiscal year-end | 404(a) management report | 404(b) auditor attestation | Form 10-K due |
|---|---|---|---|---|
| Large accelerated filer | Float of $700 million or more on the last business day of the second quarter; subject to Exchange Act reporting for at least 12 calendar months; at least one annual report filed; not eligible for the smaller reporting company revenue test | Yes | Yes | 60 days after year-end |
| Accelerated filer | Float of $75 million to under $700 million, with the same three conditions | Yes | Yes, unless an EGC | 75 days |
| Non-accelerated filer | Everyone else: float under $75 million, or revenues under $100 million with a float under $700 million, or not yet seasoned. The rule does not define the term | Yes | No | 90 days |
| Emerging growth company | An overlay on the rows above: revenues under $1.235 billion and none of four exit events; cannot be a large accelerated filer | Yes | No, while the status lasts | By filer type: 75 or 90 days |
| First annual report | The company neither filed nor was required to file an annual report for the prior fiscal year | No; a transition statement instead | No | 90 days |
Smaller reporting company and EGC are overlays, not filer types: every registrant is one of the three filer types and may also be either, both or neither. The quarterly deadlines follow the same split: 40 days after quarter-end for accelerated and large accelerated filers, 45 for the rest.
On the SEC’s count for calendar 2024, published with its May 2026 proposal, 35.4 percent of the 5,976 registrants filing on domestic forms were large accelerated filers, 12.7 percent accelerated and 51.9 percent non-accelerated. The exempt half is where most disclosed weaknesses sit: in the Q3 2026 edition of the site’s Material Weakness Tracker, 733 of the 904 companies reporting a material weakness (81%) were smaller reporting, non-accelerated filers, and 428 (47%) were EGCs. The exemption removes the auditor’s opinion, not the weaknesses or the duty to disclose them.
Smaller reporting companies and the $100 million revenue test
A smaller reporting company (SRC) is a registrant with a public float under $250 million, or with annual revenues under $100 million and either no float or a float under $700 million. The status brings scaled disclosure. By itself it says nothing about the attestation.
The link between the two was made in 2020. SEC Release 34-88365, adopted on 12 March 2020 and effective 27 April 2020, removed from the accelerated and large accelerated filer definitions any issuer eligible to be an SRC under the revenue test. Only the revenue leg counts. An SRC that qualifies on float alone, with a float of $75 million to under $250 million and revenues of $100 million or more, is an accelerated filer and needs the attestation. The SEC’s compliance guide to the amendments sets the combinations out as follows.
| Public float (end of second quarter) | Annual revenues | Status | Auditor attestation |
|---|---|---|---|
| Under $75 million | Any | SRC; non-accelerated | No |
| $75 million to under $700 million | Under $100 million | SRC; non-accelerated | No |
| $75 million to under $250 million | $100 million or more | SRC and accelerated | Yes, unless an EGC |
| $250 million to under $700 million | $100 million or more | Accelerated; not an SRC | Yes, unless an EGC |
| $700 million or more | Any | Large accelerated; not an SRC | Yes |
These are the entry tests for a seasoned company; one that has lost SRC status regains it on float alone only below $200 million. Two details decide real cases. The first is which year’s revenues count: those of the most recently completed fiscal year for which audited financial statements are available, so the float measured on 30 June 2026 is paired with fiscal 2025 revenues.
The second is that the revenue test is harder to pass on the way back than on the way in. Take a seasoned drug developer with a $400 million float and $12 million of revenues: non-accelerated, no attestation. When a product launch takes fiscal 2027 revenues past $100 million, the float measured on 30 June 2028 is paired with those revenues and the company is an accelerated filer at 31 December 2028. Unless it is an EGC, its first attestation is in the fiscal 2028 Form 10-K. Because it has then failed both SRC tests, it leaves again through the revenue test only when revenues fall below $80 million. A company that remained an SRC on float throughout (under $250 million) gets out as soon as revenues drop under $100 million. The release works both exits with numbers.
The decision tree
Run the steps in order as of the last day of the fiscal year. The answer covers the Form 10-K for that year.
- First annual report? If the company neither filed nor was required to file an annual report for the prior fiscal year, it gives no management report and no attestation, and says so in a transition statement. Stop here.
- Management’s report. From the second annual report on, 404(a) applies every year. No float, revenue or EGC test removes it.
- Seasoning. Has the company been subject to Exchange Act reporting for at least 12 calendar months and filed at least one annual report? If not, it is non-accelerated: no attestation, 90 days.
- Float. Take the public float on the last business day of the second fiscal quarter. Under $75 million means non-accelerated; for a company that was already an accelerated or large accelerated filer the line is $60 million.
- Revenue test. With a float under $700 million and revenues under $100 million, the company is non-accelerated. Two lines are lower for a company coming back down: the float must be under $560 million once it has been $700 million or more, and revenues under $80 million if the company had earlier failed both SRC tests with revenues of $100 million or more.
- Filer type. Otherwise the company is accelerated below $700 million of float and large accelerated at $700 million or more. A large accelerated filer remains one until its float falls below $560 million.
- EGC check. An accelerated filer that is still an EGC owes no attestation. A large accelerated filer cannot be an EGC. Test the other three EGC exits as well: revenues, debt and the fifth anniversary.
- Overlays. An insured bank with $5 billion or more of assets has a separate attestation requirement under FDIC rules. A foreign private issuer on Form 20-F cannot use step 5.
When status is measured, and when a change takes effect
Filer status is decided once a year, on the last day of the fiscal year, from a float measured six months earlier. For a calendar-year company the float date for fiscal 2026 was Tuesday 30 June 2026, and for fiscal 2027 it is Wednesday 30 June 2027. The float is the worldwide market value of voting and non-voting common equity held by non-affiliates, priced at the last sale, or the average of bid and asked, in the principal market on that day.
Under Rule 12b-2 the year-end determination governs the annual report for that same fiscal year and the periodic reports that follow. A company that first meets the accelerated filer test at 31 December 2026 files its fiscal 2026 Form 10-K within 75 days, by 16 March 2027, with the auditor’s first ICFR opinion in it unless the company is an EGC, and its 2027 Forms 10-Q within 40 days. A new large accelerated filer has until 1 March 2027. (A deadline that falls on a weekend or holiday moves to the next business day under Rule 0-3.)
When the float is the trigger, the practical notice is six months: the number is known in July and the opinion is as of December. When revenues are the trigger and the float is already over $75 million, the warning is closer to a year, because the test uses the last audited year’s revenues. For the float, only that one date counts. A float that passes $75 million in October and is back under it the following June never changes the status. In November 2026 a calendar-year company already knows its fiscal 2026 answer; the open question is 30 June 2027.
Two practice points on the float. Who counts as an affiliate is a judgment about control; in practice many companies treat directors, executive officers and their largest holders as affiliates for this calculation and say so on the Form 10-K cover. And the float can rise without the share price moving: when a sponsor sells down in a follow-on offering, or distributes shares to its own investors, those shares pass from affiliate to non-affiliate hands. Model price and holdings from the first quarter, and put the forecast on the audit committee’s agenda before June, not after.
Leaving a category
Exit thresholds sit below entry thresholds so that a company near a line does not change status every year. The 2020 amendments set them at $60 million and $560 million and added the revenue test as a second way out.
| Status last year | Keeps it unless, at a fiscal year-end | Then becomes |
|---|---|---|
| Large accelerated | The float on the second-quarter date is under $560 million, or the company has become eligible under the SRC revenue test | Accelerated if the float is $60 million or more and the revenue test is not met; otherwise non-accelerated |
| Accelerated | The float is under $60 million, or the company has become eligible under the SRC revenue test | Non-accelerated |
| Non-accelerated | The float is $75 million or more, the seasoning conditions are met and the revenue test is not | Accelerated, or large accelerated at $700 million or more |
The exit runs on the same clock as the entry. A float that falls under $60 million on 30 June 2027 makes the company non-accelerated at 31 December 2027, and the fiscal 2027 Form 10-K is due in 90 days with no attestation required. Leaving large accelerated status does not by itself end the attestation. A large accelerated filer whose float falls to $490 million becomes an accelerated filer unless it also meets the revenue test, with 75 days in place of 60 and the same integrated audit. Unlike EGC status, filer status can be lost and regained any number of times.
The status memo to write every July
Write the determination down when the second quarter closes and update it at year-end. One page with these lines is enough, and it is the document the auditor and the audit committee will want when a status changes.
- Measurement date and price. The last business day of the second quarter; the price and the market it was taken from.
- Shares. Total outstanding; the shares held by each person treated as an affiliate, with the reason; the resulting float.
- Revenues. Annual revenues of the latest audited fiscal year.
- Seasoning. The date reporting began and the annual reports filed since.
- Status last year. Which entry or exit line therefore applies.
- EGC tests. Revenues against $1.235 billion, non-convertible debt issued in the last three years, and the fifth-anniversary date.
- Conclusion. Filer type, SRC status and EGC status at year-end; the Form 10-K and Form 10-Q deadlines; whether an attestation is required.
- Sign-off. Prepared by, reviewed by counsel, and the dates it went to the audit committee and the auditor.
Newly public companies: the first two annual reports
Instruction 1 to Item 308 gives a registrant one annual report without either 404 report. It need not provide management’s report or the attestation until it has filed, or been required to file, an annual report for the prior fiscal year, and its first annual report must say that both are omitted because of the SEC’s transition period “for newly public companies”. The first report is not free of controls content: the officers still certify under Sections 302 and 906 and give their conclusion on disclosure controls. The second annual report carries management’s first assessment. Whether it also carries the auditor’s attestation is decided by the tree above, and for most new listings by EGC status.
The transition counts annual reports, not months. A company that lists in September with a December year-end files its first Form 10-K about six months later and its first management report about eighteen months after listing. One that lists in the spring files its first Form 10-K the following March and its first management report nearly two years after listing. A company that was already filing annual reports before its equity IPO, because of registered debt for example, has no transition to use. The wording of the 302 certifications during the transition is covered in the 302, 404 and 906 guide, and the build itself in pre-IPO SOX readiness.
Emerging growth companies: four ways out
An emerging growth company is an issuer with annual gross revenues under $1.235 billion in its most recent fiscal year that first sold common equity in a registered offering after 8 December 2011. The revenue figure dates from September 2022; the JOBS Act has the SEC index it every five years, which points to 2027 for the next adjustment. Check the figure in the rule, not on an older staff page: when read in November 2026 the SEC staff’s JOBS Act FAQs still showed $1 billion and the EGC topic of the Financial Reporting Manual $1.07 billion. The company keeps the status until the earliest of four events, and the same FAQs say a company that loses it cannot regain it (question 32). The fifth-anniversary exit is easy to misdate: in the staff’s example (question 40), a first sale on 2 May 2012 with a December year-end ends the status no later than 31 December 2017.
| Exit event | Status ends | First Form 10-K with the attestation (a reading; see below) | Calendar-year example |
|---|---|---|---|
| Annual gross revenues reach $1.235 billion | Last day of that fiscal year | The one for that fiscal year | Revenues pass the line in 2029: status ends 31 December 2029; fiscal 2029 Form 10-K |
| Fifth anniversary of the first registered sale of common equity | Last day of the fiscal year “following the fifth anniversary”, in the rule’s words: the first year-end after it | The one for that fiscal year | IPO in September 2026: status ends 31 December 2031; fiscal 2031 Form 10-K |
| More than $1 billion of non-convertible debt issued in the previous three years | The day the rolling three-year total passes $1 billion | The one for the fiscal year in which that day falls | Notes issued in May 2028 take the total over: fiscal 2028 Form 10-K |
| The company becomes a large accelerated filer | The year-end at which it first meets the test | The one for that fiscal year, due in 60 days | Float of $700 million or more on 30 June 2027, seasoning conditions met: status ends 31 December 2027; fiscal 2027 Form 10-K due 29 February 2028 |
The third column is a reading of the rules, not a quotation from them. Item 308(b) requires the attestation from an accelerated or large accelerated filer that is not an EGC, and in each row the status has gone before the report for that year is filed; none of the SEC texts read for this guide names the first report in so many words. The column also assumes the company is an accelerated or large accelerated filer at that year-end: a former EGC that is non-accelerated still owes no attestation. Confirm the year with securities counsel and the auditor as soon as an exit looks likely, because an integrated audit is planned from the start of the year, not from the day the status changes.
In practice the float exit is the one that surprises. The revenue and anniversary exits can be seen years ahead and the debt exit is in management’s hands, but the float is set by the market on a single day.
EGC status removes the attestation and nothing else discussed here. A seasoned EGC with a float of $75 million or more and revenues of $100 million or more is an accelerated filer for deadlines: 75 days for the Form 10-K and 40 for each Form 10-Q.
What changes in the year 404(b) arrives
Management’s obligation does not change when the auditor arrives: the same assessment, the same framework, and the same duty under Instruction 2 to Item 308 to keep evidence that supports the conclusion. What changes is that a second party forms its own opinion on the same controls under PCAOB Auditing Standard 2201, which binds the auditor, not management. Without 404(b) the auditor still has to understand ICFR and evaluate the design of relevant controls in order to plan the financial statement audit (AS 2110 paragraphs .18 to .20). The SEC’s 2020 release notes that it also still reports the significant deficiencies and material weaknesses it finds to management and the audit committee. AS 2110 paragraph .39 says that this understanding is different from testing controls to express an opinion on them. The table gives the auditor’s side by paragraph and the usual consequence for the company, which is practice, not rule.
| Area | What the auditor now does (AS 2201) | What it means for the company (practice) |
|---|---|---|
| Opinion | Gives its own opinion on ICFR as of year-end (.03); the opinion is adverse if a material weakness exists (.90) | A weakness management would have disclosed anyway now also produces an adverse audit opinion in the Form 10-K |
| Scope | Applies its own top-down approach (.21) and chooses the controls it will test (.39) | Compare the two scopes in the first quarter; start from management’s scoping memo |
| Understanding | Understands the likely sources of misstatement (.34); the standard calls walkthroughs frequently the most effective way (.37) | Process owners are walked through twice unless the sessions are combined |
| Testing | Tests design and operation (.42 to .45); decides how far to use the work of others from the risk of the control and the testers’ competence and objectivity (.16 to .19) | Reliance is earned control by control; see the guide to external auditor reliance |
| Timing | Decides what further evidence is needed to carry interim results to year-end (.55, .56) | Interim testing and fixes have to finish early enough to leave a period for roll-forward |
| Deficiencies | Evaluates each deficiency; reports material weaknesses to management and the audit committee in writing before its report is issued, and significant deficiencies to the committee in writing (.62, .78, .80) | One shared deficiency log; evaluation memos written to be read by the auditor |
| Reporting | Obtains written representations (.75); dates the ICFR report the same day as the financial statement report (.89) | Management’s report adds a statement that the auditor has issued an attestation report (Item 308(a)(4)); the cover-page box is checked |
The pressure falls on three kinds of evidence that management’s own testing often accepts and an auditor does not: review controls where the file shows a signature but not what was examined, key reports whose completeness and accuracy nobody tested, and IT general controls covered by inquiry alone. The site’s guides to management review controls, IPE and ITGC scoping describe the standard to expect. In practice a first-year integrated audit usually finds deficiencies that management’s testing passed; the remedy is a dry run a year early.
The calendar tightens as well. The auditor wants management’s test results and deficiency evaluations before it finishes its own work, and its opinion is dated with a Form 10-K that is now due in 60 or 75 days and not 90. In practice management’s interim testing moves into the second and third quarters, year-end testing into January, and the evaluation memo into the first weeks of February. A program that used to finish in late March has lost two to four weeks.
Foreign private issuers, banks and voluntary attestation
Foreign private issuers
A foreign private issuer that files annual reports on Form 20-F gives management’s report under Item 15(b) and, if it is an accelerated or large accelerated filer and not an EGC, the auditor’s attestation under Item 15(c), with the same one-report transition. The float and seasoning tests are those of Rule 12b-2. The revenue test is not available: a foreign private issuer may use the SRC rules only if it files on domestic forms with U.S. GAAP financial statements, so a seasoned Form 20-F filer with a $75 million float is an accelerated filer however small its revenues. The annual report is due within four months of year-end whatever the filer type. Canadian issuers on Form 40-F have their own instruction; read it with counsel. A concept release of 4 June 2025 on who should qualify as a foreign private issuer (Release 33-11376) had not led to a proposed rule as of November 2026.
Banks: FDIC Part 363
Insured depository institutions have a second requirement that turns on assets, not float, and applies whether or not the institution is public. The FDIC’s final rule published on 4 December 2025 (90 FR 55789), effective 1 January 2026, raised the thresholds in 12 CFR Part 363. Audited financial statements and the Part 363 annual report now start at $1 billion of consolidated total assets (previously $500 million). Management’s assessment of ICFR and the independent accountant’s attestation now start at $5 billion (previously $1 billion), measured at the beginning of the fiscal year. The figures are indexed to inflation, with the first scheduled adjustment effective 1 October 2027. The FDIC’s preamble says the change does not relieve public companies of Section 404. So a listed bank holding company with $3 billion of assets that is an accelerated filer still needs the 404(b) attestation, and an unlisted bank with $6 billion needs the Part 363 one.
Voluntary attestation
Nothing stops an exempt company from engaging its auditor for an integrated audit. Item 308(a)(4) has management’s report mention the auditor’s report whenever one is included, required or not, and the Form 10-K cover has a box for it. The SEC’s 2020 release notes that some exempt issuers do this. The usual reasons are a lender or underwriter that asks for it, a status change expected next year, or a past weakness that has left investors wary.
What the May 2026 proposal would change, if adopted
On 19 May 2026 the SEC proposed “Enhancement of Emerging Growth Company Accommodations and Simplification of Filer Status for Reporting Companies” (Release 33-11419, also 34-105515, File No. S7-2026-18). It was published in the Federal Register on 21 May 2026 and the comment period closed on 20 July 2026. The SEC’s rule page still listed it as proposed on 10 November 2026, and the SEC’s list of rulemaking activity to that date showed no adopting release. Nothing the SEC made final in 2025 or 2026 changes the filer definitions, EGC status or the 404(b) exemptions; the one final change in this guide is the FDIC’s, above. A proposal binds no one. The table shows what this one would change if adopted as written.
| Point | In force (November 2026) | Proposed, not adopted |
|---|---|---|
| Filer types | Large accelerated, accelerated and non-accelerated, with SRC and EGC overlays | Large accelerated and non-accelerated only; accelerated filer and SRC statuses eliminated |
| Large accelerated float | $700 million at one measurement date | $2 billion at the end of each of the two most recent second fiscal quarters |
| Price used for the float | Last sale, or average of bid and asked, on the last business day of the quarter | Average closing price over the last 10 trading days of the second quarter |
| Seasoning | 12 calendar months and one annual report | 60 consecutive calendar months of reporting |
| Auditor attestation | Accelerated and large accelerated filers that are not EGCs | Large accelerated filers only |
| Management’s assessment | Every operating company from its second annual report | Unchanged |
| Leaving large accelerated status | Float under $560 million, or the revenue test | Float under $2 billion for two consecutive years |
| Deadlines | 60, 75 or 90 days for the Form 10-K; 40 or 45 for the Form 10-Q | Non-accelerated filers stay at 90 and 45; a new tier with total assets of $35 million or less gets 120 and 50 |
| Form 20-F filers | Attestation from a $75 million float, unless an EGC | The same: the $75 million line is kept for Form 20-F |
On the SEC’s fact sheet figures, large accelerated filers would fall from 35.4 percent of domestic registrants to 19.2 percent, and no company could become one in its first five years of reporting, whatever its float. The release proposes a transition in which existing registrants re-determine their status after final rules take effect. It does not set an effective date.
- Keep working to current status. A company that is an accelerated or large accelerated filer under today’s Rule 12b-2 at its year-end, and not an EGC, owes an attestation in that year’s Form 10-K. Planning the fiscal 2026 or 2027 audit around a rule that does not exist is how a filing ends up late or incomplete.
- What to watch. The rule page, for an adopting release. If one comes, read three things first: the effective date, the transition for companies that are accelerated or large accelerated today, and whether the Form 20-F treatment changed from the proposal.
- What not to dismantle. Management’s testing program, the deficiency evaluation process and the control documentation. The proposal leaves 404(a) alone, the 302 certifications rest on the same work, the auditor would still report the deficiencies it finds, and a bank above $5 billion keeps its Part 363 attestation in any case.
- What to ask now. If the proposal would take the company out of the attestation (any accelerated filer on domestic forms, and a large accelerated filer whose float has not been $2 billion or more two years running or that has less than 60 months of reporting), ask the audit committee and the lenders whether they would want one anyway. Their answer matters more to multi-year audit planning than the rule’s timing.
A separate proposal of 5 May 2026 (Release 33-11414) would let companies file semiannual reports on a new Form 10-S in place of Forms 10-Q; it is also not adopted, and it is a different question from who needs an attestation.
Worked timeline: Halberd Software
Halberd Software is the hypothetical B2B software company in the site’s guide to standing up internal audit after an IPO: $310 million of annual recurring revenue, listed on the NYSE in September 2026 as an EGC, a December year-end, a SOX program owned by the controller’s office, and a first annual report due in early 2027. Its plan treats fiscal 2027 as the first 404(a) year. Whether fiscal 2027 is also the first 404(b) year depends on a number that does not exist yet: the float on 30 June 2027. The float figures below are scenarios, not facts about Halberd, and the attestation rows apply the reading of Item 308(b) set out in the EGC section.
| Date | Event | Filer status | 404 content |
|---|---|---|---|
| September 2026 | Lists on the NYSE | Non-accelerated; EGC | 302 and 906 certifications from the first Form 10-Q |
| 31 December 2026 | First year-end as a public company | Non-accelerated whatever the float: under 12 months of reporting, no annual report filed | None |
| By 31 March 2027 | First Form 10-K, for fiscal 2026 (90 days) | Non-accelerated; EGC | No management report, no attestation; the transition statement |
| 30 June 2027 | Float measured | The number that decides fiscal 2027 | None |
| 31 December 2027 | Status determined, with 15 months of reporting and one annual report filed | Branch A, float of $700 million or more: large accelerated, EGC status ends. Branch B, $75 million to under $700 million: accelerated, still an EGC | Management’s first assessment is as of this date in both branches |
| Branch A: by 29 February 2028 | Second Form 10-K, for fiscal 2027 (60 days) | Large accelerated; no longer an EGC | Management’s report and the auditor’s first attestation |
| Branch B: by 15 March 2028 | Second Form 10-K (75 days) | Accelerated; EGC | Management’s report only |
| Each 30 June after that | Float measured again | Branch B lasts until one of the four exits | Attestation starts with the Form 10-K for the year EGC status ends |
| 31 December 2031 | Year-end following the fifth anniversary of the IPO | EGC status ends at the latest | Fiscal 2031 Form 10-K carries the attestation if Halberd is then accelerated or large accelerated |
With $310 million of annual recurring revenue, Halberd’s reported revenues are well above the $100 million line, so the revenue test cannot help it, and a float under $75 million is not a realistic case for a company of its size. The planning question is branch A or branch B. In branch A the auditor’s first ICFR opinion is as of 31 December 2027, fifteen months after listing, on a 60-day filing timetable, in the same year as management’s first assessment. The sensible plan is to run fiscal 2027 as if branch A will happen. Agree the integrated-audit scope with the auditor in the first quarter, and hold the operating testing to its planned months so that the end of the year is left for roll-forward and fixes. Settle before June how much of the testing that internal audit performs under its disclosed dual role the auditor is prepared to use. If the float comes in under $700 million, Halberd has lost nothing but a rehearsal it needed anyway.
Worked example: a float that crosses $75 million
Harrowick Foods is hypothetical: a calendar-year specialty food manufacturer, listed since 2014 and long past EGC status, with revenues of about $260 million and a thinly traded stock. For years its float sat under $75 million and it filed as a non-accelerated filer, with management’s report only.
| Date | Fact | Result |
|---|---|---|
| 30 June 2025 | Float $61 million | Non-accelerated for fiscal 2025 |
| 30 June 2026 | Float $92 million, after a price rise and a sale of shares by the founder’s estate | Entry test met: fiscal 2025 revenues are over $100 million |
| 31 December 2026 | Fiscal year-end | Accelerated filer; still an SRC, because the float is under $250 million |
| 16 March 2027 | Fiscal 2026 Form 10-K due (75 days) | First auditor attestation, on ICFR as of 31 December 2026; 2027 Forms 10-Q due in 40 days |
| 30 June 2027 | Float $66 million | Under $75 million but not under $60 million: still accelerated, and an attestation again for fiscal 2027 |
| 30 June 2028 | Float $57 million | Non-accelerated at 31 December 2028; no attestation required for fiscal 2028 |
Harrowick had six months between knowing and the as-of date, and its auditor had planned a financial statement audit only. That is the normal shape of a first attestation outside an IPO. In November 2026 the company is in the middle of its first integrated audit with year-end testing still ahead, which is the stretch the SOX compliance checklist covers phase by phase.
The year before 404(b): a readiness checklist
Use this in the year before the attestation is expected, or as soon as a float forecast shows that a crossing is possible. “Done when” is the evidence to hold.
| Step | Action | Done when |
|---|---|---|
| 1. Status forecast | Model float and revenues against each threshold from the first quarter; name the measurement date | A dated memo with scenarios has gone to the CFO and the audit committee |
| 2. Auditor | Ask for the integrated-audit plan, timetable and fee assumptions before the measurement date | The engagement terms cover both outcomes |
| 3. Scope | Reconcile management’s significant accounts, locations, systems and key controls with the auditor’s | Differences are listed and settled in writing |
| 4. IT general controls | Test access, change and operations controls for every in-scope system across the year | No in-scope system is untested |
| 5. Review controls | Document the thresholds, inputs and follow-up for each management review control | A second person can reach the reviewer’s conclusion from the file |
| 6. Key reports | List the reports behind key controls and test their completeness and accuracy | Each key control names its reports and their tests |
| 7. Service organizations | Obtain and review SOC 1 reports, map the user controls, cover the gap to year-end | The register is complete, with bridge letters |
| 8. Dry run | Have walkthroughs and a sample of tests performed to the auditor’s standard a year early | Results are in the deficiency log with owners and dates |
| 9. Deficiencies | Write the evaluation method; evaluate and aggregate at year-end | The audit committee has reviewed the memo |
| 10. Remediation | Fix failures early enough for the control to operate and be retested before year-end | Retest evidence is on file |
| 11. Reliance | Agree which management and internal audit testing the auditor expects to use | A written reliance plan exists, control by control |
| 12. Close | Rehearse the close on the shorter Form 10-K and Form 10-Q deadlines | One quarter and one year-end have closed on the new timetable |
Common misreadings
| Misreading | What the rules say |
|---|---|
| “Smaller reporting companies are exempt from 404(b).” | Only those that are also non-accelerated. An SRC with a float of $75 million to under $250 million and revenues of $100 million or more is an accelerated filer |
| “An EGC files on non-accelerated deadlines.” | EGC status removes the attestation, not the deadlines. A seasoned EGC can be an accelerated filer |
| “EGC status lasts five years.” | It lasts until the earliest of four events. A float of $700 million can end it at the second year-end |
| “Our float is back under $75 million, so the attestation stops.” | The exit line is $60 million, unless the revenue test is met |
| “Float means market capitalization.” | It excludes shares held by affiliates, and it moves when insiders sell |
| “We crossed in June, so the audit changes next year.” | The year-end determination governs the Form 10-K for that same fiscal year |
| “Exempt from 404(b) means exempt from testing.” | Management’s assessment, the evidence behind it and the 302 certifications are unchanged |
| “Every IPO gets a year off.” | The transition belongs to a registrant with no prior annual report. A company already filing annual reports has none |
| “The threshold is now $2 billion.” | That is the May 2026 proposal, not adopted as of November 2026 |
| “Bank thresholds follow the SEC’s.” | Part 363 runs on assets: $5 billion for the ICFR attestation since 1 January 2026 |
This guide is general and educational; it is not legal, accounting or securities advice. Filer status drives filing deadlines and audit scope, so confirm it each year with securities counsel against the current text of Rule 12b-2.
Questions readers ask
What is the difference between SOX 404(a) and 404(b)?
Section 404(a) is management’s own annual assessment of internal control over financial reporting, reported in Item 9A of the Form 10-K. Section 404(b) is the external auditor’s attestation on the same controls, performed as an integrated audit under PCAOB AS 2201. Every operating company that files annual reports has the first from its second annual report; only accelerated and large accelerated filers that are not emerging growth companies have the second.
Who is exempt from SOX 404(b)?
Three groups, as of November 2026: non-accelerated filers (a float under $75 million, or revenues under $100 million with a float under $700 million, or less than twelve months of reporting or no annual report yet filed), emerging growth companies while the status lasts, and any company in its first annual report. None of them is exempt from management’s assessment under 404(a) once the first annual report is behind it.
Do non-accelerated filers have to comply with SOX 404?
Yes, with everything except the auditor’s attestation. After its first annual report a non-accelerated filer’s management assesses internal control over financial reporting every year under 404(a) and reports the conclusion in the Form 10-K, and its officers certify every Form 10-Q and Form 10-K under Sections 302 and 906. The auditor still considers internal control in planning the financial statement audit and reports the significant deficiencies and material weaknesses it finds.
Is a smaller reporting company exempt from 404(b)?
Not automatically. A smaller reporting company with a float under $75 million, or one that meets the $100 million revenue test, is a non-accelerated filer and exempt. One that qualifies only on float, between $75 million and $250 million with revenues of $100 million or more, is an accelerated filer and needs the attestation unless it is also an emerging growth company.
When does 404(b) apply after an IPO?
Never in the first annual report, and not while the company is an emerging growth company. The earliest is the second annual report, most often because the float on the last business day of that year’s second quarter is $700 million or more: the company becomes a large accelerated filer at year-end and loses EGC status the same day. The latest, for a company that is then an accelerated or large accelerated filer, is the annual report for the fiscal year in which the fifth anniversary of the IPO falls.
What is the public float threshold for an accelerated filer?
It is $75 million to enter and $60 million to leave, measured on the last business day of the second fiscal quarter, with $700 million to become a large accelerated filer and $560 million to stop being one. A company with a float below $700 million and annual revenues under $100 million is non-accelerated; for a company that had crossed those lines and lost smaller reporting company status, the figures on the way back are $560 million and $80 million. All of them are in Exchange Act Rule 12b-2 as amended in 2020 and were in force as of November 2026.
What happens to 404(b) when a company loses EGC status?
If it is an accelerated or large accelerated filer at that fiscal year-end, the Form 10-K for the year in which the status ends includes the auditor’s attestation. That is the usual reading of Item 308(b), not a quotation from it, so confirm the year with securities counsel and the auditor. If the company is a non-accelerated filer, nothing changes. The status cannot be regained.
Has the SEC raised the large accelerated filer threshold to $2 billion?
No. The SEC proposed that change on 19 May 2026 in Release 33-11419, together with eliminating the accelerated filer and smaller reporting company categories, and the comment period closed on 20 July 2026. As of 10 November 2026 it had not been adopted, so the $700 million and $75 million thresholds still apply.
Related guides
- SOX Compliance hub — every SOX and ITGC guide on the site, by stage of the SOX year.
- SOX 404 Explained — the program behind management’s assessment.
- SOX 302 vs 404 vs 906 — the certifications, and their wording during the transition.
- Pre-IPO SOX Readiness — the 18-month build before and after listing.
- Standing Up Internal Audit After an IPO — Halberd’s first 18 months.
- SOX Compliance Checklist — the annual cycle, phase by phase.
- Getting External Audit to Rely on Your SOX Testing — what AS 2201 and AS 2605 ask for.
- SOX Roll-Forward Testing — from interim testing to year-end.
- Remediating a SOX Deficiency Before Year-End — timing and retest evidence.
- Evaluating Control Deficiencies — from exception to material weakness.
- SOX Scoping and Risk Assessment — the top-down approach in practice.
- SOX 302 Sub-Certifications — the quarterly process behind the signatures.
- SOX After an Acquisition — the one-year exclusion and the integration plan.
- Material Weakness Tracker: Q3 2026 — disclosures by cause and filer status.
Leave a Reply