SOX 404a vs 404b and the EGC-to-Accelerated-Filer Transition

SOX section 404 comes in two halves, and which half applies to your company depends on one thing, your filer status under the JOBS Act. The split between 404a and 404b is not a technicality. It decides whether your external auditor has to attest to your internal controls, and that is the single biggest cost and timeline variable in a SOX program. If you are an emerging growth company you live under 404a today, but the clock to 404b is already running. We lay out the difference side by side below and show you exactly when the jump happens and what changes when it does.

What SOX 404 Actually Requires (and Where 404a and 404b Split)

Section 404 of Sarbanes-Oxley requires two things. Management must accept responsibility for internal control over financial reporting and assess whether those controls are effective, and the company must disclose that assessment in its annual report. The disagreement over the years was always about the second half, whether the external auditor must also issue an attestation report on those controls.

Under 404a, management assesses. Under 404b, management assesses AND the auditor attests. That is the entire difference in one sentence, but the operational gap between those two words is enormous. Our SOX 404 overview and approach walks through how we frame the full requirement before scoping a client.

404a vs 404b Side by Side

Requirement	404a (EGC / non-accelerated)	404b (accelerated / large accelerated)
Management assessment of ICFR	Required	Required
External auditor attestation	Not required	Required
Who files the opinion	Management only	Management plus auditor
Evidence bar	Management documentation standard	Auditor attestation standard (AS 2201)
Typical cost lift	Baseline	Materially higher

The row that matters is the second one. 404a filers do not pay for an auditor attestation because there is none. 404b filers pay for it in audit fees, in evidence work, and in calendar time, because the auditor has to plan walkthroughs, test samples, and issue an opinion under PCAOB Auditing Standard 2201. For the deeper treatment of what the attestation involves, see the 404b compliance service page and our accelerated filer 404b page.

The JOBS Act Timeline That Decides Which One You Are In

The JOBS Act created the Emerging Growth Company (EGC) category and gave it a temporary 404b exemption. An EGC keeps that exemption for up to five years after its IPO, but it can lose EGC status sooner if it crosses the revenue, float, or debt-issuance thresholds. The day you stop being an EGC, or the day you cross the public-float threshold to become an accelerated filer, 404b switches on.

The transition is not gradual. You are a 404a filer on Friday and a 404b filer on Monday, and the auditor’s attestation plan has to be ready for the same fiscal year. Companies that wait until they lose EGC status to build 404b-grade documentation are the ones whose November timelines collapse. Our JOBS Act 404 requirements page lays out the exact triggers, and the 404a service page for emerging growth companies covers what to build while you still have the exemption.

What Changes the Day You Lose EGC Status

Three things change at once. The auditor moves from advisory to attestor, which means they cannot help you design the controls they later opine on. The evidence bar moves from “documented” to “tested and opined,” which means sample sizes, walkthroughs, and reperformance enter the scope. And the timeline moves from management’s schedule to the auditor’s reporting deadline, which is fixed.

The companies that handle the jump well treat 404a as a dress rehearsal for 404b. They document the same way, scope the same way, and build the same risk-and-control matrix, so the only thing that changes at transition is the auditor’s involvement. The 404a compliance service page describes how we set that up so the lift to 404b is incremental, not a rebuild.

How We Help Companies Through the 404a-to-404b Jump

We are the Special Ops team for accounting and finance departments, and the 404a-to-404b transition is one of the situations where that matters most. We scope to your filer status, not a generic SOX template, which means we build for the auditor you will actually have under 404b even while you are still filing under 404a. The result is a program that survives the transition without a November emergency.

If you are within 12 to 24 months of losing EGC status, the highest-value work happens now, not at transition. Tell us where you are in the EGC-to-accelerated-filer transition and we will map what 404a vs 404b means for your timeline. Start with a scoping call.

FAQ

What is the SOX 404?

Section 404 of the Sarbanes-Oxley Act requires management to assess the effectiveness of internal control over financial reporting and to report that assessment in the annual filing. For 404b filers, the external auditor must also attest to that assessment.

What is SOX section 404 B?

SOX section 404(b) is the half of section 404 that requires an external auditor attestation report on internal control over financial reporting. It applies to accelerated and large accelerated filers. EGCs and non-accelerated filers are exempt.

What is the main purpose of section 404 of SOX?

The purpose is to make management responsible for internal controls over financial reporting and to make that responsibility visible to investors. Section 404 forces the CEO and CFO to sign off on the controls, not just on the numbers those controls produce.

Is SOX 404a management internal control reporting an effective alternative to SOX 404b internal control audits?

404(a) is a real alternative for EGCs and non-accelerated filers because the JOBS Act and the SEC’s tiered-filer structure exempt them from 404(b). For accelerated filers it is not an alternative. It is a requirement that runs alongside management’s 404(a) assessment.