SOX 302 vs 404: which officer certifications and ICFR reports apply to you
If you are a newly public or soon-to-be-public company, the short answer is this: Section 302 certifications are signed by the principal executive and principal financial officers with each Form 10-Q and 10-K, while the Section 404 ICFR report is management's annual assessment of internal control over financial reporting as of fiscal year end. An independent auditor attests to that assessment only for accelerated and large accelerated filers that are not emerging growth companies. The certifications happen every quarter and every year, but the ICFR assessment is an annual report with its own timing rules, so the two obligations often start at different points for the same company.
The answer changes with three things: your filer status, the year of your first required report, and whether your certifications omit the ICFR language. Under Rule 13a-14, the Section 302 certifications are exhibits to each periodic report, and officers may leave out the ICFR paragraph until the issuer becomes subject to Rule 13a-15. Under Rule 13a-15(c), the annual management evaluation generally begins with the second annual report, because it applies only once an annual report for the prior fiscal year has been filed or is required. Confirm your first annual report date, your filer category under the accelerated filer definition, and your emerging growth company status with counsel before you plan the work, since each one moves a different obligation.
Your organization owns its controls and signs its own certifications and management assessment. An implementation partner can prepare systems, documentation and evidence that support those statements, but it cannot issue the ICFR report or the auditor attestation. Only the independent registered public accounting firm issues the attestation report, and only where Section 404(b) applies to you. Ask any consultant to state in writing which parts of the work are management's and which are the auditor's, so the certifying officers know what they are relying on when they sign.
How Section 302, 404 and 906 differ side by side
This table compares the three SOX requirements that touch officer sign-off and internal control, row by row, using the rule or section that creates each obligation. Read it as a checklist of who signs, how often, what each statement covers, and what happens if a statement is false. The main takeaway is that only Section 404 involves a management assessment report that an outside auditor may attest to.
| Question | Section 302 (Rule 13a-14) | Section 404 (Rule 13a-15) | Section 906 (Rule 13a-14(b)) |
|---|---|---|---|
| Who signs or prepares | Principal executive and principal financial officers sign each certification | Management prepares the ICFR assessment; the CEO and CFO are responsible for it | Principal executive and principal financial officers sign the certification |
| How often | With each annual report on Form 10-K and each quarterly report on Form 10-Q | Once a year, as of fiscal year end, in the annual report | With each periodic report that contains financial statements |
| What the statement covers | Review of the report, no material misstatement or omission, fair presentation, and responsibility for internal controls | Management's assessment of whether ICFR is effective as of fiscal year end, against a recognized framework | The periodic report complies with the Exchange Act and fairly presents the financial condition and results |
| Does an outside auditor get involved? | No separate auditor report; officers disclose control findings to auditors and the audit committee | Only for accelerated and large accelerated filers that are not emerging growth companies (Section 404(b)) | No separate auditor report |
| Consequence of a false statement | Civil and SEC enforcement exposure under the Exchange Act (confirm current penalties with counsel) | Civil and SEC enforcement exposure; an adverse assessment must be disclosed | Fines up to $1,000,000 and 10 years' imprisonment for knowing false certification; up to $5,000,000 and 20 years for willful false certification (18 U.S.C. 1350) |
| Can ICFR language be omitted? | Yes, until the issuer becomes subject to Rule 13a-15, under Rule 13a-14 | Not applicable; this is the ICFR report itself | Not applicable; the certification does not contain ICFR language |
What officers certify under Section 302 every quarter
Under Section 302 of the Sarbanes-Oxley Act, the principal executive officer and principal financial officer sign a certification that is attached as an exhibit to each periodic report. Rule 13a-14 requires these certifications for each Form 10-Q, 10-K, 20-F and 40-F. The core statements are that the officer has reviewed the report, that to the officer's knowledge it contains no untrue statement of a material fact and no material omission, and that the financial information fairly presents the company's financial condition and results. These statements apply to every quarterly and annual filing, so the signing officers need a repeatable review process, not a once-a-year exercise.
The certification also carries internal control statements. The officers acknowledge that they are responsible for establishing and maintaining internal controls, that they evaluated those controls within 90 days before the report, and that they report on the evaluation's conclusions. They also confirm that they disclosed to the auditors and the audit committee any significant deficiencies and material weaknesses in internal control, and any fraud, whether or not material, involving management or other employees who have a significant role in internal control. Before signing, a finance leader should confirm with the controller, internal audit and IT leadership which ITGC failures or open deficiencies were raised, and document that the disclosure happened.
The 302 certification does not require a formal management assessment of ICFR, but it does require the officers to be able to stand behind the internal control statements. Ask IT and the control owners for a written status of open access, change and operations issues before each filing, and confirm that the audit committee minutes reflect what was reported. Officers should also confirm with counsel which items are subject to the 90-day evaluation window, since the window is measured from the report date.
When newly public companies can omit ICFR language
Rule 13a-14 lets certifying officers leave the internal control over financial reporting language out of the Section 302 certification until the issuer becomes subject to Rule 13a-15. In practice, the first annual report usually carries a certification without the ICFR paragraphs, because management has not yet been required to evaluate ICFR under Rule 13a-15(c). Rule 13a-15(c) generally places the first annual ICFR evaluation in the second annual report, after the company has filed, or been required to file, an annual report for the prior fiscal year. The first annual report still requires full disclosure certifications, so the omission is narrow.
- Certification wording: The 302 certification in the first annual report may omit the internal control paragraphs, but the officers still certify the financial statements and disclosure.
- Disclosure controls: Disclosure controls and procedures remain in scope from the first filing, even without the ICFR language.
- Timing: The first management ICFR assessment generally falls in the second annual report, so the rule covers one fiscal year.
- Sign-off readiness: Officers should understand what they are not yet certifying, and what the second report will require.
- Auditor role: No external auditor attestation applies at this stage.
Confirm with counsel which fiscal year starts the clock for your company and whether any transition relief applies to your specific filing history.
Quarterly reports on Form 10-Q carry Section 302 certifications as exhibits, and the same omission of ICFR language applies while the issuer is not yet subject to Rule 13a-15. Officers certify that they reviewed the report, that it contains no material misstatement or omission, and that the financial information fairly presents the company's condition. The officers still make the statements about responsibility for internal controls and disclosure of deficiencies if the ICFR paragraphs are included. Companies should check the exact certification form for each filing, since counsel usually drafts the template.
- Form coverage: Rule 13a-14 requires the certification as an exhibit to each Form 10-Q, so the omission carries into the first quarters.
- Language check: Compare each quarterly certification against the template approved for the filing, not against the prior year's form.
- Deficiency reporting: Officers still disclose known significant deficiencies or material weaknesses to the auditors and audit committee.
- Change in status: Once the ICFR requirement applies, quarterly certifications must include the ICFR language.
- Documentation: Keep records showing which template was used for each quarter.
Confirm with counsel and the auditor which certification form applies to each quarter in your transition period.
An emerging growth company can use the transition rules above, and it is also exempt from the Section 404(b) auditor attestation. Management still performs the ICFR evaluation under Section 404(a) once the rule applies, and the company still reports the result. The emerging growth company status ends on the terms set out in the statute and SEC rules, so the exemption does not last indefinitely. Companies that rely on this status should track each condition that could end it, including growth thresholds and issuance of certain debt, and plan the move to full auditor attestation in advance.
- Management assessment: The 404(a) management report still applies once the ICFR requirement starts, even for an emerging growth company.
- Auditor attestation: The 404(b) attestation does not apply while emerging growth company status holds.
- Status tracking: Record the date on which the status could end, and the conditions that would end it earlier.
- Planning: Build the ICFR evidence now, so the company can absorb an attestation if it loses status.
- Disclosure: Describe the status in filings where the rules require it.
Confirm with counsel how the status is determined for your company and when it would end.
Filer status drives whether the auditor attestation applies, and it can change after the company goes public. Accelerated and large accelerated filers that are not emerging growth companies need an auditor attestation under Section 404(b), while non-accelerated filers do not. Filer status depends on public float and revenue tests set out in the SEC definitions, and it is determined at fiscal year end. A company can move between categories over time, so the attestation requirement can start in a year that differs from the first ICFR assessment. Smaller issuers can face different timing for the management report.
- Filer category: Accelerated and large accelerated status is set by the definitions in the SEC rules, not by how the company describes itself.
- Status determination: Status is measured as of fiscal year end, so a change in public float can affect the next year's attestation.
- Attestation timing: The auditor attestation can start later than the first management assessment.
- Cost planning: Auditor fees and internal ICFR work usually scale with the attestation requirement.
- Transition tracking: Map each filing against the filer category that applies to that year.
Confirm your filer category, the fiscal year in which the first ICFR evaluation applies, and the attestation start date with counsel and your independent auditor before the first annual report.
How Section 906 adds criminal penalties to the certification
Section 906 sits alongside the Section 302 certifications and attaches to the same periodic reports. Under Rule 13a-14(b), the CEO and CFO certify each report that contains financial statements under 18 U.S.C. 1350, and that certification carries criminal exposure that the 302 exhibit does not.
The 906 certification
Rule 13a-14(b) requires the CEO and CFO to certify, under 18 U.S.C. 1350, each periodic report that contains financial statements. The 906 certification is a separate document from the 302 exhibit and must accompany the report. Confirm with counsel that the filing package includes both certifications for every report with financial statements, including amended reports where your counsel requires them.
Penalty for knowing false certification
A knowing false certification under Section 906 carries fines up to $1,000,000 and up to 10 years' imprisonment. The test is whether the signing officer knew the report did not comply with the statute's requirements. For ICFR work, this means officers should not sign a 906 certification without a documented basis for the financial statements and the control conclusions behind them.
Penalty for willful false certification
A willful false certification carries a higher ceiling: fines up to $5,000,000 and up to 20 years' imprisonment. The willful standard is stricter than knowledge alone and reflects deliberate misstatement. Management should keep the sub-certification and control-testing records that show the officers' review, since those records are what a reviewer examines when judging intent.
Who signs the 906 certification
The principal executive officer and principal financial officer sign the 906 certification, the same two officers who sign the 302 certifications. Smaller issuers often have one person filling both roles, which concentrates personal exposure. Confirm in writing who holds each role for every filing period, and document any change in officer during a reporting cycle.
How 906 differs from the 302 exhibit
The 302 certification is an exhibit to the filing that speaks to disclosure accuracy, responsibility for internal controls and disclosure of deficiencies to auditors. The 906 certification is a separate written certification that attaches criminal penalties to the financial statements in the report. Both must be prepared and reviewed, but the 906 document does not carry the internal control statements that the 302 exhibit contains.
How the reporting cycle moves from quarterly certification to annual ICFR report
The sequence shows how officer certifications made each quarter feed into the year-end management assessment and, where it applies, the auditor's attestation. Each output depends on the one before it, so the evidence gathered early in the year carries through to the annual report.
Close the quarter and prepare financial statements
Management closes the books for the quarter and prepares the financial statements that go into the Form 10-Q, or the Form 10-K for the fiscal year end. Finance, accounting and the disclosure team own this step. The output is a draft report with financial statements that the certifying officers can review, and the step is complete when the close checklist is signed off and open items are documented.
Review the report and sub-certify with control owners
The principal executive and financial officers review the draft report and the sub-certifications or control inputs from business and IT owners. Those inputs cover known control failures, fraud involving key control personnel and significant changes. The output is a record showing who reviewed what and what was raised, which supports the officers' statements about internal controls.
Evaluate controls and report deficiencies to auditors
Under Section 302, the certifying officers state that they evaluated internal controls within 90 days before the report and disclosed significant deficiencies, material weaknesses and fraud to the auditors and audit committee. The output is a set of disclosure communications to the auditor and audit committee, and the step closes when those communications are on file and any significant changes to controls are reported.
Sign the Section 302 and 906 certifications
The CEO and CFO sign the Section 302 certifications, filed as exhibits under Rule 13a-14, and the Section 906 certifications under 18 U.S.C. 1350, which accompany each periodic report containing financial statements. Section 906 adds criminal exposure for knowing or willful false certification. The output is the signed certifications filed with the report, and the step is complete when both sets are attached to the filing.
Repeat the quarterly cycle through the fiscal year
Each quarterly report repeats the review, disclosure and certification steps, so the officers certify at every periodic filing. Under Rule 13a-14, the ICFR language may be omitted from the Section 302 certification until the issuer becomes subject to Rule 13a-15, which matters for newly public companies. The output is a consistent set of certifications across the year, and the step is complete when each filing carries its certifications.
Complete management's annual ICFR assessment
At fiscal year end, management performs its Section 404(a) assessment of the effectiveness of internal control over financial reporting, using a suitable recognized framework as Rule 13a-15(c) requires. Under that rule, the annual evaluation generally starts once the issuer has filed an annual report for the prior year, so the first assessment usually falls in the second annual report. The output is management's documented assessment, and the step is complete when the conclusion and supporting evidence are ready for the annual report.
Obtain the auditor attestation where required
Where Section 404(b) applies, the registered public accounting firm attests to and reports on management's assessment under PCAOB AS 2201. The attestation does not apply to emerging growth companies or to issuers that are neither accelerated nor large accelerated filers. The output is the auditor's report included with the annual report, and the step is complete when the auditor has issued its report and management has confirmed the filing.
File the annual report with ICFR disclosures
The Form 10-K includes management's ICFR report, any auditor attestation, and the Section 302 and 906 certifications for the year. Management and the audit committee should confirm that the year-end conclusions match the quarterly disclosures. The output is the filed annual report, and the step is complete when the certifications and ICFR reports are attached and the evidence package is retained.
Who signs, who evaluates and who attests
Section 302 certifications, the Section 404 management assessment and the auditor attestation are three separate obligations with three separate owners. The cards below separate who signs, who evaluates, who attests and who only prepares the evidence those people rely on.
CEO and CFO certifications
The principal executive and financial officers sign the Section 302 certifications attached to each Form 10-Q and 10-K. They state they reviewed the report, that it contains no material misstatement or omission, and that they are responsible for internal controls. They also certify that they disclosed significant deficiencies and material weaknesses to the auditors and audit committee. Before signing, confirm the sub-certification process that gives them the facts they are attesting to. Their signatures are personal, so the basis for each one should be documented.
Management and audit committee
Management evaluates the effectiveness of internal control over financial reporting as of fiscal year end and includes that assessment in the annual report. The audit committee oversees the process, receives deficiency reports and reviews how material weaknesses are disclosed. Management owns the assessment, so it cannot delegate that judgment to the external auditor or to an implementation partner. Ask for a written evaluation that names the framework used, the controls tested and the deficiencies found.
Independent registered public accounting firm
The registered public accounting firm attests to management's ICFR assessment under Section 404(b), and only for accelerated and large accelerated filers that are not emerging growth companies. The firm tests controls under PCAOB AS 2201 and issues its own report on internal control. It does not sign the Section 302 certifications. Confirm early whether your filer status requires this attestation, because that status decides whether the audit fee applies at all.
Implementation partner's role
An implementation partner such as DeployOpen can prepare systems, control evidence and documentation for the controls management evaluates. It can help organize access reviews, change records and backup logs so management and the auditor can test them. It does not sign certifications, make the ICFR assessment or issue any report or attestation. Agree in the written scope which artifacts are delivered and confirm that management keeps ownership of every conclusion.
How IT general controls support what officers certify
Officers who sign Section 302 certifications rely on internal control over financial reporting, and much of that control depends on IT general controls. Automated controls, such as a system that calculates revenue or applies a pricing rule, only work as designed if the underlying application is protected from unauthorized access, changed through approved releases, implemented under tested procedures and kept running completely and accurately. The four areas SEC guidance names (access to programs and data, program changes, program development and computer operations) are the usual places where those protections live. An officer who certifies that controls were evaluated is, in practice, relying on evidence that these areas work for each financially significant system.
SEC guidance in Release 33-8810 does not publish a catalog of IT general controls. It says the aspects relevant to an ICFR evaluation vary with each company's facts and circumstances, and that management only needs to evaluate the IT general controls necessary for other controls addressing financial reporting risks to operate properly and consistently. Before officers sign, management should confirm which applications, databases and infrastructure feed financial reporting, which automated controls depend on them, and which ITGCs protect those dependencies. Confirm this scoping with the external auditor early, since the auditor's own risk assessment under AS 2110 will shape what it expects to see.
Weak ITGCs can change what an officer can say. If an access or change control fails and the company cannot show that dependent automated controls still worked, the failure may be classified as a deficiency, a significant deficiency or a material weaknesses, and the certifying officers must disclose significant deficiencies and material weaknesses to the auditors and audit committee under Section 302. Ask the control owners for a list of ITGC exceptions from the period, the compensating controls management relies on for each, and the dates those exceptions were identified and closed. That list is the starting point for the disclosure conversation before the certification is signed.
Common questions about SOX 302, 404 and 906 certifications
Who signs the Section 302 certifications and how often?
The principal executive officer and the principal financial officer sign the Section 302 certifications. Under Rule 13a-14, they are attached as exhibits to each Form 10-Q, 10-K, 20-F and 40-F, so they are signed for every quarterly and annual periodic report. The certifying officers state that they reviewed the report, that it contains no material misstatement or omission, and that the financial information fairly presents the company's condition. They also state that they are responsible for internal control over financial reporting and that they evaluated those controls within 90 days before the report.
Does the auditor sign the Section 302 certificate?
No. The Section 302 certificate is signed by the CEO and CFO, not by the external auditor. The auditor's role under Section 404(b) is to attest to and report on management's assessment of internal control over financial reporting, and only for issuers that are subject to that requirement. Certifying officers rely on their own evaluation, on the work of internal audit and on information the auditor communicates, including significant deficiencies and material weaknesses, which they must disclose to the auditors and the audit committee.
Can a newly public company omit the ICFR language from its certification?
Rule 13a-14 lets officers omit the internal control over financial reporting language from the Section 302 certification until the issuer becomes subject to the ICFR requirements of Rule 13a-15. Whether and when that applies depends on the company's filer status, its emerging growth company status and the transition rules that follow an IPO. Confirm the exact wording and timing with the company's securities counsel and external auditor before the first filing, because the omission is not a general exemption from internal control obligations.
When is the first Section 404 management assessment due?
Rule 13a-15(c) requires the annual ICFR evaluation only once the issuer has filed, or been required to file, an annual report for the prior fiscal year. The first assessment therefore generally falls in the second annual report, not the first. Counsel and the auditor should confirm the date for a specific company, since it depends on when the company became a reporting company and on its filer status.
What is the difference between the Section 302 and Section 906 certifications?
Section 302 certifications are a disclosure and internal control statement required with each periodic report. Section 906, under 18 U.S.C. 1350, is a separate certification by the CEO and CFO that each periodic report containing financial statements fully complies with the Exchange Act and that the information fairly presents the company's financial condition. Rule 13a-14(b) requires the Section 906 certifications to accompany those reports. Section 906 carries criminal penalties: fines up to $1,000,000 and up to 10 years' imprisonment for knowing false certification, and up to $5,000,000 and up to 20 years for willful false certification.
What should the company prepare before the officers sign?
Before signing, officers need evidence that supports each statement they make. In practice this means:
- A documented evaluation of disclosure controls and internal control over financial reporting, completed within the 90 day window the certification describes
- A current list of significant deficiencies, material weaknesses and known fraud involving key control personnel, with a record of what was communicated to the auditors and audit committee
- Sub-certifications or review records from finance, IT and control owners, including evidence for IT general controls that affect financial reporting
- A record of significant changes to internal control since the last evaluation
The organization owns these controls. An implementation partner can help prepare systems and evidence, but only the company's officers sign, and counsel and the auditor should review the process.
Can an implementation partner prepare the certification evidence for us?
An implementation partner can prepare the systems, controls documentation and evidence that officers review, but it cannot sign or attest for the company. DeployOpen plans, implements, documents and supports self-hosted open-source platforms in the client's own infrastructure, and it prepares systems and evidence for compliance assessments. It does not issue audit reports, attestations or certifications, and its engagements are fixed-scope with the scope agreed in writing before work starts. Ask counsel and the external auditor which evidence they will rely on before scoping that work.
How DeployOpen prepares systems and evidence for ICFR work
DeployOpen plans, implements, documents and supports self-hosted open-source platforms inside the client's own cloud accounts, data centers or air-gapped networks, and it prepares the IT general control systems and evidence that management uses for its Section 404(a) assessment and that the external auditor later tests. In practice, that means setting up the platforms that run financially significant processes, configuring access and change workflows, and organizing the records that show those controls operated during the fiscal year. The work is scoped in writing before it starts, so the client knows which applications, environments and evidence sets are included before any system is touched.
The roles in this topic are fixed. The organization's officers sign the Section 302 certifications and the Section 906 certifications, and management owns its ICFR assessment and the conclusions in it. DeployOpen does not sign any certification, does not perform or issue the Section 404(b) auditor attestation, and does not issue any report, opinion or certificate. Only the independent registered public accounting firm can attest to management's assessment. When you bring in DeployOpen, ask for a written statement of which evidence artifacts will be produced, who in your organization approves them, and which items remain your responsibility to collect and retain.
Before you engage any implementation partner, confirm three things with your audit committee and external auditor: which systems are in ICFR scope, what evidence format and retention period they expect, and how they plan to test design and operating effectiveness. Engagement scope and timing should follow from those answers. Preparing well-documented systems does not guarantee a clean ICFR conclusion or an unqualified attestation, because outcomes depend on the design of your controls, how they operated, and what the auditor finds.
