What does SOX 404 compliance cost, and how much of it is IT controls?
A finance or IT leader who owns a SOX 404 budget should start with the SEC's own numbers. The SEC Office of Economic Analysis found that the mean total Section 404 compliance cost for companies subject to the auditor attestation under Section 404(b) was $2.87 million before the 2007 reforms and $2.33 million after. The study did not break out IT controls as a separate line, so no published figure isolates the IT share of that total. Any internal number for ITGC work has to be built from your own cost records.
The IT share moves with the company. The same SEC study found that absolute Section 404 costs rise with public float, while costs measured against assets fall as company size grows. It also found that longer experience with 404(b) is associated with lower reported costs. The number of financially significant applications, databases, infrastructure components and locations in scope will drive the IT share more than any single line item, so the first budget question is how many systems your scoping process places inside the ICFR evaluation. Internal labor was the largest component of total cost for 404(b) companies, ahead of the ICFR share of audit fees, outside vendor fees and non-labor costs, which means most of the ITGC spend sits in staff time rather than invoices.
Two roles should stay fixed in the budget. The organization owns its controls and the evidence that supports management's assessment. An outside implementation partner such as DeployOpen can prepare systems, configuration baselines and evidence packages for those controls, but it does not assess them or issue an attestation. Under Section 404(b), the company's registered public accounting firm attests to management's assessment and issues the report. Before approving a budget, ask your auditor which ITGC populations and samples they expect, and ask any partner for a fixed scope in writing that lists the systems, control areas and deliverables it covers. A quote built from that written scope is the only reliable way to convert the SEC's survey averages into a figure for your environment.
Who gets paid for what in a Section 404 budget
This table compares the main cost components of Section 404 compliance by who is paid, whether the cost is one-time or recurring, and what moves it up or down. Internal labor is the largest category in the SEC's 2009 study, so read the rows for vendors and tooling as the parts you can scope and buy separately. Use the table to build questions for your quote and to see which costs stay with your own team.
| Cost component | Who is paid | One-time or recurring, and what drives it |
|---|---|---|
| Internal labor | Your own finance, IT and control staff (salaries and time allocation, not a payment to a vendor) | Recurring every year. Drivers include the number of key systems in scope, the count of manual controls, how many ITGC changes occur, and how much evidence must be gathered by hand. |
| ICFR share of the auditor's fee | Your independent registered public accounting firm, for the portion of audit work tied to the internal control attestation | Recurring, and only for companies subject to the 404(b) attestation. Drivers include public float, the number of IT-dependent controls the auditor tests, and whether evidence is ready for interim testing. |
| Outside vendor and consultant fees for setup | Consultants or implementation partners who document controls, define scope and prepare systems and evidence | Largely one-time for initial scoping, documentation and control design. Drivers include the number of applications, the state of existing documentation and the amount of remediation needed before the first assessment. |
| Outside vendor and consultant fees for testing support | Advisors who help test controls, prepare samples or run a readiness review | Recurring in most years, often sized to the annual testing cycle. Drivers include how much testing management performs internally, how many ITGC areas are outsourced and how stable the environment is. |
| Tooling and non-labor costs | Software vendors, hosting providers and, for self-hosted platforms, your own cloud or data center operations | Mixed. License and hosting costs recur, while configuration and integration are usually one-time. Drivers include the number of log sources, retention periods and whether open-source tools reduce license spend but add operating effort. |
| Ask in every quote | Each vendor and advisor in your budget | Confirm the fixed scope, deliverables, what is one-time versus recurring, the assumptions about systems and locations, and which evidence the work will produce. |
Which factors make the IT controls share larger or smaller
The IT controls share of Section 404 cost moves with how many financially significant systems a company runs, how it is sized and how mature its evidence is. Each driver below is managed through scoping and evidence discipline, not by removing controls that auditors expect to see.
Public float
Absolute Section 404 cost rises as public float grows, because a larger float usually means a larger audit scope and more walkthroughs and tests. For ITGC work, the question is how many financially significant applications and reports the auditor will rely on. Ask the external auditor early which systems they plan to test, and confirm whether the ICFR audit fee in your quote covers the IT areas you expect to be in scope.
Company size by assets
Costs scaled by assets fall as company size grows, so a smaller balance sheet often carries a heavier compliance burden per dollar of assets. Smaller issuers can keep the IT controls share proportionate by standardizing a few core financial systems and limiting the number of people who administer them. Check whether your scope grows with headcount or with the systems that actually feed the financial statements.
Financially significant applications and databases
Each application or database that feeds financial reporting adds access, change and operations controls to test. Keeping the inventory of these systems current, and retiring unused ones, reduces the number of control sets that internal labor must design, operate and evidence each year. Ask for a scoping memo that lists each system, its role in reporting and the owner who produces its evidence.
Cloud and SaaS dependence
Financial systems hosted in public cloud or SaaS shift some ITGC evidence to providers, but management still owns user access, configuration and change approval inside the tenant. Costs rise when teams must request provider reports, map shared responsibilities and test the parts they retain. Confirm which provider reports exist, how often they are issued and which controls you must test yourselves.
Locations and third-party providers
Each business location, shared service center and outsourced provider can add entities, interfaces and reports that auditors may need to cover. Costs grow when evidence is gathered separately from each site or vendor, and when service organization reports arrive late or do not match the period under review. Maintain one register of locations and providers, with the report and bridge letter status for each.
Years of 404(b) experience
The 2009 SEC study associated longer 404(b) experience with lower reported costs, which suggests that repeatable processes, stable control design and reusable evidence reduce yearly effort. Teams in their first audit cycles usually spend more on documentation and testing preparation. Track which tests and evidence packages carried over unchanged from the prior year, and ask for a plan that shows how those will be reused.
What the 2020 404(b) exemption estimate means for an ITGC budget
The SEC estimated in 2020 that an issuer newly exempt from the Section 404(b) auditor attestation would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs (Release 34-88365). That saving removes the auditor's attestation work, not management's own assessment. Section 404(a) still requires management to assess internal control over financial reporting every year, and the IT general controls that support automated financial controls remain part of that assessment. An exempt company that cuts its ITGC budget on the assumption that the 404(b) saving covers ITGC testing will likely find its evidence thin when management has to show the assessment is supported.
The estimate is an average across issuers, so it should not be used as your own budget line. The part of the saving tied to audit fees depends on how much of the ICFR audit your auditor was doing, and the part tied to other costs depends on what your team spent on preparing for that audit. Before you rely on any figure, ask your finance team and internal audit to split last year's SOX spend into management labor, auditor fees for the ICFR attestation, outside vendor fees and non-labor costs. That split shows which costs the exemption would actually reduce and which will stay with you.
Whether the exemption applies at all depends on filer status under 15 U.S.C. 7262(b) and (c) and the accelerated filer definition in 17 CFR 240.12b-2, including whether the company qualifies as an emerging growth company. Those tests use public float, revenue and transition periods that change from year to year, so confirm your current status with securities counsel and your auditor before you change your audit plan. Once status is confirmed, plan the ITGC work for the year management must still assess, and keep the evidence for the controls that support your financial reporting.
How a SOX ITGC cost estimate moves from scope to quote
This sequence turns a general question about Section 404 cost into a written, scoped estimate for IT general control work, with each phase producing an artifact that the next phase depends on. Readers can use it to see where their own spend will land and what to ask a partner to price.
Confirm filer status and 404 applicability
Management first establishes whether Section 404(a) applies and whether the external auditor attestation under Section 404(b) applies, based on filer status, emerging growth company status and public float. The controller, general counsel and securities counsel usually own this decision, with the audit committee informed. The output is a written applicability memo that states which assessments apply to the fiscal year. Without it, nobody can say whether the estimate covers a management assessment only or a full auditor attestation, and the two carry very different cost profiles.
Scope financially significant systems and reports
Using a top-down, risk-based approach, management identifies the financial reporting risks, the controls that address them and the applications, databases, infrastructure and locations those controls depend on. Only IT general controls needed for the proper and consistent operation of those controls are in scope, so operational-only systems drop out. The output is a system inventory that maps each in-scope application to its reports and automated controls. The number of in-scope systems is the single biggest driver of ITGC hours, so ask any partner to price against this list.
Document ITGC design and walkthroughs
For each in-scope system, the team documents how access, program change, program development and computer operations controls are designed and then walks a transaction or change through the process to confirm the documented design matches reality. Process owners and system administrators supply the walkthrough evidence. The output is a set of control narratives and walkthrough memos for each area, with gaps recorded. Teams that already maintain current documentation spend less here than teams starting from scratch, which is a common reason for wide variation in quotes.
Test controls in-house or with a partner
Testing checks whether each ITGC operated effectively over the period, using samples of access reviews, change tickets, job logs and backup records. The company may test with internal staff, with co-sourced internal audit or with an implementation partner that prepares the test packages. Management owns the conclusion either way. The output is a test workpaper set with exceptions logged. Ask any quote to state which tests the partner performs, which the company performs, and how sample sizes are set.
Remediate gaps before year end
Each exception is evaluated for its effect on the IT-dependent controls it supports, and then either remediated or covered by a compensating control. Remediation work, such as tightening access reviews or fixing change approval workflows, is usually the least predictable cost because it depends on what testing finds. The output is a remediation log showing the fix, the date it took effect and the retest result. Scope a remediation allowance separately in the quote instead of folding it into the base fixed price.
Hand evidence to the external auditor
The company organizes the evidence package by control area and system, cross-referenced to the scope inventory and the test workpapers, and provides it to the external auditor. The auditor performs its own testing under PCAOB standards where a Section 404(b) attestation applies. The output is an indexed evidence repository and a clear list of open requests. Any cost related to auditor queries and re-performance is usually billed by the audit firm, so ask the auditor to confirm its fee assumptions before the engagement starts.
What inflates ITGC cost and how to avoid it
Most of the cost of IT general controls comes from doing more work than the financial reporting risk requires, or finding gaps late when fixes are expensive. The cards below name the common inflators and the step that keeps each one under control. Each is a planning decision that management and its advisers can make before testing starts.
Scoping every system
Treating every application, server and database as in scope multiplies testing across systems that do not feed financial reporting. SEC guidance says management evaluates only the IT general controls needed for the proper and consistent operation of controls that address financial reporting risks, and can leave out controls that only affect operational efficiency. Avoid this by mapping each financially significant report to its source systems and documenting why each system is in or out of scope. Ask your advisers to show that mapping before any testing fee is agreed.
Discovering missing evidence late
Evidence gaps, such as change tickets without approvals or access reviews without sign-off, are often found during the auditor's year-end fieldwork. Each gap then requires retesting, extra samples and more outside hours. Avoid this by running a mock walkthrough of each in-scope control several months before year end and keeping a dated evidence log. Ask whether the evidence will show who performed each control and when, not only that the control exists.
Unplanned remediation near year end
A control that fails close to the fiscal year end leaves little time to redesign it, operate it and test it again before management's assessment. The cost then shifts to rush consulting, overtime and possible compensating controls. Avoid this by setting internal deadlines for remediation well before year end and tracking each open gap against the audit calendar. Confirm with your auditor which operating periods they expect to test.
Undocumented cloud and SaaS reliance
When a financial system runs in a cloud or SaaS environment, management still owns the controls over access, changes and operations that touch it. Without documentation of what the provider handles and what the company handles, teams end up collecting provider reports in the final weeks and rebuilding the responsibility split by hand. Avoid this by recording each provider's relevant reports, their coverage period and the company's own controls in a single responsibility matrix. Confirm which reports the provider can supply and how often they are updated.
Fixed-scope work without written deliverables
Fixed-scope engagements are priced against a defined scope, so vague deliverables lead to change requests when the work turns out larger than expected. Disputes over whether a control was tested or a document was produced add cost on both sides. Avoid this by agreeing in writing the systems, controls, test procedures, evidence formats and acceptance criteria before work starts. Ask each adviser to list what is excluded, so the quote can be compared line by line.
Questions buyers ask about SOX 404 cost and IT controls
What do the SEC's Section 404 cost figures measure, and how old are they?
The most detailed published figures come from the SEC Office of Economic Analysis study issued in September 2009, which compared costs before and after the 2007 reforms. It reported that mean total Section 404 compliance cost for companies subject to auditor attestation under 404(b) fell from $2.87 million to $2.33 million, with medians of $1.19 million and $1.04 million. These numbers describe companies from that period, so they show the structure of cost rather than what a company pays today. Use them to understand which components dominate, then ask current advisers and auditors for present-day estimates tied to your filer status, public float and systems. The SEC study sets out the methodology and sample.
Is internal labor really the largest part of Section 404 cost?
Yes, according to the 2009 SEC study, internal labor could make up more than 50 percent of total Section 404 compliance cost for companies subject to 404(b). The remaining components were the ICFR share of audit fees, outside vendor fees and non-labor costs. This matters for IT controls because the hours spent by finance, IT and control owners on evidence collection, walkthroughs, access reviews and change tickets often exceed the fees paid to outside parties. Budgets that count only auditor and consultant invoices understate the program. Ask your team to time the recurring evidence tasks for each ITGC area before you set a budget.
How much of the Section 404 budget goes to IT controls versus the audit?
The SEC study does not split total cost into an IT-only figure, so no exact IT share can be stated from it. What it does show is the ICFR portion of audit fees and outside vendor fees as separate lines. For 404(b) companies, the mean ICFR audit fee share fell from $821,000 to $652,000 after the 2007 reforms, and the mean outside vendor fee fell from $438,000 to $311,000. IT general controls sit inside both internal labor and these fee lines, because auditors test them as part of ICFR. To find your own split, tag internal hours and invoices by ITGC area (access, program changes, program development, computer operations) during the year and compare them to the audit fee letter.
Does a non-accelerated filer still pay for ITGC work under SOX?
Often yes, but the cost falls in a different place. Section 404(a) requires management to assess internal control over financial reporting for most issuers, while Section 404(b) auditor attestation does not apply to emerging growth companies or to issuers that are neither accelerated nor large accelerated filers. The 2009 SEC study found that among companies subject only to 404(a), the mean total cost fell from $425,000 to $336,000, while the median rose from $111,000 to $162,000. In 2020 the SEC estimated that an issuer newly exempt from 404(b) would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs. Management still needs evidence that IT controls supporting financial reporting operate, so an exemption from the attestation does not remove the internal work.
What should we ask a partner for in a Section 404 or ITGC quote?
Ask for a written scope before any price. A useful quote lists the in-scope applications, databases, infrastructure and locations, the ITGC areas covered, the number of systems and controls to be documented or tested, and who performs each task. It should state which deliverables are one-time, such as current-state documentation, control design and remediation, and which recur, such as quarterly access reviews, change sampling support and evidence collection for the audit cycle. Ask how the partner works with your external auditor and what the partner will not do. DeployOpen does not publish prices. Its fixed-scope engagements are quoted from a written scope agreed before work starts, and ongoing support is available as a retainer.
Can our own team perform the ITGC work without an outside partner?
Many organizations do part of the work internally, and the decision depends on the systems in scope, the number of controls, staff availability and the audit timetable. Management owns its controls and must be able to evidence them, so internal ownership is required even when a partner helps. Work that often stays in-house includes approving access, owning change decisions and reviewing evidence. Work that partners often help prepare includes mapping systems to controls, configuring logs and ticket trails, building evidence collection routines and running the first full testing cycle. Estimate your internal hours by ITGC area first, then decide which tasks to co-source. Outside firms can prepare evidence, but only the independent auditor issues the attestation.
What to ask for in a written SOX ITGC quote
A written quote for SOX ITGC work should start with a list of in-scope systems: each financially significant application, its database and operating system, the infrastructure it runs on, and the locations and reports that depend on it. Ask the provider to tie each system to the risk assessment your management team completed, because the scope drives the number of controls tested and the sample sizes behind them. The quote should then address the four IT general control areas named in SEC guidance (access to programs and data, program changes, program development and computer operations) and state which of them apply to your facts. For each area, ask for named deliverables: a control narrative, a walkthrough write-up, a control matrix mapping each control to its owner and frequency, and a test script or evidence request list. Ask which deliverables are one-time (initial design documentation, system inventory, remediation of gaps) and which recur each year (operating effectiveness testing, quarterly access reviews, change sample pulls). Also confirm the evidence format each deliverable will take, such as exported system reports with timestamps, ticket records, approval workflows and backup restore logs, and who keeps the originals.
The quote should also state what your staff must provide, because internal labor is the largest component of Section 404 cost according to the SEC's 2009 study. Ask for a list of client roles, expected hours per role, and the named people who will grant system access, approve changes and supply data extracts. Confirm who owns each control: the organization owns its controls and remains responsible for its ICFR assessment, while the implementation partner prepares systems, documentation and evidence. Be wary of any language suggesting the provider will sign off on the effectiveness of your controls. Only your management, through its own assessment, and your independent registered public accounting firm, through its attestation under PCAOB AS 2201, can reach those conclusions. Ask the quote to list what the external auditor still performs on its own, including its risk assessment under AS 2110, its independent testing and its attestation report. Illustrative example: a quote that prices "ITGC support" with no system list, no named owners and no statement of what the auditor does itself gives you no basis for comparing bids or for holding anyone to the work.
How DeployOpen prepares SOX ITGC systems and evidence
DeployOpen is a Chainscore Labs company that plans, implements, hardens and documents self-hosted open-source platforms inside the client's own infrastructure. We prepare the systems and IT general control evidence that management and the external auditor test, which is where a large share of Section 404 effort sits, while the company keeps ownership of its controls and the independent auditor issues the conclusions.
How we scope
- Agree in writing which financially significant applications, databases and infrastructure fall inside the ITGC scope before work starts.
- Map the four ITGC areas to each in-scope system so internal labor estimates rest on a defined boundary.
- Confirm with your auditor and internal audit which controls and evidence they expect, and record that in the written scope.
- Request a fixed-scope quote that lists deliverables, timelines and assumptions, so cost drivers are visible from the start.
How we build
- Configure access, change, development and operations controls on the self-hosted platforms within your own cloud accounts or data centers.
- Set up logging, ticket linkage and approval workflows so each control produces evidence without manual reconstruction at year end.
- Document control design, owners and frequency so internal teams can operate the controls without relying on outside staff.
- Test the configured controls with your team before handover so gaps surface before the auditor's walkthroughs begin.
How we hand over
- Deliver control narratives, configuration baselines, runbooks and an evidence index tied to each control and system.
- Walk your internal audit and IT teams through how to pull evidence for samples, reducing repeated requests during testing.
- Transfer administrative knowledge and access so management retains ownership of the controls and their operation.
- Confirm with your external auditor what they will accept as evidence, since only the auditor issues reports or attestations.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the initial scope is delivered.
- Revisit the ITGC scope when systems change, new platforms are added or the filer status of the company changes.
- Keep documentation current with each platform upgrade so evidence stays consistent from one fiscal year to the next.
- Scope retainer work in writing so recurring effort and its drivers stay visible to finance and IT leadership.
