SOX 404(b) auditor attestation for new accelerated filers

When does the SOX 404(b) auditor attestation start for a new accelerated filer?

The auditor attestation under Section 404(b) starts with the fiscal year end after a company becomes an accelerated or large accelerated filer, provided it is not an emerging growth company and the twelve-month reporting and annual report conditions are met. Those conditions are that the company has been subject to Exchange Act reporting for at least twelve calendar months and has filed at least one annual report. Filer status is set by public float, meaning the market value of common equity held by non-affiliates, measured as of the last business day of the second fiscal quarter. An accelerated filer has at least $75 million but less than $700 million of public float, and a large accelerated filer has $700 million or more. Issuers eligible for the smaller reporting company revenue test are excluded from accelerated status. Management, not DeployOpen, determines filer status, and the company should document that determination each year.

Because float is measured at a single date each year, the answer can change from one year to the next. A company that crosses $75 million at its second quarter end becomes an accelerated filer for the following fiscal year, but the attestation does not begin until its reporting history and annual report conditions are satisfied. Illustratively, a company that first lists in the middle of a year may have a float above the threshold at its next second quarter end, yet still owe no 404(b) attestation until its first annual report has been filed. Equally, a company whose float falls below $75 million may exit accelerated status. Confirm the float calculation with counsel and your audit committee, and confirm the current rule text in 17 CFR 240.12b-2 before relying on any year-end conclusion.

How a company works out its filer status each year

This sequence tells a company whether it has become an accelerated or large accelerated filer, and therefore whether the external auditor's ICFR attestation under Section 404(b) applies to its next annual report. Each step produces a documented conclusion that management, counsel and the auditor can review.

Confirm Exchange Act reporting history
Finance and legal confirm the company has been subject to Exchange Act reporting for at least twelve calendar months and has filed at least one annual report. Both conditions come from Rule 12b-2, and a company that misses either one cannot be an accelerated filer regardless of its size. The output is a dated reporting history memo that lists the registration date, each periodic filing and the annual report filed, reviewed by securities counsel.
Identify the second fiscal quarter end
Legal and financial reporting identify the last business day of the second fiscal quarter, the measurement date for public float under Rule 12b-2. The date is fixed by the company's own fiscal calendar, so it should be recorded in the filer-status workpaper before any share price data is pulled. The output is a confirmed measurement date tied to the fiscal year being tested.
Measure public float at that date
The company calculates public float as of the measurement date by valuing the common equity held by non-affiliates, using the aggregate market value method that Rule 12b-2 describes. Affiliate holdings are excluded, so the cap table and insider ownership records must be current. The output is a public float calculation with the price source, share counts and affiliate exclusions documented so an auditor can recompute the figure.
Apply the smaller reporting company revenue test
Before using the float thresholds, the company checks whether it qualifies for the smaller reporting company revenue test, which Rule 12b-2 uses to exclude certain issuers from accelerated filer status. This check looks at annual revenues and public float together, so it must use the figures reported for the most recent fiscal year. The output is a written eligibility conclusion that states whether the exclusion applies and cites the revenue figures used.
Compare float with the accelerated filer thresholds
If the company is not excluded, the public float figure is compared with the Rule 12b-2 thresholds: $75 million or more but less than $700 million for an accelerated filer, and $700 million or more for a large accelerated filer. The company also confirms it is not an emerging growth company, since EGC status removes the 404(b) requirement regardless of float. The output is a threshold conclusion that names the filer category and the status check.
Apply the classification to the next annual report
The filer category determined from the second quarter measurement applies to the annual report for the fiscal year that follows. Financial reporting and the SEC reporting lead record the effective fiscal year, which in turn tells the audit team whether Section 404(b) attestation is required for that cycle. The output is a fiscal-year applicability memo that confirms the 404(b) requirement or its absence for the upcoming audit.
Document the conclusion and obtain review
The filer-status conclusion is written up as a workpaper with each input, source and calculation, then reviewed by securities counsel and shared with the external auditor before planning starts. The auditor's review confirms the attestation scope, and any disagreement about float or status is resolved before the ICFR plan is set. The output is a signed-off filer-status memo retained with the SOX documentation, which the company should refresh each year.

Public float tests and the twelve-month reporting rule

Filer status is set by a public float test, and the test is measured at the end of the second fiscal quarter. Under Rule 12b-2, an issuer is an accelerated filer if its public float is $75 million or more but less than $700 million, and a large accelerated filer at $700 million or more. Public float generally counts shares held by non-affiliates, valued at the market price, so the figure reflects how much of the company's stock is actually traded outside insiders. The status you hold in a fiscal year is determined by the float at the second quarter end of the prior year, which means a company whose float jumps late in the year will not feel the 404(b) requirement until the following annual cycle. Confirm the exact float calculation, the price and share count conventions, and the exclusion for issuers eligible for the smaller reporting company revenue test against the current text of 17 CFR 240.12b-2 at the eCFR definitions, not against a summary or a banker's model.

A newly public company cannot become an accelerated filer until it has been reporting for a set period. Under Rule 12b-2, the issuer must have been subject to Exchange Act reporting for at least twelve calendar months and must have filed at least one annual report. A company that completes an IPO therefore usually stays a non-accelerated filer for its first annual report even if its float is well above the threshold. Finance and legal teams should map the registration effective date, the twelve-month date and the first 10-K filing date onto the calendar, because these three dates decide when management's 404(a) assessment and the auditor's 404(b) attestation first apply. This timing also determines when IT teams need ITGC evidence that will survive an integrated audit.

Plan the timeline backward from the next second-quarter measurement date. Once the float figure is known, the practical question is whether the company will be an accelerated filer at its next year end and whether it still qualifies as an emerging growth company, since EGC status overrides the filer test for 404(b) purposes. Ask the external auditor and counsel to confirm in writing which annual report first triggers the attestation, and ask IT leadership to name which financially significant systems will need documented ITGCs and a tested operating history before that report. A float forecast that changes after the second quarter does not change the current year's status, so the plan should include a check at each quarter end.

How EGC status ends and triggers the 404(b) attestation

Emerging growth company status is the first gate for the 404(b) attestation, and it ends on any of four triggers. The attestation applies only when the company is also an accelerated or large accelerated filer, so each trigger should be checked against the company's own dates and public float.

Revenue reaches the threshold

EGC status ends at the fiscal year end in which annual revenues reach $1,235,000,000. Revenue is measured at that fiscal year end, so a company growing toward the limit should model the year it could cross it. Finance should confirm the revenue figure used for this test against the company's audited financial statements, not forecasts.

Fifth anniversary of IPO

EGC status ends at the fiscal year end after the fifth anniversary of the first registered sale of common equity. The clock runs from the first registered sale, not from listing or the date the S-1 went effective, so the company should confirm that date with counsel. A fiscal year end falling just after the anniversary can extend EGC status by almost a full year.

Over $1 billion in debt

EGC status ends if the company has issued more than $1 billion of non-convertible debt over the prior three years. Treasury and legal teams should keep a running schedule of note and bond issuances, since a large refinancing can end EGC status without any change in equity or revenue. Convertible instruments are not counted under this trigger.

Becoming a large accelerated filer

A company that becomes a large accelerated filer loses EGC status, because large accelerated filers have public float of $700 million or more measured at the end of the second fiscal quarter. Losing EGC status here matters most because the 404(b) attestation then applies on the same measurement cycle. Public float should be tracked at each second quarter end.

Attestation needs filer status too

EGC status ending does not create the 404(b) attestation by itself. The company must also be an accelerated or large accelerated filer, which depends on public float at the second quarter end and on the twelve-month reporting history. A company that loses EGC status but remains a non-accelerated filer still owes only management's 404(a) assessment.

Track each trigger on a calendar

Each trigger has a different measurement date, so a single annual review can miss one. Keep a dated tracker covering fiscal year end revenue, the IPO anniversary, debt issuance over three years, and second quarter public float. Confirm each date and figure with the external auditor and securities counsel, and review the tracker after every financing or acquisition.

What changes in ITGC testing and evidence once the auditor opines

Once a company must obtain an auditor's attestation under Section 404(b), management's own work does not stop. Management still performs and documents its 404(a) assessment of internal control over financial reporting each fiscal year end, and it still needs IT general controls that keep financially significant systems operating consistently. What changes is who tests them. The external auditor now audits ICFR under PCAOB AS 2201, integrated with the financial statement audit, and assesses IT risks under AS 2110, which requires the auditor to understand the IT general controls that the automated controls depend on. For IT teams, the first audit year usually brings a sharper set of questions about access, change and job processing than the management assessment alone did.

The auditor may use the work of internal audit and of others working for management or the audit committee. Under AS 2201, paragraphs 16 to 19, that reliance is scaled to the competence and objectivity of those people and to the risk of the control being relied on. A higher-risk ITGC, such as privileged access to a general ledger database, will draw more direct testing by the auditor, while a low-risk control may be tested largely through the work of internal staff. The practical decision for management is whether the testing it already does is documented well enough, by people independent enough from the control owner, to be considered. Confirm with the engagement team early which ITGC testing they expect to rely on and in what form.

What makes the first 404(b) year cost more

The first integrated audit of ICFR usually costs more than the years that follow, and the SEC's 2009 study found that the 2007 reforms did not produce a statistically significant fall in first-year mean cost. The cards below cover the drivers that inflate the first year and the checks that reduce them before the auditor arrives.

Controls that exist only in practice

Many IT controls operate informally: an administrator approves a change in a chat thread, or a access review happens but nobody records it. In a first audit, the external auditor must see the control designed, documented and operating, so every undocumented control costs time to write up, walk through and retest. Before the audit, ask each system owner to show one recent instance of each key control with its approval record attached.

ITGC deficiencies found in walkthroughs

Walkthroughs are the first point where the auditor traces a transaction through IT systems, and they often expose gaps in user access reviews, change approvals or privileged account monitoring. Each deficiency triggers evaluation of the IT-dependent controls it touches, and remediation can push testing into a later period. Run a mock walkthrough of your financially significant applications one or two quarters before the audit so that gaps surface while there is still time to fix them.

Growth in system scope

The first audit often brings more applications, databases, interfaces and reports into ICFR scope than management expected, because the auditor evaluates risk independently of the company's internal scoping. Each added system needs its own access, change and operations controls tested. Ask the auditor to confirm the scoping approach in writing early, and compare the proposed list against your own top-down risk assessment.

Auditor onboarding and learning curve

An auditor new to your environment must learn your architecture, data flows and control owners, which adds hours to planning and fieldwork. Some of that cost falls on IT staff who answer repeated questions and produce the same populations several times. Prepare a system inventory, a control matrix mapping each key control to an owner and evidence source, and a single contact for population requests.

Evidence that is hard to produce

Auditors test controls over a period, so they need complete and accurate populations, such as all change tickets or all terminated users, along with proof that those populations are complete. Systems that cannot export these reports easily, or that retain logs for short periods, slow down testing. Confirm with each system vendor and internal team what reports exist, how far back they go, and who can run them on demand.

Recurring costs after year one

Second-year costs are typically lower because controls are documented, populations are established and the auditor understands the environment. The SEC's 2020 estimate for a newly exempt issuer put the annual savings at about $210,000, including roughly $110,000 in audit fees and $100,000 in other costs (Release 34-88365). Treat that figure as context for how much the attestation can cost in general, and check it against the release before using it in a budget discussion.

Who owns the attestation work and who prepares for it

The company owns every decision that drives the attestation. Management determines its own filer status each year from the public float measured at the end of the second fiscal quarter, owns its ICFR and the IT general controls that support automated controls, and performs the management assessment under Section 404(a). Management also signs the certifications and is the party the auditor examines, so no outside firm can take over these duties.

Filer status determination: Track public float at the end of the second fiscal quarter and confirm the twelve-month reporting and annual report conditions under Rule 12b-2.
Controls and ITGC ownership: Design, operate and monitor access, change, development and operations controls in the company's own environment.
Management's 404(a) assessment: Evaluate ICFR as of fiscal year end against a recognized framework, such as COSO 2013, and document the conclusion.
Evidence retention: Keep the logs, approvals, tickets and reports that show each control operated throughout the period.
Auditor interface: Provide walkthroughs, access to systems and written representations, and resolve deficiencies with the auditor.

Confirm with your audit committee and external auditor which team owns each step before the first attestation year begins.

How to prepare before the first attestation year

The sequence moves from confirming filer status to documenting ITGC design, collecting operating evidence and handing a tested control set to the external auditor before the first integrated audit begins. Each phase produces a named artifact that the next phase depends on.

Monitor public float against the thresholds
Finance and legal confirm the company's public float as of the end of the second fiscal quarter, measured against the accelerated filer and large accelerated filer thresholds in Rule 12b-2, and confirm that the smaller reporting company revenue test does not exclude the issuer. They also confirm the twelve-calendar-month reporting history and the filing of at least one annual report. The output is a written filer status determination, signed off by the CFO and reviewed with the audit committee, that states the date the company expects to become subject to the 404(b) attestation. Confirm the exact test dates and any transition rules with your securities counsel and your auditor, since the determination depends on your own filing history.
Assess the gap between current and required controls
Once the expected filer status is clear, management and IT run a gap assessment of the ICFR program against what an external auditor will test. The team identifies financially significant applications, databases, infrastructure and reports, maps the automated controls that depend on them, and compares existing ITGC documentation with the four areas named in SEC guidance: access to programs and data, program changes, program development and computer operations. The output is a gap register listing each missing or weak control, its owner and its financial reporting risk. Confirm the scope with your auditor early, because the gap register sets the workload for every later phase.
Document ITGC design and ownership
IT and finance write down how each in-scope ITGC is designed: who performs it, how often, what system generates the evidence, what triggers an exception and who reviews it. Each control is tied to the business process or automated control it protects, following the top-down, risk-based approach that SEC guidance describes. The output is a controls narrative and matrix for each ITGC area, with named control owners and reviewers who have the authority and competence to perform the review. Management should be able to show that each control addresses a specific risk to ICFR, not a generic security practice.
Remediate design gaps before evidence collection
Where the gap register shows a control that does not exist or is designed too loosely, IT remediates it before the company starts relying on it for the test period. Typical fixes include formal access recertification, a documented change approval path with segregation of duties, and a defined process for onboarding and retiring users. Each remediated control receives a dated change record and a first instance of operation. The output is a closed gap register with evidence that each design change went live, so the auditor does not have to test controls that were still being built during the period under review. Ask your auditor which remediation dates they will accept before you schedule any change.
Collect operating evidence across the period
Control owners run each ITGC on its defined frequency and retain the evidence the control produces: access review sign-offs, change tickets with approval and testing records, job failure logs, backup restoration results and incident tickets. Evidence should be complete, dated and traceable to a specific population, such as all users provisioned during the quarter. A control performed inconsistently produces deficiencies, so the program owner checks completeness at regular intervals. The output is an evidence library indexed by control and period, with a named person who can explain each item. Keep provider evidence for any cloud or outsourced system in the same library, since auditors will ask for it.
Run interim testing and a self-assessment
Before the auditor tests year-end operation, management tests a sample of each ITGC over an interim period, looking for exceptions while there is still time to correct them. The internal audit function or a separate tester who did not operate the control performs the test, using the same populations and sample logic the auditor is likely to use. The output is an interim test memo for each control, listing the population, sample, result, exceptions and any compensating action, along with a roll-forward plan to cover the remaining period. Management should document any deficiency and its severity before the auditor finds it.
Hand over the controls to the external auditor
The company holds a kickoff meeting with the registered public accounting firm to confirm scope, the ITGC population, the sampling approach, the reliance plan for internal audit work and the timing of walkthroughs. The auditor, under PCAOB AS 2201, decides how much of management's work it can use, scaled to the competence and objectivity of the testers. The output is an agreed audit plan and a shared evidence request list, plus a written list of open items with owners and due dates. The auditor performs its own testing and issues its own opinion. The implementation partner, if one is engaged, prepares the systems and evidence but does not sign any attestation.

Questions buyers ask about the 404(b) start date

Can a company work out its own filer status and 404(b) start date?

Yes, the company can run the public float test itself, but the result needs review by its auditor and securities counsel. Under Rule 12b-2, an accelerated filer has public float of $75 million or more but less than $700 million, measured at the end of the second fiscal quarter. The issuer must also have been subject to Exchange Act reporting for at least twelve calendar months and have filed at least one annual report. Companies that pass the revenue test for smaller reporting companies are excluded, so the float figure alone does not settle the question. Ask the auditor to confirm the measurement date, the float calculation and the first year the auditor attestation applies before budgeting.

Does losing emerging growth company status mean an auditor attestation starts right away?

Not automatically. Losing EGC status removes the exemption from the 404(b) auditor attestation, but the attestation applies only if the company is then an accelerated or large accelerated filer. EGC status ends at the earliest of several events, including revenues reaching $1,235,000,000 at a fiscal year end, the fiscal year end after the fifth anniversary of the first registered sale of common equity, issuing more than $1 billion of non-convertible debt over three years, or becoming a large accelerated filer. A company that loses EGC status while its float remains below $75 million may still avoid the attestation. Confirm the status change date and the resulting filer category with counsel and the auditor.

What must the company provide for the auditor's ITGC testing?

The company must provide a documented, current view of its IT general controls over financially significant systems, plus evidence that each control operated during the period. Auditors typically ask for an inventory of in-scope applications, databases and infrastructure, walkthrough support, population reports and samples for access reviews, change tickets with approvals and test results, job and backup logs, and records of incident and provider oversight. Under PCAOB AS 2201, the auditor may rely on the work of internal audit or others working for management, scaled to their competence and objectivity. Agree the evidence list, sample sizes and system-generated report standards with the auditor early, because the auditor must test the completeness and accuracy of any report it relies on.

Can an implementation partner issue the 404(b) attestation?

No. Only the company's independent registered public accounting firm can issue the auditor attestation on management's ICFR assessment under Section 404(b). An implementation partner can help prepare systems, configure logging and access controls, document controls and assemble evidence, but it cannot audit the company, issue an opinion or certify the controls. DeployOpen prepares systems, controls and evidence for compliance assessments and does not issue audit reports, attestations or certifications. Management still owns the control environment and its own assessment under Section 404(a), so the company should keep the decision on scope and remediation within its own governance.

How long does first-year 404(b) preparation take?

The duration depends on the number of in-scope systems, how mature the existing control documentation is, and the fiscal calendar, so no general figure applies. The first integrated audit usually takes longer than later years because the auditor must test design and operating effectiveness for the first time, and the SEC's 2009 study found mixed results on first-year cost after the 2007 reforms. Plan backward from the first fiscal year end the attestation covers, and confirm the expected timeline, interim testing points and roll-forward approach with the auditor. Ask any partner for a written scope and schedule tied to those dates.

What does the SEC's 2020 savings estimate cover?

The SEC's 2020 estimate in Release 34-88365 projected that an issuer newly exempt from the 404(b) attestation would save about $210,000 per year on average, made up of roughly $110,000 in audit fees and $100,000 in other costs. It is an average projection for newly exempt issuers, not a guarantee for any company. It does not include the cost of management's own Section 404(a) assessment, the internal effort to maintain ITGCs, remediation of control deficiencies, or the cost of a second auditor review if the company later returns to filer status requiring attestation. Ask your counsel and auditor which costs stay with the company under your filer category before using the figure in a budget.

What to check before bringing in outside help

Outside help on a first SOX 404(b) attestation usually splits into three roles: the company owns its controls, an implementation partner prepares systems and evidence, and an independent registered public accounting firm performs the attestation. The checks below keep those roles clear before any statement of work is signed.

Confirm the attestation firm and the partner

Only the company's registered public accounting firm can perform the Section 404(b) attestation, and the firm that audits the financial statements usually performs it. Confirm that your auditor is registered with the PCAOB and that your implementation partner is a separate party. A partner that also attests to the same controls creates an independence conflict, so ask for that answer in writing before discussing scope.

Get written scope before work starts

Ask for a written statement of scope, deliverables and timing before any access is granted. The document should list the in-scope applications, databases, infrastructure and reports, and name each artifact the company will receive, such as walkthrough narratives, access review records and change tickets. Vague scope is the most common source of surprise fees, so treat any open-ended estimate as a risk.

Confirm how evidence is produced and kept

Ask how the partner generates evidence, where it is stored, who can alter it and how long it is retained. Evidence should come from the system of record with timestamps and named approvers, not from screenshots assembled after the fact. Confirm that the company, not the partner, holds the final copies that the external auditor will sample.

Test experience in your own environment

Ask for examples of ITGC work performed inside a client's own cloud accounts, data centers or on-premises networks, and ask how those engagements handled access to production systems. Check that the team can explain how it would test a change management workflow or privileged access review in your actual toolchain. Generic framework knowledge does not show that the team can produce evidence your auditor will accept.

Decide who signs what

Clarify who signs the management assessment and the readiness statement: the company's executives, not the implementation partner. The partner may sign a statement of work deliverable or a readiness checklist, but it should not sign anything that reads as an opinion on ICFR. Agree this allocation in the contract so that the external auditor's independence and management's responsibility remain distinct.

Why companies miss the 404(b) start date

The most common reason a company is surprised by the 404(b) requirement is that nobody measured public float at the right moment. Accelerated filer status is set by public float measured at the end of the second fiscal quarter, so a company whose share price rose during the year can cross the $75 million line without anyone noticing until the annual report is being drafted. The reverse also happens: a company assumes it is an accelerated filer, plans a full auditor attestation budget, and then finds it fell below the threshold. Finance should record the float calculation at the second quarter end every year, confirm the smaller reporting company revenue test with counsel, and confirm the twelve-month and first annual report conditions in Rule 12b-2, since a company that has not yet met them cannot be an accelerated filer regardless of its float.

A second frequent error is treating emerging growth company status as a fixed term. Companies often assume they keep the exemption for five years from the first registered equity sale, but the status also ends earlier if revenues reach the Rule 12b-2 threshold, if the company issues more than $1 billion of non-convertible debt over three years, or if it becomes a large accelerated filer. Each trigger should be tracked against the financial plan, with the corporate secretary and controller reviewing them at each fiscal year end. Confirm the current revenue threshold and definitions directly in the eCFR text of Rule 12b-2 before setting the planning date.

Even when the start date is known, teams often find that ITGCs over financially significant systems were never documented in a form an auditor can test. Access reviews, change approvals and backup monitoring may happen informally, with evidence spread across ticketing tools, email and administrator memory. Late discovery of cloud or SaaS applications is also common: a billing platform or consolidation tool may hold financial data but sit outside the IT asset inventory, so no provider report or access evidence was requested. Inventory every system that feeds the financial statements, confirm which provider evidence exists for each, and start documenting controls at least a full reporting cycle before the first integrated audit.

How DeployOpen prepares ITGC systems and evidence for the attestation

DeployOpen works with the finance, IT and compliance teams of a company that expects to become an accelerated filer and need an auditor's ICFR attestation. We prepare the systems, IT general controls and evidence that management and the external auditor will test, while the company keeps ownership of its controls and the auditor issues the opinion.

How we scope

Agree in writing which financial applications, databases, infrastructure and reports fall inside the ITGC scope for the attestation year.
Map each in-scope system to the four ITGC areas: access, program changes, program development and computer operations.
Confirm with your auditor and finance team the public float measurement date and the expected filer status before scoping starts.

How we build

Configure self-hosted open-source platforms in your own cloud accounts, data centers or air-gapped networks to log access and change activity.
Set up approval workflows, change tickets, review cadences and backup and recovery routines that produce testable records.
Document each control's design, owner, frequency and evidence source so management can run walkthroughs and operating tests.

How we hand over

Deliver control narratives, configuration baselines, access review records and change samples in a format your auditor can request and re-perform.
Train control owners to produce and retain evidence on the schedule the written scope sets, so the records exist before the auditor asks.
Provide a handover that names who in your organization owns each control after the engagement closes.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, so ITGC evidence keeps flowing through later filing years.
Support covers responses to deficiencies found in ITGC testing, with remediation planned and agreed in writing before work starts.
Ask for a written quote that lists the scope, deliverables and timeline, because DeployOpen does not publish a price list and quotes follow from the scope.

When does the SOX 404(b) auditor attestation start for a new accelerated filer?

How a company works out its filer status each year

Confirm Exchange Act reporting history

Identify the second fiscal quarter end

Measure public float at that date

Apply the smaller reporting company revenue test

Compare float with the accelerated filer thresholds

Apply the classification to the next annual report

Document the conclusion and obtain review