Does SOX 404 still apply to an emerging growth company?
Yes. An emerging growth company (EGC) still owes management's Section 404(a) assessment of internal control over financial reporting (ICFR) and the Section 302 certifications signed by the CEO and CFO. What it can defer is only the Section 404(b) auditor attestation, which the JOBS Act exempted in 2012. The exemption is from the attestation, not from SOX 404 as a whole, so the company's own team must still evaluate ICFR, document its controls and conclude on effectiveness each year once the requirement starts. Rule 13a-14 lets officers leave the ICFR language out of the certification only until the issuer becomes subject to Rule 13a-15, so the certification wording itself is also timing-dependent.
The timing of the first management assessment depends on the company's filing history, not on its revenue alone. Under Item 308 Instruction 1 of Regulation S-K, a newly public company may omit management's ICFR report in its first annual report, and Rule 13a-15(c) requires the annual evaluation only once an annual report for the prior fiscal year has been filed or required. In practice the first assessment generally falls in the second annual report. Finance and IT leaders should confirm the exact first-report date with their securities counsel and external auditor by checking the company's registration timeline, because a late or accelerated filing history changes when the clock starts.
EGC status does not shrink SOX 404 scope or the IT general controls behind it. Financially significant applications, databases, infrastructure and the reports that feed the financial statements still need access, change, development and operations controls that management can evaluate. An illustrative example: a company with one ERP and a cloud consolidation tool still has to show who can post journal entries and who can change the close configuration, even though no auditor opines on those controls yet. Because the external attestation can arrive once the company loses EGC status, the practical task is to build and test ITGC evidence now, so that the first auditor-tested year does not start from documentation gaps.
What an EGC still owes under SOX 404 and 302
An emerging growth company drops the 404(b) auditor attestation but keeps management's own ICFR work. Each card below names an obligation, who owns it, and what management should check before the first assessment falls due.
Annual 404(a) management assessment
Section 404(a) requires each annual report to include management's assessment, as of fiscal year end, of the effectiveness of internal control over financial reporting. Management owns this conclusion, not the external auditor, and the EGC exemption does not remove it. Check that the assessment date matches the fiscal year end and that the conclusion rests on documented testing of the controls that address financial reporting risks.
Evaluation under Rule 13a-15(c)
Rule 13a-15(c) requires management to evaluate ICFR as of each fiscal year end against a suitable, recognized framework. An evaluation that follows SEC Release 33-8810 satisfies the rule, and the framework most issuers use is COSO's 2013 Internal Control, Integrated Framework. Confirm which framework the board has adopted and that the evaluation covers IT general controls needed for automated controls.
Section 302 certifications under Rule 13a-14
Officers sign Section 302 certifications as exhibits to each Form 10-Q and 10-K. Under Rule 13a-14, an EGC may omit the ICFR language in those certifications until it becomes subject to the ICFR requirements of Rule 13a-15. Officers should still confirm the disclosure controls supporting the certifications are working, and should not sign statements about ICFR that the company has not yet evaluated.
ITGCs for automated controls
Management cannot evaluate automated controls, such as calculations, interfaces and system-enforced approvals, without the IT general controls that keep them running as designed. Under SEC guidance, only the ITGCs necessary for the proper and consistent operation of those financial reporting controls need evaluation. Map each automated control to its supporting access, change, development and operations controls, and document why each one is in scope.
Documentation and evidence retention
The 404(a) conclusion is only as strong as the records behind it. Keep control descriptions, walkthrough notes, test scripts, samples, exception logs and remediation tickets for each fiscal year, and set a retention period that covers the period the auditor or regulator could review. Ask the team that owns each control to sign off on its evidence file before the year-end evaluation begins.
Item 308 first-year statement
Instruction 1 to Item 308 of Regulation S-K lets a newly public company omit management's ICFR report and the auditor's attestation until it has filed, or been required to file, an annual report for the prior fiscal year. The first annual report must include a prescribed statement saying so. The first ICFR evaluation therefore usually falls in the second annual report, so use the first year to build the control inventory and test it.
What an EGC can defer: the 404(b) attestation
An emerging growth company can defer the auditor attestation on internal control over financial reporting. The JOBS Act (Public Law 112-106), enacted in 2012, exempts EGCs from the auditor attestation in Section 404(b) of the Sarbanes-Oxley Act. That exemption removes one deliverable, the external auditor's opinion on ICFR. It does not remove management's obligation under Section 404(a) to assess the effectiveness of ICFR as of fiscal year end, and it does not remove the Section 302 certifications that officers sign with each periodic report. Management still owns the evaluation, and the company still has to be able to show how it reached its conclusion. The external auditor's role also continues. The financial statement audit still requires the auditor to understand and assess IT risks under AS 2110, including the IT general controls that matter for automated controls and reports the auditor plans to rely on. The auditor simply does not issue an ICFR opinion. In practice, a company that expects to be an EGC for several years should ask its audit firm, early, which systems and reports the auditor expects to touch, because those are the ITGCs the financial statement audit will probe even without a 404(b) opinion. Confirm the scope conversation directly with the engagement partner rather than assuming it stays light.
Deferral also does not mean the ITGCs can wait. Access to financially significant applications, change control over production systems and computer operations still determine whether the numbers in the financial statements can be trusted, and the officers signing the 302 certifications rely on that. The SEC's 2020 estimate (Release 34-88365) put the average annual savings for an issuer newly exempt from the 404(b) attestation at about $210,000, made up of roughly $110,000 in audit fees and about $100,000 in other costs. The SEC did not itemize the other costs in that summary, so ask any prospective partner or internal finance team to break out what their own estimate includes, such as internal labor, testing tools and remediation. The estimate is a regulatory figure, not a forecast for any specific company. The practical decision is what to do with the savings. Companies that defer the attestation and then reduce ITGC testing often face a steep first integrated audit when the EGC period ends. Use the years of deferral to document the key IT controls, collect operating evidence for each quarter, and close known gaps, so the first 404(b) audit tests a stable environment rather than a new one.
When EGC status ends and how the 404(b) clock starts
This sequence tells a company which of the four Rule 12b-2 triggers could end emerging growth company status, what to track for each one, and how the first auditor attestation under Section 404(b) follows once status ends.
Confirm the company's EGC starting point
Finance and legal record the date of the first registered sale of common equity, usually the IPO closing, and the fiscal year end that follows it. This date anchors the five-year test. The output is a single written memo, signed by the CFO and reviewed by securities counsel, that names the anniversary date and the fiscal year end it produces. Confirm the anchor with counsel before relying on it, since the wording of the registered sale matters.
Track the revenue test each fiscal year
Finance measures total annual gross revenues for the most recently completed fiscal year against the $1,235,000,000 threshold in Rule 12b-2. Status ends at the fiscal year end in which revenues reach that figure. The output is a revenue tracker, reconciled to the audited financial statements each year, that shows the trend and flags any year that approaches the threshold. Growth through acquisition should be included in the tracker, so the test reflects the consolidated figure.
Log non-convertible debt issuances over three years
Treasury keeps a dated log of every non-convertible debt issuance, with principal amounts, so the three-year total can be tested against the $1 billion limit in Rule 12b-2. Status ends if more than $1 billion of such debt is issued within a three-year period. The output is a rolling schedule reviewed at each quarter close and before any new financing is approved. Ask counsel whether any instrument, such as certain private placements, needs classification before it is added to the log.
Run the public float test before each year end
Legal and finance compute the aggregate worldwide market value of common equity held by non-affiliates as of the last business day of the second fiscal quarter, following the accelerated filer and large accelerated filer definitions. A company that meets the large accelerated filer test loses EGC status. The output is a documented float calculation with the price, share count and affiliate holdings used, retained for the year end filing file. Confirm the measurement date and method against the current rule text before the test is run.
Identify the fiscal year end that ends EGC status
Once any trigger is met, the company determines which fiscal year end ends EGC status, using the earliest applicable trigger. Counsel and the CFO document which test fired and on which date. The output is a status memo that states the end date, the triggering test and the first annual report that must include management's and the auditor's ICFR reports. Treat this memo as the basis for the audit planning calendar.
Confirm the accelerated filer schedule with the auditor
Finance and the audit committee confirm with the external auditor when the Section 404(b) attestation starts under the accelerated filer rules, since the attestation timing depends on filer status in the year the EGC exemption ends. The output is an agreed written timetable covering the first integrated audit. For the detailed filer rules and how the timing works, see the sibling topic on when the 404(b) attestation starts for a new accelerated filer.
Prepare ITGC evidence before the first attested year
IT and finance map the ITGCs over financially significant systems to the key controls that rely on them, and collect a full year of operating evidence for access, program changes, program development and computer operations. The output is an evidence binder with walkthrough documentation, sample populations and remediation records, reviewed by internal audit before the external auditor begins testing. Gaps found now are cheaper to fix than gaps found during the first integrated audit.
How to prepare ITGCs before EGC status ends
The most useful work an emerging growth company can do before its status ends is to document its IT general controls while the 404(a) assessment is still the only ICFR obligation. Start by mapping which applications, databases and infrastructure support financial reporting, then identify the automated controls and system-generated reports that management relies on. This inventory decides the scope of everything that follows. Rule 13a-15 and SEC Release 33-8810 expect management to evaluate only the IT general controls needed for those reporting controls to operate properly and consistently, so a clear map prevents both overbuilding and gaps.
For each in-scope system, document the four areas named in SEC guidance: access to programs and data, program changes, program development, and computer operations. Release 33-8810 states that the relevant aspects vary with each company's facts and circumstances, so write down why each area applies or does not apply, and what evidence proves it operates. Then run a dry-run evaluation before the first 404(a) report. Pick a sample of user access reviews, change tickets and backup restores, and check whether the evidence is complete, dated and approved by someone independent of the work. Confirm with your auditor how many periods they expect to see before accepting a control as operating.
Clear deficiencies while there is still time to fix them and retest. A first-year assessment without ITGC evidence is the most common gap, and it is avoidable. The auditor's first integrated audit under AS 2201 will test what the company has already documented, so an undocumented control is treated as absent. Plan the transition now: confirm the date your status could end using the Rule 12b-2 tests, assign owners for each ITGC area, and agree with your auditor in writing what evidence and sample sizes they will need.
What to do now, at the 404(b) trigger, and after
While the company is an emerging growth company, management still owes its Section 404(a) assessment and the Section 302 certifications, but the external auditor does not attest to ICFR under Section 404(b). The first management assessment generally falls in the second annual report, so the period before it is the time to define the ITGC scope, document the design of key controls and confirm that the financially significant systems have owners. The organization owns its controls. Any attestation report is issued by an independent auditor, not by an implementation partner.
- Scope the systems: Map the applications, databases, infrastructure and reports that feed financial statements, and record which automated controls depend on them.
- Document access and change design: Write down how user access is requested, approved and removed, and how changes move to production, with named control owners.
- Assign owners: Give each ITGC area a responsible person in IT and a business reviewer who can explain the control.
- Produce recurring evidence: Keep access review sign-offs, change tickets with approvals and backup restore logs so the first assessment has samples to test.
- Run a dry walkthrough: Trace one transaction through each system to confirm the documented design matches how the system behaves.
Before leaving this phase, check that every key control has a named owner, a defined frequency and a retained artifact.
Emerging growth company status ends at the earliest of several events, including reaching the revenue threshold, issuing more than $1 billion of non-convertible debt over three years, the fifth anniversary of the first registered sale of common equity, or becoming a large accelerated filer. Once a trigger is near, the company should plan for the auditor attestation as if it already applies, because the first integrated audit tests ITGCs over automated controls and reports. Confirm the exact trigger date with counsel and the auditor.
- Track each trigger: Monitor revenue run rate, planned debt issuance and the anniversary date against the Rule 12b-2 tests, and assign one owner to report on them monthly.
- Close design gaps early: Fix missing access reviews, untracked emergency changes and unowned reports before the audit period begins.
- Test before the auditor does: Run a management test of each key ITGC over at least one full period and record exceptions with remediation dates.
- Prepare the population lists: Produce complete user, change and job lists from each system, since auditors test whether those reports are accurate and complete.
- Brief the audit committee: Agree on who signs representations and how deficiencies will be escalated.
Check whether the planned timeline leaves enough time to remediate any deficiency before the fiscal year end that ends EGC status.
After the company loses EGC status, the external auditor performs an attestation of ICFR in addition to management's assessment. ITGC testing becomes a standing part of the audit, and the auditor will expect consistent evidence across the whole fiscal year, not only at year end. The organization still owns the controls and the assessment. The auditor issues the attestation report, and implementation partners or consultants can only prepare systems, controls and evidence.
- Run ongoing monitoring: Schedule recurring access reviews, change reviews and backup restores with evidence stored in one place.
- Manage interim and roll-forward testing: Agree with the auditor which controls are tested at an interim date and which must be rolled forward to year end.
- Track service providers: Collect SOC reports and bridge letters from cloud and SaaS providers that host financial data, and record any complementary user entity controls.
- Handle deficiencies promptly: Log each exception, assess its effect on IT-dependent controls and track remediation to closure.
- Review the evidence cycle: After each audit, update the control narratives and sample sets to reflect system changes.
Confirm with the auditor which evidence formats and sample periods it will accept before the first attestation year begins.
Choosing a SOX ITGC partner for an EGC
An emerging growth company still owns its management assessment and certifications, so any outside help has to fit inside that ownership. The cards below cover what to verify before signing, from the written scope to the handover of knowledge, and they note where an independent auditor's rules set the limits. DeployOpen works on a fixed scope agreed in writing and does not issue reports or attestations.
Written scope and deliverables
Ask for a written scope that names the systems, the ITGC areas (access, program changes, program development, computer operations), the deliverables and the dates. An EGC still needs management's Section 404(a) assessment, so the partner's work should map to evidence that management can present in that assessment. Confirm which items are included, which are excluded, and what triggers a change order. DeployOpen agrees scope, deliverables and timelines in writing before work starts.
Experience with public issuer evidence
Ask for examples of ITGC documentation and evidence prepared for public issuers, described in general terms. Look for familiarity with walkthroughs, change tickets, user access reviews and evidence of backup and job monitoring that a reviewer can re-perform. Ask how the partner handles populations, samples and retention of evidence, and whether it has worked on a first-year integrated audit. Do not accept claims you cannot test against your own control list.
Preparing evidence versus auditor role
Separate the work of preparing systems and evidence from the work of attesting to it. The partner can document controls, configure logging and assemble evidence packages. Only an independent auditor issues opinions or reports, and management owns the conclusion in its 404(a) assessment. Confirm in writing that the partner will not make control conclusions on management's behalf.
Auditor independence limits
Before the engagement starts, ask your external auditor what work it may accept from a third party and what it must not perform. Independence rules can restrict who designs, implements or tests controls, and an auditor may need to re-perform work it relies on. Get the answer in writing, and share the partner's proposed role with the auditor early so that scope decisions do not surface as deficiencies later.
Knowledge of your systems
The partner should understand your financially significant applications, databases, infrastructure, hosting locations and any cloud or SaaS providers that process financial data. Ask how it will learn the environment, which configuration baselines it will review, and which system owners it will interview. Systems that run a few reports at month end can carry as much ITGC risk as large ERP platforms, so the partner's scoping should reflect your own risk assessment.
Knowledge transfer to your team
Because an EGC's ITGC obligations continue after the partner leaves, require documented procedures, control owners named by your organization, and a walkthrough of each evidence package. Ask how the partner will train your staff to run the recurring reviews, such as access recertifications and change reviews, and what handover material you will keep. Plan for the company to operate these controls alone before its EGC status ends.
Questions emerging growth companies ask about SOX 404
Does an emerging growth company need a management assessment in its first annual report?
Generally no. Under Instruction 1 to Item 308 of Regulation S-K, a newly public company can omit management's ICFR report until it has filed, or been required to file, an annual report for the prior fiscal year, and its first annual report must include a prescribed statement saying so. Rule 13a-15(c) follows the same timing, so the first 404(a) assessment usually lands in the second annual report. Emerging growth status does not remove management's 404(a) duty once that point arrives. Confirm the exact wording of the transition statement with your securities counsel before filing.
When does the first 404(a) report usually fall for an emerging growth company?
It usually falls in the second annual report, because management's assessment is measured as of fiscal year end and applies only after the company has filed, or been required to file, an annual report for the prior year. Plan the ITGC evidence period so that controls over financially significant systems operate and can be tested before that year end. Your filing calendar, IPO date and fiscal year end determine the exact report, so confirm the date with counsel and your auditor.
Does an emerging growth company still need ITGCs if it skips the auditor attestation?
Yes. The exemption covers only the auditor attestation under Section 404(b). Management still has to assess ICFR under Section 404(a), and that assessment depends on IT general controls that keep automated controls and reports reliable. SEC guidance says management evaluates the ITGCs necessary for the proper and consistent operation of controls that address financial reporting risks. Your external auditor may also rely on ITGC evidence for financial statement audit work, even without an ICFR opinion. Scope the ITGCs to the systems that feed the financial statements, not every IT system.
What revenue or time limits end emerging growth company status?
Status ends at the earliest of four events: the fiscal year end in which total annual gross revenues reach $1,235,000,000, the fiscal year end after the fifth anniversary of the first registered sale of common equity, issuing more than $1 billion of non-convertible debt over three years, or becoming a large accelerated filer, as defined in Rule 12b-2. Each event can trigger the 404(b) attestation in the next annual report, so track all four, not just revenue. Confirm the current thresholds and any SEC changes against the eCFR text of Rule 12b-2.
Can we do the ITGC work ourselves?
Often yes, for a company with a capable internal finance and IT team and a small set of financially significant systems. Management owns the controls and the assessment, so the work must be performed and documented by people who understand the financial processes. Consider outside help where your team lacks SOX experience, the scope spans cloud or multiple ERPs, or you need a second pair of eyes on design. An implementation partner can prepare systems, access reviews, change records and evidence, but only an independent auditor issues an opinion. Confirm what your auditor will accept as management testing before deciding.
What does the ITGC work require from our IT and finance teams?
The work needs both teams to agree on scope and to produce repeatable evidence. The main requirements are:
- Finance identifies the systems, reports and key controls that affect the financial statements.
- IT documents access provisioning, change approval, job scheduling and backup procedures for those systems.
- Both teams run walkthroughs with the auditor and keep dated evidence of each control operating over the period.
- A named owner reviews deficiencies and tracks remediation before year end.
Skilled effort rises with the number of systems and the maturity of existing documentation, so start the inventory early.
What does it cost to prepare ITGCs before emerging growth status ends, and what drives it?
No supplied source gives a price for this work, so ask for a written, fixed-scope quote rather than relying on a benchmark. The main cost drivers are the number of financially significant systems, whether they run on-premises, in cloud or as SaaS, the state of existing documentation, the number of control owners, and how many deficiencies need remediation. One-time costs include scoping, documentation and remediation. Recurring costs include access reviews, change testing and evidence collection each year. Ask for the split between one-time and recurring work, the deliverables, and which tasks the quote assigns to your team. The SEC's 2020 estimate of roughly $210,000 per year in savings from the 404(b) exemption (Release 34-88365) covers audit and other costs for newly exempt issuers, not your ITGC program, so do not use it as a budget.
How DeployOpen works on this
DeployOpen is a Chainscore Labs company that plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For SOX 404 readiness, we prepare the systems and IT general control evidence management will rely on, while the company owns its controls and its ICFR assessment, and an independent auditor issues any report.
How we scope
- Agree in writing which financial systems, databases and infrastructure fall inside the ITGC boundary before work starts.
- Map each in-scope application to the access, change, development and operations controls it depends on.
- Confirm with your auditor and finance team which reports and interfaces must be covered before the engagement begins.
How we build
- Configure access, change approval and backup controls in your own cloud accounts or data centers.
- Set up logging and ticketing so that each control leaves dated, attributable records an assessor can sample.
- Test each control against its written design, then fix gaps before management's assessment period begins.
How we hand over
- Deliver control descriptions, procedures and an evidence index mapped to each in-scope ITGC area.
- Document configurations, runbooks and sampling instructions so your staff can reproduce evidence without us.
- Walk your internal audit and finance teams through the handover so ownership of each control is clear.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the fixed-scope work ends.
- Retainer support can keep evidence current as the company grows toward the point where EGC status ends.
- Ask any provider to confirm in writing what remains your responsibility, including management's 404(a) assessment.
