SOX 404 for non-accelerated filers: what smaller issuers still owe

Does SOX 404 still apply to a non-accelerated filer?

Yes, management still has to assess internal control over financial reporting every year. A smaller issuer that is neither an accelerated nor a large accelerated filer must still complete management's annual assessment under Section 404(a), as of fiscal year end, and that assessment has to cover the IT general controls that support financial reporting. What the company does not owe is the external auditor's attestation under Section 404(b), which Section 404(c) exempts for issuers in this category. The exemption changes who tests the controls. It does not remove the duty to evaluate them. The IT general controls in scope depend on the company's facts. SEC guidance in Release 33-8810 asks management to evaluate only the IT controls needed for the proper and consistent operation of controls that address financial reporting risks, so access, change and operations controls over the ledger, the close tools and the reporting databases are the starting point, not every system in the estate. In its 2020 release on accelerated filer definitions (Release 34-88365), the SEC estimated that a newly exempt issuer would save about $210,000 per year on average, roughly $110,000 in audit fees and $100,000 in other costs. Ask your auditor or advisor what portion of that saving your own company would see, because the other costs are largely internal time and tooling you may still carry.

The exemption does not remove the need for evidence. Management must still support its conclusion with documentation and testing that a reviewer, including a future auditor, can follow. SEC guidance allows management to rely on ongoing monitoring when ICFR risk is low, but it expects the evaluation to consider evidence from a reasonable period during the year, including fiscal year end. Before the next assessment, confirm which financially significant systems you consider in scope, document how each relevant IT control is designed and operated, and keep dated records such as access review sign-offs, change approvals and backup restore results. A smaller team that records this evidence as it goes will find the annual assessment far easier to complete than one that reconstructs it at year end.

How SEC guidance scales ITGC evaluation for smaller companies

Release 33-8810 does not give smaller issuers a shorter list of IT general controls. It lets management size its evaluation to how the company is built and how much risk sits in each area. The cards below cover the levers the guidance names and the facts a finance and IT team should confirm before relying on them.

Centralized controls and direct interaction

Management's daily involvement with a control can be sufficient evidence when controls are centralized and few people are involved. For IT general controls, this may apply to a small change approval group or a single administrator who reviews privileged access. Confirm who approves production changes, who holds administrative rights in each financially significant system, and whether the same managers see the work every day. If those answers are clear and the people are few, document the daily interaction as evidence.

Multiple reporting layers and segments

The same guidance says daily interaction generally will not be enough when there are multiple reporting layers or operating segments. A subsidiary running its own ledger, a second entity with separate administrators, or a reporting package built in spreadsheets outside the core system can each break the single-reviewer assumption. Map every entity, system and reporting layer that feeds the financial statements. Where any layer runs without central oversight, plan direct testing for the controls that cover it.

Low-risk areas and ongoing monitoring

When ICFR risk in an area is low, management may conclude that evidence from ongoing monitoring is sufficient without direct testing. In IT general controls, a read-only reporting database with no privileged access and no automated financial calculations may fall into this group. Confirm the risk rating with a documented reason, identify the monitoring activity that already produces evidence, and check that the monitor reviews the same access and change records the auditor would sample.

Evidence across a reasonable period

Management's evaluation would ordinarily consider evidence from a reasonable period during the year, and that period includes fiscal year end. Monitoring that stops in the middle of the year does not cover the close. Confirm that access reviews, change approvals and backup restores occur in the final weeks before year end and that their records are retained. Keep a dated schedule so that the fiscal year end testing window is not a single rushed exercise.

Scope limited to financial reporting risk

Management need only evaluate the IT general controls necessary for the proper and consistent operation of controls that address financial reporting risks. Controls that only affect operational efficiency fall outside that evaluation. A smaller company should map each financially significant application to the automated controls and reports it supports, then drop systems that do not feed those controls. Confirm this mapping in writing before the year begins so that scope decisions are not made during the audit.

Which ITGC areas a smaller issuer still has to evaluate

Access controls decide who can change financial applications, databases and the infrastructure under them. In a smaller company, the same few people often administer several systems, so management usually evaluates a short list of accounts with broad rights and checks that each one is needed, approved and reviewed. The evaluation is about whether access that could alter financial results is limited to authorized people with duties that fit their roles.

Privileged accounts: Confirm who holds administrator, database owner and root-level rights on the general ledger and close systems, and why.
Provisioning and removal: Look for approval records for new access and prompt removal when someone leaves or changes roles.
Periodic access reviews: Evidence of a dated review, signed by a reviewer who is not the administrator, comparing the user list with approved access.
Authentication settings: Password, multifactor and session settings for the financial applications, exported from the system.
Shared or service accounts: A current list with owners and the process that controls their use.

Before relying on this area, check that your access review covers the accounts that can change data directly, not only the screens that users see.

Segregation of duties when the accounting team is small

When a small accounting team cannot separate duties, the company does not escape the control objective, it has to meet it another way. PCAOB AS 2201 contains a note at paragraph 42 that recognizes this situation: a smaller company with fewer accounting staff may implement alternative controls where duties cannot be segregated, and the external auditor, where one applies, evaluates whether those alternatives are effective. The practical question for management is which person can initiate, approve, record and reconcile the same transactions, and what independent evidence shows that a second person looked at the work.

The usual alternatives are compensating review controls and privileged access evidence. A reviewer who is outside the transaction flow, such as an owner, board member or outside accountant, can sign off on period-end reconciliations, journal entries above a set amount, and changes to vendor master data, with the review evidence retained. On the IT side, the company should pull logs for administrator and superuser accounts in financial applications and show that someone other than the administrator reviews them, along with approval records for user access requests and for changes to system configuration. Confirm with your auditor, before year end, which of these the auditor would expect to see, because the sufficiency of a review depends on its precision and on whether the reviewer has the knowledge to spot an exception.

Document the rationale before testing begins, not after the auditor asks. The record should name each incompatible duty, explain why it cannot be separated given headcount, describe each alternative control with its owner and frequency, and state how the reviewer would detect an error or override. Keep the rationale alongside the risk assessment so that the reasoning for scope and for alternative controls can be read together. Where the company is unsure whether its arrangement is acceptable, a readiness review by an independent party can identify gaps early. That work prepares the evidence; only the independent auditor concludes on whether the controls are effective.

How management's annual ICFR assessment runs for a smaller issuer

The sequence turns a smaller issuer's financial reporting risks into a documented, evidence-backed conclusion on internal control over financial reporting, which management signs at fiscal year end without an auditor attestation under Section 404(b). Each step produces a record that the company can hand to its external auditor and that supports its certifications.

Scope financially significant systems and processes
Management starts from the financial statements and works down to the accounts, disclosures and processes that could produce a material misstatement, then identifies the applications, databases, infrastructure and service providers that support them. The finance lead and IT owner usually prepare this together, and the output is a scope memo that lists each system, the reporting risk it touches and the reason it is in or out of scope. SEC guidance says the IT general controls to evaluate are those needed for other controls that address financial reporting risks, so the memo should also state which IT areas are excluded because they only affect operational efficiency. The step is done when the memo has been reviewed and approved by management and retained with the year's ICFR file.
Document the control design and risk assessment
For each in-scope process, management records the key controls, who performs them, the frequency, the data they use and the risk each one addresses. For a smaller company this is often a short narrative plus a control matrix, and the matrix should show where IT-dependent controls rely on system logic, reports or access restrictions. The output is a risk and control matrix that links every key control to a financial reporting risk. Management should confirm that the matrix reflects the company's actual processes, because it becomes the baseline for the walkthroughs and tests that follow.
Perform walkthroughs to confirm design
A walkthrough follows one transaction or report from origination through recording and reporting, and checks that each documented control exists and is designed to address the risk. The person who owns the control explains it, and the evaluator observes the system or inspects the evidence the control produces. For IT, this covers how user access is granted and removed, how changes to financially significant programs are approved and how key reports are generated and reviewed. The walkthrough documentation records the transaction traced, the people interviewed, the screens or reports observed and any gaps found. A control that fails design is fixed or redesigned before operating testing begins.
Assess whether monitoring can substitute for direct testing
SEC guidance allows management to rely on evidence from ongoing monitoring when ICFR risk is low, without direct testing of each control. Before using this route, management should document why the risk is low, how the monitoring is performed, who reviews its results and whether it covers the controls relied upon. Monitoring carried out by a single owner who also performs the control is generally weaker, so the file should explain any independent review. The output is a short assessment memo that either supports relying on monitoring for specific controls or calls for direct testing of those controls.
Test operating effectiveness across a reasonable period
Management selects samples or uses system-generated reports to test whether controls operated as designed during the year. SEC guidance says the evaluation ordinarily considers evidence from a reasonable period, including fiscal year end, so testing should not rest only on early-year activity. For IT general controls, testers typically review access listings and approval records, change tickets with test and approval evidence, backup and job logs, and incident and vendor review records. Each test produces workpapers that show the population, sample, attributes checked, evidence reviewed, result and reviewer sign-off. Testing that finds exceptions moves to the deficiency evaluation step rather than being closed out in the test file.
Evaluate deficiencies and their effect on reporting
Each exception is assessed for severity by asking whether a control failure could lead to a material misstatement, and whether a compensating control exists and was itself tested. An IT general control failure matters most where it undermines an automated control or a report that the company relies on, so the evaluation should trace each affected business control. The output is a deficiency log that records the cause, the controls affected, the likelihood and magnitude assessment, the compensating controls considered and the classification reached. Management should discuss significant deficiencies and material weaknesses with its audit committee and, where relevant, its external advisers before concluding.
Document and sign the management conclusion
Management reaches a conclusion on whether internal control over financial reporting is effective as of fiscal year end, supported by the scope memo, walkthroughs, test workpapers and deficiency log. The conclusion is recorded in a written ICFR assessment that identifies the framework used, which the SEC guidance and Rule 13a-15(c) recognize, and any material weaknesses. The package is then retained so that the chief executive and chief financial officers can rely on it for their certifications and so that the company can present it if asked. The company, not an independent auditor, owns this conclusion, and an outside adviser may prepare the file but cannot sign it for management.

What a smaller issuer pays for ITGC work and who gets paid

This table compares the main cost components of keeping IT general controls evidenced without an auditor attestation, showing who is paid, whether each cost is one-time or recurring, and what drives it up. Use it to build a written scope that a quote can follow, and note that the SEC's 2020 estimate of about $210,000 a year in savings covers audit fees and other costs for newly exempt issuers, so the remaining internal and vendor costs still need budgeting.

Cost component	Who is paid	One-time or recurring, and what drives it
Internal staff time	Your own employees (salaried, no separate invoice)	Recurring. Driven by the number of in-scope systems, the number of access reviews and change tickets, and how many people share control duties.
External consultants for scoping and documentation	Consultant or implementation partner, under a written scope	One-time for initial scoping and narratives, then periodic. Driven by system count, prior documentation quality and whether controls already run in a ticketing tool.
Co-sourced internal audit or testing support	Co-source provider or outside firm you engage	Recurring for periodic testing. Driven by the number of controls tested, sample sizes and how often management tests before year end.
Tooling and licenses	Software vendors or open-source hosting costs paid to your cloud or data center provider	Mostly recurring. Driven by user count, logging volume and whether identity and change tools are already licensed.
Log retention and storage	Cloud or data center provider, or your storage team	Recurring. Driven by how long you keep access and change logs and how much audit trail your systems generate.
External auditor engaged for other work	Independent audit firm, under a separate engagement letter	Varies. Driven by services such as financial statement audit or a voluntary review. Confirm with the auditor which work requires independence safeguards and how fees are split.
Implementation partner for evidence preparation	DeployOpen or another implementation partner, under a written, fixed scope	One-time for setup, then optional retainers. DeployOpen does not publish prices; quotes follow the agreed written scope.

What the SEC cost studies show about smaller issuers

The 2009 SEC study of Section 404 costs is the most cited data on what internal control reporting costs smaller public companies, and its headline numbers point in two directions at once. Among companies subject only to management's assessment under Section 404(a), the mean total cost fell from $425,000 to $336,000 after the 2007 reforms, while the median rose from $111,000 to $162,000. Both figures come from the same study, so they describe the same population but tell different stories about who carried the cost.

The gap between mean and median is the important part. A mean is pulled upward by a small number of companies with very large costs, so a falling mean can happen even when a typical company spends more. The rising median suggests that the ordinary smaller issuer, the one with a modest accounting team and a few systems, paid more after the reforms than before. Read the two figures together: the reforms may have reduced spending at the top of the range while increasing the burden on companies near the middle. The study does not replace an estimate for your own company, and it reflects 2007 era practices rather than your current systems.

When a consultant or software vendor quotes a figure for your ITGC program, ask them to break it into internal labor, partner fees and tooling, and to state which years and which control areas the quote covers. Ask which costs recur each year (testing, evidence collection, access reviews) and which are one-time (initial scoping, design documentation, remediation of gaps). A quote that cannot be split this way is hard to compare with the SEC figures or with another bid.

What must be in place before the first 404(a) assessment

A smaller issuer still owes management's annual assessment of internal control over financial reporting under Section 404(a), even without an auditor attestation. The items below are the records that assessment depends on, and each one can be checked before fiscal year end rather than discovered during it.

Current list of financial systems

Keep a written inventory of every application, database, infrastructure component and report that feeds the financial statements. Scope it from the top down, starting with financial reporting risks, then confirm that the list matches what IT actually runs. To check it, pick two reports at random and trace each back to its source system. If a system appears in the trace but not on the list, the inventory is incomplete. SEC guidance says management evaluates only the controls needed for reliable financial reporting, so this list defines the boundary.

Documented ITGC design

Write down how each general control is designed across access, program changes, program development and computer operations. A design document should say who performs each control, how often it runs, and what evidence it leaves. SEC guidance notes that the relevant aspects of IT general controls vary with each company's facts, so a generic template is weak support. To check it, ask someone outside IT to explain one control from the document alone. If they cannot describe what would prove the control failed, the design needs more detail.

Named control owners

Assign each control to a named person who is accountable for its performance and for the evidence it produces. Small teams often let one administrator cover several roles, so confirm who reviews whose work. Where duties cannot be segregated, the company needs a documented alternative control and proof that it operates. To check it, compare the owner list against the access list. If the same person requests, approves and deploys changes, flag that conflict and record how a second reviewer covers it.

Access review evidence

Keep dated records showing that someone reviewed who can reach financially significant applications, databases and infrastructure, and removed access that no longer fits. Terminated and transferred staff are the usual gaps. Review the reviewer's sign-off too, because an unsigned export does not show that anyone looked at it. To check it, select a recent leaver and confirm that access was removed within the company's own stated window. Also confirm that privileged accounts were reviewed separately from standard user accounts.

Change approval records

Retain tickets or approvals that show each change to a financially significant system was authorized, tested and approved before it reached production. Emergency changes need the same trail, with a after-the-fact review. To check it, take a sample of production changes from the period and match each one to an approval made before deployment. Note any change that has no ticket, or whose approver is also the person who deployed it, because those are the items an auditor will ask about first.

Backup, job and service provider records

Maintain records that show scheduled financial jobs completed, backups ran and restores were tested, and that failures were investigated. Pair these with an inventory of service providers that host or support financial systems, including the SOC reports or other assurance each one provides and when those reports were last reviewed. To check it, pick one failed job from the period and confirm it was followed up. Then confirm that the provider inventory names an owner for each provider's assurance report.

Questions smaller issuers ask about SOX 404 and ITGCs

Can a smaller public company run its SOX 404 assessment without outside help?

Yes, management can perform its own assessment, but the work must still meet the standard the rule sets. Section 404(a) requires management to assess ICFR as of fiscal year end, and Rule 13a-15(c) requires an evaluation against a suitable, recognized framework. Only the auditor attestation under Section 404(b) is exempt for non-accelerated filers, so the company still owns the controls, the evaluation and the conclusion. Outside help is usually about capacity and method: an implementation partner can prepare system configurations, access reports, change records and evidence folders, while management documents its own judgments. Confirm internally who will sign the assessment and who will review the evidence before engaging anyone.

What does the SOX 404 work need from finance and IT?

Finance defines which accounts and disclosures carry financial reporting risk, and IT shows how the systems that produce those numbers are controlled. SEC guidance says management only needs to evaluate the IT general controls necessary for other controls over financial reporting to operate properly and consistently. In practice that means finance identifies the in-scope applications, reports and key controls, while IT supplies:

User access listings, role assignments and privileged account reviews
Change tickets with approval, testing and release records for financially significant systems
Job scheduling, backup and recovery, and incident records for the period
Evidence that IT service providers are monitored, where any are used

Each party should agree on the evidence format and the period covered before testing starts.

Does losing smaller reporting company status change SOX 404 obligations?

Losing smaller reporting company status does not by itself end management's duty under Section 404(a), which applies to all issuers. The status change matters because the exemption from the 404(b) auditor attestation depends on whether the company is an accelerated or large accelerated filer, not on smaller reporting company status alone. Filer status is determined under the accelerated filer definition in 17 CFR 240.12b-2, based on public float and other conditions, so a company should track its public float and revenue at each measurement date. Ask counsel and the external auditor to confirm which measurements apply to your facts, because the timing of a status change determines when attestation begins.

How long does the SOX 404 assessment take for a smaller company?

The timeline depends on how many systems, locations and controls are in scope, how centralized the accounting process is, and how much evidence already exists. SEC guidance notes that management's daily interaction with controls may provide sufficient evidence in smaller companies where controls are centralized and few people are involved, which can shorten the work. Evaluation still needs to consider evidence from a reasonable period during the year, including fiscal year end, so a company should not wait until year end to start. No duration is set by the rule. Ask any consultant or partner for a written schedule tied to a defined scope, and confirm with your auditor how much of the work they will rely on.

What can the external auditor do for a non-accelerated filer, and what can it not do?

A non-accelerated filer is not required to obtain a 404(b) auditor attestation, so the auditor's ICFR opinion is not part of the annual report. The auditor still performs the financial statement audit, which involves risk assessment under AS 2110 and may involve IT controls where they affect the numbers. Auditors can give recommendations and share observations, but they cannot design or operate your controls, prepare the management assessment for you, or certify ICFR as effective for a non-accelerated filer. Confirm in writing with your auditor which procedures they will perform and whether they will rely on your IT testing, since their reliance decides how much evidence you must keep.

What does the exemption from auditor attestation save?

The SEC estimated in 2020 that an issuer newly exempt from the 404(b) auditor attestation would save about $210,000 per year on average, made up of roughly $110,000 in audit fees and $100,000 in other costs (Release 34-88365). That figure is an average estimate for newly exempt issuers and does not predict your savings. Actual savings depend on your fee arrangements, the scope of your controls, whether you still use an outside firm for management testing, and how much IT evidence you already produce. The 2009 SEC study also found that costs for companies subject only to Section 404(a) varied widely, with the median rising after the 2007 reforms, so ask any advisor to quote the work from a written scope.

What happens to ITGC work if the company later becomes an accelerated filer?

Once the company is an accelerated filer, it can lose the 404(b) exemption and the external auditor must attest to ICFR, including the IT general controls that support automated controls and reports. The management evaluation under Section 404(a) continues, but the auditor will test the same ITGC areas more deeply and expect the evidence to be complete for the full period. Start preparing before the change: confirm your filer status calculations, document your IT general control scope, and test the evidence format now so the first attested year does not depend on untested records. Ask your auditor which systems they expect to test and how they will consider reliance on any third-party service provider reports.

How DeployOpen prepares ITGC evidence for a smaller issuer's assessment

DeployOpen works on SOX 404 for non-accelerated filers and smaller reporting companies by preparing the IT systems and evidence that management uses for its own ICFR assessment. The company owns its controls and conclusions, and only the independent auditor or assessor issues any report or opinion.

How we scope

Agree in writing which financially significant applications, databases and infrastructure fall inside the ITGC scope.
Map each in-scope system to the financial reporting risks and automated controls it supports, so the assessment stays focused.
Fix deliverables, responsibilities and timelines in a fixed-scope agreement before any work starts.

How we build

Configure access, change and backup controls in your own cloud accounts, data centers or private networks.
Document each control's owner, frequency and evidence source so management can test it without rebuilding the record.
Run security testing against in-scope systems so gaps surface before management's year-end evaluation begins.

How we hand over

Deliver control descriptions, procedures, configuration baselines and evidence collection logs for your staff to own.
Walk your finance and IT teams through how each control operates and what the evidence shows at fiscal year end.
Provide a written record of the work performed so your management and independent auditor can review it directly.

How we support

Offer ongoing support, upgrades and continuous testing through a retainer after the initial handover.
Confirm with your auditor which evidence formats and sampling periods they will accept before building collection routines.
Ask any implementation partner to state in writing which tasks management and the auditor keep for themselves.

SOX 404 for non-accelerated filers and smaller reporting companies