SOX Compliance Services: Readiness, ITGC Testing, and Control Testing for Sections 302 and 404
SOX compliance support for US-listed companies, IPO candidates, foreign private issuers, subsidiaries of US-listed groups, and the service organizations they rely on. We assess internal control over financial reporting against COSO 2013, test IT general controls and key controls to support management's assessment, and prepare service organizations for SOC 1 reports. Most readiness assessments take 6–12 weeks.
What Is SOX Compliance?
SOX compliance means meeting the Sarbanes-Oxley Act of 2002, the US law that makes public company leaders answerable for their financial reports. The CEO and CFO certify every quarterly and annual report, management assesses internal control over financial reporting (ICFR) each year, and for larger companies an independent auditor attests to that assessment.
In practice, SOX compliance is a cycle: scope the accounts and processes that matter, document the risks and controls, test that the controls work, fix what doesn't, and give leadership the evidence to sign. Most companies use the COSO 2013 Internal Control–Integrated Framework as the yardstick, with IT general controls (ITGCs) covering the systems that produce the numbers.
Accredify Global supports that cycle without taking your external auditor's place. We assess readiness, test ITGCs and key controls for management's assessment, and help service organizations get the SOC 1 reports their customers' auditors rely on. The SOX 404(b) attestation itself can only come from your PCAOB-registered audit firm.
SOX in 2026: Proposed Relief From 404(b), and Optional Semiannual Reporting
The SEC has proposed fewer auditor attestations. On 19 May 2026 it proposed collapsing today's filer categories into two. The large accelerated filer threshold would rise from $700 million to $2 billion of public float, and all other companies would become non-accelerated filers that no longer need a SOX 404(b) auditor attestation. Management's 404(a) assessment and the Section 302 and 906 certifications would stay.
Quarterly reports could become optional. A separate May 2026 proposal would let companies file a semiannual report on a new Form 10-S instead of 10-Qs. CEO and CFO certifications would still apply to each report.
Both are proposals, not final rules, when this page was reviewed. Until they are adopted, today's thresholds apply. Separately, the PCAOB's new quality control standard for audit firms, QC 1000, takes effect on 15 December 2026, so expect auditors to ask for clearer evidence.
Sources: Filer status proposal (Uniqus) · 404(b) exemption proposal (Schneider Downs) · Semiannual reporting proposal (DLA Piper) · QC 1000 effective date (WilmerHale)
SOX Compliance by Company Type: What Applies and How We Help
SOX duties depend on where you are in the listing journey and your filer status. Thresholds below are today's rules.
| Company type | What applies | How we help |
|---|---|---|
| Pre-IPO companies | Section 302 from the first periodic report; 404(a) from the second annual report | Readiness assessment and an ICFR roadmap before listing |
| Emerging growth companies | 302 and 404(a); no 404(b) for up to five years while EGC status lasts | Control testing for management's assessment |
| Non-accelerated filers | 302 and 404(a); no 404(b). Includes smaller companies with under $100 million revenue | 404(a) testing and deficiency tracking |
| Accelerated and large accelerated filers | 302, 404(a), and 404(b) auditor attestation (public float of $75 million or more) | Pre-audit readiness, ITGC and key control testing, remediation checks |
| Foreign private issuers | 302 and 906 certifications and 404 reporting in the Form 20-F; 404(b) by filer status | The same support, delivered by auditors local to your operations |
| Subsidiaries and offshore centres of US-listed groups | In scope of the parent's ICFR; controls set by group finance | Local control and ITGC testing to the parent's standards |
| Service organizations | Customers' auditors rely on your controls through a SOC 1 report | SOC 1 readiness and reports signed by our licensed CPA partner firm |
| Private companies | Not required by law; lenders, investors, and buyers often expect SOX-style controls | A proportionate controls review ahead of funding or sale |
| Newly acquired businesses | Can usually be left out of the 404 assessment for up to a year after acquisition | Integration testing so the business is ready the following year |
SOX Requirements by Section, and What We Test
The sections that drive most SOX compliance work, and the evidence behind each.
| Section | What it requires | Evidence we look for |
|---|---|---|
| 302 | CEO and CFO certify each 10-K and 10-Q, including disclosure controls and any significant deficiencies or fraud | Sub-certifications, disclosure committee records, and deficiency reporting |
| 404(a) | A yearly management report on the effectiveness of ICFR, using a recognized framework such as COSO 2013 | Scoping, risk and control matrices, walkthroughs, and test results |
| 404(b) | The external auditor's attestation on ICFR, for accelerated and large accelerated filers | Evidence prepared so your auditor's testing runs smoothly |
| 906 | CEO and CFO certify that each periodic report fully complies and fairly presents the financials | The control evidence that supports the signature |
| 409 | Rapid disclosure of material changes, usually on Form 8-K within four business days | Event escalation and disclosure procedures |
| 802 | Record retention, with criminal penalties for destroying or altering records | Retention schedules and legal hold procedures |
| 806 | Protection for employees who report suspected fraud | A working whistleblower channel and case handling |
SOX ITGCs: Where Most Deficiencies Start
If the systems that produce your numbers aren't controlled, the financial controls that depend on them can't be relied on.
The four ITGC areas we test
| Access to programs and data | User provisioning, removal of leavers, privileged access, and periodic access reviews |
|---|---|
| Program changes | Approval, testing, and separation of duties for changes to financial systems |
| Program development | Controls over new systems and data migrations, including ERP projects |
| Computer operations | Job scheduling, interface monitoring, backups, and incident handling |
Findings we see most
- Leavers who still have access to the ERP or bank portals
- Shared or generic admin accounts on financial systems
- Changes moved to production by the person who wrote them
- Key reports used in controls with no check on their completeness and accuracy
- SOC 1 reports collected but complementary user entity controls never mapped
ITGC evidence overlaps heavily with ISO 27001 and SOC 2 access and change controls, so we test once and map the results. A cyber security risk assessment covers the wider security picture, including the incident and cyber disclosure duties listed companies now carry.
SOX Deadlines, Penalties, and What a Material Weakness Costs
SOX puts personal liability on the people who sign, and public disclosure on the company when controls fail.
Filing clocks
| Form 10-K | 60 days after year end for large accelerated filers, 75 for accelerated, 90 for others |
|---|---|
| Form 10-Q | 40 days after quarter end for large accelerated and accelerated filers, 45 for others |
| Form 8-K | Generally within four business days of the event |
Each 10-K and 10-Q carries Section 302 and 906 certifications, so the control evidence must be ready before the filing date, not after.
Penalties and consequences
- Up to $1 million and 10 years in prison for knowingly certifying a report that does not comply (Section 906)
- Up to $5 million and 20 years for doing so willfully
- Criminal penalties for destroying or falsifying records (Section 802)
- SEC enforcement and civil penalties for false Section 302 certifications
- Public disclosure of material weaknesses, and recovery of incentive pay after restatements under exchange clawback rules
How Our SOX Compliance Services Work
Six stages, from scoping to a clear view of where you stand before your auditor arrives.
Planning an IPO, or not sure whether 404(b) applies to you? A free scoping review answers that first.
Book a free scoping reviewSOX vs SOC 1 vs ISO 27001: Who Needs Which
Three kinds of control evidence that are often confused.
| Topic | SOX | SOC 1 | ISO 27001 |
|---|---|---|---|
| Who needs it | Companies with US-listed securities | Service organizations whose work affects clients' financial reporting | Any organization proving information security |
| What it covers | Internal control over financial reporting | Controls at the service organization relevant to clients' ICFR | An information security management system |
| Who signs | CEO and CFO; the external auditor for 404(b) | A licensed CPA firm | An accredited certification body |
| Output | Certifications and the ICFR report in the 10-K or 20-F | A Type 1 or Type 2 report | A three-year certificate with yearly audits |
If you provide payroll, hosting, payments, claims, or outsourced finance services to listed companies, their auditors will usually ask for a SOC 1 Type 2 report. Our SOC 1 and SOC 2 services are delivered with a licensed CPA partner firm.
SOX Compliance Cost and Timeline
We do not publish a price list. The cost depends on how many processes, locations, and systems are in scope, and whether you need readiness, testing, or both. A free scoping review gives you a tailored proposal.
What shapes the scope
- Significant accounts and processes — revenue, close, payroll, treasury, and more
- Locations and entities — subsidiaries and shared service centres
- Systems — ERP, consolidation, billing, and their interfaces
- Service organizations — SOC 1 reports to review and map
- Reuse — existing narratives, ISO 27001 or SOC 2 evidence
How long it takes
| Readiness assessment | 6–12 weeks, depending on scope |
|---|---|
| Control testing | Interim and year-end cycles across your fiscal year |
| Pre-IPO programs | Planned back from your expected listing date |
How to Choose SOX Compliance Services
Questions worth asking any SOX provider, and how Accredify Global answers them.
| Question to ask | Accredify Global's answer |
|---|---|
| Can you issue our SOX 404(b) opinion? | No. Only your PCAOB-registered audit firm can. We support management's side. |
| Will our auditor rely on your testing? | That is your auditor's decision. We document testing so they can judge competence and objectivity. |
| Do you design the controls you test? | No. To stay objective, we don't design or run the controls we test. |
| Can you test overseas subsidiaries? | Yes, through our auditor network in 71 countries. |
| Do you give accounting or legal advice? | No. Accounting judgments stay with your finance team, auditor, and counsel. |
| How is it priced? | A tailored proposal after a free scoping review. |
What You Receive From a SOX Engagement
Accounts, processes, locations, and systems in scope.
Your risk and control matrices measured against COSO 2013.
Access, change, development, and operations findings.
Samples, evidence, and conclusions your auditor can follow.
Each issue described for management's severity evaluation.
A plain view for the CEO, CFO, and audit committee.
Frequently Asked Questions About SOX Compliance
Straight answers on sections, company types, ITGCs, the 2026 proposals, cost, and timeline.
What is SOX compliance?
SOX compliance means meeting the Sarbanes-Oxley Act of 2002. The CEO and CFO certify each quarterly and annual report, management assesses internal control over financial reporting every year, and larger companies also need an independent auditor's attestation on those controls.
Who has to comply with SOX?
Companies with securities registered with the US SEC, including foreign private issuers, along with their subsidiaries as part of the group's controls. Private companies are not required to comply, but lenders, investors, and buyers often expect SOX-style controls.
What is the difference between SOX 404(a) and 404(b)?
Section 404(a) requires management to assess and report on the effectiveness of internal control over financial reporting each year. Section 404(b) requires the company's external auditor to attest to that assessment, and it applies to accelerated and large accelerated filers.
Which companies are exempt from SOX 404(b)?
Today, non-accelerated filers, including smaller reporting companies with under $100 million in annual revenue, and emerging growth companies for up to five years after their IPO. Newly public companies also get a transition period before their first management report. An SEC proposal from May 2026 would widen the exemption if adopted.
What changed for SOX in 2026?
In May 2026 the SEC proposed raising the large accelerated filer threshold to $2 billion of public float and removing the 404(b) attestation for all other companies, and separately proposed optional semiannual reporting. Both were still proposals when this page was reviewed. Management's 404(a) assessment and Section 302 and 906 certifications would continue.
What are SOX Section 302 and 906 certifications?
Section 302 requires the CEO and CFO to certify each 10-K and 10-Q, including the effectiveness of disclosure controls and any significant control deficiencies or fraud. Section 906 is a separate criminal certification that the report fully complies with SEC rules and fairly presents the company's financial condition.
What are the penalties for SOX violations?
Under Section 906, knowingly certifying a non-compliant report can bring fines of up to $1 million and up to 10 years in prison, rising to $5 million and 20 years if willful. Destroying or falsifying records carries separate criminal penalties, and the SEC can bring civil enforcement for false certifications.
What are SOX ITGCs?
IT general controls are the controls over the systems that produce financial data. They usually cover access to programs and data, program changes, program development, and computer operations. Weak ITGCs can stop auditors relying on automated controls and system reports.
What framework is used for SOX compliance?
Most US-listed companies assess internal control over financial reporting against the COSO 2013 Internal Control–Integrated Framework, which has five components and 17 principles. Many also use COBIT for IT controls.
What is a material weakness?
A deficiency, or combination of deficiencies, in internal control over financial reporting that creates a reasonable possibility that a material misstatement will not be prevented or detected on time. Material weaknesses must be disclosed, and management cannot conclude that ICFR is effective while one exists.
Does SOX apply to foreign companies and subsidiaries?
Yes. Foreign private issuers with US-listed securities include SOX certifications and the ICFR report in their Form 20-F. Subsidiaries and offshore delivery centres of US-listed groups fall within the parent's ICFR scope and are tested to the parent's standards.
How does SOC 1 relate to SOX?
When a listed company outsources a process that affects its financial reporting, such as payroll or hosting, its auditor usually relies on the service provider's SOC 1 Type 2 report. Service organizations get SOC 1 reports so their customers can meet SOX requirements.
Can Accredify Global issue our SOX 404(b) opinion?
No. The 404(b) attestation can only be issued by your PCAOB-registered external audit firm. We support management with readiness, ITGC and control testing, and SOC 1 for service organizations, and we don't design or run the controls we test.
How long does SOX readiness take?
A readiness assessment usually takes 6 to 12 weeks, depending on processes, locations, and systems. Testing then runs across the fiscal year in interim and year-end cycles. Companies preparing for an IPO should start well before listing.
How much do SOX compliance services cost?
There is no list price. Cost depends on the number of significant processes, locations, systems, and service organizations in scope, and on how much existing evidence can be reused. A free scoping review gives you a tailored proposal.
Know Your Controls Will Hold Before Your Auditor or Your CFO Has to Sign
Tell us about your filer status, systems, and locations. We'll confirm which SOX duties apply, where the biggest gaps are likely to be, and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global compliance team.