SOX 404(b) is the part of Section 404 of the Sarbanes Oxley Act that requires a company's external auditor to issue its own opinion on the effectiveness of internal control over financial reporting. It sits on top of 404(a), which is management's own assessment. Only accelerated filers and large accelerated filers are subject to 404(b). Non-accelerated filers and emerging growth companies do 404(a) and stop there.

What is the difference between SOX 404(a) and 404(b)?

404(a) is management's assessment of internal control over financial reporting, signed by the company, and it applies to every filer from its second annual report onward. 404(b) is a separate attestation report from the registered public accounting firm that audits the financial statements, and it applies only to accelerated and large accelerated filers. The evidence bar is what changes: under 404(b) an external auditor re-performs testing and forms an independent opinion.

How much does SOX 404(b) compliance cost?

The software is the small part. Recorded contract data read on 4 September 2026 puts SOX and internal audit platforms at a median near $49,420 for Workiva, $45,947 for Optro, $41,400 for Hyperproof and $24,481 for FloQast. Against that, a benchmark SOX program at a large filer runs into the millions of dollars and tens of thousands of internal hours per year. Platform license is commonly around two percent of what the program costs.

What features does SOX 404(b) software need?

A risk and control matrix tied to financial statement assertions, walkthrough documentation, design and operating effectiveness testing with sampling, evidence capture with dates and preparer and reviewer, deficiency tracking with severity, ITGC coverage for the systems in scope, and segregation of duties conflict detection. The item most shortlists underweight is an auditor-facing view: a way for the external auditor to pull evidence without a quarter of email.

SOX 404(b) compliance software: Sarbanes Oxley Section 404(b) requirements, the filer threshold and the auditor attestation

SOX 404(b) is the auditor attestation half of Section 404: your external audit firm forms its own opinion on whether internal control over financial reporting worked, and publishes it. Management's own assessment under 404(a) applies to every filer. The 404(b) attestation applies only to accelerated and large accelerated filers, and the line between those categories is drawn by public float and revenue, not by headcount or how complicated the business feels.

That distinction decides whether you are buying software to document your own conclusion or software that has to survive an independent auditor re-performing your testing. The second job is materially harder, and it is the reason teams that treated SOX as a spreadsheet problem end up replacing the spreadsheet in their first attestation year.

Complianceofficer is the obligations layer of that stack, not the whole SOX suite. We keep the regulatory obligations that apply to your entities identified, owned, mapped to controls and current, and we tell you the day one of the underlying rules moves. Below: exactly who 404(b) catches, the thresholds read from the rule text, and what the platforms cost.

Last updated September 2026. Threshold text read from 17 CFR 240.12b-2 on 4 September 2026; every contract figure was read the same day and is dated on the page.

Scan which obligations apply before your first attestation year

Pick your industry and size, then the regimes you operate under. The scan returns the obligations that apply to an organization like yours, what moved in the last twelve months, and the primary source behind each line. No signup, nothing stored.

§ Live · Compliance scan

No signup. Nothing you pick is stored.

Industry

Region

Frameworks you answer to

SOC 2 ISO 27001 GDPR HIPAA AML / KYC SOX PCI DSS

Also check regulatory changes from the last 12 months (takes a few seconds)

Sample register · fintech, US · what a scan returns

§ 01 Written AML program with a named officer BSA
§ 02 KYC and customer due diligence FinCEN CDD
§ 03 Sanctions screening lists Changed
§ 04 PCI DSS v4.0 validation Watching

§ 183 Who it catches

Who has to comply with SOX 404(b), read from the rule rather than from a vendor blog

Filer status is defined in Exchange Act Rule 12b-2. It turns on the aggregate worldwide market value of voting and non-voting common equity held by non-affiliates, measured on the last business day of your most recently completed second fiscal quarter, plus a revenue test that the SEC added in 2020. Two other conditions apply to both accelerated tiers: you must have been subject to Exchange Act reporting for at least twelve calendar months, and you must have filed at least one annual report.

Filer status and whether SOX 404(b) applies
Filer status	Public float test	Revenue test	404(a)	404(b) auditor attestation
Large accelerated filer	$700 million or more	Not eligible for the SRC revenue test	Yes	Yes
Accelerated filer	$75 million or more, less than $700 million	Not eligible for the SRC revenue test	Yes	Yes
SRC, revenue under $100m	Any	Revenue under $100 million	Yes	No, excluded since 2020
SRC, revenue over $100m	$75m to $250m	Fails the revenue test	Yes	Yes, still an accelerated filer
Emerging growth company	Any, until large accelerated	Under $1.235 billion gross revenue	Yes, from the second annual report	No, for up to five fiscal years post-IPO
Non-accelerated filer	Under $75 million	n/a	Yes	No

Row four is the one that catches people. When the SEC amended the accelerated filer definitions in March 2020, effective 27 April 2020, a lot of coverage compressed the change into "smaller reporting companies are exempt from 404(b)". That is not what the rule says. The exclusion reaches an issuer that qualifies as a smaller reporting company under the revenue test, meaning annual revenue below $100 million. A company that is an SRC purely because its float sits between $75 million and $250 million, while booking $140 million of revenue, remains an accelerated filer and still owes the attestation. Revenue growth, not a share price move, is what pulls those companies in.

§ 184 The ratchet

The entry and exit thresholds are not the same number, and that asymmetry is deliberate

Almost every summary of Section 404 quotes the entry thresholds and stops. Rule 12b-2 also sets separate, lower exit thresholds, and the gap between them is where a lot of budget quietly disappears. You become an accelerated filer at $75 million of float. You stop being one only when float falls below $60 million, or when you become eligible for the smaller reporting company revenue test. Large accelerated filer status starts at $700 million and ends below $560 million.

Accelerated filer entry and exit thresholds
Status	You enter at	You only exit below	The band you are stuck in
Accelerated filer	$75 million float	$60 million float	$60m to $75m: still filing 404(b)
Large accelerated filer	$700 million float	$560 million float	$560m to $700m: still a large accelerated filer

In practice this means a company whose market value falls 15 percent after crossing a threshold does not get its compliance obligation back. A business that listed at $80 million of float and drifted to $65 million keeps the auditor attestation, keeps the accelerated filing deadlines, and keeps the cost base, until either float breaks $60 million or revenue drops under $100 million and the revenue test rescues it. Budgeting on the assumption that a soft year removes the obligation is a mistake worth catching before it shows up in a forecast.

The determination is annual and it is made at fiscal year end, and it governs the deadlines for that year's annual report, the following year's quarterly and annual reports, and everything after while status holds. So the measurement that matters was taken on the last business day of your second fiscal quarter, months before anyone starts thinking about the 10-K. Teams that check float in Q2 rather than in Q4 give themselves two extra quarters to build evidence, which is the whole ballgame given the constraint in the next section.

§ 185 Pre-IPO

Why the EGC exemption is a timing problem rather than a reprieve

Most companies going public qualify as emerging growth companies under the JOBS Act, and an EGC is permitted not to provide the 404(b) auditor attestation. Read quickly, that sounds like five free years. Read carefully, it is a deadline with four separate ways to arrive early. EGC status ends at the earliest of: annual gross revenue reaching $1.235 billion, issuing more than $1 billion in non-convertible debt across three years, becoming a large accelerated filer, or the last day of the fiscal year following the fifth anniversary of the IPO.

The third route is the one that arrives without warning. A company whose stock performs well can cross $700 million of float and become a large accelerated filer in year two, losing EGC status and picking up 404(b) several years before the calendar would have ended it. Nothing about the business changed. The share price did.

Which runs into the constraint that governs every SOX readiness plan: an attestation covers a period, and control effectiveness cannot be created retroactively. An auditor testing operating effectiveness needs evidence that the control ran, with dates, a preparer, a reviewer, and an artifact, across the period under audit. Reconstructing twelve months of approvals in the month before an audit is not a documentation exercise, it is a finding. That is the real reason pre-IPO teams stand up a control system twelve to eighteen months before their first assessment rather than in the quarter they need it.

The sequencing that works is unglamorous: get 404(a) genuinely right first, under management's own assessment, with the risk and control matrix, the walkthroughs and the evidence trail all operating normally. A 404(b) year then adds an independent opinion on top of a machine that already runs. Teams that skip the 404(a) discipline and try to stand up both at once are the ones that report a material weakness in year one. The severity ladder behind that outcome is set out in material weakness and significant deficiency, and the mechanics of the testing itself in SOX 404 testing.

§ 186 Cost

What SOX 404(b) software costs, from recorded contracts rather than list prices

No serious vendor in this category publishes a rate card. Every figure below comes from recorded purchase data on Vendr, read on 4 September 2026, and each is a median annual contract with the recorded range and the average discount buyers negotiated off the first quote. Medians move, so treat these as a negotiating anchor with a date on it, not a price list.

Recorded annual contract values for SOX and internal audit platforms
Platform	Median annual contract	Recorded range	Average discount off first quote	Where it fits a 404(b) program
LogicGate	$53,784	$12,294 to $136,130	19%	Configurable risk workflow, strong when SOX is one of several programs
Workiva	$49,420	$12,736 to $153,365	11.44%	Strongest where SOX sits next to SEC reporting and the 10-K
Optro (formerly AuditBoard)	$45,947	$21,220 to $111,208	16.33%	Purpose-built SOX and internal audit workflow, common at first-year filers
Hyperproof	$41,400	$22,215 to $70,000	21.15%	Control mapping across frameworks, lighter on financial audit depth
Onspring	$33,808	$9,972 to $55,810	Not reported	Mid-market GRC, flexible but more build-it-yourself
Diligent	$25,335	$5,500 to $48,323	7.67%	Ties SOX status to board and audit committee reporting
FloQast	$24,481	$10,147 to $68,727	23%	Controls embedded in the close, popular with pre-IPO controllers

The discount column is the part worth studying, because it tracks substitutability almost exactly. Diligent at under 8 percent and Workiva at 11 percent are the two hardest negotiations on the list, and neither has a drop-in replacement: board reporting and 10-K assembly are not commodity jobs. FloQast at 23 percent sits in a crowded close-management market. A procurement rule of thumb like "assume 20 percent off" is wrong at both ends of this table.

Keep the software number in proportion. A platform in the $25,000 to $55,000 range is a small fraction of what a SOX program costs once external audit fees, advisory support and internal hours are counted, and at a large filer the program runs into the millions of dollars and tens of thousands of hours annually. Implementation services commonly add 30 to 100 percent of first-year license. Nobody has ever saved a SOX program by negotiating the license harder; the savings are in scoping fewer, better controls. The wider pricing picture across the category is on compliance software pricing, and the SOX-specific breakdown in SOX compliance software pricing.

§ 187 Scoring

What to score when the buyer is an external auditor you have not met yet

A 404(a) tool has one audience: you. A 404(b) tool has two, and the second one is a registered public accounting firm that will re-perform your testing and form its own opinion. That changes what matters in a demo.

Evidence with provenance

Every artifact needs a date, a preparer, a reviewer and an unbroken link to the control it supports. Screenshots dropped in a shared drive fail this the moment someone asks when the review happened.

An auditor-facing view

Read-only access scoped to the population your auditor is testing. The alternative is a quarter of email attachments, which is where fee overruns come from.

A real risk and control matrix

Controls mapped to financial statement assertions and to the accounts and processes they cover, not a flat checklist. Scoping conversations happen in this object.

ITGC coverage

Access, change management, operations and program development for every in-scope system. ITGC failures invalidate the automated controls that depend on them, which is how one finding becomes twenty. See ITGC controls software.

Segregation of duties

Conflict detection across the ERP roles that actually post entries, plus documented compensating controls where separation is not possible. Covered on segregation of duties software.

Deficiency severity workflow

Deficiency, significant deficiency and material weakness are different conclusions with different disclosure consequences. The tool should force the reasoning, with owners and remediation dates.

One category is routinely left off scorecards and then becomes the reason for a late-cycle scramble: knowing that an obligation behind a control has changed, on the day it changes, rather than at the next annual refresh. That is the job this product does, alongside whichever SOX platform you pick, and it is set out on regulatory change management. For the broader Section 404 program, including 404(a) and the control lifecycle, start at SOX compliance.

§ 188 Questions

Questions buyers ask about SOX 404(b)

What is SOX 404(b)?

SOX 404(b) is the part of Section 404 that requires your external auditor to issue its own opinion on the effectiveness of internal control over financial reporting. It sits on top of 404(a), management's own assessment. Only accelerated filers and large accelerated filers are subject to it. Non-accelerated filers and emerging growth companies perform 404(a) and stop there.

What is the SOX 404(b) threshold?

You become an accelerated filer, and therefore subject to 404(b), once public float held by non-affiliates reaches $75 million on the last business day of your second fiscal quarter, you have been reporting for at least twelve calendar months, and you have filed at least one annual report. An issuer is excluded if it qualifies as a smaller reporting company under the revenue test, meaning annual revenue under $100 million. Large accelerated filer status begins at $700 million of float.

Are emerging growth companies exempt from SOX 404(b)?

Yes, for as long as EGC status lasts, which is up to five fiscal years after the IPO. The status ends at the earliest of four events: gross revenue reaching $1.235 billion, issuing more than $1 billion of non-convertible debt over three years, becoming a large accelerated filer, or the last day of the fiscal year following the fifth anniversary of the IPO. The 404(a) assessment still applies from the second annual report onward.

Does a smaller reporting company have to comply with SOX 404(b)?

Not automatically. SRC status alone does not exempt you, and this is the most common misreading of the 2020 amendments. The exclusion applies only if you also meet the revenue test, annual revenue under $100 million. An SRC whose float sits between $75 million and $250 million but which books more than $100 million in revenue is still an accelerated filer and still owes the attestation.

How do you exit accelerated filer status?

The exit thresholds sit below the entry thresholds. You enter at $75 million of float but only leave when float falls below $60 million, or when the smaller reporting company revenue test becomes available to you. Large accelerated status begins at $700 million and ends below $560 million. Between those numbers you keep the obligation, the accelerated filing deadlines and the cost.

When should a pre-IPO company start SOX readiness?

Early enough that controls have actually operated across the period an auditor will test, because effectiveness cannot be documented retroactively. Most pre-IPO programs begin twelve to eighteen months before the first 404(a) assessment. A SOX rollout typically runs twelve to sixteen weeks in the mid-market and four to six months at a large filer from kickoff to a first testing cycle, plus a quarter of parallel running.

Does SOX 404(b) apply to private companies?

No. Section 404 applies to issuers filing reports with the SEC under Section 13(a) or 15(d) of the Exchange Act, so a private company has no 404(a) or 404(b) obligation. Companies preparing to list still build the control environment early, because the first assessment after listing covers a period that has already happened.

Can you use one platform for both 404(a) and 404(b)?

Yes, and you should. The difference between the two years is who reviews the evidence, not what the evidence is. A platform that produces a defensible 404(a) assessment, with dated artifacts, named preparers and reviewers, and a control matrix tied to assertions, is already producing what a 404(b) auditor asks for. Choosing a lightweight tool for the 404(a) years and migrating before the attestation year is the expensive path, because the evidence history rarely survives the move.

§ 99 · Final entry

Get on the early-access list

Leave your work email, confirm the 6-digit code, and we will email you when your spot opens. Nothing is charged before launch.

§ 90