From its second annual report onwards, every company filing a 10-K must report on its internal control over financial reporting. This free SOX 404 compliance checklist runs that annual programme for controllers, SOX leads and internal audit: scoping, documentation, the testing plan, deficiency evaluation, the quarterly 302 certifications and management’s 404(a) report. A conditional phase adds auditor coordination when your filer status requires a 404(b) attestation. The result is one dated, signed record of how management reached its conclusion.
“SOX compliance” is three obligations with different owners and cadences. The certifications come every quarter. Management’s assessment is annual but built from work across the year. The auditor’s attestation depends on filer status, and many smaller registrants never need one.
The SEC does not prescribe how management should evaluate its controls. Its 2007 interpretive guidance describes a top-down, risk-based evaluation focused on the controls that address the risk of material misstatement, and a company following it satisfies the annual evaluation requirement. Auditors apply the same logic under PCAOB AS 2201, so this checklist starts from the financial statements, not last year’s control list.
When: every 10-Q and 10-K.
Covers: the report is not misleading, the conclusion on disclosure controls, and material changes in internal control.
Also: significant deficiencies, material weaknesses and relevant fraud disclosed to the auditor and audit committee.
When: annually, as of the fiscal year end.
Covers: management’s responsibility, the framework used and a conclusion on effectiveness.
Rule: any material weakness means ICFR cannot be concluded effective.
When: annually, in an integrated audit with the financial statements.
Who: accelerated and large accelerated filers that are not emerging growth companies.
Standard: PCAOB AS 2201.
| Filer position | 302 certifications | 404(a) report | 404(b) attestation |
|---|---|---|---|
| Large accelerated filer: public float of $700 million or more | Yes | Yes | Yes, unless an emerging growth company |
| Accelerated filer: public float of $75 million to under $700 million, unless the revenue test below applies | Yes | Yes | Yes, unless an emerging growth company |
| Non-accelerated filer, including a smaller reporting company with revenue under $100 million | Yes | Yes | No |
| Emerging growth company | Yes | Yes | No, while EGC status lasts |
| First annual report after an IPO | Yes | Not yet: a transition statement instead | Not yet |
Six phases take the programme from scoping to the signed 10-K. A seventh appears only when your filer status requires an auditor’s attestation.
The filer status and first-annual-report answers on the first task decide which Phase 6 tasks appear and whether Phase 7 appears at all.
Each test cycle runs as its own checklist using the SOX Internal Control Testing Checklist. This phase sets the plan and collects the results.
Each quarter’s certification runs on its own recurring checklist. For a first annual report after an IPO, the transition statement task replaces the management report tasks.
Shown only when the company is an accelerated or large accelerated filer and not an emerging growth company, and this is not its first annual report.
The Act is brief. The detail sits in the SEC’s Exchange Act rules, Regulation S-K and, for auditors, PCAOB standards. The table maps each requirement to its source and the phase that evidences it. Foreign private issuers and investment companies follow variations of these rules, so treat the table as a starting point, not legal advice.
| Requirement | Source | What it asks for | Evidenced in |
|---|---|---|---|
| Maintain disclosure controls and ICFR | Rule 13a-15(a) | Controls designed by or under the supervision of the CEO and CFO | Phases 2–3 |
| Recognised control framework | Rule 13a-15(c); COSO 2013 | A suitable framework set by a body that followed due process | Phases 1 and 3 |
| Quarterly disclosure controls evaluation | Rule 13a-15(b) | Effectiveness as of the end of each fiscal quarter | Phase 6 |
| Changes in ICFR | Rule 13a-15(d); Item 308(c) | Evaluate and disclose changes that materially affected, or are reasonably likely to materially affect, ICFR | Phase 6 |
| Officer certifications | Section 302 (Rule 13a-14(a)); Section 906 (18 U.S.C. 1350) | CEO and CFO certifications with each 10-Q and 10-K | Phase 6 |
| Management’s annual assessment | Section 404(a); Rule 13a-15(c); Item 308(a) | A conclusion on ICFR as of the fiscal year end, disclosing any material weakness | Phases 2–6 |
| Deficiency severity | AS 2201, Appendix A | Definitions of deficiency, significant deficiency and material weakness | Phase 5 |
| Auditor attestation | Section 404(b); Item 308(b); AS 2201 | An auditor’s report on ICFR for accelerated and large accelerated filers | Phase 7 |
Two SEC proposals from May 2026 would change parts of this. The filer status proposal of 19 May would raise the large accelerated filer threshold from $700 million to $2 billion of public float and fold accelerated filers into the non-accelerated category, so only large accelerated filers would need a 404(b) attestation. The proposal of 5 May would let companies elect to file a semiannual Form 10-S instead of quarterly 10-Qs, certifying semiannually. Neither would change management’s 404(a) assessment. At the time of review both were proposals only, their comment periods closed in July 2026, so plan against the current rules.
A recurring schedule starts this checklist yearly, the certification checklist quarterly and each test cycle on its own date. Dynamic due dates count back from the filing deadline, so a late scoping memo shows months before it squeezes year-end testing.
Conditional logic reads the Phase 1 answers. A non-accelerated filer never sees the auditor coordination phase, a newly public company gets the transition statement instead of a management report, and a large accelerated filer cannot skip the tasks it needs.
The scoping memo and management’s report run as approvals. RCMs, test results and certification packs sit on the task they support, the activity trail records who signed off and when, and template versioning ties each year to its checklist.
CheckFlow is not a GRC platform or an audit firm, and it does not issue an opinion on your controls. It runs the work, evidence and sign-offs behind management’s assessment. Test steps for each cycle live in the SOX Internal Control Testing Checklist, and CheckFlow’s compliance checklist software shows how the same approach covers your whole compliance calendar.
ERP access conflicts are reviewed with the Segregation of Duties Review Checklist, and many key controls operate inside the Month-End Close Checklist, where reconciliations and journal approvals leave the evidence your testers sample.
Section 302 is a personal CEO and CFO certification with every 10-Q and 10-K. They certify, among other things, their evaluation of disclosure controls and that they have told the auditor and audit committee about significant deficiencies, material weaknesses and relevant fraud. Section 404(a) is management’s annual report on whether internal control over financial reporting is effective as of the year end. Section 404(b) is the auditor’s attestation, required only for some filers.
No. Only accelerated and large accelerated filers need one, and emerging growth companies are exempt while their status lasts. Since the SEC’s 2020 amendments, a company eligible to be a smaller reporting company with revenue under $100 million is not an accelerated filer. Every registrant still files the 404(a) report and the certifications.
PCAOB AS 2201 defines it as a deficiency, or combination of deficiencies, that creates a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe but still merits the attention of those overseeing financial reporting. Management cannot conclude ICFR is effective while a material weakness exists, and must disclose it.
The 302 certifications apply from the first periodic report. Management’s 404(a) report starts with the second annual report; the first carries a statement that it includes no assessment or attestation. An emerging growth company can defer 404(b) for up to five years after its IPO, unless it loses EGC status sooner, for example by reaching $1.235 billion in annual revenue.
Rule 13a-15(c) requires a suitable, recognised framework, and in the US that is usually COSO’s Internal Control – Integrated Framework (2013), with five components and 17 principles. It superseded the 1992 framework on 15 December 2014. COSO’s February 2026 guidance on generative AI builds on the 2013 framework rather than replacing it.
It has proposed to. In May 2026 the SEC proposed optional semiannual reporting on a new Form 10-S, and a filer status overhaul that would limit 404(b) to large accelerated filers with at least $2 billion of public float. At the time of review neither had been adopted and no effective date had been set, so the current thresholds and quarterly certifications apply.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
