More than two decades after the Sarbanes-Oxley Act reshaped corporate governance and financial reporting, Section 404 remains one of its most impactful (and challenging) provisions. As technology advances, business models evolve, and regulatory scrutiny intensifies, SOX 404 compliance in 2026 looks very different than it did even a few years ago.
For CPAs, SOX 404 is no longer just about testing controls. It’s about understanding how automation, data governance, cybersecurity, and management judgment intersect with internal control over financial reporting (ICFR).
This post provides an up-to-date overview of SOX 404 in 2026, including applicability, core requirements, emerging risks, and best practices CPAs need to stay inspection-ready and compliant.
What Is SOX 404?
Section 404 of the Sarbanes-Oxley Act requires public companies to establish, maintain, assess, and report on the effectiveness of their ICFR. The objective is to ensure that financial statements are reliable and free from material misstatement, whether due to error or fraud.
SOX 404 has two key components:
- SOX 404(a): Management’s annual assessment of ICFR
- SOX 404(b): The external auditor’s independent attestation of management’s assessment
Who Is Subject to SOX 404?
Accelerated and Large Accelerated Filers
These companies must comply with both 404(a) and 404(b):
- Accelerated filers: Public float between $75 million and $700 million
- Large accelerated filers: Public float greater than $700 million
Non-Accelerated Filers
Companies with public float under $75 million are generally subject only to 404(a) and are exempt from auditor attestation under 404(b), unless they voluntarily comply or later become accelerated filers.
While exemptions for smaller companies continue to be discussed, no significant rollback of SOX 404(b) has occurred.
Core SOX 404 Requirements
Establishing and Documenting Internal Controls
Management must design and document controls across the five COSO components:
- Control environment
- Risk assessment
- Control activities
- Information and communication
- Monitoring
Management’s Annual Assessment
Management must:
- Evaluate control design and operating effectiveness
- Disclose material weaknesses, if any
- Include a written assessment in the annual Form 10-K
Auditor Attestation (404(b))
External auditors must:
- Independently test ICFR
- Issue an opinion on management’s assessment
- Identify material weaknesses or scope limitations
What CPAs Need to Know in 2026
1. Risk-Based Scoping Remains Critical
CPAs should continue to focus on:
- Significant accounts and disclosures
- Key controls and entity-level controls
- IT general controls and system dependencies
Over-scoping remains a common inefficiency, while under-scoping increases inspection risk.
2. AI and Automation Are Now ICFR Risks
By 2026, many organizations rely on AI-enabled tools for reconciliations, anomaly detection, forecasting, and reporting. CPAs must understand:
- How automated controls function
- What human review controls exist
- How models are governed, validated, and changed
Lack of documentation or oversight around AI-driven processes can create control gaps.
3. Cybersecurity and Data Integrity Matter More Than Ever
Regulators and auditors increasingly view material cybersecurity risks as potential ICFR deficiencies. CPAs should:
- Understand the company’s cybersecurity framework
- Evaluate access controls, data integrity, and incident response
- Recognize when cyber incidents may trigger disclosure or control implications
4. PCAOB Inspection Focus Areas
Ongoing inspection themes include:
- Management review controls and level of precision
- Testing of complementary user entity controls
- Clear documentation of walkthroughs and control performance
- Use of specialists and reliance on SOC 1 reports for third-party service providers
CPAs should ensure audit methodologies and internal documentation align with current PCAOB expectations.
Common SOX 404 Pitfalls
- Inadequate control documentation
- Weak testing of IT general controls
- Overreliance on spreadsheets without compensating controls
- Poorly defined management review controls
- Failure to reassess risks after system or organizational changes
Best Practices for 2026
- Maintain clear, current documentation using narratives, flowcharts, and control matrices
- Collaborate closely with IT, compliance, and operations teams
- Perform regular risk assessments tied to business and technology changes
- Invest in continuous training on emerging risks and regulatory guidance
- Monitor SEC, PCAOB, COSO, and AICPA developments—especially around AI and data governance
SOX 404 in a Broader Governance Context
In 2026, SOX 404 increasingly intersects with:
- ESG reporting infrastructure
- Third-party and cloud service providers
- Enterprise data governance
Strong ICFR frameworks support not just compliance, but investor trust and long-term resilience.
Stay Current with SOX 404 CPE
SOX 404 compliance continues to evolve, and CPAs play a central role in ensuring effective controls, credible reporting, and regulatory readiness.
Our in-depth CPA CPE conferences, live webinars, and self-study courses provide practical guidance on SOX 404, PCAOB trends, technology risks, and more, helping you stay ahead in an increasingly complex reporting environment.