The 404(a) opportunity

Navigating the proposed SEC filer rule changes

The Securities and Exchange Commission’s (SEC) proposed simplification of filer statuses represents one of the most significant shifts in the Sarbanes-Oxley (SOX) compliance landscape in decades. For issuers that may no longer be required to obtain an external auditor’s attestation on internal control over financial reporting (SOX 404(b)), the initial reaction is often relief at the prospect of reduced compliance costs.

However, this is a pivotal moment that demands a strategic response, not a tactical retreat. While the external auditor attestation requirement may no longer apply to certain issuers, management’s responsibility under SOX 404(a) to assess and report on the effectiveness of internal control over financial reporting (ICFR) remains unchanged. In the absence of auditor attestation, stakeholders may place greater emphasis on management’s assessment.

Forward-thinking organizations will not view this as an opening to dismantle their SOX programs.

For some organizations, this may create an opportunity to further evolve their SOX program from a compliance-focused exercise into a risk-based, technology-enabled, and strategically aligned control function, optimizing controls and reinvesting resources into higher-value risk management and automation initiatives. This is the opportunity that lies ahead for 404(a) programs and their leaders. Before making that transition, companies will need to evaluate whether the benefits of continued auditor attestation, including investor confidence, governance considerations, audit committee oversight, and external stakeholder expectations, outweigh the potential compliance cost savings associated with a 404(a)-only model. For some registrants, maintaining a level of rigor comparable to a 404(b) environment may remain an important strategic consideration. In addition, management must continue to obtain sufficient evidence to support its assessment of ICFR effectiveness.

Redefine the strategy: From compliance-driven to risk-driven

For those entities that thoughtfully determine a 404(a)-only model is appropriate, the proposed changes may provide greater flexibility to pivot from a prescriptive, external auditor-led testing model to a truly risk-based approach tailored to the business and financial reporting risks, while continuing to support management’s assessment of effectiveness of ICFR:

• Optimize scope: Focus testing on internal controls that mitigate the greatest financial reporting risks, such as complex revenue streams, management estimates, or cybersecurity, while scaling back on lower-risk, routine processes.
• Modernize cadence: Adopt a dynamic testing cadence that leverages continuous control monitoring (CCM) for automated controls and high-volume transaction streams, reserving deep-dive manual testing for the most critical, high-risk areas. Consider a rotational testing strategy. Rather than testing everything equally, focus resources on areas experiencing change or elevated risk, such as:
  1. Newly designed or implemented controls.
  2. Processes that have recently undergone system migrations or transformations.
  3. Controls with new process owners or significant team turnover.
  4. Historically highly complex or manual areas.
• Right-size effort: Tailor documentation and evidence thresholds to what is truly necessary for management’s assertion and the Audit Committee’s oversight, freeing valuable hours for higher-impact operational and strategic risk areas.

Elevate the SOX function to a strategic “controls advisor”: Without the heavy execution burden of exhaustive sample testing, the SOX and Internal Audit functions may have opportunities to further expand their advisory role and to provide direct assistance to external auditors. This reclaimed capacity allows the team to partner directly with the first line of defense to provide timely observations on design of controls that embrace artificial intelligence (AI), integrate new technologies, and align with changes in external audit methodologies. A critical part of this advisory role is a renewed focus on the Test of Design.

As organizations adopt more automated controls, AI-enabled processes, and continuous monitoring capabilities, external auditors are placing greater emphasis on whether controls are appropriately designed to address the underlying risks before evaluating their operating effectiveness. By front-loading effort into robust control design, rationalization, and documentation, organizations can establish a sound control framework before leveraging emerging technologies.

Modernize the engine: Leverage technology as a strategic asset

By aligning control environments more closely with dynamic internal risk management and strategic priorities rather than relying solely on legacy compliance-driven programs, organizations can consider redeploying resources to assess and embed emerging technologies that are tailored to their unique business needs. The resulting efficiencies can be strategically reinvested to build a modernized, intelligent control environment. This enables the use of advanced technology to test a broader scope of controls, ultimately enhancing timeliness of control oversight and strengthening organizational resilience:

• Pioneer AI in internal controls: AI is shifting SOX compliance from a highly manual exercise to a more intelligent, automated, and risk-focused process:
  • Generative AI: Reduce administrative burden by drafting control narratives, updating risk control matrices, analyzing controls against peer datasets/benchmarks, and mapping controls against evolving frameworks.
  • AI-assisted testing: Use machine learning tools and AI capabilities as a “first-pass” reviewer to analyze contracts, independently reconcile large datasets, identify anomalies for further investigation, and draft control testing lead-sheets and workpapers.
  • Predictive risk modeling: Analyze historical data to predict where control breakdowns are most likely to occur, enabling more proactive monitoring, targeted testing, and preemptive resource allocation.
• Elevating the control environment through CCM: By moving beyond traditional, spot-check control activities, advanced analytics can be deployed to test transactions in real time. This modernizes risk oversight into an active monitoring control, which can instantly identify surface-leveling anomalies, duplicate payments, and separation of duties conflicts that may not be detected through traditional sampling approaches.
• Optimize governance, risk, and control (GRC) platforms: Leverage modern, AI-enabled GRC platforms as a dynamic “single source of truth” to consolidate control programs, automate reporting and issue remediation workflows, complete with real-time dashboards for the Audit Committee.

Reaffirm the value: Connect controls to business performance

A strong ICFR framework extends far beyond regulatory compliance; it is the bedrock of good corporate governance and operational excellence. Finance/SOX leaders will be challenged to reinforce this message and appropriately reposition management’s 404(a) program with key internal and external stakeholders:

• Optimize external audit delivery and revisit reliance: While a 404(b) exemption reduces formal attestation requirements, it does not eliminate the external auditor’s need to perform walk-throughs, understand processes, evaluate the control environment, and consider the effectiveness of key information technology and manual controls as part of the financial statement audit. In today’s highly automated financial reporting environment, controls continue to play an important role in the audit. Professional standards may require auditors to evaluate and test controls when substantive procedures alone are insufficient, system-generated information is used in the audit, reliance on controls supports the audit strategy, or controls address identified significant risks. A strong, management-certified control environment can support audit quality and efficiency, while deterioration in controls may increase audit complexity, potentially reducing or eliminating any cost savings gained from the 404(b) exemption.
• Protect investor confidence: Capital markets demand reliable, high-quality financial reporting. A continued commitment to a strong, management-certified control environment, even without the 404(b) attestation, is critical for maintaining trust, supporting compliance with debt covenants, other contractual obligations, and enabling future debt and equity offerings.
• Drive operational efficiency: Well-designed processes and controls reduce manual errors, prevent revenue leakage, and accelerate the financial close. The data from control testing can and should be used to identify and remedy operational bottlenecks.
• Strengthen fraud prevention: A robust and continuously monitored control environment remains the primary defense against internal and external fraud, safeguarding company assets as the business scales.
• Reinforce control ownership and governance: For organizations that transition to a 404(a)-only model, maintaining a strong culture of control ownership, monitoring, and accountability will remain critical to preventing deterioration in the effectiveness of the control environment.
• Provide positive assurance: Stakeholders may place greater emphasis on management’s assessment process and related governance activities where auditor attestation is not required. Board committees, principal executive officers, and various external stakeholders (including shareholders/investors) may seek additional reliance over management’s 404(a) program and its results.