Pre-IPO and newly public companies
SOX compliance services for companies facing Section 404
Your first annual report has a date on it and the control work has not started. We build the controls and the evidence, and we tell you which part of Section 404 you owe before you buy any of it.
Before you buy SOX compliance services
A company that buys a 404(b) attestation it does not owe pays for work that is not required of it.
A company that tests late in the year has no time to fix the gaps before the assessment date.
Which firm can take which role is settled before scoping, not during it.
Find out which part of Section 404 you owe
Who has to comply with SOX 404 and what management owes
SEC reporting companies face Section 404, subject to exemptions and transition relief. A company making its first annual report after going public can leave the Section 404 reports out of that report (Item 308, Instruction 1).
Management owes the assessment. Under Section 404(a) the company's own officers evaluate internal control over financial reporting and publish that conclusion.
The second obligation, the auditor attestation under Section 404(b), is a separate opinion from the registered audit firm on those same controls. It applies to accelerated and large accelerated filers, the SEC's size categories set by public float and revenue. The SEC's 2020 amendments moved a group of smaller reporting companies out of accelerated filer status (adopting release 34-88365).
An emerging growth company (EGC), one within five years of its first registered equity sale, stays outside 404(b) while that status lasts.
For the difference between a SOX audit and your internal audit function, read SOX audits and internal audits.
Section 404(a) and 404(b) compared
| Requirement | Section 404(a) | Section 404(b) |
|---|---|---|
| Who signs it | Management | The registered public accounting firm |
| Who is covered | Annual filers subject to 404(a), after transition relief | Accelerated and large accelerated filers, excluding EGCs |
| What it produces | Management's report on internal control | A separate opinion inside the integrated audit, one audit covering statements and controls |
| Who does the testing | Management, or a firm working for management | The audit firm, as part of its own opinion |
Auditor independence and the role we can take
Dimov Audit is on the PCAOB register, the board overseeing firms that audit public companies. Sarbanes-Oxley consulting and the issuer audit cannot come from the same firm for the same company, because a firm may not audit controls it designed or take on management's own work (SEC independence rules).
Management's testing under 404(a) is readiness work. The testing behind a 404(b) opinion belongs to the audit (AS 2201). Tell us which role you need on the first call. We also perform the issuer audit itself.
What a SOX readiness engagement covers
Scoping and risk assessment
Which accounts and processes are material enough that a control is required over them.Process documentation
Narratives, flowcharts and a control matrix your auditor can follow.ITGC review
IT general controls: access, change and operations over financial systems.Control testing
Design and operating effectiveness, sampled and evidenced by our team.Deficiency evaluation
We rank each gap and say which ones management has to report.Remediation support
Our team fixes what testing found, before the assessment date.
A material weakness is a gap severe enough that a material misstatement could go undetected. A significant deficiency is less severe and still merits the attention of whoever oversees reporting.
How a SOX readiness engagement works
Filer status
We settle whether you owe 404(a) alone or 404(b) as well before we scope anything.Scope and risk
We agree materiality, the significant accounts, and the processes behind them.Walk through and test
We walk each process, test design first, then operating effectiveness.Remediate and hand over
We rank the gaps, evidence the fixes, and hand your auditor a usable file.
Who SOX readiness is for
Pre-IPO companies
Building controls and evidence before the S-1, the registration statement filed to go public.Newly public companies
Inside the transition period, working out when the attestation starts to apply.SOX compliance for private companies
Lenders, buyers and private equity owners asking for the same controls without the statute.
A second look at last year's documentation
What drives the cost of a SOX engagement
Dimov Audit prices on the file, not on the hour.
- 01The number of significant accounts and processes in scope
- 02How many entities and locations consolidate
- 03The state of the documentation at handover
- 04Whether ITGCs are in scope, and how many systems feed the ledger
- 05Whether this is a first year build or an annual refresh
A first year build and an annual refresh are not the same engagement, and the quote turns on which one you are in.
On starting early, said in a tax planning context and true of a controls build for the same reason:
“Make sure to start planning with a professional far ahead of time, maybe six months before, nine months before.”
George Dimov, CPA
“Dimov team showed remarkable professionalism, dedication, and attention to detail throughout the entire audit process. Despite a very tight deadline on our end, they managed to deliver the completed audit in due time.”
Marina Alexandra Ion
Related audit services
PCAOB audits
The issuer audit itself, from a firm on the public register.
Financial statement audits
GAAS audits for companies not filing with the SEC.
Attestation services
Agreed-upon procedures and examinations short of a full audit.
This is general information and not advice for your circumstances. Whether Section 404 applies to a company, and which part of it, depends on that company's filer status, so speak to a CPA before acting on it.
Talk to us about your Section 404 obligation
Companies reach us because a filing date moved, an auditor asked for a control matrix that had not been built, or a board wanted to know what SOX was going to cost. Each is easier to fix early.
Send your filer status, your last annual report and the date you are working toward. We will tell you what Section 404 asks of you and scope the SOX compliance services around it before you sign.
Contact
Connect with Dimov Audit
Our dedicated team is ready to assist you on your path to financial success.
24 Mercer St, 2nd Floor, Suite 214
New York, NY 10013
United States
Reviewed by George Dimov, CPA. Dimov Audit works with issuers and private companies across all 50 states.
Are your financials audit-ready?
Are Your Financials Audit-Ready?
At Dimov Audit, we pride ourselves in quick communication, accurate work, and seamless delivery.