The SEC wants to move the 404(b) line. Here’s what changes for you — and what doesn’t.

Every few weeks this summer a CFO has asked me some version of the same question: “If the SEC raises the threshold, do we still need to do all this?” The short answer is yes. The longer answer is worth five minutes, because the companies that read the proposal as a reprieve are the ones I expect to see with a material weakness in two years.

What the proposal actually does

In May 2026 the SEC proposed changing how filer status is determined. The headline pieces, as proposed:

• The large-accelerated-filer threshold moves up — from $700 million in public float to a materially higher figure (the proposal uses $2 billion).
• Fewer companies fall into the accelerated-filer bucket, which is the bucket that triggers Section 404(b) — the requirement that your independent auditor issue its own opinion on internal control over financial reporting.
• Newly public companies get a longer on-ramp before 404(b) applies — a multi-year runway instead of the current transition.

The comment period closed in July. Reading the comment file, the reaction was broadly supportive, which usually means some version of this gets adopted. It is still a proposal. Nothing about your next 10-K has changed yet.

What does not change

This is the part that gets lost.

Section 404(a) is untouched. Management is still required to assess and report on the effectiveness of ICFR every year, using a recognized framework, as of fiscal year-end. That obligation exists whether or not an auditor also opines. The exemption is from the auditor’s attestation, not from having controls that work.

Section 302 certifications are untouched. Your CEO and CFO still sign, every quarter, that disclosure controls are effective and that material ICFR changes and weaknesses have been disclosed. Personal liability doesn’t move with the float threshold.

The financial statement audit is untouched. Your auditor still has to understand your controls to plan the audit. When they find that a control doesn’t operate, that becomes a deficiency they evaluate and communicate — 404(b) or not.

The PCAOB’s revised auditing standard for ICFR audits takes effect for fiscal years beginning on or after December 15, 2026. If you remain in 404(b), the audit gets more prescriptive, not less.

The practical trap for companies near the line

Here is what I am seeing in practice, and what colleagues at other firms are reporting: auditors of companies sitting near the threshold are not relaxing their evidence expectations. If your float puts you within reach of accelerated status — in either direction — expect the audit team to want 404(b)-quality documentation regardless, because they don’t want to rebuild the file the year you cross.

That means the proposal changes the timing of when an outside opinion is required. It does not change what a defensible control environment looks like:

Area	Still required under 404(a) alone?
Documented, top-down, risk-based scope	Yes
Process narratives and walkthroughs for significant cycles	Yes
Journal-entry approval, access restriction, and population review	Yes
ITGCs over financially relevant systems	Yes
Management testing with retained evidence	Yes — it is the basis for your assessment
Deficiency evaluation, aggregation, and audit-committee reporting	Yes
Filer-status analysis before each annual report	Yes, and it just got more important

What to do this quarter

1. Re-run your filer-status analysis now, and document it. Public float at the measurement date, revenue, EGC status, reporting history, and the transition provisions. Have securities counsel review it. This is the single most common “we assumed” finding I see, and the proposal makes assumptions riskier, not safer.
2. Don’t cut the testing program. If you were planning to scale back management testing on the theory that the auditor wouldn’t be attesting, reverse that. Your 404(a) conclusion has to stand on your own evidence.
3. Use the runway for remediation, not deferral. If you are newly public and the on-ramp gets longer, that time is best spent fixing the ITGC and close-process gaps that would have been findings — so that when 404(b) does arrive, the first attestation is clean.
4. Put the proposal on the audit committee agenda. One page: where you sit relative to the thresholds today, what would change under the proposal, and what management is doing either way.

The honest summary

The proposal is good news for the cost of compliance at companies that were in 404(b) purely because of float. It is not a reason to have fewer controls, less evidence, or a less rigorous close. The companies that treat it as one will find out the expensive way — from their auditor, from a restatement, or from a Section 302 certification that turned out to be wrong.