Your first year as a public company: the SOX 404 timeline nobody hands you
What has to exist by the first annual report, what the auditor will test, and where newly listed companies run out of time.
Nobody hands a newly public company a calendar for Section 404. The obligation is dated and non-negotiable; the work behind it is neither obvious nor small. Here is the timeline I walk management teams through, counting back from the first annual report that requires it.
What 404 actually requires
Section 404(a) requires management to assess and report on the effectiveness of internal control over financial reporting. Section 404(b) requires the external auditor to attest to it. Newly public companies generally get a transition period before the first management report is due, and smaller filers may be exempt from the auditor attestation — but the management assessment is not optional, and the auditor’s own financial statement audit still depends on your controls.
The four things that have to exist
- A documented control environment. Entity-level controls: who approves what, how the board oversees, how issues are escalated.
- Process-level documentation for every significant account and disclosure — flowcharts or narratives that show where a number can go wrong and what stops it.
- IT general controls (ITGCs) over the systems those processes depend on: access, change management, operations. This is where most first-year findings live.
- Evidence that the controls operated — not just existed — for the period under assessment.
Where companies run out of time
- ITGCs are discovered late. Finance owns SOX; IT owns the systems. The gap between them is where the exceptions are.
- Remediation has a lag. A control fixed in month ten only has two months of operation to test.
- Spreadsheets count. If a material number lives in Excel, that spreadsheet needs controls too.
- Turnover. The person who designed the control leaves; the evidence leaves with them.
A working calendar
| Months before year-end | What should be done |
|---|---|
| 12+ | Scoping: significant accounts, locations, systems |
| 9–12 | Process and ITGC documentation; gap list |
| 6–9 | Remediation of design gaps; controls begin operating |
| 3–6 | Management testing; fix operating failures while there’s still runway |
| 0–3 | Auditor fieldwork; roll-forward testing |
If you’re reading this at month six, the scorecard will tell you which gaps are still fixable in time.