SOX 404 compliance doesn't happen overnight. This is the phased approach we use to take companies from initial scoping through audit-ready ICFR — typically over 12 to 18 months.
The Sarbanes-Oxley Act requires all public companies to establish and maintain internal controls over financial reporting (ICFR). Section 404(a) requires management to assess and report on the effectiveness of those controls. Section 404(b) adds a requirement for an independent auditor to attest to that assessment — applying to accelerated and large accelerated filers.
Whether you're preparing for your first IPO, transitioning from 404(a) to 404(b), or optimizing an existing SOX program, the roadmap below outlines the approach we take at Garibyan to get you there — on time, with clean workpapers, and no surprises at audit.
Your SEC filer classification determines whether you need management's assessment (404a), an independent auditor attestation (404b), or both.
| Filer Type | Public Float | Revenue | 404(a) | 404(b) |
|---|---|---|---|---|
| Large Accelerated Filer | ≥ $700M | Any | ✔ | ✔ |
| Accelerated Filer | $250M – $700M | ≥ $100M | ✔ | ✔ |
| Smaller Reporting Company (Accelerated) | $75M – $250M | > $100M | ✔ | ✔ |
| Smaller Reporting Company (Non-accelerated) | < $75M – $700M | < $100M | ✔ | ✘ |
| Emerging Growth Company | Varies | < $1.235B | ✔ | ✘ (up to 5 yrs) |
We establish governance, define materiality, and map the full scope of your ICFR program. This phase sets the foundation — getting alignment with leadership, your external auditor, and the cross-functional teams who own the controls.
We work with your process owners to understand how transactions actually flow, identify where risks of material misstatement exist, and design controls to address them — including entity-level controls, process-level controls, and IT general controls.
Controls move from paper to practice. We create templates, train control owners on proper execution and documentation, and resolve design gaps before operational testing begins.
The core of SOX compliance — we test whether controls are operating consistently and effectively over time. This includes sample-based attribute testing, key report validation, and coordination with your external auditors to align on methodology and evidence.
We prepare for the external auditor's walkthroughs and testing, perform rollforward testing on final-quarter controls, finalize deficiency evaluations, and help you draft management's ICFR report. Then we transition you into a sustainable, repeatable program for year two and beyond.
Whether you're 18 months from your first 10-K or looking to optimize an existing program, we can help you get there — with senior-level attention, practical deliverables, and no surprises at audit.
Book a Consultation →