A company can fail its internal control over financial reporting test without a single wrong number in its financial statements.
That surprises many first-time public company finance teams. The test is whether your controls could have let a material error through, not only whether one got through. This guide covers internal control over financial reporting (ICFR) for public and pre-IPO companies: the COSO 2013 framework and its 17 principles, entity-level controls, process-level controls and IT general controls (ITGCs), management's assessment under SOX 302 and 404(a), the auditor attestation under 404(b) and who is exempt, how to classify a deficiency, a significant deficiency or a material weakness, and what remediation and disclosure look like. It includes a worked deficiency evaluation with illustrative numbers.
Key takeaway: ICFR is the process a public company uses to give reasonable assurance that its financial statements are reliable and prepared in accordance with GAAP. Management evaluates it against a suitable framework, almost always COSO 2013, and reports the conclusion in the 10-K under SOX 404(a). The auditor attests to it under 404(b) only for accelerated and large accelerated filers that are not emerging growth companies. A deficiency becomes a material weakness when there is a reasonable possibility that a material misstatement would not be prevented or detected on a timely basis. That test looks at what could happen, not only at what did. One material weakness at year-end means management cannot conclude that ICFR is effective, and the company has to say so.
General information, not legal or accounting advice for a specific entity. Confirm your filer status and the current rules with your auditor and securities counsel.
What is internal control over financial reporting (ICFR)?
ICFR is a process, designed by or under the supervision of the principal executive and principal financial officers and effected by the board, management and other personnel, that provides reasonable assurance about the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with GAAP. The definition is in Exchange Act Rules 13a-15(f) and 15d-15(f). It covers three things: records that in reasonable detail accurately and fairly reflect transactions and dispositions of assets; assurance that transactions are recorded as needed to prepare GAAP statements and that receipts and expenditures are made only in accordance with authorizations of management and directors; and prevention or timely detection of unauthorized acquisition, use or disposition of assets that could have a material effect on the financial statements.
Two words in that definition carry weight. "Reasonable" means no control system gives absolute assurance. "Process" means ICFR is the whole set of controls and how they work together, not one policy binder.
Internal controls over financial reporting are narrower than the controls a company runs in general. Controls over operational efficiency or compliance with unrelated laws are outside it unless they bear on the financial statements.
How is ICFR different from disclosure controls and procedures?
Disclosure controls and procedures (DC&P) cover all the information a company must disclose in its Exchange Act reports, and ICFR covers the reliability of the financial statements. DC&P are defined in Rule 13a-15(e) and are broader, because they reach MD&A, risk factors and other non-financial disclosures. The two overlap heavily, since a failure in ICFR usually means DC&P are not effective either.
| Disclosure controls and procedures | Internal control over financial reporting | |
|---|---|---|
| Purpose | Information required in SEC reports is recorded, processed, summarized and reported on time | Financial reporting is reliable and statements are prepared under GAAP |
| Scope | All required disclosure, financial and non-financial | Financial statements and the records behind them |
| Evaluated | Every quarter, as of period-end (Rule 13a-15(b)) | Annually by management; changes disclosed every quarter |
| Where disclosed | Item 4 of the 10-Q and Item 9A of the 10-K (Item 307 of Regulation S-K) | Item 9A of the 10-K (Item 308 of Regulation S-K); changes in Item 4 of the 10-Q |
| Framework | No prescribed framework | A suitable, recognized framework, usually COSO 2013 |
Section 302 of the Sarbanes-Oxley Act sits on top of both. The CEO and CFO certify each 10-Q and 10-K, and the certification says they are responsible for DC&P and ICFR, that they evaluated them, and that they disclosed to the auditors and the audit committee all significant deficiencies and material weaknesses in ICFR and any fraud, whether or not material, involving management or other employees with a significant role in ICFR. The separate Section 906 certification is a criminal-penalty statement about the report as a whole. For how the quarterly certification fits the close, see our quarter-end close checklist.
What is the COSO 2013 framework, and what are its 17 principles?
The COSO 2013 Internal Control-Integrated Framework is the framework most U.S. public companies use to evaluate ICFR. It has five components and 17 principles. COSO issued the updated framework in May 2013, and the original 1992 version was superseded as of December 15, 2014. SEC rules require a "suitable, recognized framework" and do not name one. COSO is the one that auditors, the SEC staff and the market expect.
| Component | Principle (abbreviated) |
|---|---|
| Control environment | 1. The organization demonstrates a commitment to integrity and ethical values |
| 2. The board demonstrates independence from management and exercises oversight of internal control | |
| 3. Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities | |
| 4. The organization demonstrates a commitment to attract, develop and retain competent individuals | |
| 5. The organization holds individuals accountable for their internal control responsibilities | |
| Risk assessment | 6. The organization specifies objectives with sufficient clarity to identify and assess risks |
| 7. The organization identifies and analyzes risks to achieving its objectives | |
| 8. The organization considers the potential for fraud | |
| 9. The organization identifies and assesses changes that could significantly affect internal control | |
| Control activities | 10. The organization selects and develops control activities that mitigate risks |
| 11. The organization selects and develops general control activities over technology | |
| 12. The organization deploys control activities through policies and procedures | |
| Information and communication | 13. The organization obtains or generates and uses relevant, quality information |
| 14. The organization internally communicates information, including objectives and responsibilities for internal control | |
| 15. The organization communicates with external parties about matters affecting internal control | |
| Monitoring activities | 16. The organization conducts ongoing or separate evaluations of internal control |
| 17. The organization evaluates and communicates internal control deficiencies in a timely manner |
Two principles stand out against the 1992 framework. Fraud risk assessment (Principle 8) is now explicit, and general controls over technology (Principle 11) are named, which is why ITGCs get so much attention.
COSO also says an organization cannot conclude it has effective internal control if a major deficiency exists in a component or relevant principle, or in the components operating together. In practice, auditors and management map their key controls to the 17 principles to show the framework is covered, and a gap against a principle becomes a deficiency to evaluate. For SEC reporting, the severity of that deficiency is judged under the SEC's material weakness and significant deficiency definitions, not COSO's "major deficiency" wording.
COSO published guidance in February 2026, Achieving Effective Internal Control Over Generative AI, that applies the 2013 framework to generative AI. It adapts the same components and principles and does not replace them. We cover it in our post on COSO's AI governance framework.
What is the difference between entity-level controls, process-level controls and ITGCs?
Entity-level controls operate across the whole company, process-level controls operate inside a specific business process or account, and ITGCs support the systems both depend on. Auditors and management use all three layers in a top-down, risk-based approach: start with the entity-level controls, move to significant accounts and processes, and then test the specific controls that address each risk.
| Layer | What it covers | Examples | How it is tested |
|---|---|---|---|
| Entity-level controls | Control environment, risk assessment, monitoring, and company-wide policies | Code of conduct and its enforcement, audit committee oversight, fraud risk assessment, internal audit, period-end financial reporting process, monitoring of results of operations | Inquiry, inspection of minutes and policies, and evaluation of how precisely the control operates |
| Process-level (transaction-level) controls | Specific risks of misstatement in a significant account or disclosure, tied to assertions | Three-way match on payables, review of revenue contract terms, account reconciliations, review of the allowance for credit losses, journal entry approval | Walkthrough, then test of design and operating effectiveness on a sample |
| IT general controls (ITGCs) | The systems that run process-level controls | Access to programs and data, program change management, program development, computer operations such as backup and job scheduling | Test that the system controls and reports a process-level control relies on are reliable |
Entity-level controls vary in how precisely they operate. PCAOB AS 2201 lists examples, including controls over management override, the risk assessment process, the period-end financial reporting process and controls to monitor results of operations. It requires the auditor to evaluate the control environment and the period-end financial reporting process. A strong entity-level control, such as a detailed monitoring review, can sometimes reduce the testing needed at the process level. Ineffective audit committee oversight of external financial reporting and ICFR is one of the indicators of a material weakness that AS 2201 lists.
IT general controls (general IT controls, or ITGCs) matter because they affect the reliability of almost everything else. An automated control, a system-generated report used in a review, and a calculation in a spreadsheet pulled from the ERP all depend on access, change management and operations being sound. The auditor tests ITGCs where the process-level controls rely on the systems. An ITGC deficiency does not always become a misstatement risk by itself. Its severity depends on what relies on the system and whether other controls would catch the error.
Information produced by the company that a control uses (a report, a listing, a data extract) must itself be complete and accurate for the control to work. Auditors ask for this under AS 1105. Teams call it information produced by the entity, or IPE. The worked example later in this guide turns on a failure of exactly this kind.
What does management have to do under SOX 302 and 404(a)?
Under Section 404(a), management of every public company that is past its first annual report must assess ICFR as of fiscal year-end and report its conclusion in the 10-K. Section 302 requires management to certify the quarterly and annual reports and to disclose any change in ICFR that materially affected, or is reasonably likely to materially affect, ICFR in the most recent quarter. The two work as a cycle: 302 each quarter, 404(a) each year.
The 404(a) report in Item 9A, required by Item 308(a) of Regulation S-K, must include:
- A statement that management is responsible for establishing and maintaining adequate ICFR.
- A statement identifying the framework used to evaluate effectiveness.
- Management's assessment of the effectiveness of ICFR as of the end of the most recent fiscal year, including disclosure of any material weaknesses. Management cannot conclude ICFR is effective if one or more material weaknesses exist at year-end.
- A statement that the registered public accounting firm has issued an attestation report on ICFR, if one is required.
SEC Release 33-8810 gives management interpretive guidance on how to perform the assessment. It is principles-based and scalable, and the steps follow a risk-based pattern:
- Plan and scope. Identify the financial reporting risks, meaning what could go wrong in the financial statements, and the significant accounts and disclosures. Include entity-level controls and fraud risk.
- Identify the controls that address those risks. Document each key control: who performs it, how often, what it covers, and how precisely it operates.
- Evaluate the evidence of operating effectiveness. Test or monitor the controls, with more evidence for higher-risk areas. Management can use ongoing monitoring, self-assessment, internal audit testing or direct testing.
- Evaluate deficiencies. Assess each deficiency alone and in combination.
- Conclude and report. Disclose any material weakness, and document the basis for the conclusion.
Acquired businesses can be excluded for up to a year. Under SEC staff FAQ guidance, management may exclude a recently acquired business from its assessment for no more than one year from the acquisition date and from no more than one annual management report, with disclosure that identifies the business and its significance to the consolidated financial statements.
The assessment must be supported by evidence that someone else could follow. Documentation is where many teams fall short in the first year, because a control can operate well and still fail the audit if nothing shows that it did. For the quarterly evidence side, see our quarter-end close checklist.
Who needs an auditor attestation under 404(b), and who is exempt?
The registered public accounting firm must attest to and report on ICFR under Section 404(b) for accelerated filers and large accelerated filers. Non-accelerated filers and emerging growth companies (EGCs) are exempt from 404(b), and a newly public company is exempt from both 404(a) and 404(b) in its first annual report. Every exempt company other than a new registrant still owes the 404(a) management assessment.
| Company | 404(a) management assessment | 404(b) auditor attestation |
|---|---|---|
| Large accelerated filer (public float of $700 million or more, with at least 12 months of reporting and one annual report filed) | Required | Required |
| Accelerated filer (public float of $75 million to under $700 million, not eligible as a smaller reporting company under the revenue test, with at least 12 months of reporting and one annual report filed) | Required | Required |
| Non-accelerated filer, including a smaller reporting company with under $100 million of annual revenue and under $700 million of float | Required | Not required (Section 404(c), added by Dodd-Frank Section 989G) |
| Emerging growth company | Required | Not required while it keeps EGC status (JOBS Act Section 103) |
| Newly public company, first annual report | Not required until the second annual report | Not required until the second annual report |
Three points trip up first-year teams.
Filer status is set each year. It is determined at fiscal year-end using public float as of the last business day of the second fiscal quarter and annual revenue. Moving down a category takes a lower threshold than moving up: for example, float below $60 million, or qualifying as a smaller reporting company under the revenue test, to leave accelerated filer status, and below $560 million of float to leave large accelerated filer status. Confirm your status before you plan the year's testing.
EGC status can end early. An EGC keeps the status until the earliest of the last day of the fiscal year following the fifth anniversary of its first registered sale of common equity, annual gross revenues of $1.235 billion or more, becoming a large accelerated filer, or issuing more than $1 billion of non-convertible debt in three years. Once it loses EGC status, the 404(b) exemption goes with it if it is also an accelerated or large accelerated filer.
The auditor's opinion is on ICFR itself. In an ICFR audit under PCAOB AS 2201, the auditor gives an opinion on the effectiveness of ICFR, in an integrated audit alongside the financial statement audit. If a material weakness exists at year-end, the auditor's opinion on ICFR is adverse, even if the financial statements are fairly stated. For how the auditor's overall responsibilities frame the work, see our post on PCAOB AS 1000 auditor responsibilities.
The SEC proposed in Release 33-11419 on May 19, 2026 to raise the large accelerated filer threshold from $700 million to $2 billion of float, to require at least 60 consecutive months of Exchange Act reporting and two consecutive years above the threshold before a company qualifies, and to eliminate the accelerated filer and smaller reporting company categories so that every other company is a non-accelerated filer. If adopted as proposed, only large accelerated filers would need 404(b). As of November 2, 2026 the proposal has not been adopted, so the thresholds in the table still apply.
What does a pre-IPO company need to know about ICFR?
A company preparing to go public does not have to give a management ICFR report or an auditor attestation in its first annual report, but it should have a working control environment well before then. Instruction 1 to Item 308 of Regulation S-K gives a newly public company a transition period, and its first 10-K can omit the management report and the auditor attestation. Management's report is required in the second annual report. The first 10-K must include a statement that it does not include management's report or an attestation report because of the transition period the SEC rules allow for newly public companies.
That transition does not mean the company can wait. Three things apply earlier.
Material weaknesses show up in the S-1. If the company or its auditor identifies a material weakness while preparing the registration statement, the company typically discloses it in a risk factor, along with the remediation plan. Investors and underwriters read that disclosure closely.
The 302 certification still applies, with a transition. The CEO and CFO certify the first periodic reports. Under SEC staff guidance, a newly public company may omit the ICFR-related language in the certification until the first annual report that includes management's report.
Section 13(b)(2) applies from registration. The books-and-records and internal accounting controls provisions of the Exchange Act apply to a registrant even before the 404 transition ends.
For most companies the practical work starts 12 to 24 months before the IPO: document key controls, fix the ITGCs, build the close process, and run a mock assessment. Our post on the S-1 and other registration statements covers the filing itself, and our IPO readiness page covers the broader workstream.
How do you classify a deficiency, a significant deficiency or a material weakness?
You classify a deficiency by how likely it is that a misstatement would not be prevented or detected on a timely basis, and how large that misstatement could be. The SEC definitions are in Exchange Act Rule 12b-2 and Rule 1-02(a)(4) of Regulation S-X, and PCAOB AS 2201 uses the same terms.
| Term | Definition (paraphrased from SEC and PCAOB sources) | Who hears about it |
|---|---|---|
| Control deficiency | A control's design or operation does not allow management or employees, in the normal course of performing their functions, to prevent or detect misstatements on a timely basis | Management, at the appropriate level |
| Significant deficiency | A deficiency, or combination of deficiencies, less severe than a material weakness yet important enough to merit attention by those responsible for oversight of financial reporting | Audit committee and the auditor (via the 302 certification) |
| Material weakness | A deficiency, or combination of deficiencies, such that there is a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis | Audit committee and auditor; disclosed publicly in the 10-K |
A design deficiency exists when a necessary control is missing or an existing control is not designed so that it would meet its objective even if it operated as designed. An operating deficiency exists when a well-designed control does not operate as designed, or the person performing it lacks the authority or competence to do so effectively.
"Reasonable possibility" has a specific meaning. It means the likelihood of the event is either reasonably possible or probable, using the ASC 450-20 terms. It is a lower bar than "more likely than not."
The evaluation follows a repeatable set of steps. Both management (per Release 33-8810) and the auditor (per AS 2201) use the same logic:
- Identify the deficiency and its type. Is it a design deficiency or an operating deficiency? Which account, assertion and COSO principle does it touch?
- Assess the likelihood. Is there a reasonable possibility that the control would fail to prevent or detect a misstatement? The question is about the possibility, not whether a misstatement actually occurred.
- Estimate the magnitude. How large a misstatement of the account or disclosure could reasonably possibly result from the deficiency? Base it on the potential misstatement, not on the error actually found, and compare it to materiality for both the annual and the interim financial statements.
- Consider the risk factors. The nature of the accounts affected, susceptibility to fraud, subjectivity and complexity of the estimates, how the control interacts with others, and possible future consequences.
- Aggregate related deficiencies. Deficiencies that affect the same account, disclosure, assertion or COSO component are evaluated in combination, because several smaller ones can add up to a material weakness.
- Test compensating controls. A compensating control counts only if it operates at a level of precision that would prevent or detect a misstatement that could be material, and only if testing shows it operated effectively, including as of the assessment date.
- Check the indicators of a material weakness. AS 2201 lists four: fraud by senior management, whether or not material; restatement of previously issued financial statements to correct a material misstatement; a material misstatement identified by the auditor in the current period that the company's ICFR would not have detected; and ineffective oversight of financial reporting and ICFR by the audit committee.
- Apply the prudent official test. Would a prudent official with knowledge of the facts conclude they have reasonable assurance that transactions are recorded as necessary to prepare GAAP financial statements? If not, AS 2201 treats that as an indicator of a material weakness, and the evaluation weighs it alongside likelihood and magnitude.
- Conclude, document and communicate. Record the reasoning, tell the audit committee and the auditor, and carry the result into the 404(a) conclusion and the 302 certifications.
Severity depends on what could happen, not on what did. A deficiency can be a material weakness even when no misstatement has occurred, and a small actual error does not reduce the severity of a control failure that could have allowed a large one.
What does a deficiency severity evaluation look like? A worked example
The example below is illustrative. The company, amounts and thresholds are invented to show the steps. Your own materiality, risk assessment and facts will differ, and the conclusion in a real case is a judgment made with your auditor.
The situation. Cedar Point Systems, Inc. is a calendar-year accelerated filer that is not an emerging growth company. For fiscal 2026 its pre-tax income is $48.0 million, and management uses 5% of pre-tax income, or $2.4 million, as materiality for evaluating deficiencies (illustrative). In March, an ERP update changed the logic of a custom accounts receivable aging report. Invoices with a status of "disputed" dropped out of the report. Here, "disputed" is the ERP status for invoices on a collections hold because the customer's ability to pay is in doubt, so the expected loss is a credit loss under ASC 326. Invoices contested over price, quantity or performance would instead be evaluated as variable consideration, including implicit price concessions, under ASC 606. That report feeds the quarterly calculation of the allowance for credit losses under ASC 326. Nobody tested the report after the update, and no control checked that it was complete and accurate. At December 31, the disputed invoices total $14.0 million. In the fourth-quarter close, an analyst notices the aging total is lower than the receivables control account. Management recalculates the allowance with the full population and books a $0.9 million increase before the 10-K is filed.
Step 1: Identify the deficiencies. There are two. First, there is no control over the completeness and accuracy of the aging report, a design deficiency in the control over information produced by the entity. Second, the report change went into production without testing or approval, an operating deficiency in the change management ITGC, because the documented change process was not followed (illustrative). Both affect the same account, the allowance for credit losses, and the same assertion, valuation. They are evaluated together. Management also has to determine what else the March ERP update changed. A change-management gap affects every report and automated control in that release, not only this one.
Step 2: Likelihood. The failure was not hypothetical. The report excluded disputed invoices every month from March through December. A reasonable possibility clearly exists that the allowance control would not prevent or detect a material misstatement, because the control relied on a report that was wrong.
Step 3: Magnitude. The omitted invoices total $14.0 million. Loss rates on disputed invoices have ranged from about 5% to 25% over the past five years (illustrative). At the top of that range, the allowance could have been understated by up to $3.5 million, which is more than materiality of $2.4 million. Management's recalculation at December 31, using current collection evidence on the disputed balances, produced the $0.9 million increase. That is the actual error. The deficiency is judged on the potential error, so the $0.9 million does not cap the severity.
Step 4: Compensating controls. This is where the conclusion turns. The table compares three versions of the facts.
| Scenario | Compensating control | Potential misstatement after considering it | Conclusion |
|---|---|---|---|
| A. No other control | None. The analyst's catch in Q4 was ad hoc and not a designed control | Up to $3.5 million, above $2.4 million materiality | Material weakness at December 31. The deficiency was found after year-end, so there was no time to remediate and test a fix before the assessment date |
| B. Independent monthly tie-out | The AR manager ties the aging total to the receivables control account every month, investigates differences above $100,000, and keeps the evidence. It operated all year | The March change would have surfaced at the April tie-out. Remaining exposure is below the $100,000 threshold per month | Likely a control deficiency rather than a significant deficiency, assuming management confirms no other report or automated control in the March release was affected and the auditor agrees. Fix the report and the change process, and report the finding to management |
| C. Tie-out exists but lapsed | The same tie-out, but its owner left in February and no one performed it from March through December | Up to $3.5 million for the months it did not operate | Material weakness. A compensating control that did not operate during the period does not count |
Step 5: Indicators and the prudent official test. The report was wrong from March onward, so the allowance in the filed first-, second- and third-quarter 10-Qs was understated too, against a lower interim materiality. In scenarios A and C, management evaluated the understatement in each filed 10-Q under ASC 250 and SAB 99 and concluded it was not material to any quarter (illustrative). No restatement or Item 4.02 filing is required, and the restatement indicator does not apply, although the 2026 comparative quarters presented in the 2027 10-Qs may need to be revised. Had a quarter been materially misstated, the restatement indicator and an Item 4.02 analysis would come into play, and the disclosure controls conclusions in the earlier 10-Qs would need to be revisited. There is no fraud, so the indicators do not force the answer. The conclusion rests on the magnitude and the missing control. A prudent official who knew that a report feeding the allowance had been wrong for ten months, with a potential understatement of up to $3.5 million, and that no control would have caught it, would not conclude that the allowance was reliably prepared.
Step 6: Conclude and communicate. In scenarios A and C, management cannot conclude that ICFR was effective as of December 31. The weakness was found in the post-year-end close, so the fixes (a corrected report, a completeness and accuracy control over it, and a tighter change process) can only be reported as remediation in a later period. Management tells the audit committee and the auditor, and Item 9A describes the weakness and the remediation. The CEO and CFO's Item 307 conclusion on disclosure controls as of December 31 will generally also be that they were not effective. Because the company is an accelerated filer that is not an emerging growth company and is past its first annual report, the auditor also issues an adverse opinion on ICFR in scenarios A and C.
What this example shows: the same facts produce three different answers depending on whether an independent control was designed, whether it operated for the full period, and whether it was precise enough. Teams that only count the $0.9 million they booked would have called scenario A a minor error.
How do you remediate a material weakness?
Remediation has four stages: find the root cause, fix the design, run the new control long enough to test it, and then conclude it works. Management owns the plan, the audit committee oversees it, and the auditor tests the result.
- Root cause. Why did the control fail? Common causes are missing technical accounting expertise, weak ITGCs, manual processes that do not scale, unclear ownership, or documentation that does not show what was reviewed. Fix the cause, not only the instance.
- Design the fix. Write the control description: owner, frequency, population, precision, evidence, and the data it relies on. Add the information-produced-by-the-entity check where a report or extract feeds the control.
- Implement and train. Put the control in the close calendar, assign a backup, and train the reviewers on what they are comparing and to what threshold.
- Operate, test and conclude. A new control has to operate for enough occurrences to be tested. Practice varies with the control's frequency, and the auditor decides what is sufficient. For example, an annual control may need one occurrence, a quarterly control often needs at least two, and a daily control needs a larger sample. Management then tests it and documents why the weakness no longer exists.
A material weakness is remediated for a given year-end only if the corrected control operated long enough before that date to be tested. If it was fixed in December and has had one occurrence, expect the weakness to remain in the year-end conclusion and be reported as remediated in a later quarter.
How do you disclose deficiencies and material weaknesses?
A material weakness must be disclosed publicly. Significant deficiencies and other deficiencies go to the audit committee and the auditor and are not required to be disclosed in the filing.
| Where | What is disclosed |
|---|---|
| Item 9A of the 10-K (Item 308 of Regulation S-K) | Management's conclusion on ICFR as of year-end, any material weaknesses identified, and the auditor's attestation report if 404(b) applies |
| Item 4 of the 10-Q (Item 308(c)) | Any change in ICFR during the quarter that materially affected, or is reasonably likely to materially affect, ICFR, including remediation steps |
| Section 302 certifications | CEO and CFO state they disclosed all significant deficiencies and material weaknesses to the auditors and the audit committee |
| Risk factors (Item 1A) | The material weakness, its effect on the reliability of reporting, and the remediation plan and its risks |
| Form 8-K Item 4.02 | Within four business days, if the board, a committee or an authorized officer concludes (or the auditor advises) that previously issued financial statements should no longer be relied on. A material weakness by itself does not trigger an 8-K |
Good disclosure of a material weakness is specific. It states the nature of the weakness, the account or process affected, the effect on the financial statements if known, the remediation actions taken and planned, and the expected timing. The SEC staff has commented on vague descriptions, on conclusions that disclosure controls were effective when a material weakness existed, and on disclosure that omitted management's own ICFR conclusion.
What changes for ICFR in 2026?
As of November 2, 2026, the statute and the 404(a) and 404(b) requirements are unchanged. Three 2026 developments matter. The SEC proposed new filer-status categories in Release 33-11419 on May 19, 2026, described above. On May 5, 2026, in Release 33-11414, it proposed letting companies elect semiannual reporting on a new Form 10-S instead of quarterly 10-Qs, which would change how often the 302 certification and the change-in-ICFR disclosure occur. Neither proposal had been adopted as of November 2, 2026. COSO released Achieving Effective Internal Control Over Generative AI in February 2026, applying the 2013 framework to generative AI. On the auditor side, the PCAOB's amendments on technology-assisted analysis (AS 1105 and AS 2301) apply to audits of fiscal years beginning on or after December 15, 2025, so 2026 integrated audits are the first under them.
We have not found a PCAOB standard written specifically for AI-assisted controls. The existing standards apply: a control that uses AI output still needs an owner, a defined precision, and evidence of review, and the auditor evaluates it under AS 2201 like any other control. Our SOX controls page covers AI-assisted controls and a worked documentation example.
What do Big 4 and primary sources say?
The primary sources set the rules, and the Big 4 publish the interpretive guidance most teams use day to day.
- Exchange Act Rules 13a-15 and 15d-15 define ICFR and disclosure controls, and Rule 12b-2 and Rule 1-02(a)(4) of Regulation S-X define significant deficiency and material weakness.
- Item 308 of Regulation S-K sets the content of management's report, the auditor attestation and the quarterly change disclosure. Item 307 covers disclosure controls.
- SEC Release 33-8810 is the Commission's interpretive guidance for management's ICFR assessment.
- PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, governs the auditor's work, including the severity indicators and the evaluation of compensating controls.
- COSO Internal Control-Integrated Framework (2013) is the framework. COSO's February 2026 publication applies it to generative AI.
- Deloitte publishes a guide for management on next steps after identifying a deficiency in ICFR on DART.
- PwC covers management's and the auditor's ICFR reports in the SEC Financial Reporting Manual, chapter 4300 on Viewpoint.
- KPMG publishes a Handbook on internal control over financial reporting on its Financial Reporting View site.
- EY publishes practical guidance on SOX readiness before an IPO.
Frequently asked questions
What is ICFR?
ICFR is the process a public company uses to give reasonable assurance that its financial reporting is reliable and its financial statements are prepared in accordance with GAAP. The definition is in Exchange Act Rules 13a-15(f) and 15d-15(f). Management assesses it each year against a framework such as COSO 2013, and reports the conclusion in Item 9A of the 10-K.
What is the difference between ICFR and disclosure controls and procedures?
Disclosure controls and procedures cover all the information a company must disclose in its SEC reports, financial and non-financial, and are evaluated every quarter. ICFR covers the reliability of the financial statements and is assessed by management annually, with changes disclosed each quarter. They overlap, and a material weakness in ICFR usually means disclosure controls were not effective either.
What are the 17 COSO principles?
The 17 principles sit under five components. Control environment has five (integrity and ethics, board oversight, structures and authority, competence, accountability). Risk assessment has four (objectives, risk identification and analysis, fraud risk, and significant change). Control activities has three (selecting controls, technology general controls, and policies and procedures). Information and communication has three, and monitoring has two.
What is the difference between entity-level controls, process-level controls and ITGCs?
Entity-level controls apply across the company, such as the code of conduct, audit committee oversight and the period-end financial reporting process. Process-level controls address specific risks in an account or transaction flow, such as account reconciliations and journal entry approval. ITGCs cover access, change management, development and operations for the systems that process-level controls depend on.
Who needs a SOX 404(b) auditor attestation?
Accelerated filers and large accelerated filers that are not emerging growth companies need a 404(b) attestation. Non-accelerated filers and emerging growth companies are exempt, and a newly public company is exempt in its first annual report. The SEC proposed changing the filer thresholds in May 2026, and the proposal had not been adopted as of November 2, 2026.
Are emerging growth companies exempt from SOX 404(b)?
Yes, while they keep emerging growth company status. The exemption comes from Section 103 of the JOBS Act. EGC status ends at the earliest of the last day of the fiscal year following the fifth anniversary of its first registered sale of common equity, annual gross revenues of $1.235 billion, becoming a large accelerated filer, or issuing more than $1 billion of non-convertible debt in three years. EGCs still owe the 404(a) management assessment once the new-registrant transition ends.
What is the difference between a significant deficiency and a material weakness?
A material weakness is a deficiency, or combination, with a reasonable possibility that a material misstatement of the annual or interim financial statements will not be prevented or detected on a timely basis. A significant deficiency is less severe but important enough to merit attention from those overseeing financial reporting. Material weaknesses are disclosed publicly, and significant deficiencies go to the audit committee and the auditor.
Does a pre-IPO company have to comply with SOX 404?
Not in the first annual report after the IPO. A newly public company can omit the management report and the auditor attestation until its second annual report. Section 13(b)(2) of the Exchange Act applies from registration, and a material weakness found during the S-1 process is typically disclosed as a risk factor, so most companies build the controls well before the IPO.
Can you disclose a material weakness and still file a clean 10-K?
You can file a 10-K, but management cannot conclude that ICFR is effective if a material weakness exists at year-end. The 10-K has to describe the weakness and the remediation. The financial statements can still carry an unqualified audit opinion if they are fairly stated, while an auditor attesting under 404(b) gives an adverse opinion on ICFR.
How long does it take to remediate a material weakness?
It depends on the root cause and on how often the control operates. A control fix can be designed in weeks, but the new control has to operate for enough occurrences to be tested, so many remediations span at least two to four quarters. The auditor decides what is sufficient for a given control.
How does Gaapio help with ICFR?
Gaapio is an AI-powered technical accounting platform built by CPAs. The technical accounting judgments that feed your controls, such as the memo documenting the credit loss methodology behind the allowance in the example above, are where it fits today. You give Gaapio your facts and it asks follow-up questions before drafting. It is grounded in the licensed FASB Codification, Big 4 guidance, and SEC filings and comment letters. Conclusions come with clickable citations so a reviewer can trace each one. See Gaapio accounting memos.
Gaapio's SOX Controls product is coming soon and is being designed for control documentation and testing workflows: documenting controls, assisting with testing workflows, and organizing documentation for auditor review. See the SOX controls page for what it is designed to do. Your team makes the control, testing and classification calls. Gaapio does not test your controls, conclude on your ICFR or file your 10-K.
Ready to see how it works on your next technical accounting memo? Request a demo.