SECURITIES COMPLIANCE | 2026-09-29
Sarbanes-Oxley Section 404: Internal Control Over Financial Reporting for California Public Companies
SOX made management — and, for larger companies, the outside auditor — formally accountable for the controls behind a company’s financial statements. Section 404 is where that accountability lives.
The Sarbanes-Oxley Act of 2002 (SOX) was enacted after a wave of accounting scandals to restore confidence in public-company financial reporting. Its most consequential operational requirement is Section 404, which requires management to assess, and (for larger companies) the outside auditor to atte
Sarbanes-Oxley changed how public companies are held accountable for their numbers. At its center is Section 404 — the requirement to assess and report on internal control over financial reporting.
Why SOX Exists
Congress passed the Sarbanes-Oxley Act in 2002 in response to major accounting frauds. SOX imposed new duties on public companies, executives, auditors, and audit committees, created the PCAOB to oversee auditors, and — through Sections 302 and 404 — made management directly accountable for the accuracy of financial reporting and the controls behind it.
Section 404(a) — Management’s Assessment
Section 404(a) requires management to establish and maintain internal control over financial reporting (ICFR) and to include in the annual report management’s assessment of the effectiveness of that control as of the fiscal year-end. Management must identify the framework used (commonly the COSO framework) and disclose any material weaknesses. A material weakness — a deficiency such that there is a reasonable possibility that a material misstatement will not be prevented or detected — means ICFR cannot be concluded to be effective.
Section 404(b) — Auditor Attestation
Section 404(b) requires the company’s independent auditor to attest to, and report on, the effectiveness of the company’s ICFR — an independent check on management’s assessment. This auditor attestation applies to larger companies; smaller reporting companies and non-accelerated filers (and, under later reforms, certain low-revenue filers) have been exempted from the 404(b) auditor-attestation requirement, though they remain subject to 404(a) management assessment.
Section 302 — The Certifications
Related to 404, Section 302 requires the CEO and CFO to certify in each periodic report that they have reviewed it, that it does not contain material misstatements or omissions, that the financial statements fairly present the company’s condition, and that they are responsible for and have evaluated the disclosure controls and internal controls. These personal certifications put the signing officers on the line for the report’s accuracy.
Consequences of Control Failures
A disclosed material weakness can affect investor confidence, the stock price, and the company’s access to capital, and it must be remediated and disclosed. Beyond disclosure, control failures can contribute to restatements (which can trigger clawbacks) and to enforcement or litigation exposure where they reflect deeper reporting problems. Sound ICFR is therefore both a compliance requirement and a risk-management safeguard.
Frequently Asked Questions
What is SOX Section 404?
The requirement that management assess (404(a)) — and, for larger companies, the auditor attest to (404(b)) — the effectiveness of internal control over financial reporting in the annual report.
What is a material weakness?
A control deficiency creating a reasonable possibility that a material misstatement will not be prevented or detected; its existence means ICFR is not effective.
Do small companies need the auditor attestation?
Smaller reporting companies and non-accelerated filers (and certain low-revenue filers) are generally exempt from the 404(b) auditor attestation but still must provide the 404(a) management assessment.
What does Section 302 require?
CEO/CFO certifications in each periodic report as to its accuracy and the company’s disclosure and internal controls.
Related Securities & Governance Guides
Talk to a Securities Attorney About SOX Compliance
If your California public company must comply with Section 404 — or is dealing with a control deficiency — the requirements and disclosures are specific. Trembach Law Firm advises on Sarbanes-Oxley compliance. Call (818) 514-7680.
Contact Trembach Law Firm at (818) 514-7680 for a confidential consultation.
Trembach Law Firm | 27001 Agoura Road, Suite 350, Calabasas, CA 91301