Sarbanes-Oxley Act Section 404 — Internal Control Over Financial Reporting Assessment and Attestation

What it is

The statute itself, 15 U.S.C. §7262 (Sarbanes-Oxley Act §404), states: "(a) Rules required — The Commission shall prescribe rules requiring each annual report required by section 78m(a) or 78o(d) of this title to contain an internal control report, which shall — (1) state the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and (2) contain an assessment... of the effectiveness of the internal control structure and procedures of the issuer for financial reporting."

Subsection (b) adds the independent-auditor side: "each registered public accounting firm that prepares or issues the audit report for the issuer, other than an issuer that is an emerging growth company..., shall attest to, and report on, the assessment made by the management of the issuer. An attestation made under this subsection shall be made in accordance with standards for attestation engagements issued or adopted by the Board." The output is an attestation report attached to the issuer's annual report (10-K) and filed with the SEC — not a certificate.

The term "ITGC" (information technology general controls) does not appear anywhere in the statute's text. It is a term the audit profession uses for a category of controls tested inside the broader §404(b) engagement under PCAOB Auditing Standard AS 2201 ("An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements") — it is not itself a separately named legal audit type.

Who owns it

The statutory requirement is set by Congress (15 U.S.C. §7262) and administered by the U.S. Securities and Exchange Commission. The attestation standard applied by auditors, AS 2201, is issued by the Public Company Accounting Oversight Board (PCAOB), the body the statute refers to as "the Board".

Who assesses it

The statute names who performs the attestation: "each registered public accounting firm that prepares or issues the audit report for the issuer... shall attest to, and report on, the assessment made by the management of the issuer" (15 U.S.C. §7262(b)) — an independent auditor registered with the PCAOB, not the issuer itself.

Who asks for it

Statutory (scoped). The statute applies only to issuers filing periodic reports under Exchange Act §13(a) or §15(d); the independent-auditor attestation in subsection (b) does not apply to issuers that are neither an "accelerated filer" nor a "large accelerated filer", nor to emerging growth companies. Smaller/newly public issuers still perform the management assessment under §404(a); only the outside attestation under §404(b) is exempt.

The obligation runs directly from the statute, not from a buyer or a scheme: the independent auditor's attestation is a legal duty under 15 U.S.C. §7262(b). The resulting report becomes part of the issuer's annual report (10-K), which is filed with the SEC and made public on EDGAR — reaching investors through that public filing chain, which is consistent with the statute's own title, the "Corporate and Auditing Accountability, Responsibility, and Transparency Act."