The most significant overhaul of the U.S. filer status framework in two decades. If finalized, roughly half of currently-attested issuers would move out of the SOX 404(b) auditor attestation regime. Audit committees now own a governance decision they have never had to make before.
AT A GLANCE
On May 19, 2026, the SEC proposed sweeping amendments to the public company filer status framework. The threshold for Large Accelerated Filer (LAF) status would rise from $700 million to $2 billion in public float and the filer status would be collapsed into two principal buckets. Per the SEC’s own Fact Sheet, only 19.2% of current reporting companies would qualify as LAFs (down from 35.4% today), and 80.8% would become Non-Accelerated Filers — exempt from the SOX 404(b) auditor attestation on internal control over financial reporting. Comments are due by July 20, 2026.
The Proposal in Plain English
On May 19, 2026, the U.S. Securities and Exchange Commission issued two companion proposals — Registered Offering Reform and Enhancement of Emerging Growth Company Accommodations and Simplification of Filer Status for Reporting Companies. Together, they represent the most consequential rethinking of the U.S. public company reporting framework since the JOBS Act of 2012.
The filer status proposal would collapse today’s five overlapping categories (Large Accelerated Filer, Accelerated Filer, Non-Accelerated Filer, Smaller Reporting Company, Emerging Growth Company) into two principal buckets — Large Accelerated Filers (LAFs) and Non-Accelerated Filers (NAFs) — with a new sub-category of Small Non-Accelerated Filers (SNFs) for the very smallest issuers.
The accounting and reporting consequences are not subtle. By the SEC’s own analysis, the proposal would move approximately half of currently-attested issuers out of the SOX 404(b) auditor attestation regime, and create a mandatory five-year IPO on-ramp during which no newly public company would qualify as an LAF — regardless of public float. For every controller, audit committee chair, and general counsel of a U.S. public company, the question is no longer whether the framework will change but how to prepare for when it does.
It is important to note that the proposal excludes or does not apply to several categories of issuers such as asset-backed issuers, registered investment companies and foreign private issuers (FPIs).
The Numbers That Matter
Three data points tell the story:
| Metric | Today | Under Proposal |
|---|---|---|
| LAF threshold (public float) | $700 million | $2 billion |
| Share of reporting companies classified as LAFs | 35.4% | 19.2% |
| Share of reporting companies classified as AFs | 12.7% | N/A — category eliminated |
| Share of reporting companies classified as NAFs | 51.9% | 80.8% |
| Share classified as Small Non-Accelerated Filers (sub-category of NAF) | N/A — category did not exist | 17.9% |
| LAF seasoning requirement | 12 months as Exchange Act registrant | 60 months (five years) |
| LAF measurement methodology | Single-day Q2 snapshot | 10-day Q2 trailing average, two consecutive years |
| LAF share of total market public float | ~98.8% | ~93.5% |
Source: SEC Release No. 33-11419 and SEC Fact Sheet (May 19, 2026). Percentages based on 5,976 domestic-form registrants in calendar year 2024.
Why LAF coverage of market float drops only modestly — from 98.8% to 93.5%
The current $700 million LAF threshold — unchanged since 2005 — has drifted well beyond its original calibration as equity markets grew, and today captures 98.8% of total market public float. The SEC is proposing to raise the threshold to $2 billion in part to reestablish the original relationship, which the Commission estimated at roughly 95% when the LAF status was adopted. At $2 billion, approximately 93.5% of total market public float would remain subject to LAF requirements — a five-percentage-point reduction. The proposal is calibrated to retain comprehensive disclosure for the issuers that genuinely move markets, while reducing the compliance burden on the long tail of smaller companies.
What Changes for NAFs — and What Does Not
This is where careful drafting matters. The SOX 404(b) auditor attestation is the headline change, but a great deal of the control architecture survives unchanged.
What Goes Away for NAFs
The SOX 404(b) auditor attestation is the headline change under the SEC’s May proposal, but a number of other disclosure obligations are also scaled back for companies reclassified to NAF status:
| Item | Current LAF / AF Treatment | Proposed NAF Treatment |
|---|---|---|
| SOX 404(b) auditor attestation on ICFR | Required annually | Not required |
| Audited financial statements in 10-K | Three years | Two years (Article 8 of Reg S-X) |
| MD&A period-to-period comparison (Item 303) | Three years | Two years |
| Risk factor disclosure (Item 105) | Required | Not required |
| Quantitative & qualitative market risk (Item 305) | Required | Not required |
| Performance graph (Item 201(e)) | Required | Not required (except investment companies) |
| Executive compensation disclosure | 5 NEOs, full CD&A, pay ratio, pay-vs-performance | 3 NEOs, no CD&A, no pay ratio, no pay-vs-performance |
| IPO financial statements (S-1) | Three years | Two years |
What Does Not Change
It is critical for audit committees and finance leaders to understand what the proposal does not touch. Companies reclassified as NAFs would continue to be subject to:
- SOX Section 404(a) — management’s annual assessment of the effectiveness of ICFR remains mandatory for every reporting issuer.
- SOX Sections 302 and 906 — CEO and CFO certifications regarding the accuracy of financial statements, the effectiveness of disclosure controls and procedures (DC&P), and the design of ICFR remain unchanged.
- The financial statement audit — although no separate attestation will be required if 404(b) is no longer required, the independent auditor must still perform certain procedures over the company’s ICFR.
- Material weakness disclosure — Item 9A of Form 10-K and comparable Form 10-Q items continue to require disclosure of control deficiencies that rise to the level of a material weakness.
- Disclosure controls and procedures — quarterly/semi-annual evaluation and certification obligations are unaffected.
- Substantive SOX obligations — the obligation to design, operate, document, and maintain ICFR is unchanged.
Uniqus View
The proposal removes the external auditor’s independent opinion on management’s assessment — it does not remove the assessment itself. Companies that interpret this as ‘SOX is over’ will create the next generation of material weakness restatements. The diligence required of management actually increases when the auditor backstop is removed.
What 404(b) Removal Means in Practice
For companies reclassified as Non-Accelerated Filers, the removal of Section 404(b) represents a structural shift in how ICFR accountability is distributed — between the auditor and management, and between external validation and internal rigor. Understanding the practical consequences across three dimensions helps companies prepare rather than react.
The Auditor’s Role Narrows
Under the current integrated audit model, the external auditor concurrently performs two engagements: a financial statement audit and an ICFR attestation under PCAOB AS 2201. The two are mutually reinforcing — control testing performed for 404(b) purposes informs risk assessments, scoping decisions, and substantive procedures across both opinions.
When 404(b) is removed, the auditor continues to perform the financial statement audit and must still consider ICFR as part of that engagement. What disappears is the separate attestation opinion on management’s assessment. Practically:
- Walkthroughs and control tests performed primarily to support the 404(b) opinion — rather than to reduce substantive audit risk — will no longer be required. This is the principal driver of the fee reduction.
- The auditor’s obligation to communicate identified control deficiencies to the audit committee continues under PCAOB auditing standards. The auditor backstop for surfacing deficiencies does not disappear entirely; it narrows in scope and depth.
- For companies with complex IT environments, significant manual controls, or recent acquisitions, the auditor’s ICFR consideration under the financial statement audit may remain more extensive than the minimal floor — particularly where control reliance is used to reduce substantive testing.
Cost Expectations
Companies should plan for a meaningful reduction in external audit fees when the 404(b) obligation is removed, though the precise saving will vary with company complexity, auditor approach, and the degree to which current 404(b) testing drives substantive audit scoping. The most current and directly relevant evidence comes from a 2025 GAO study:
| GAO-25-107500 (2025) Source | |
|---|---|
| Key Finding | Implication |
| +$219K median fee increase in trigger year (+13%) | The trigger-year jump is the best available proxy for the 404(b) attestation premium — and therefore the best estimate of savings when the requirement goes away. |
Source: U.S. Government Accountability Office, GAO-25-107500, “Sarbanes-Oxley Act: Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones” (June 2025). Nongeneralizable sample of 96 companies, FY 2019–2023
Internal SOX program costs — headcount, tooling, third-party readiness support — are unlikely to reduce at the same rate as the external audit fee saving, particularly if management commits to maintaining a credible 404(a) assessment. In many cases, targeted investment in the internal programs should increase to compensate for the narrowing of the auditor’s concurrent work. Finance leaders should model both sides: gross audit fee savings offset by incremental internal investment to determine the realistic net benefit.
The Governance Responsibility Transfers to Management
The most consequential shift is not financial — it is the transfer of ICFR accountability from a dual-responsibility model (management and auditor) to a management-only model. Under 404(b), the auditor’s independent re-performance serves as a second line of defense against inaccurate ICFR disclosures. Research demonstrates that exempt companies are materially more likely to misreport the status of their internal controls — not because management is dishonest, but because the audit process surfaces issues that internal review does not catch.
Once that independent backstop is removed, the quality of the management assessment depends entirely on the design and discipline of the internal process. Audit committees should specifically challenge whether control descriptions are specific enough to be testable by a third party, whether population testing is genuinely independent of management-prepared evidence, and whether management review controls are documented at a level that would withstand SEC scrutiny without the auditor’s concurrent work papers. These are standards that 404(b) attestation has historically enforced externally. Without it, they must be enforced internally.
The governance bottom line
Removing 404(b) does not reduce the obligation to have effective internal controls — it removes the external auditor’s verification. That distinction is the entire governance challenge the proposal creates.
Proposed Transition Period
The proposal includes a specific transition mechanism for existing registrants. Once the final amendments become effective, each registrant would be required to make an initial filer status determination — assessing whether it qualifies as an LAF or NAF based on its public float for the fiscal year prior to the effective date and the immediately preceding fiscal year. Registrants may make this determination at any point after the effective date, but no later than the day before the last day of the fiscal year in which the amendments take effect.
Critically, for current LAFs and AFs with public float below $2 billion, reclassification is not automatic upon rule adoption. A current LAF that qualifies as an NAF under the new threshold may make its initial determination immediately after the rules take effect and begin using NAF accommodations — including scaled disclosure and the removal of the 404(b) attestation requirement — in its very next Securities Act or Exchange Act filing. For example, if the rules become effective in 2027, a calendar year-end LAF with public float below $2 billion could complete its status assessment after Q2 2027 and, from that point, apply NAF accommodations going forward.
If a current LAF fails to make the initial determination by the deadline, it retains LAF status until its next regular annual assessment date. All other registrants that miss the deadline would be treated as NAFs (but not SNFs) until their next assessment.
A Decision Framework for Audit Committees
If the proposal is finalized substantially as drafted, every company in the $700 million to $2 billion public-float band — and every newly public company — will face the same question: should we maintain a voluntary SOX 404(b) attestation, or scale back?
The answer is not obvious, and it varies from company to company. We propose a six-factor decision framework that audit committees should deliberate on, along with discussions with both securities counsel and auditors.
| Factor | Push to retain voluntary 404(b) | Push to scale back |
|---|---|---|
| 1. Investor base and governance ratings | Significant institutional ownership, particularly from index funds or governance-focused investors who routinely engage on financial reporting quality | Predominantly retail or growth-focused shareholder base with limited governance engagement; no active proxy advisor scrutiny of ICFR disclosures |
| 2. Historical ICFR track record | Prior material weaknesses, significant deficiencies, or restatements within five years | Clean ICFR opinions for three or more consecutive years |
| 3. Control environment stability | Recent CFO, Controller, or Chief Accounting Officer departure; in-progress ERP migration or major system implementation; significant business model or organizational restructuring in the past 24 months | Stable finance leadership for three or more years; settled, single-ERP environment; no significant operational or system changes underway |
| 4. Internal audit and audit committee capacity | Thin or newly established internal audit function; audit committee without a member with deep ICFR or financial reporting expertise; limited prior experience running a standalone 404(a) assessment without auditor co-testing | Mature, well-resourced internal audit function with dedicated SOX expertise; audit committee with an experienced financial expert who actively oversees ICFR program design |
| 5. Contractual and lender obligations | Private credit facilities, bond indentures, or material commercial agreements that reference ICFR attestation or external audit scope; lender or rating agency expectations that have historically been tied to attestation-level assurance | No contractual provisions referencing 404(b) or external attestation scope; credit facilities and commercial agreements that are silent on ICFR attestation standard |
| 6. Complexity of ICFR environment | Complex revenue recognition, multi-ERP landscape, significant AI-enabled or automated processes in the close cycle, or high-judgment estimates where independent re-performance adds demonstrable value | Stable, mature, low-judgment financial reporting environment with a well-documented and consistently applied control framework |
Two factors deserve particular attention.
Companies that have introduced agentic AI into close, reconciliation, journal entry, or revenue recognition processes are operating in a control environment that did not exist when SOX was enacted. COSO’s 2026 GenAI supplement is on the horizon. For these companies, retaining a voluntary attestation may be prudent governance hygiene — at least until the AI control framework has been independently validated.
The AI overlay
Companies that have introduced agentic AI into close, reconciliation, journal entry, or revenue recognition processes are operating in a control environment that did not exist when SOX was enacted. COSO’s 2026 GenAI supplement is on the horizon. For these companies, retaining a voluntary attestation may be prudent governance hygiene — at least until the AI control framework has been independently validated.
The restatement tail
Empirical evidence from the 2010 Dodd-Frank exemption for non-accelerated filers, and subsequent academic research, consistently shows higher rates of restatement and undisclosed material weaknesses at non-attested companies. The pattern is not subtle. Audit committees should assume that investor and lender scrutiny of NAF management assessments will intensify in the years following any final rule.
Practical Steps for the Next 90 Days
While the rule remains in proposal form, finance leaders should not wait for adoption to begin the analysis. The comment period closes July 20, 2026. Adoption, if it occurs, could become effective for fiscal years ending on or after a date in 2027.
Step 1
Determine your projected status
Calculate your 10-day trailing average public float at the end of the most recent two fiscal quarters. Identify whether you would be an LAF, NAF, or SNF under the proposed framework. For companies near the $2 billion threshold, model sensitivity to share price movement.
Step 2
Run the decision framework
Convene a working session of the CFO, Controller, Chief Audit Executive, General Counsel, and Audit Committee Chair. Work through the six factors above. Document the analysis. This should become a board-level conversation in Q3 or Q4 2026.
Step 3
Stress-test your 404(a) program
Assume the auditor attestation goes away. Is your management assessment defensible standing alone? Are the control descriptions specific enough? Is the population testing IPE-controlled? Are management review controls (MRCs) documented at a level that would survive an SEC enforcement inquiry without the auditor’s concurrent work papers? PCAOB inspection findings over the past three years are a usable benchmark for the level of rigor external investors will expect.
Step 4
Recalibrate IPO readiness roadmaps
For pre-IPO companies, the five-year on-ramp materially changes the costs and sequencing of public-company readiness. The shift is not ‘less SOX’ — it is ‘differently sequenced SOX.’ Companies should still build credible 404(a) programs before Day 1, but the auditor attestation budget can be deferred, and the program can mature over the on-ramp period. Build the roadmap on the five-year horizon, not the historical 18-month horizon.
Step 5
Engage with the comment process
Companies in industries with concentrated views — financial services, life sciences, technology, energy — should consider submitting comment letters individually or through trade associations. The SEC has explicitly invited comments on whether additional NAF or SNF accommodations are appropriate, and whether the $2 billion threshold strikes the right balance.
Looking Ahead
We expect three structural shifts in the U.S. ICFR governance ecosystem if the proposal is finalized substantially as drafted.
1
First, the rise of voluntary attestation as a market signal
Companies that voluntarily maintain 404(b) attestation will use it as a differentiator in capital raises, M&A, and governance ratings. Expect proxy advisors and governance rating agencies to begin tracking ‘voluntary 404(b)’ as a discrete data point within the next 24 months.
2
Second, the bifurcation of the SOX advisory market
The current model — heavy reliance on audit firms for both attestation and adjacent advisory — comes under structural pressure when roughly half of attestation engagements disappear. Independent, audit-conflict-free advisory becomes the natural fit for the management-assessment universe. This is a structural tailwind for firms not encumbered by audit independence constraints.
3
Third, the AI-enabled management assessment becomes the new default
Without an auditor’s independent re-performance, management’s documentation, evidence capture, and population testing must stand on their own. Agentic AI tooling for control operation, evidence preservation, and population testing moves from ‘nice to have’ to ‘governance hygiene.’ The COSO 2026 GenAI supplement will arrive in a market that has already begun this transition.
We believe
The May 19 proposal is not a deregulatory windfall. It is a redistribution of governance responsibility — from the auditor to management, from the standards-setter to the audit committee, from universal external validation to risk-tiered internal rigor. For companies that prepare, this is an opportunity to build a better ICFR program. For companies that interpret it as permission to disinvest, the next material weakness disclosure is already on the runway.
How Uniqus Can Help
SOX 404(b) Decision Support
Apply our six-factor decision framework with your Audit Committee. Assess cost savings, governance trade-offs, and implications for investors and lenders. Deliver a board-ready recommendation memo.
404(a) Management Assessment Build-Out
Stress-test your management assessment against a world without auditor attestation. Strengthen MRC documentation, IPE controls, evidence capture, and population testing to investor-defensible standards.
IPO Readiness on the 5-Year On-Ramp
Re-sequence your IPO readiness roadmap to the new five-year NAF window. Build a 404(a)-credible program for Day 1; mature toward LAF readiness across years 1–5; preserve voluntary 404(b) optionality throughout.
AI-Enabled Controls Testing
Deploy agentic testing for control operation, evidence preservation, and population coverage. Build the documentation trail that lets management stand alone—and a roadmap aligned with the COSO 2026 GenAI supplement.
Sources & References
- SEC, Release No. 33-11419, “Enhancing the Public Company Reporting Framework” (May 19, 2026).
- SEC Fact Sheet, “Enhancing the Public Company Reporting Framework” (May 19, 2026). Percentages based on 5,976 domestic-form registrants, calendar year 2024.
- SEC, Release No. 33-11418, “Registered Offering Reform” (May 19, 2026).
- U.S. Government Accountability Office, “Sarbanes-Oxley Act: Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones,” GAO-25-107500 (June 2025).
- PCAOB, Auditing Standard No. 2201, “An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements” (2007, as amended).
