Skip to main content

Sarbanes-Oxley Section 404
A Guide for Small Business

July 14, 2017

For 2007 annual reports, smaller public companies need to assess their internal control over financial reporting.

It doesn't have to be a chore.


Section 404 of the Sarbanes-Oxley Act requires public companies' annual reports to include the company's own assessment of internal control over financial reporting, and an auditor's attestation. Since the law was enacted, however, both requirements have been postponed for smaller public companies. The requirement of an auditor's attestation won't apply to most smaller public companies until their 2008 annual reports. The 2007 annual report will be the first year that the management assessment will need to be included.

This brochure is designed to help make the first time easier.

In June 2007, the SEC issued interpretive guidance to help companies assess their internal controls. This guidance was developed specifically with smaller companies in mind. The guidance is voluntary. You can find it, along with other information summarized in this brochure, on the Commission's website at We strongly encourage you to review this information.

Return to Top