SOX 404 and ICFR Readiness for Pre-IPO Companies

Weaknesses found late reach the prospectus

Once a company files to go public, its controls become a disclosure topic. If a material weakness is identified during the IPO process, the registration statement will typically need to describe it, along with the plan to fix it. Investors read that section.

After listing, the obligations arrive in sequence. The CEO and CFO sign Section 302 certifications with the first periodic report. Management's assessment of internal control over financial reporting under Section 404(a) generally begins with the second annual report. An emerging growth company is exempt from the auditor's attestation under Section 404(b) for as long as it keeps that status.

The work behind those signatures takes months, not weeks: scoping, documenting each process, fixing design gaps, and collecting test evidence over enough time to show the controls operate. Starting twelve to eighteen months before the target listing date leaves room to fix what the dry run finds.

Engraving of a tightrope walker between two buildings above a net woven from ledger paper, holding a magenta pole. — Weave the net before the walk.

Readiness covers scoping through dry run

Scoping and risk assessment
Significant accounts, disclosures and locations, selected using materiality and qualitative risk factors, with the relevant assertions for each.
Process and control documentation
Narratives or flowcharts for each in-scope process, and a risk and control matrix linking every risk to the control that addresses it.
Entity-level controls
Board and audit committee oversight, the code of conduct, the whistleblower channel, the fraud risk assessment and management's monitoring of controls.
IT general controls
Access, change management and operations for the systems that feed financial reporting, including the ERP, payroll and critical spreadsheets.
Key reports and spreadsheets
Completeness and accuracy of the system reports and end-user tools that controls depend on.
Remediation and dry-run testing
Design fixes for gaps, then walkthroughs and sample testing of key controls the way an auditor would approach them.

Evidence built for management's signature

Deliverable	What it is	When
Scoping memo	Significant accounts, processes, locations and systems in scope, with the materiality basis	Week 3
Process narratives and flowcharts	One per in-scope process, written so a new hire could follow each control step	Weeks 4 to 8
Risk and control matrix	Spreadsheet mapping each risk to controls, owners, frequency, evidence and key-control status	Week 8
Gap and remediation plan	Design gaps ranked by the likelihood of a deficiency, with owners and target dates	Week 9
Dry-run test results	Walkthrough and sample-test workpapers for key controls, with each exception and its cause	Weeks 12 to 15
Readiness readout	Audit committee briefing on status, open risks and the path to the first management assessment	Week 16

Sixteen weeks in five stages

Weeks 1 to 3
Scope
We agree materiality, select significant accounts and systems with management, and confirm the approach with your auditor if you want.
Weeks 3 to 8
Document
Walkthroughs with process owners produce the narratives and the risk and control matrix. IT general controls are documented in parallel.
Weeks 6 to 12
Remediate
Your team fixes design gaps with our support, such as new reviews, access changes, reconciliations and evidence standards.
Weeks 10 to 15
Dry run
We test key controls with samples drawn the way an auditor would draw them, and record each exception with its root cause.
Week 16
Hand over
We brief the audit committee, train control owners and hand over a testing calendar for the first year as a public company.

Commitments we ask of your team

Read-only access to the ERP and supporting systems, or exports we specify
Trial balances, prior audited financial statements and any auditor management letters
Process owners' time for walkthroughs, typically one to two hours per process
An executive sponsor, usually the CFO, with authority to assign remediation
IT or system administrators for access, change management and backup evidence
Your target listing date and any guidance from your auditor or underwriters

Is this the right fit?

A good fit

Venture-backed companies planning a listing within roughly 12 to 24 months
Private-equity portfolio companies preparing for an IPO or a sale to a public acquirer
Recently listed companies building toward management's first 404(a) assessment
Companies whose lenders or investors require SOX-style controls without a listing

Not the right fit

Companies that need an auditor's opinion on internal control; we never perform attest work
Organizations looking for a firm to run their SOX testing indefinitely; we build the program and transfer it to your team

Scoping decides the workload

Over-scoping costs more than it protects. A risk and control matrix with 400 controls is harder to run and test than one with 80 well-chosen key controls, and auditors do not reward volume. We scope from materiality and risk, then ask of every proposed control: if this failed, could a material misstatement go undetected? If the answer is no, it is not a key control, and it does not belong in the matrix as one.

Entity-level controls carry weight

The COSO framework, and the auditors who apply it, start with the control environment: board oversight, the code of conduct, the whistleblower channel, the fraud risk assessment and how management monitors its own controls. At a private company these are often the least documented. We build them early, because they are hard to evidence after the fact. If no fraud risk assessment exists, our fraud risk assessment addresses COSO principle 8, which asks the company to consider the potential for fraud when it assesses risk.

IT general controls need early attention

Automated controls and system reports are only reliable if access to the system is restricted and changes to it are controlled. At a company that grew on NetSuite or Sage Intacct with three administrators and no change log, IT general controls are the slowest fixes, so we document them in the first weeks. Where access needs a deeper redesign, the segregation of duties project handles it alongside readiness.

Spreadsheets behind entries need controls

A revenue waterfall, a commission calculation or a reserve model is a control in its own right when a journal entry depends on it. We list each one, record who can change it, and add a review step that checks inputs and formulas, not only the total. A locked, versioned file with a named reviewer and a dated sign-off is usually enough at this stage.

Close automation belongs in scope

If an AI tool drafts reconciliations or codes invoices, the control that reviews its output becomes the key control, and the tool's access belongs in IT general control scope. COSO's 2026 guidance on internal control over generative AI is a useful reference for documenting both. The internal controls checklist for growing companies is a quick way to see which basics are already in place before scoping begins.

What people ask before hiring us

Will our auditor rely on your testing?

Your auditor decides. We are not your auditor and do not perform attest work. We document scoping, controls and testing in the form auditors expect, and we suggest sharing the risk and control matrix with your auditor early so you can agree the approach.

Does the SEC's May 2026 filer-status proposal change the plan?

It could change the auditor attestation, not the management assessment. The proposal would raise the large-accelerated-filer threshold to $2 billion in public float and treat other companies as non-accelerated filers without a 404(b) attestation. As of November 2026 it is not final, and management's 404(a) assessment would remain either way.

What is the difference between SOX readiness and ICFR?

Internal control over financial reporting is the set of controls itself. SOX readiness is the work of getting those controls documented, operating and evidenced before the law requires management, and for larger companies the auditor, to report on them.

Can we do this without new software?

Yes. Spreadsheets work for most companies at this stage. If you already use a GRC or close tool, we document controls inside it. We do not sell software or accept referral fees from vendors.

Also in Financial Process & Controls

Design, test and repair the controls over how money moves through your company, sized for a small finance team and checked against the ledger rather than a questionnaire.

Controls Health Check
A three-to-four-week diagnostic of your core money flows that ranks every control gap by consequence and hands you a fix list your team can act on.
Segregation of Duties & Approval Design
A six-to-eight-week project that maps every user's access against their duties, removes conflicting rights, redesigns the approval matrix and adds compensating controls where the team is too small to split.

Tell us what you are seeing

A first conversation is a scoping call: what worries you, what you need to show, and to whom. You leave it with a view on where to start, whether or not you hire us.

Start a conversation

Writehello@financeethics.com

Call(307) 365-5252

Office7124 Commons Dr, Cheyenne, WY 82009

HoursMonday to Friday, 9:00 to 17:00 Mountain Time

Be ready for 404 before you list

Weaknesses found late reach the prospectus

Readiness covers scoping through dry run

Scoping and risk assessment

Process and control documentation

Entity-level controls

IT general controls

Key reports and spreadsheets

Remediation and dry-run testing

Evidence built for management's signature

Sixteen weeks in five stages

Scope

Document

Remediate

Dry run

Hand over

Commitments we ask of your team

Is this the right fit?

A good fit

Not the right fit

Scoping decides the workload

Entity-level controls carry weight

IT general controls need early attention

Spreadsheets behind entries need controls

Close automation belongs in scope

What people ask before hiring us

Also in Financial Process & Controls

Controls Health Check

Segregation of Duties & Approval Design

Related work and reading

Services

Articles and scenarios

Sectors

Tell us what you are seeing