What it means
The section grew out of the accounting scandals of the early 2000s, on the view that reliable numbers depend on the plumbing behind them. Rather than only auditing the final figures, the law asks whether the processes that produce those figures are designed properly and followed consistently.
Compliance splits into two parts that are often confused. Section 404(a) is management's own assessment, which every listed company must produce; Section 404(b) is the auditor's separate attestation, which applies to larger filers and is much the more expensive half.
The work starts with scoping, and scoping starts with materiality. Teams identify the accounts and disclosures large enough to matter, trace them back to the processes and systems that feed them, then document the controls in those processes, from bank reconciliations to who is allowed to approve a journal entry.
Technology controls sit alongside these, covering who can change a system setting and who has access to the ledger. Testing follows documentation: a sample of each control is examined for evidence that it operated as described throughout the year.
Failures are graded as deficiencies, significant deficiencies or material weaknesses, and only the last must be disclosed publicly, which tends to hit the share price and prompt awkward questions from lenders. The standing complaint is cost, and it is a fair one, particularly in the first year after a company lists.
The offsetting benefit is that a business able to prove its controls usually closes its books faster and meets fewer surprises, so the discipline earns back part of the expense.
In practice
Real-world examples.
Example
A newly listed technology company spends its first compliance year mapping 240 controls across order-to-cash, procure-to-pay and financial close. The exercise reveals that three people can both create a supplier and approve payments to it, a segregation issue fixed before testing begins.
Example
An auditor selects 25 monthly bank reconciliations for testing and finds that four were completed after the accounts had already been reported. The control is judged ineffective in operation even though it was well designed.
Example
A retail group discloses a material weakness in its revenue recognition controls in its annual report. Its shares fall 9% and its bank asks for monthly rather than quarterly covenant certificates until the weakness is remediated. The remediation plan runs for three quarters and is reported to the audit committee at every meeting.
Think of it
“Section 404 is the SOX requirement for internal control assessment-controls testing mandate.
Formula
Calculation
Overall materiality = Benchmark figure x percentage, commonly 5% of pre-tax income. Performance materiality = Overall materiality x a reduction factor, commonly 50% to 75%.
A listed manufacturer reports pre-tax income of $40,000,000. Applying a 5% benchmark gives overall materiality of 40,000,000 x 0.05 = $2,000,000. Setting performance materiality at 75% of that figure gives 2,000,000 x 0.75 = $1,500,000, which becomes the practical scoping line. An inventory balance of $9,000,000 sits well above that line and is clearly in scope for documentation and testing, while a prepayment balance of $600,000 falls below it and can be excluded unless it carries a specific risk such as a history of errors.Case study
Seen in the real world.
Ravensmoor Components is an invented manufacturer described here for illustration. Two years after listing, it had passed its first Section 404 cycle by working weekends and pulling three people out of the reporting team for four months.
Reviewing the effort, the finance director noticed that most of the strain came from evidence rather than from the controls themselves. Managers were performing reviews properly but leaving no record, so testers had to reconstruct after the fact what had happened months earlier.
In this fictional example, the company invested in workflow tools that captured approvals automatically as work was done. The second year cost roughly 35% less in external fees and, more usefully, the monthly close shortened from eleven working days to seven because errors were being caught as they arose.
Watch out
Common mistakes.
- Treating Section 404 as an audit requirement rather than a management obligation, when the assessment and the evidence behind it belong to the company.
- Documenting controls that describe how the process is supposed to work instead of how it actually works, which guarantees testing failures.
- Confusing a control deficiency with a material weakness, and either over-disclosing minor issues or failing to escalate serious ones.
Questions
People also ask.
Does Section 404 apply to private companies?
Not directly, though private businesses preparing to list, or those owned by listed groups, often adopt the same discipline well in advance.
What is the difference between a significant deficiency and a material weakness?
A material weakness creates a reasonable possibility that a material misstatement would not be prevented or detected, and must be publicly disclosed; a significant deficiency is less severe and is reported to the audit committee instead.
How is scope decided?
Through materiality applied to account balances and disclosures, combined with a risk assessment that can pull in smaller accounts where the chance of error is high.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%