SEC Proposes Internal Control Audit Exemption for Some Companies

The SEC proposed on May 19 to exempt about 81% of reporting companies from the auditor attestation on internal controls required by Sarbanes-Oxley Section 404(b), and the comment period closed on July 20, 2026.

Finance teams running an SEC reporting software comparison now need to know which filings will keep an external control audit and which will not. Audit firms, investor groups and the Institute of Internal Auditors have pushed back on the proposal and on a separate New York Stock Exchange filing that would delay internal audit for new listings.

The two proposals reach different parts of the assurance chain. The SEC plan removes the external auditor’s opinion on controls for most issuers, while the NYSE plan postpones the internal audit function at newly listed companies from one year to five.

Who is exempt under the SEC filer status plan

The SEC’s proposal (Release 33-11419) would collapse the filer categories into two: large accelerated filers and non-accelerated filers. The accelerated filer and smaller reporting company categories would disappear.

A company would qualify as a large accelerated filer only with a public float of $2 billion or more, up from $700 million today. It would also need 60 months of Exchange Act reporting, up from 12 months.

Only large accelerated filers would keep the Section 404(b) attestation on internal control over financial reporting. Everyone else would file as a non-accelerated filer and could drop it.

The SEC’s analysis puts non-accelerated filers at about 81% of reporting companies, which together hold about 6.5% of total public float. About 1,596 companies that have an attestation today would lose it.

The 60-month seasoning test has a second effect. For any SEC reporting software comparison, it matters that a company that lists this year would be a non-accelerated filer for at least five years, whatever its size.

The smallest filers get further relief. A “small” non-accelerated filer, with total assets of $35 million or less, would have 120 days to file a Form 10-K and 50 days for a Form 10-Q. Large accelerated filers would have 60 and 40 days, and other non-accelerated filers 90 and 45 days.

Foreign private issuers filing Form 20-F would still need an attestation at a $75 million float or more, unless they are emerging growth companies.

“Our goal is to recalibrate these disclosure requirements based on the company size, how long it’s been public.”

Paul Atkins, Chairman, SEC

Atkins said companies still required to obtain an attestation would hold about 94% to 95% of total public float. He has said he wants to “make IPOs great again” and described the attestation as among the costliest requirements for companies weighing a listing.

NYSE moves internal audit from one year to five

The NYSE filing, SR-NYSE-2026-37, would amend Sections 303A.00 and 303A.07 of its Listed Company Manual. Newly listed companies would have five years, rather than one, to establish an internal audit function.

The claim that the proposals cut the need for internal auditors is accurate only for new NYSE listings, and only as a delay. The requirement itself stays, and the function can be in-house or outsourced to a provider other than the company’s independent auditor.

The Exchange said new issuers find one year too short while they upgrade accounting systems, controls and staffing. It noted that Nasdaq does not require listed companies to maintain an internal audit function.

The NYSE also pointed to protections that remain in place. They include a three-member independent audit committee, management’s own assessment of controls under Section 404(a), the Section 404(b) attestation, and CEO and CFO certifications under Sections 302 and 906.

The SEC published notice of the filing on August 13, and comments closed on September 8. The Exchange Act sets a maximum window of 90 days from Federal Register publication on August 18, which ends on Monday, November 16. By then the SEC must approve, disapprove or institute proceedings.

The Institute of Internal Auditors urged the SEC to reject the change. Anthony Pugliese, its president and chief executive, said extending the deadline fivefold “would be a significant step backward for good governance”. He wrote that “the current rule requires presence, not scale.”

The IIA’s central argument links the two proposals. Most new issuers are already exempt from the attestation for up to five years, and the SEC plan would remove it for every newly public company. Under both changes, a typical new issuer could trade for five years with neither an internal audit function nor an independent opinion on its controls.

A coalition letter joined the IIA with Better Markets, the Interfaith Center on Corporate Responsibility, RIMS, the National Whistleblower Center, the Association of Certified Fraud Examiners, Public Citizen and Americans for Financial Reform Education Fund. It said “a five-year absence is neither limited nor prompt.”

Companies that build the function in-house can start from an internal audit plan template. In an SEC reporting software comparison, those that outsource it will be weighing internal audit software against a co-sourced provider.

Audit firms and investors object to the exemption

The Center for Audit Quality, which represents the largest audit firms, said in its July letter that the SEC may have extended the accommodation too broadly.

“By expanding the population of companies exempt from internal control over financial reporting (ICFR) auditor attestation to approximately 81% of public companies, the proposal may extend accommodations too broadly, including to companies where independent assurance over internal controls remains important to investors and the capital markets.”

Dennis McGowan, Vice President of Professional Practice, Center for Audit Quality

The CAQ also wrote: “We do not support a five-year exemption from SOX 404(b) for newly public companies regardless of size.” It said the accommodation is inappropriate for highly capitalised issuers, such as the large companies now preparing to list.

Grant Thornton backed the goal of simplifying filer status but raised concern about the exemption for many issuers. It warned of a significant fall in integrated audit engagements, which could narrow auditor choice, and asked the SEC to consult investors.

PwC proposed keeping the $700 million threshold. EY raised concerns that control deficiencies would go underreported. Crowe argued that a threshold of about $1.1 billion would still deliver meaningful relief.

Investors were sharper. CalPERS said auditor testing generally results in disclosure of deficiencies management had not previously reported, and noted higher rates of ineffective controls and restatements among non-accelerated filers. The Principles for Responsible Investment called the attestation a “cornerstone of confidence in the reliability of financial statements.”

The Council of Institutional Investors, the AFL-CIO, NASAA and NASBA also filed objections. More than 50 professors and former regulators, including former PCAOB chairman James Doty, said the plan removes external audits of ICFR for all registrants with up to $2 billion in public float. Nasdaq and the American Bankers Association supported the relief.

Lou Pizzileo, a partner at Grassi in New York, said he saw further repeal as a long shot. “We’ve come a long way from ‘Sarbanes Oxley 1.0’, where it was one size fits all,” he said.

SEC reporting software comparison: what to check

Any SEC reporting software comparison should start with filer status, because the new test turns on two consecutive years of float readings and 60 months of reporting history. A tool that tracks only the current $700 million line will give the wrong answer.

Deadlines are the second check. Software for SEC reporting calendars would need to handle 60, 90 and 120 day annual filing windows and 40, 45 and 50 day quarterly windows, depending on category.

Control documentation is the third. Management’s Section 404(a) assessment stays for every issuer, so companies losing the auditor’s opinion still need evidence of testing, owners and remediation. Teams comparing software should ask whether it can produce that file without the auditor’s request lists driving it.

Buyers should also avoid long contracts priced around the attestation workload until the final rule is clear. A fair SEC reporting software comparison today weighs what the product does under both the current and the proposed categories.

What to watch in the SEC reporting rule timeline

The SEC has not set a date for a final rule on filer status. The proposal drew more than 240,000 comment letters across its related changes, most of them on a separate semiannual reporting option, which Atkins has defended as flexible.

The nearer date is November 16, when the SEC’s 90-day window on the NYSE internal audit filing ends. Whether the Commission approves, disapproves or opens proceedings will show how much weight it gives the IIA coalition.