The $2B question: Who’s rolling back their controls after the SEC’s proposed changes?
In this blog:
The SEC’s proposed float threshold change is expected to give many companies an exit from section 404(b) of the Sarbanes-Oxley Act, but most responsible CFOs aren’t taking it.
Key takeaways:
- The SEC’s recent proposals extend disclosure scaling and other accommodations currently used by smaller reporting companies and emerging growth companies, offering organizations relief from section 404(b).
- Section 404(b) relief is not synonymous with total relief, and management is still responsible for maintaining controls regardless of whether they receive a 404(b) opinion.
- Whether your organization continues to adhere to the requirements of 404(b) depends on your investor base, transaction horizon, and controls maturity. Eligibility to opt out alone shouldn’t drive the decision.
The SEC’s May 2026 proposal would collapse the current five-category filer framework into two: large accelerated filers and non-accelerated filers. Under the new rules, a company would need to meet all three of the following criteria to qualify as a large accelerated filer:
- At least $2 billion in public float (up from $700 million today)
- That threshold met for two consecutive fiscal years
- At least 60 months of Exchange Act reporting history
Everyone else becomes a non-accelerated filer, and Section 404(b) auditor attestation would apply only to large accelerated filers. The scale of this shift matters. Under the new framework, the SEC estimates that roughly 81% of public companies would qualify as non-accelerated. That’s a meaningful number of companies that no longer need to meet the 404(b) requirement.
While the proposed changes aren’t yet final, now is the time for finance leaders to evaluate what these changes could mean for their organization.
The distinction CFOs must get right: 404(b) relief vs. internal controls relief
Relief from 404(b) doesn’t equal relief from maintaining internal controls.
Section 404(b) governs whether your external auditor must independently attest to your internal controls over financial reporting. The proposal would remove that requirement for non-accelerated filers, but companies will still be obligated to comply under Section 404(a), which requires management to design, maintain, and assess those controls in the first place and continue to assess internal controls for purposes of certifying of Forms 10-K and 10-S.
What 404(b) relief removes | What robust internal controls still require, regardless of 404(b) status |
The requirement for your external auditor to issue a formal opinion on the effectiveness of your internal controls | Management’s ongoing obligation to design and maintain effective controls over financial reporting |
The direct cost of an annual auditor ICFR attestation | Documentation, testing, and remediation of any control deficiencies |
An independent, third-party verification layer that investors and boards have come to rely on | The same standard of accurate financial reporting and reliable disclosure |
As a public company, no longer having a 404(b) opinion does not change your controls obligation—it just removes the outside party who was holding you accountable for it. The risk to companies, executives, and shareholders is that discipline quietly erodes once that outside party no longer needs to check.
Greg Rotz
Partner, Risk & Regulatory Practice Leader
Highspring
CFOs are still responsible for maintaining a control environment
A company can qualify for relief but still be compelled to uphold their responsibility to shareholders to maintain a control environment, including validating that controls are operational and remediating deficiencies. For these finance leaders, it’s a signal to the market and an opportunity to differentiate your organization.
Voluntary 404(b) maintenance tells investors that your financial reporting has passed an independent, external check. It signals to your board and audit committee that the discipline behind your numbers doesn’t depend on whether it’s required. In an environment where trust is priced into valuations, that’s a differentiator.
Dropping attestation may reduce audit fees in the short term. But the longer-term implications can be much more significant. Controls can quickly and quietly erode maturity, and rebuilding investor confidence after a restatement or control failure could cost far more than the amount you saved from neglecting attestation.
For companies in the financial services space, investor and regulator confidence is currency. The firms earning premium trust are the ones treating strong internal controls as a competitive advantage.
Paul MacIntosh
Financial Services Lead
Highspring
Key considerations before rolling back attestation
Maintaining 404(b) isn’t the right answer for every company. The key is making a deliberate, defensible decision. Here are some important factors finance leaders should consider.
Investor relations
Your investors have come to expect a certain level of external assurance. Rolling it back without a clear narrative invites intense scrutiny on an earnings call. Know what you’ll say and why before the decision becomes public.
Board and audit committee expectations
Audit committees exist to protect the integrity of financial reporting. Many will be reluctant to relinquish external attestation, particularly when it comes to companies approaching a transaction, a capital raise, or continued growth toward the $2 billion threshold.
Transaction readiness
Buyers, lenders, and underwriters value a clean, externally validated control environment. If a sale, IPO follow-on, or major financing is anywhere on your horizon, reducing external oversight complicates diligence and slows value realization at exactly the moment speed matters most. A strong controls foundation is an asset you can point to.
Reputational risk
A control failure at a company that voluntarily dropped attestation invites a sharper spotlight. The question, “Why did you remove the safeguard?” is not one any CFO wants to answer after the fact.
Organizations that approach this decision thoughtfully evaluate it alongside their controls environment, reporting rigor, and transaction readiness goals. When viewed in that broader context, the right path often becomes much clearer.
5 questions CFOs should be asking right now
Bring these to your next conversation with your advisors and audit committee:
- What signal does rolling back 404(b) send to our investors? Are we prepared to defend that decision publicly?
- How does our transaction readiness posture change if we reduce external oversight ahead of a potential sale, raise, or refinancing?
- What is our internal controls maturity without the discipline of external attestation forcing rigor, and how can AI be layered in to meet old requirements?
- How does our audit committee view this? Have we given them the analysis they need to weigh in?
- What’s the true long-term cost of a control lapse versus the near-term savings on attestation fees?
If you’re not able to answer these questions confidently, now’s the time to address them before making a final decision.
Relief is a conversation starter, not a conclusion
The SEC’s proposed threshold change gives finance leaders a genuine out—but an out only offers an advantage when you understand what you’re trading away by taking it.
The most credible CFOs are asking not whether they can drop 404(b), but whether they should. They’re also prioritizing governance and long-term credibility over a line item of short-term savings, because they understand that investor and board trust, once earned, compounds.
If you’re weighing where your company should land, don’t make the decision in isolation. Connect with Highspring’s Risk and Regulatory team to assess your compliance posture and build a defensible position before the rules are final.
