Section 404 of the Sarbanes-Oxley Act (SOX 404) mandates that public companies assess their internal controls over financial reporting (ICFRs). SOX 404(a) requires company management to assess ICFRs, and SOX 404(b) calls for registered public accounting firms to attest to and report on the assessments, made by management.

Implementation of SOX 404 began with U.S. accelerated filers who were first required to provide management assessment and auditor attestation in annual reports for periods ending on or after November 15, 2004. Since 2004, all filers, other than non-accelerated filers (who now have been permanently exempted from the requirements of SOX 404(b) by the recently passed Dodd-Frank Wall Street Reform and Consumer Protection Act), have phased into the SOX 404 regulatory scheme and are currently required to provide SOX 404(a) and (b) certifications in their annual reports.