When Should You Start SOX Preparation Before an IPO?

The first annual report you file after an IPO contains no report on internal control over financial reporting, from management or from anyone else. Instruction 1 to Item 308 of Regulation S-K excuses a newly public registrant from paragraphs (a) and (b) until it has been required to file an annual report for the prior fiscal year, and it supplies the replacement sentence you put in the 10-K instead: "This annual report does not include a report of management's assessment regarding internal control over financial reporting or an attestation report of the company's registered public accounting firm due to a transition period established by rules of the Securities and Exchange Commission for newly public companies." Management's first assessment therefore lands in your second annual report, and Item 308(a)(3) makes it an assessment "as of the end of the registrant's most recent fiscal year". Work backwards from that as-of date rather than from the listing date and the 12-to-18-month answer our own SOX practice gives stops being a rule of thumb and becomes arithmetic. The contrarian part: the deadline nearly every pre-IPO plan we see is built around, the first 10-K, is the one date the rules explicitly let you skip.

Below: which date actually binds, what you sign long before any 404 report is due, when an auditor's opinion first attaches, and how to run the calendar backwards without buying eighteen months of consulting you do not need yet.

Key takeaways

• The first 10-K after listing omits the internal control report entirely, under Instruction 1 to Item 308 of Regulation S-K, and the instruction gives you the exact disclosure sentence to use in its place.
• The binding date is the fiscal year end covered by your second annual report. Item 308(a)(3) makes management's conclusion an as-of assessment, and a control that started operating in the final quarter supports almost nothing.
• Certifications arrive far earlier than the 404 report. Rule 13a-14 and Rule 15d-14 put signed officer certifications in every Form 10-Q and Form 10-K, starting with the first one you file.
• The auditor is in your control environment before any of that. PCAOB AS 1305 requires the auditor to communicate all significant deficiencies and material weaknesses in writing to management and the audit committee before issuing the report on the financial statements, and the IPO audit is an audit.
• Most newly public companies never owe a 404(b) opinion in year one or year two. Emerging growth company status and the accelerated-filer definition both delay it, and both are worth understanding before anyone budgets for it.

Dateline. The position as of August 23, 2026 against the instruments cited. We are not lawyers or your auditor; filer status is a determination your counsel and auditor make on your facts.

The date that binds, and the one that does not

Almost every pre-IPO SOX plan we are shown is anchored on the listing date, and that anchor is wrong by roughly a year. Take a company that lists in June 2027 on a calendar fiscal year. The first annual report is the 10-K for fiscal 2027, filed in early 2028. Under Instruction 1 that report carries the transition-period sentence and no internal control report. The second annual report is the 10-K for fiscal 2028, and that one carries management's assessment of internal control over financial reporting as of December 31, 2028.

Now read Item 308(a)(3) literally. It asks for "Management's assessment of the effectiveness of the registrant's internal control over financial reporting as of the end of the registrant's most recent fiscal year". That is an as-of conclusion, not a period conclusion, which is a genuine difference from a SOC 2 Type II and the source of an expensive mistake: teams read "as of" and conclude the controls only have to be working in December.

An as-of conclusion still has to be supported, and the support for a quarterly control is the quarters it ran. An access review that begins in October gives you one occurrence to point at on December 31. A change management process installed in November has a population of six weeks. Nobody signs a clean assertion on that.

So the practical deadline is the start of the fiscal year covered by your second annual report. In the June 2027 example that is January 1, 2028: six months after listing, and roughly eighteen months after a company that started in mid-2026. That is where the 12-to-18-month figure comes from, and why it is a range rather than a number.

What you sign before any 404 report exists

The transition period covers Item 308. It covers nothing else, and this is where first-time filers get surprised.

Rule 13a-14 requires that each report filed on Form 10-Q or Form 10-K under Section 13(a) include certifications signed by "each principal executive and principal financial officer of the issuer, or persons performing similar functions, at the time of filing of the report", and the rule is explicit that the signature cannot be delegated under a power of attorney. Rule 15d-14 does the same for reports filed under Section 15(d). Your first quarterly report after listing carries certifications signed by two named human beings, long before the annual report where the 404 assessment first appears.

The auditor arrives earlier still. AS 1305 requires the auditor to communicate in writing to management and the audit committee all significant deficiencies and material weaknesses identified during the audit, before the report on the financial statements is issued, and to distinguish clearly between the two. The financial statements in your registration statement are audited. So the written list of your control problems, on the auditor's letterhead, exists during the S-1 process, in front of an audit committee you are in the middle of assembling.

That letter is the real first SOX event for most companies. It is not a 404 report and it does not become a public filing on its own, but it is what determines whether the phrase "material weakness" turns up in your risk factors. Teams that plan against the first 10-K meet it far too late to act on it.

When an auditor's opinion on your controls first attaches

A separate question carries a much bigger number: when does an outside firm have to give an opinion on your internal control, rather than just tell your audit committee what it found.

15 U.S.C. 7262(b) requires the registered public accounting firm to attest to and report on management's assessment for issuers "other than an issuer that is an emerging growth company", and subsection (c) says the requirement does not apply to an issuer that is "neither a 'large accelerated filer' nor an 'accelerated filer' as those terms are defined in Rule 12b-2". Two independent exemptions, and most newly public companies sit inside at least one of them.

Emerging growth company status comes from 15 U.S.C. 77b(a)(19), which sets the entry test at total annual gross revenues of less than $1,000,000,000 in the most recently completed fiscal year, indexed for inflation every five years by the Commission. It ends at the earliest of several triggers, one of which is the last day of the fiscal year following the fifth anniversary of the first sale of common equity under an effective registration statement. Our first-year ITGC guide covers how that ceiling behaves; the short version is that five years is a maximum, not a plan.

The filer definitions in Rule 12b-2 add a delay that is structural rather than discretionary. An issuer becomes an accelerated filer only after it first meets the conditions as of a fiscal year end: non-affiliate public float of $75 million or more but less than $700 million, twelve calendar months subject to Section 13(a) or 15(d) reporting, and at least one annual report filed. Large accelerated filer works the same way at $700 million or more. A company listing in June 2027 has neither twelve months of reporting nor a filed annual report at its December 2027 year end, so it cannot be an accelerated filer then either.

Put the two together and the ordinary sequence for a mid-year IPO is: no internal control report in the first 10-K, management's own assessment in the second, and an auditor's attestation later still, if ever. Budget accordingly, and be suspicious of any proposal that prices a 404(b) readiness programme for a company that will not owe a 404(b) opinion for years.

Running the calendar backwards

Four anchors, in the order they bite. Fill in your own dates and the plan writes itself.

Anchor one: the as-of date. Fiscal year end covered by your second annual report. Everything else is derived from this.

Anchor two: the first day of that fiscal year. Every control you intend to rely on should be operating by this date, in its final form, with its evidence landing somewhere durable. This is the date that turns a compliance project into a compliance programme.

Anchor three: the last date an annual control can start and still have run once. Quarterly controls are covered by anchor two. Annual ones are worse, because a control that runs once a year and has never run has nothing to point at.

Anchor four: the audit committee's first look at the AS 1305 letter. During the S-1 audit. Anything you want fixed before it appears in writing has to be fixed before fieldwork, not before listing.

Work those four backwards and you land somewhere between twelve and eighteen months before listing for a company with a functioning finance team, and further out for a company that has never had a controller. Not because SOX takes eighteen months of continuous effort, but because the sequence contains two steps whose duration you cannot compress: remediating what the auditor finds, and letting the fixed controls actually run.

Where we would tell you to wait

This section costs us money, and it is the part we would most want to read.

If your IPO date is aspirational rather than scheduled, do not start a SOX programme. We have watched companies carry a control matrix, a testing calendar and an outside advisor through two years of a market that never opened for them. The durable work at that stage is a close calendar that produces auditable numbers, a named controller, an identity provider that is genuinely the single front door to your financial systems, and a change process with a system of record. None of that is wasted if the listing never happens.

If you are pre-revenue or pre-audit, the sequence is wrong. SOX documentation describes controls over financial reporting. If the financial reporting is still being designed, you will document a process that changes twice before anyone tests it. Get the first audited financial statements done first.

If someone is selling you a 404(b) readiness programme and you will be an emerging growth company, ask them to show you the statute. 7262(b) exempts emerging growth companies from the attestation requirement by name. There are good reasons to build to the higher standard anyway, mostly around not having to redo the work later, but it should be a decision you make with the exemption in front of you rather than a scope you inherit. The same applies to a SOC 2 you already hold: some evidence transfers and the scope does not, which our first-year ITGC guide and reusing evidence across frameworks both work through.

Where Top Floor fits

The parts of a pre-IPO SOX calendar that benefit from outside help are narrow: deciding which controls have to start operating first, designing evidence so populations are complete and exportable rather than reconstructed, and having someone in the room who has read an AS 1305 letter before. That is our SOX readiness work, and where it sits alongside a SOC 1 for enterprise customers it runs better as one programme, which is what our audit and assurance practice is for. Where a company has no senior owner for the programme, a fractional security leadership arrangement carries it until you hire.

What we will not do is hold your control register. Management's assertion is management's, and a programme where the consultants own the artifacts fails the year they leave. We also do not audit and do not attest: your external auditor is the only party whose opinion on your controls counts.

How to decide this week

First, write down two dates: the fiscal year end covered by your second annual report on your current listing plan, and the first day of that fiscal year. If nobody in the company can produce those two dates in a meeting, that is the finding, and it is a governance finding rather than an IT one.

Second, ask your audit partner when the written communication of significant deficiencies and material weaknesses for the current audit goes to the audit committee. That date is your real first deadline, and it is usually sooner than people expect.

Third, sort your control inventory by cadence. Quarterly and annual controls go to the top of the queue, because their evidence cannot be manufactured later. Daily and per-event controls can start last.

Fourth, check your filer status against 7262(b), 7262(c) and Rule 12b-2, and record the answer with its reasoning. It changes what you owe, what you should spend, and it changes every year.

Frequently asked questions

When should we start SOX preparation before an IPO?

Twelve to eighteen months before the expected listing date for a company with a functioning finance team, and the range exists because the binding date is not the IPO. Instruction 1 to Item 308 of Regulation S-K excuses a newly public registrant from the internal control report in its first annual report, so management's first assessment appears in the second one, as of that fiscal year end. The controls you intend to rely on should be operating from the first day of that fiscal year. A December listing and a June listing therefore give you very different runway from the same start date.

Does a newly public company file a SOX 404 report in its first 10-K?

No. Instruction 1 to Item 308 of Regulation S-K provides a transition period for newly public companies and supplies the sentence to use instead, stating that the annual report does not include a report of management's assessment regarding internal control over financial reporting or an attestation report of the company's registered public accounting firm due to a transition period established by Commission rules for newly public companies. The exemption covers Item 308 paragraphs (a) and (b) only. Officer certifications, the financial statement audit and every other reporting obligation are unaffected.

When does the auditor attestation under Section 404(b) first apply?

Not while you are an emerging growth company, and not while you are neither an accelerated filer nor a large accelerated filer. 15 U.S.C. 7262(b) requires the attestation only for issuers other than emerging growth companies, and 7262(c) exempts issuers that are neither large accelerated filers nor accelerated filers under Rule 12b-2. The filer definitions add a structural delay, because an issuer becomes an accelerated filer only after twelve calendar months subject to Section 13(a) or 15(d) reporting and at least one annual report filed, on top of the public float test.

Do we have to certify anything before our first SOX report?

Yes. Rule 13a-14 requires certifications signed by the principal executive and principal financial officers in each report filed on Form 10-Q or Form 10-K under Section 13(a), and Rule 15d-14 does the same for reports filed under Section 15(d). Those attach to the first periodic report you file after listing, well before the second annual report where management's internal control assessment first appears. The rule also prohibits signing the certification by power of attorney, so the named officers sign personally.