Governance runway · public rules

The SOX 404 timeline — why it decides your IPO date

The thing that stalls a listing is almost never revenue. It's a governance lead time — usually internal-control readiness under SOX 404 — that founders discover after they've told the board a date. Unlike a financial gap, you can't close it faster by growing. This is the one to start first.

Section 404 of the Sarbanes-Oxley Act requires a public company to document, test, and report on its internal control over financial reporting (ICFR). It has two parts, and the distinction matters for your timeline:

Section 404(a) — management's assessment of ICFR. A newly public company generally must include this beginning with its second annual report after going public.
Section 404(b) — the external auditor's attestation on ICFR. This is deferred for an emerging growth company (EGC) under the JOBS Act (up to five years) and does not apply to a non-accelerated filer. Larger issuers (accelerated / large accelerated filers) are on the hook for it.

The takeaway most decks miss: even with the 404(b) auditor attestation deferred, you still have to build and be able to assert effective controls. The relief is on who signs off, not on whether the controls exist. Getting there is a program, and a program has a lead time.

Why 9–15 months, not 9–15 weeks

ICFR readiness isn't a document you write; it's a control environment you stand up and then operate long enough to test. That operating period is what makes it a calendar problem, not a headcount problem. A realistic sequence:

Phase	Rough duration	What happens
Scope & risk assessment	1–2 months	Identify significant accounts, processes, and the systems that touch them; map to the COSO framework.
Design controls	2–3 months	Write control descriptions, close the obvious design gaps (segregation of duties, access, reconciliations, close checklists).
Implement & remediate	2–4 months	Put controls into operation, fix design gaps, often add finance/IT headcount and tooling.
Operate & test	3–6 months	Controls have to run before you can test that they're effective — this window can't be bought back.
Assess & report	1–2 months	Management concludes on effectiveness; remediate any deficiencies found in testing (which restarts the clock on that control).

Add them up and the honest band is 9–15 months for a company starting close to zero — longer if a material weakness surfaces late and has to be remediated and re-tested. That's why our engine treats a missing SOX 404 program as the single most schedule-relevant governance gap.

Where it sits in the readiness score

In the IPOPath governance model, "ICFR / SOX 404 readiness program underway" carries a weight of 14 of 100 — the same as a fast public-company close and majority-independent board, and second only to two years of PCAOB-audited financials (22). But the weight understates the schedule impact. Two companies can score identically on governance; the one missing SOX 404 has a materially later feasible listing date, because the fix has a fixed minimum duration.

This is why the timeline model doesn't just count open gaps — it starts from a base band by governance readiness band and then pushes the range out for each open gap. A company in the "Early" band with a governance gap and a real financial shortfall lands in a 16–28+ month program, not a next-quarter event.

A concrete read

Say your numbers clear a US main tier today but your governance score is 62/100 with SOX 404 not started. On the financials, you could file. On the calendar, you can't — because 404 readiness alone puts a floor under your timeline. The report will tell you the same thing every honest advisor will: start the control program now, in parallel with everything else, because it's the longest pole and the one you can't shorten by raising more or growing faster.

Not accounting or legal advice. The filer categories (EGC, accelerated, large accelerated), the 404(b) phase-in, and the specific reporting deadlines carry conditions and change over time. This is an educational overview; confirm your filer status and obligations with your PCAOB-registered auditor and securities counsel.

What to start this quarter

Name an owner. ICFR without a directly accountable finance leader drifts. This is usually the first real hire on the path.
Do the scoping now. The risk assessment costs little and tells you how big the gap actually is — often smaller for a disciplined finance team than founders fear.
Fix the close first. A fast, controlled monthly close is both a governance gate in its own right and the foundation everything else sits on.
Don't wait for the banker. None of this requires an underwriter to be engaged, and all of it is on your critical path.

See where SOX 404 puts your timeline

The free estimate weights your governance toggles — including whether a SOX 404 program is underway — and shows the readiness band instantly. The full report turns that into a dated 12–36 month roadmap.

Try the free estimate Get the report — $490 →