Evolving Management’s ICFR Assessment Under SEC Proposed Rule
If adopted, the SEC’s proposed filer status changes could exempt more companies from SOX Section 404(b) compliance. Companies newly exempt from 404(b) can view the transition as an opportunity to reevaluate how management performs its assessment of ICFR under SOX Section 404(a).
In under a minute
In May 2026, the Securities and Exchange Commission (SEC) proposed amendments that could reduce external attestation requirements, but it would not reduce management’s responsibility for internal control over financial reporting (ICFR) or executive certifications. That makes the design of a risk-based assessment especially important.
For companies that might no longer be subject to Sarbanes-Oxley Act (SOX) Section 404(b), the opportunity is not to retreat from control oversight. It is to reexamine how management’s assessment of ICFR is documented and aligned to risk.
An effective management assessment strategy can help companies:
- Prevent or detect misstatements in financial statements
- Provide confidence before executive certifications are signed
- Support audit committee oversight
- Maintain readiness for future SOX Section 404(b) compliance
- Address emerging risks tied to AI, automation, data quality, and system-generated information
- Reallocate internal audit capacity toward higher-risk or higher-value areas
The appropriate approach will depend on risk profile, control maturity, company complexity, prior control issues, proximity to filer status thresholds, and management’s risk assessment.
Effective ICFR still matters
If external auditor attestation no longer applies, management still has responsibilities to maintain effective ICFR and perform an annual assessment. To perform this assessment, management may use internal audit or external service providers. Companies should evaluate whether the planned scope, testing approach, and reporting cadence provide enough coverage of financial reporting risks to sufficiently evidence management’s assessment of ICFR and support the audit committee’s oversight of the financial reporting process, including ICFR.
Internal audit or external party work can involve performing a risk assessment of the company, including identification of risk to the financial statements and controls to address the risks; monitoring and identifying areas where ICFR should change due to emerging risks; evaluating key ICFR controls; and identifying design of operating effectiveness control deficiencies before they become material weaknesses. These actions contribute to a commitment to governance and setting the “tone at the top” from management and the audit committee regarding ICFR.
Crowe observation: The absence of an external auditor attestation requirement should not result in a lack of discipline around internal control. Rather, it might represent an opportunity to reassess the extent of evidence and documentation that management uses to support its ICFR conclusions.
AI and data quality affect financial reporting
As organizations adopt AI-enabled tools and rely more heavily on system-generated information, management should consider how those dependencies affect their ICFR assessment plan. Management might need to address data lineage, information produced by the entity, model governance, access rights, change management, and management review controls that rely on AI-generated outputs.
This focus is especially important where automated outputs support reconciliations, account analyses, forecasts, disclosures, or other financial reporting controls.
The assessment should address both the technology and the information used by the technology.
Crowe observation: Management teams frequently focus on controls surrounding AI tools themselves, but financial reporting risks often originate with the quality, completeness, and accuracy of the data feeding those tools. The internal audit function can be a useful resource for assessing the impact of AI and data quality.
Considerations for management’s assessment
The SEC proposal might create opportunities for management to tailor its ICFR assessment approach based on risk, complexity, and maturity. Management can reassess all key controls, the risks associated with those controls, the data and judgments used in those controls, and the nature and extent of documentation needed to support management’s assessment. The approach should be evaluated with C-suite executives responsible for SOX Sections 302 and 906 certifications.
The following exhibit from a June 2007 SEC interpretive release provides considerations for management with respect to evaluating the sufficiency of evidence supporting the operation of its ICFR.
Determining the sufficiency of evidence based on ICFR risk
Source: SEC interpretive release, “Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934,” June 20, 2007, https://www.federalregister.gov/d/E7-12299
Crowe observation: Companies can continually reevaluate both the design of their internal controls and the extent of evidence needed to support management’s annual assessment of ICFR under SOX Section 404(a).
Management’s assessment should evolve with risk
ICFR assessment strategies do not need to be static. As companies grow, complete acquisitions, implement new systems, enter new markets, increase AI use, or approach potential SOX Section 404(b) applicability, management should periodically reassess whether its ICFR assessment plan remains aligned with its risk profile.
Proximity to the proposed $2 billion public float threshold should not influence management’s testing and documentation approach. Maintaining a scalable SOX program, even during periods when external auditor attestation is not required, is important for management to execute its responsibilities under SOX.
Crowe observation: A scalable, risk-based approach can help balance cost efficiency with investor expectations, audit committee needs, and management certification responsibilities.
Reinvesting internal audit capacity
For organizations newly exempt from SOX Section 404(b) whose external auditors relied on internal audit testing as part of their SOX work, the proposal might offer an opportunity to redirect internal audit resources toward areas that can provide value to management and the audit committee such as emerging risks, operational effectiveness, and business performance initiatives.
Examples include operational reviews focused on process efficiency and cost reduction opportunities, AI governance, technology and digital transformation, third-party and vendor risk, acquisition integration, working capital and cash flow, revenue growth and profitability, and cybersecurity and data protection.
For example, an internal audit team that spends fewer hours testing SOX controls annually might perform an operational review of the procure-to-pay process, identify opportunities to reduce cycle times, strengthen vendor management practices, or improve working capital performance. Similarly, internal audit might assess whether an organization’s AI investments are producing expected business benefits while maintaining appropriate governance and control.
What comes next
The SEC proposal remains subject to public comment. If finalized, management will have an opportunity to rethink its assessment of ICFR, not retreat from it. A calibrated risk-based assessment approach can help preserve control discipline, strengthen executive certification processes, maintain SOX readiness, and free internal audit capacity for higher-value areas.
Contact us
