Share

Beyond SEC Compliance Relief: A Once-in-a-Decade Opportunity to Reshape Your SOX Program

Most companies will see the SEC’s two proposed rules as simply a welcome reduction in their compliance requirements. Strategic organizations will see something bigger: a rare opportunity to reshape their SOX program around the controls that actually matter.

Fellow practitioners and clients keep asking us the same question – does the SEC’s proposed rules on scaling back control requirements for mid-sized public companies lessen the importance of risk-based internal controls? Our answer is no. In fact, we believe the proposals create meaningful new value for both registrants and their advisors. Here’s why.

Two Proposals, One Direction: Less Friction to Being Public

The first proposed rule, SEC File Number S7-2026-15 – Semiannual Reporting, would amend Exchange Act Rules 13a-13 and 15d-13 to give reporting companies the option to move from quarterly to semiannual reporting. Companies could elect to file two reports per year, a new Form 10-S and a Form 10-K, rather than a Form 10-K and three Form 10-Qs.

The second proposal, SEC File Number S7-2026-18 – Enhancement of Emerging Growth Company Accommodations and Simplification of Filer Status for Reporting Companies, would raise the public float threshold for becoming a large accelerated filer from $700 million to $2 billion, change how public float is calculated, and require at least 60 consecutive calendar months of reporting before a company can become a large accelerated filer. While each proposal contains several other provisions, these are the ones we are asked about most.

The Scale of the Shift is Enormous

Both proposals are aimed at easing the burden of being public, firstly, by reducing the frequency of financial reporting, and secondarily, by narrowing the population of large accelerated filers subject to auditor attestation of the effectiveness of internal control over financial reporting under Section 404(b) of the Sarbanes-Oxley Act. This is not a niche change. The SEC estimates in its “Fact Sheet: Enhancing the Public Company Reporting Framework” that only 19% of registrants would qualify as large accelerated filers under the new rule; down from roughly 35% today. The other 81% of public companies would become non-accelerated filers, a group that collectively represents only about 6.5% of total market public float. In short, the majority of current large accelerated filers could see their auditor-attestation requirement fall away.

Most companies will initially focus on the obvious upside: lower compliance costs. But the real prize is strategic – the chance to fundamentally rethink how you approach internal controls.

Not All Controls are Created Equal

For a registrant currently subject to SOX 404(b) that would no longer be a large accelerated filer, the opportunity lies in rationalizing the controls it performs and “uncoupling” from external-audit alignment. This means flexibility to maintain and test the controls that management considers most critical to the business, rather than controls emphasized by the external auditor to maximize auditor reliance. Our experience shows this can be transformational. For example, a company with 250 key controls largely shaped by auditor-reliance requirements might rationalize that population to 150 management-critical controls or fewer, redirecting efforts toward higher-level monitoring controls that leverage automation and support continuous monitoring.

It also creates an opportunity to revisit the nature, timing, and extent of testing, moving away from detailed, heavily prescribed transactional testing and toward a leaner, risk-based model. Management gains additional flexibility in how testing is documented, potentially retiring lengthy, highly detailed scripts that consume significant time today to satisfy an external auditor’s format.

A Word of Caution: This Isn’t a Decision About Cost

The potential reduction in requirements should not be treated as simply one less administrative task. A company that has invested years of time and effort becoming “404(b) compliant” must weigh four real considerations before discarding that rigor:

• Risk appetite – If certain control requirements are eased back, are your financial reporting risks still mitigated? Those controls were put in place for a reason, and the risks they were designed to address do not go away.
• Investor perception – How will shareholders view a step back from auditor-attested controls, and can you get ahead of or shape that narrative?
• Audit-committee comfort – Does the Board have the assurance it needs to stand behind management’s assessment alone?
• Reversibility – If growth pushes public float back above $2.0 billion, how quickly could you rebuild the rigor you unwound? Companies exempt from independent auditor attestation should map their trajectory toward that threshold now and remember they remain obligated to perform their own assessment and report their conclusions.

The registrant still needs to comply with 404(a) under SEC requirements and understand its shareholders’ expectations. The opportunity is real, but it should be captured deliberately, not by default.

How Centri Can Help

At Centri, we help companies turn regulatory change into an opportunity to strengthen and streamline their control programs. Our Risk Advisory team uses a risk-based, right-sized approach to focus resources on material risks and the controls that matter most, without over-engineering the control environment. By partnering closely with management, we help organizations reduce the compliance burden, improve efficiency, and build scalable control programs that support reliable financial reporting.

Our approach includes:

• Senior-led delivery – Senior-level attention throughout, backed by decades of audit and advisory leadership.
• Deliverables that stand up – Executive and audit-committee-ready output, risk-focused objectives, and a prioritized, actionable roadmap.
• A collaborative approach – Responsive support, close alignment with your control owners and external auditors, and clear communication with management and the Board at every stage.

We also help management educate stakeholders on the changes and their impact, and work with external auditors to understand the requirements that would not go away should the proposed rule pass.

Let’s Talk

These proposals could reshape the internal control over financial reporting obligations of the vast majority of public companies, and those that plan ahead will be best positioned to realize the benefits. Contact Centri for a complimentary SOX rationalization readiness assessment, and let us help you turn a regulatory change into a lasting competitive edge.

Rich Sowalsky

Partner | Risk Advisory Practice Leader | CISA

Rich is a Partner at Centri Business Consulting and the leader of the firm’s Risk Advisory Practice. He has more than 17 years of combined experience in risk & internal control consulting, internal audit, IT risk & cybersecurity advisory, Sarbanes-Oxley (SOX) 404 Compliance, Enterprise Risk Management, financial reporting & accounting. He joined Centri in February 2022 and has provided a variety of risk advisory and compliance services for clients across various industries, including insurance, digital assets & fintech, life sciences, financial services, healthcare, technology, and more.. View Rich Sowalsky's Full Bio

Gareth Montague-Smith

Managing Director | CPA

Gareth is a Managing Director at Centri Business Consulting. He has more than 28 years of finance and accounting experience, providing financial, auditing, and internal audit services across multiple industries. View Gareth Montague-Smith's Full Bio