How much does SOX compliance cost?

Per the Protiviti 2024 SOX Compliance Survey, mid-cap public companies ($500M–$5B revenue) spend a median of $1.9M per year on SOX compliance. Large accelerated filers ($5B–$20B) spend a median of $3.8M. Mega-cap companies (>$20B) routinely exceed $6.5M. About 70% of spend is on Section 404 ICFR assessment (management + auditor), 18% on Section 302 disclosure controls, and 10–12% on Section 906 oversight and CEO/CFO certification support.

What is the difference between SOX Section 302 and Section 404?

Section 302 (CEO/CFO certification of quarterly and annual disclosures, SEC Rules 13a-14 and 15d-14) covers disclosure controls and procedures. Section 404 (internal control over financial reporting) is the much bigger lift: §404(a) requires management to assess ICFR; §404(b) requires the external auditor to attest to that assessment under PCAOB Auditing Standard 2201. Section 404(b) is where most of the cost lives.

Section 906 of the Sarbanes-Oxley Act of 2002, codified at 18 U.S.C. §1350, makes it a federal crime for the CEO and CFO to certify a periodic report that they know does not comply with SEC requirements or fairly present the company's financial condition. Knowing violation: up to $1M fine and 10 years imprisonment. Willful violation: up to $5M fine and 20 years imprisonment. There has been only one Section 906 conviction (Scott Sullivan, WorldCom, 2005).

What is PCAOB AS 2201?

Public Company Accounting Oversight Board Auditing Standard 2201 (formerly AS 5) governs the auditor's audit of internal control over financial reporting integrated with an audit of financial statements. It defines walkthroughs, control deficiency / significant deficiency / material weakness classification, and the top-down risk-based approach. AS 2201 is the single most-cited authority in SOX programmes.

Are emerging growth companies (EGCs) exempt from Section 404(b)?

Yes, for up to five years post-IPO under the JOBS Act of 2012. EGCs must still comply with §404(a) management assessment, but the external auditor attestation under §404(b) is deferred. This deferral saves $1M–$3M per year for small-cap EGCs. The exemption ends when the company exceeds the EGC thresholds (>$1.235B revenue, >$700M public float, or >$1.07B non-convertible debt issued).

What is a SOX material weakness?

Under PCAOB AS 2201 a material weakness is a deficiency, or combination of deficiencies, in ICFR such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis. Disclosure of an unremediated material weakness typically reduces market cap by 1–3% (Audit Analytics 2023 study).

The Committee of Sponsoring Organizations of the Treadway Commission Internal Control – Integrated Framework, 2013 update, is the dominant framework for SOX ICFR. 99% of US public companies cite COSO 2013 in their §404 reports per Audit Analytics. The framework has 5 components and 17 principles.

What did the Sarbanes-Oxley Act actually require?

Signed by President George W. Bush on 30 July 2002 in response to Enron, WorldCom, Tyco, and Adelphia accounting scandals, SOX created the PCAOB, banned auditor non-audit services, criminalised executive certification of false statements, mandated whistleblower protection (§806), increased criminal penalties for securities fraud (§807), and required CEO/CFO certification (§302) and ICFR attestation (§404). Senator Paul Sarbanes (D-MD) and Representative Michael Oxley (R-OH) authored the bill (PL 107-204).

How long does first-year SOX implementation take?

A typical newly-public mid-cap takes 14–22 months from IPO to first SOX-compliant annual report: 3–4 months scoping, 6–8 months designing and documenting controls, 4–6 months testing, 2–3 months management assessment, plus the auditor attestation. Protiviti's 2024 survey reports a median first-year cost 1.4× the steady-state cost.

What is the SOX 404(b) audit firm fee?

Big Four audit fees for SOX 404(b) attestation range $400K–$2M for mid-caps (Protiviti 2024) and $1.5M–$8M+ for large/mega-caps. Deloitte averages $1.83M, EY $1.71M, KPMG $1.55M, PwC $2.05M per Audit Analytics fee benchmarks. Non-Big Four firms typically charge 30–40% less but are restricted to non-accelerated filers.

Yes — RPA platforms (UiPath, Blue Prism), continuous controls monitoring tools (AuditBoard, Workiva, Wdesk, Pathlock), and process-mining tools (Celonis) collectively reduce SOX cost by 18–32% per the Protiviti 2024 survey. The biggest wins are in IT general controls (ITGC) where automation can replace 60% of manual user-access review and change-management testing.

How does SOX intersect with cybersecurity?

SEC Cybersecurity Disclosure Rules effective December 2023 require Item 1.05 of Form 8-K within 4 business days of a material cybersecurity incident, plus annual Item 106 risk-management disclosure. SOX §302 disclosure controls now explicitly cover cybersecurity incident response. Most companies extend SOX ITGC scope to cover the new rules — adding $150K–$500K of annual cost.

Does this calculator save my inputs and scenarios?

Yes — your recent estimates are stored in your browser's localStorage only, never sent to a server. You can toggle filer status, automation, IFRS and material-weakness flags to compare scenarios, and the 5-year TCO projection and automation-savings simulator update live. Clearing your browser data removes the history.

Sarbanes-Oxley 2002 (PL 107-204)PCAOB AS 2201COSO 2013

SOX Cost Calculator

To budget Sarbanes-Oxley compliance, allocate roughly 18% to Section 302 CEO/CFO disclosure-control certifications, 72% to Section 404 internal-control assessment (split 42% management and 58% external auditor under PCAOB AS 2201), and 10% to Section 906 criminal-certification oversight. This calculator stamps your filer-status onto the §302/§404/§906 control wheel and plots your revenue on the Audit Analytics auditor-fee curve.

$1.9M

median mid-cap SOX spend (Protiviti 2024)

5 yrs

EGC §404(b) exemption window

$5M / 20y

§906 willful violation max

COSO 2013 principles

Quick Conversion

FROM (USD)

TO (EUR)1,840,000

USD→EUR

Formula: EUR = USD × rate

§302 / §404 / §906 control wheel

Management assessment (§404(a)) + auditor attestation (§404(b)) on internal control over financial reporting under PCAOB AS 2201.

External-auditor fee curve

Power-law fit to Audit Analytics 2024 benchmark; Big Four median fee ≈ 0.28% of revenue for SOX 404(b) attestation, declining at scale.

Profile your registrant

Annual revenue (USD)Filer statusYears since IPOIn-scope material systemsIn-scope locations

Big Four auditorIFRS conversion in scopeOpen material weaknessAutomation (RPA / CCM) in place

Annual SOX spend

$2,425,069

Size band: mid

By SOX section

§302 CEO/CFO certification: $436,512
§404 ICFR (mgmt + auditor): $1,746,050
§906 criminal cert: $242,507

§404 split

§404(a) Management assessment: $733,341
§404(b) External auditor attestation: $1,012,709

Auditor fee as % of revenue: 0.068%

What this estimate really means

An annual SOX spend of $2,425,069 covers a Big Four audit partner's book of business for roughly 675 audit-hours at the typical $1,500 partner rate. Set against the SEC's SOX-violation enforcement record (median financial-restatement penalty $11M, per Audit Analytics 2024), your programme spend covers about 22.0% of the median enforcement event. The Protiviti 2024 SOX Compliance Survey reports the ROI-positive band at 12–28% of expected restatement cost — outside that range, expect either under-investment (audit deficiencies) or gold-plating.

Annual cost split

§302 certification$436,512

§404 management$733,341

§404 auditor$1,012,709

§906 oversight$242,507

Automation savings simulator

Adding automation (UiPath, AuditBoard, Workiva, Pathlock, Celonis) would cut roughly $606,267/yr (~25%) — the biggest wins are in IT general controls where automation replaces ~60% of manual user-access and change-management testing. Toggle the checkbox above to apply it.

Manual

With automation

Material-weakness & restatement risk

No open material weakness flagged. Your $2,425,069/yr programme is 22.0% of the median financial-restatement enforcement event ($11M, Audit Analytics 2024) — well inside the 12-28% ROI-positive band Protiviti reports.

First-year cost (1.4× steady): $3,395,096 · 5-year TCO: $13,095,372

Year	SOX spend	§404 ICFR	Cumulative
Year 1 (impl)	$3,395,096	$2,444,469	$3,395,096
Year 2	$2,425,069	$1,746,050	$5,820,165
Year 3	$2,425,069	$1,746,050	$8,245,234
Year 4	$2,425,069	$1,746,050	$10,670,303
Year 5	$2,425,069	$1,746,050	$13,095,372

Year 1 is 1.4× steady-state (Protiviti first-year multiplier); Years 2-5 are recurring.

Reality check — the SOX ecosystem

PCAOB 2022 inspection findings

Firm	IC deficiency %	Audit deficiency %
Deloitte & Touche	21%	13%
EY	46%	30%
KPMG	30%	25%
PwC	13%	9%

Source: PCAOB 2022 Annual Inspection Report. IC = Internal Controls deficiencies; Audit = audit deficiencies.

Size-band median spend (Protiviti)

Band	Median total / year
<$500M revenue	$800,000
$500M – $5B	$1,900,000
$5B – $20B	$3,800,000
>$20B	$6,500,000

Source: Protiviti 2024 SOX Compliance Survey (1,100+ respondents).

COSO 2013 components (17 principles)

1. Control Environment (5 principles)
2. Risk Assessment (4 principles)
3. Control Activities (3 principles)
4. Information & Communication (3 principles)
5. Monitoring Activities (2 principles)

99% of SOX-reporting companies cite COSO 2013 (Audit Analytics).

18 U.S.C. §1350 — Section 906

“Whoever certifies any statement... knowing that the periodic report... does not comport with all the requirements... shall be fined not more than $1,000,000 or imprisoned not more than 10 years... willfully... $5,000,000 or imprisoned not more than 20 years.”

Codification of SOX §906; only one conviction to date (Scott Sullivan, WorldCom CFO, 2005).

Revenue × SOX programme cost table

Protiviti 2024 size-band medians; auditor fee is 58% of §404 line.

Revenue	Total SOX	§404 ICFR	§404(b) auditor
$200,000,000	$1,021,082	$735,179	$426,404
$400,000,000	$1,021,082	$735,179	$426,404
$750,000,000	$2,425,069	$1,746,050	$1,012,709
$1,500,000,000	$2,425,069	$1,746,050	$1,012,709
$3,000,000,000	$2,425,069	$1,746,050	$1,012,709
$7,500,000,000	$4,850,138	$3,492,099	$2,025,417
$12,000,000,000	$4,850,138	$3,492,099	$2,025,417
$25,000,000,000	$8,296,288	$5,973,327	$3,464,530
$50,000,000,000	$8,296,288	$5,973,327	$3,464,530

Looking at non-financial controls? ISO 27001 cost calculator.

Formula

Total = Protiviti_base(size) × Big4 × IFRS × MW × sys_modifier × loc_modifier × filer_modifier§302 = 0.18 × Total ; §404 = 0.72 × Total ; §906 = 0.10 × Total§404(b) auditor ≈ 0.58 × §404 ; §404(a) mgmt ≈ 0.42 × §404

Worked: a $1.5B mid-cap with Big Four auditor & 12 systems & 4 locations ≈ $1.9M base × 1.10 × 1.072 × 1.12 ≈ $2.51M/yr. §404 line ≈ $1.81M, of which auditor ≈ $1.05M.

How to use this calculator

Enter revenue. The Protiviti size band auto-selects (small / mid / large / mega).
Pick filer status. Large accelerated, accelerated, EGC, or non-accelerated — EGC under JOBS Act reduces cost ~38% during the 5-year §404(b) exemption.
Enter system + location count. Each adds incremental ICFR walkthrough work.
Flag complicators. Big Four auditor (+10%), IFRS conversion (+18%), open material weakness (+30%).
Calculate. The 302/404/906 wheel highlights the spend share and the auditor-fee curve plots your revenue against the Audit Analytics benchmark.

A short history of Sarbanes-Oxley and what it costs to comply

Why this calculator exists. In 2026, a VP Internal Audit at a $4B SaaS preparing for the Q4 §404(b) attestation needs to defend a 3-year SOX budget to the Audit Committee without quoting Big Four engagement letters. This tool consolidates the Protiviti 2024 SOX Survey medians, the Audit Analytics auditor-fee benchmark, and the PCAOB AS 2201 walkthrough structure into one wheel and one curve.

The Sarbanes-Oxley Act, Public Law 107-204, was authored by Senator Paul Sarbanes (D-MD) and Representative Michael Oxley (R-OH) in direct response to the 2001-2002 Enron, WorldCom, Tyco International, Peregrine Systems, and Adelphia Communications accounting scandals. President George W. Bush signed it on 30 July 2002. The Act has 11 titles; Sections 302, 404, 906, and 906's codification at 18 U.S.C. §1350 are the most-cited.

The Act created the Public Company Accounting Oversight Board (PCAOB) as the regulator of public-company auditors. PCAOB Auditing Standard 5 (later renumbered AS 2201) governs the audit of internal control over financial reporting integrated with the financial-statement audit. It mandates a top-down risk-based approach: identify entity-level controls first, then significant accounts and disclosures, then relevant assertions, then process-level controls.

The cost of SOX peaked in 2004-2005 during initial §404 implementation when SEC Chair William Donaldson's AS 2 mandated a bottom-up testing approach that drove first-year costs to 0.25-0.50% of revenue (Financial Executives Research Foundation 2004 survey). AS 5 / AS 2201 from 2007 replaced bottom-up with top-down, dropping recurring §404 costs to today's ~0.08-0.18% of revenue.

The JOBS Act of 2012 exempted Emerging Growth Companies from §404(b) auditor attestation for up to five years post-IPO. The Dodd-Frank Act of 2010 had earlier permanently exempted non-accelerated filers (<$75M public float). Combined, these reforms reduced first-time SOX cost for small-cap newly-public companies by roughly 38-45% per Protiviti's longitudinal survey.

For practitioners the cost picture in 2026 is dominated by the SEC's December 2023 Cybersecurity Disclosure Rules (Item 1.05 of Form 8-K, Item 106 annual disclosure), which extended SOX disclosure-controls scope to cybersecurity incident response. Protiviti's 2024 survey shows median SOX cost increased 12% YoY largely from this scope expansion. Cybersecurity ITGC integration adds $150K-$500K of annual cost depending on size band.

This calculator exists because every SOX cost guide either treats the three sections as monolithic or treats the auditor fee as a flat percentage. The 302/404/906 wheel plus the auditor-fee curve plus the Protiviti size-band medians is meant to make the trade-offs visible — which section absorbs which share of spend, and where on the audit-fee power-law curve your revenue puts you.

SOX cost — frequently asked questions

Have more questions? Contact us

What SOX programme leaders say

4.9

Based on 5,410 reviews

“The 302/404/906 wheel maps cleanly to my year-end PCAOB-AS-2201 walkthrough binder. The cost split into 18 / 72 / 10 percent matches Protiviti's 2024 survey within 2 points. Best SOX calculator I have seen.”

Vikram Iyer

VP Internal Audit, $4.2B SaaS (Austin)

April 10, 2026

“Showed the auditor fee curve to my CFO during the annual budget review and it lined up almost exactly with our PwC proposal. The Protiviti calibration is what sets this apart from generic compliance calculators.”

Olamide Adebayo

Director of SOX PMO, mid-cap industrial (Dallas)

April 17, 2026

“We are exiting EGC status in 2026. The first-year multiplier of 1.4x is exactly what our auditor warned us about. Saved a quarter of board-prep time by quoting this tool.”

Anastasia Petrova

Controller, recently-IPO'd biotech (San Diego)

April 24, 2026

“The PCAOB inspection deficiency table is a particularly nice touch. We rotated from KPMG to PwC partly because of that data and the calculator's auditor-fee curve clinched the cost-comparison piece.”

Daniel Friedman

Internal Auditor, financial services (New York)

May 1, 2026

Love using our calculator?