How Much Does SOX Compliance Cost in 2026? Costs by Filer Year

A newly public company owes no SOX 404 report in its first 10-K, then spends about $617,900 a year in internal cost for its first management assessment under Section 404(a), per Protiviti's latest full SOX survey. Once the auditor must attest under 404(b), the first-year internal average rises to $1,047,200, and audit fees step up by a median $219,000, per a 2025 GAO study. Sources read October 21, 2026.

Those are averages with a wide spread behind them, so treat them as a starting line. The real bill depends on two things a CFO can map before the IPO: how many locations and key controls the company runs, and which year it loses its exemption from auditor attestation. The second one moves the number more than any software choice.

Toolradar data: of the 220 compliance tools that Toolradar, the software directory we run, tracked on October 20, 2026, only 20 publish a paid price. The SOX platforms named on this page are all in the quote-only group, so the software line has to come from a sales conversation.

SOX costs at a glance

Each row is an average annual internal cost from Protiviti's 2023 Sarbanes-Oxley Compliance Survey (564 respondents, fiscal 2022 data, excluding external audit fees), plus the audit fee figures from GAO-25-107500. Read on October 21, 2026.

Compliance stage	Who it applies to	Average internal cost per year	Auditor fee effect
First 10-K after the IPO	Every newly public company	No ICFR report required	None from SOX 404
First year of 404(a)	Second 10-K	$617,900	No attestation fee
Ongoing 404(a)	Emerging growth and smaller filers	$765,900	No attestation fee
First year of 404(a) and 404(b)	Accelerated and large accelerated filers	$1,047,200	Median audit fee up $219,000 in the transition year
Second year of 404(a) and 404(b)	Same	$1,150,000	Median audit fee up a further $47,000
Beyond the second year	Same	$1,404,300	Fees level off

The table reads as a staircase. Management's own assessment costs a first-year filer about $618,000, and auditor attestation adds roughly $430,000 of internal work on top, before the audit firm bills anything extra. That gap is the reason the exemption date matters so much in an IPO plan.

When each SOX requirement starts

SOX cost follows the calendar the SEC sets, so budgeting starts with placing the company on it. Three rules decide when each bill arrives.

• The first annual report is exempt. Instruction 1 to Item 308 of Regulation S-K lets a newly public company skip both the management report and the auditor's report until it has filed an annual report for the prior year. The first 10-K carries a transition statement instead.
• Emerging growth companies skip 404(b) for up to five years. The SEC's emerging growth company page sets the revenue ceiling at $1.235 billion. Status ends earlier if revenue crosses that line, the company issues more than $1 billion of non-convertible debt in three years, or it becomes a large accelerated filer.
• Small companies can stay exempt after that. Since the SEC's 2020 amendments, a smaller reporting company with less than $100 million in revenue is not an accelerated filer, so it needs no auditor attestation even after its five years run out.

Who must get the attestation is set by Exchange Act Rule 12b-2. An accelerated filer has a public float of $75 million to under $700 million, and a large accelerated filer $700 million or more. Both tests also need twelve months as a reporting company and one annual report already filed. A company with a big float that is not an emerging growth company can therefore face 404(b) in its second 10-K.

What two IPO paths cost over four reports

This scenario takes two companies through their second to fifth 10-Ks, using the Protiviti averages for each compliance stage. The totals are our arithmetic on published averages, not a quote or a forecast for any one company.

Path A, an emerging growth company that keeps its exemption:

• 10-K 2, first year of 404(a): $617,900
• 10-K 3 to 5, ongoing 404(a): $765,900 x 3 = $2,297,700
• Internal total over four reports: $2,915,600, with no attestation fee

Path B, a company that is a large accelerated filer by its second 10-K:

• 10-K 2, first year of 404(a) and 404(b): $1,047,200
• 10-K 3, second year: $1,150,000
• 10-K 4 and 5, beyond the second year: $1,404,300 x 2 = $2,808,600
• Internal total over four reports: $5,005,800, plus the auditor's attestation work inside the audit fee

Path B costs $2,090,200 more in internal effort over the same four reports, and that is before any audit fee. The averages come from different companies, and the 404(b) groups skew larger, so part of the gap is company size rather than the rule itself. The direction holds anyway: auditor attestation is the single biggest step in the SOX bill.

GAO's data shows how fast companies can land on Path B. A study it cites followed 40 firms after their IPOs and found that 17 (42.5%) lost emerging growth status within two years. A pre-IPO plan that budgets only for 404(a) is betting the company grows slowly.

What the auditor adds

Audit firms do not bill a separate line for SOX attestation, because PCAOB standards fold it into one integrated audit. GAO worked around that by tracking 98 companies that moved from exempt to nonexempt status between 2019 and 2023. The median audit fee rose $219,000 (13%) in the year of transition.

Two smaller moves sit on either side of it. Fees rose a median $80,000 in the year before transition, which GAO's interviewees tied to companies paying auditors to test controls early, and a median $47,000 the year after, when they mostly leveled off. In a separate regression on 96 companies, GAO found nonexempt companies paid 19% higher audit fees than exempt ones of similar revenue.

One exempt biotech company told GAO that losing its exemption would double its audit fee from $500,000 to $1 million and add $400,000 of internal cost. That is one company's estimate, not a benchmark, but it shows the scale a smaller filer should expect.

What drives the internal cost up or down

Location count is the clearest driver in the Protiviti data. Single-location companies averaged $704,800 a year, companies with 2 to 9 locations $1,158,500, and those with 10 or more $1,607,100. More locations means more controls: a single-location company reported 34 entity-level and 307 process-level key controls on average.

Below $1 billion in revenue, size barely moves the average. Companies under $500 million in revenue averaged $651,000, almost the same as the $651,800 for $500 million to $999.99 million. Above that the averages climb: $1,035,000 from $1 billion to $4.99 billion and $1,791,700 at $10 billion or more.

Filer status tracks the attestation rule. Non-accelerated filers, which include smaller reporting and emerging growth companies, averaged $723,100, accelerated filers $882,700 and large accelerated filers $1,364,800.

The low end is real too. Among companies under $500 million in revenue, 55% spent $500,000 or less, and 45% of first-year 404(a) filers did the same. A lean single-location company with a short control list can run well under the headline average.

How many hours the controls take

Protiviti asked how many hours each key control takes per activity. Testing operating effectiveness averaged 5.9 hours a control, a design walkthrough 5.1 hours and documentation 4.9 hours.

Apply those to the 341 key controls of an average single-location company and the arithmetic gives about 2,012 hours of testing alone, or 5,422 hours across all three activities. At a 2,080-hour work year, that is roughly 2.6 full-time people before anyone remediates a deficiency. Hours are also the line that keeps growing: 58% of respondents said their SOX hours rose in fiscal 2022, and only 14% said they fell.

Much of that work goes outside the company. Respondents put an average 36% of internal SOX cost on outsourced resources, onshore or offshore. Those consulting and co-sourcing fees sit inside the internal averages above, not on the audit firm's invoice.

The software line

SOX platforms do not publish prices, so this page builds no software total. Every vendor below routes buyers to a demo or a quote, read on October 21, 2026.

Platform	What its pricing page shows	Our coverage
Optro, formerly AuditBoard	Quote-only; Optro prints no price and lists unlimited stakeholder licenses	AuditBoard review
Workiva	Quote-only; Workiva prints no price and builds a custom quote for each organization	Workiva alternatives
Hyperproof	Quote-only; Hyperproof prints no price and shows a product tour instead of plans	Hyperproof review
Scytale	Quote-only; names Build, Scale and Enterprise plans with no dollar figure	None yet

GAO counts software among the internal costs of 404(a), so a platform competes for the same budget as staff time. It pays off when it cuts hours, and it saves nothing on the auditor's fee unless the auditor relies on more of your testing. Respondents said external auditors relied on an average 29% of their controls testing, and 24% for the smallest revenue band.

The ranked list with each platform's strengths sits in the best SOX compliance software. Toolradar keeps tool pages for AuditBoard, Workiva and Hyperproof.

What the averages leave out

• Readiness before the first 10-K. The survey measures annual compliance years, so pre-IPO process mapping and control design are not priced in it.
• Remediation. A material weakness adds testing, consulting and audit hours that the averages do not isolate.
• Data age. The survey covers fiscal 2022, and GAO found audit fees rose almost 6% a year from 2019 through 2023. A June 2024 Protiviti poll of webinar attendees had 52% saying internal SOX costs rose over two years.
• Vendor ties. Protiviti sells SOX consulting, and AuditBoard, now Optro, helped write the 2023 questionnaire. GAO also calls the survey nongeneralizable. Treat the averages as a range marker, not a quote.

What to budget before the IPO

Put three numbers in the plan. First, the internal cost of the first 404(a) year, sized off location count, near $705,000 for one location. Second, the year the company is likely to lose its exemption, using the float and revenue tests above. Third, the audit fee step GAO measured for that year, confirmed with your audit firm in writing.

Many key controls sit in the financial close, so documenting the close is control work you can start before the IPO. The month-end close checklist and the best close management software cover that ground, and FloQast vs BlackLine compares the two close platforms on price and fit. For the rest of the pre-IPO stack, see the best finance stack for a Series A company, NetSuite implementation cost and the CFO software pricing index. The equity side needs its own budget: 409A valuation cost and cap table software pricing compared.

How we built this

We read the Protiviti 2023 Sarbanes-Oxley Compliance Survey (564 respondents, conducted online in the second quarter of 2023), GAO report GAO-25-107500 (published June 2025), the SEC's emerging growth company page, its 2020 accelerated filer release, and Item 308 and Rule 12b-2 in the eCFR, all on October 21, 2026. The 2023 edition is the latest Protiviti survey with dollar cost averages; its 2024 follow-up was a webinar poll without them. Path totals and hour estimates are our arithmetic on those published figures. Software prices come from each vendor's own pricing page. No third-party price estimate is used anywhere on the page.

FAQ

How much does SOX compliance cost a newly public company?

Nothing for the first 10-K, which is exempt from both ICFR reports. From the second 10-K, the first year of management assessment under 404(a) averages about $618,000 in internal cost on Protiviti's survey. A company that also needs auditor attestation that year averages about $1.05 million internally, plus a higher audit fee.

How much does SOX 404(b) add to audit fees?

GAO tracked 98 companies that became subject to auditor attestation between 2019 and 2023. Their median audit fee rose $219,000, or 13%, in the transition year, after a median $80,000 rise the year before. Fees then mostly leveled off, with a median $47,000 rise the following year.

Do emerging growth companies have to comply with SOX?

Yes, partly. An emerging growth company still files management's 404(a) assessment from its second annual report. It skips auditor attestation under 404(b) for up to five fiscal years after the IPO, unless it crosses $1.235 billion in revenue, issues over $1 billion of non-convertible debt in three years, or becomes a large accelerated filer.

Is SOX cheaper for a small public company?

In dollars, yes. Single-location companies averaged $704,800 a year against $1,607,100 for those with 10 or more locations, and 55% of companies under $500 million in revenue spent $500,000 or less. GAO notes the burden is heavier relative to company size, and a smaller reporting company under $100 million in revenue avoids auditor attestation altogether.

How much does SOX compliance software cost?

Optro (formerly AuditBoard), Workiva, Hyperproof and Scytale are all quote-only and publish no price, as of October 21, 2026. Of 220 compliance tools tracked on Toolradar, only 20 publish a paid price. Ask for a quote with your control count and user count fixed, so offers compare like with like.

What is the biggest cost in SOX compliance?

People. Internal SOX cost is mostly staff and outside help, with respondents placing an average 36% of it on outsourced resources. Key control testing alone takes about 2,012 hours a year for an average single-location company, on Protiviti's per-control averages.

This page is general information, not personalized financial, legal or accounting advice. Confirm your filer status, exemption dates and fees with your auditor and securities counsel before you build the budget.

Cite this: CFOpresso, "How Much Does SOX Compliance Cost in 2026? Costs by Filer Year", November 2026.

Some offers on this page may be paid placements or contain affiliate links.