Internal control reporting is mandatory mainly for listed groups. In the US every SEC issuer's management must assess internal control over financial reporting under section 404(a) of the Sarbanes-Oxley Act, and accelerated and large accelerated filers also need auditor attestation; US issuers must keep accurate books and internal accounting controls under the Exchange Act. Singapore relies on director duties and CEO and CFO assurance for listed companies. India's CARO and internal financial controls reporting could not be confirmed.
United States: section 404 and the books and records rule
Section 404(a) requires each SEC issuer's annual report to include management's assessment of the effectiveness of internal control over financial reporting at year end. Section 404(b) adds an attestation by the registered audit firm, performed within the audit, but this does not apply to emerging growth companies or to issuers that are neither accelerated nor large accelerated filers.
Separately, the Exchange Act requires issuers to keep books and records that fairly reflect transactions and to maintain internal accounting controls. For a foreign subsidiary of a US-listed group, the parent's obligations translate into group control requirements, documentation and testing at the subsidiary.1234
Singapore: director duties and listed company assurance
Singapore directors must ensure management keeps complete and accurate records, in-house or outsourced, and must present financial statements under prescribed standards. For SGX-listed companies, the Code of Corporate Governance 2018 expects the annual report to say whether the board has received CEO and CFO assurance on the records, the financial statements and internal controls.56
| Market | Who | Requirement | Source |
|---|---|---|---|
| United States | All SEC issuers | Management assessment of ICFR (404(a)) | 15 USC 7262(a) |
| United States | Accelerated and large accelerated filers (not EGCs) | Auditor attestation (404(b)) | 15 USC 7262(b)-(c) |
| United States | Issuers | Books, records and internal accounting controls | 15 USC 78m(b)(2) |
| Singapore | SGX-listed companies | Statement on CEO and CFO assurance | ACRA; Code of Corporate Governance 2018 |
| India | Not confirmed | CARO 2020 and internal financial controls reporting | See gaps |
Decisions to make
- Is the parent an SEC issuer, and what is its filer status?23Filer status decides whether auditor attestation of ICFR is required in addition to management's assessment.
- Which subsidiaries are in scope of group control testing?4The issuer's books, records and internal control duties reach the transactions recorded by its subsidiaries.
- Who in each subsidiary owns the records, especially where bookkeeping is outsourced?5Singapore directors remain responsible for complete and accurate records even when they are outsourced.
Documents usually needed
- Risk and control matrix for each in-scope entity
- Management's ICFR assessment and testing evidence
- Sub-certifications from subsidiary finance heads
- Outsourcing agreements and service organisation reports
- CEO and CFO assurance statement for listed companies
Common mistakes
- Assuming smaller US issuers are free of section 404 entirely; management's assessment still applies
- Leaving subsidiaries out of control documentation because they are below materiality without a scoping analysis
- Treating outsourced bookkeeping as transferring the directors' responsibility
- Applying SOX-style testing to non-listed groups without considering cost
Questions businesses ask
Does a non-accelerated filer need an auditor's ICFR attestation?
No. Section 404(b) does not apply to issuers that are neither large accelerated nor accelerated filers, but management's own assessment under section 404(a) is still required.31
Do Singapore directors stay responsible if bookkeeping is outsourced?
Yes. Directors must ensure management maintains complete and accurate records, which may be kept in-house or outsourced.5
What this guide does not yet confirm
These points need checking with a qualified local professional before you rely on them.
- India: CARO 2020 applicability and exemptions, and auditor reporting on internal financial controls under section 143(3)(i) of the Companies Act 2013, could not yet be checked on the MCA, NFRA or India Code sites.
- SEC rules defining accelerated filer thresholds (Rule 12b-2) could not yet be checked.
- UK internal controls reforms (Corporate Governance Code provision 29) and any EU equivalents were not researched.
- UAE, Saudi and German internal control reporting duties were not researched.
Sources and review status
Each statement is numbered to the source it was checked against. We use official sources where we can, and each statement says whether it was checked against an official or a secondary source. Sources last checked on 19 October 2026. None of it has been professionally reviewed yet: it is research checked against official and secondary sources by WONE Global, not legal or tax advice.
Section 404(a) of the Sarbanes-Oxley Act requires an SEC issuer's annual report to contain management's internal control report, stating management's responsibility for adequate internal control over financial reporting and assessing its effectiveness at year end. Federal; SEC issuers.
Statutory text read on the Cornell Legal Information Institute reproduction of the United States Code; the official text is published at uscode.house.gov.
Section 404(b) requires the issuer's registered audit firm to attest to and report on management's internal control assessment under PCAOB standards, as part of the audit engagement rather than a separate one; emerging growth companies are excluded. Federal; SEC issuers.
Statutory text read on the Cornell Legal Information Institute reproduction of the United States Code; the official text is published at uscode.house.gov.
The auditor attestation in section 404(b) does not apply to issuers that are neither large accelerated filers nor accelerated filers. Federal; filer status as defined in Exchange Act Rule 12b-2. Management's own assessment under section 404(a) still applies.
Statutory text read on the Cornell Legal Information Institute reproduction of the United States Code; the official text is published at uscode.house.gov.
US issuers must keep books, records and accounts that in reasonable detail fairly reflect their transactions and must maintain internal accounting controls giving reasonable assurance that transactions are authorised and recorded and assets are safeguarded. Federal, Securities Exchange Act section 13(b)(2); applies to issuers with registered securities or reporting obligations, and through them to their consolidated subsidiaries in practice.
Statutory text read on the Cornell Legal Information Institute reproduction of the United States Code; the official text is published at uscode.house.gov. The application to subsidiaries in practice is an interpretation, not stated in the text read.
Singapore directors must ensure that management maintains complete and accurate accounting and other records, which may be kept in-house or outsourced, and must present financial statements that comply with prescribed accounting standards. All Singapore companies, Companies Act 1967 section 201 and related duties.
Under the Singapore Code of Corporate Governance 2018, an SGX-listed company's annual report should state whether the board has received assurance from the CEO and CFO on the financial records, the true and fair view of the financial statements and the adequacy of internal controls. SGX-listed companies, on a comply-or-explain basis.
Questions on this topic
6 statements on internal controls and icfr (sox, caro and local equivalents)
