Section 404 requires external auditors and management to report the status of their Internal Control on Financial Reporting (ICFR). Documenting and testing financial manual and automated controls requires significant effort and is the costliest legislation for companies to implement. The management has to produce an internal control report