Risk Strategy

The SEC Wants to Stop Requiring Risk Disclosure for 80% of Public Companies. Your Risk Program Just Became the Backstop.

The SEC just proposed letting about 80 percent of public companies stop disclosing their risks and stop having an auditor verify their controls. What that signals for mid-market risk leaders.

By Eric Kennedy · Tue Jun 09 2026 · 8 min read

TL;DR: On May 19, 2026, the SEC proposed a rule under which only the largest public companies, about 19 percent, would still be required to do two things: obtain an independent auditor's attestation that their financial controls work, and file a Risk Factors section. The other 81 percent, the entire mid-market included, would fall outside both. None of this is final and the timeline is long. But the direction is clear. The outside forces that pushed companies to prove their controls and write down their risks are being pulled back, and the thing left holding the line is the company's own risk program. That is good news only if the program actually works.

For most of the last two decades, two outside forces made companies take risk seriously whether leadership wanted to or not. Since Sarbanes-Oxley, an independent auditor has had to come in once a year and attest that a company's internal controls over financial reporting actually hold up. And the SEC has required a Risk Factors section in public filings, which forces management to write down, in plain view, what could go wrong. Both are now on the table to be removed for most of the market.

On May 19, 2026, the SEC proposed amendments that would raise the large accelerated filer threshold from 700 million dollars to 2 billion dollars in public float and collapse five overlapping filer categories into two. SEC Chairman Paul Atkins framed it as part of an agenda to make it cheaper to go and stay public. Whatever you think of the policy, the effect for a risk leader is specific. The regulatory floor under risk work is being lowered for roughly four out of five public companies.

This is a proposal, not a rule. The Federal Register published it on May 21, 2026, the public comment period closes July 20, 2026, and the path to adoption and an effective date is still long. But the market is already reading the signal, which is why it belongs in front of you now.

What the proposal actually changes

Today, a public company that crosses 700 million dollars in public float becomes a large accelerated filer. That triggers the most demanding tier of obligations, including the requirement to pay its outside auditor to independently test and attest that its internal controls over financial reporting work. That attestation is Section 404(b) of Sarbanes-Oxley, and it is a real, expensive engagement.

The proposal would raise that line to 2 billion dollars in public float and eliminate the accelerated filer and smaller reporting company categories entirely. Everything that is not a large accelerated filer becomes a non-accelerated filer. By the SEC's own estimate, that flips the population hard. Large accelerated filers drop from 35.4 percent of public companies today to 19.2 percent, and non-accelerated filers rise to 80.8 percent. The bar would also get harder to trip into by accident. A company would need 2 billion dollars in public float, measured as a 10-trading-day average at the end of its second fiscal quarter, for two straight years, plus 60 months as a public company, before it became a large accelerated filer.

For that whole non-accelerated filer group, two requirements would not apply. The 404(b) auditor attestation would not be required. And the company would not have to provide risk factor disclosure in its Form 10-K and Form 10-Q. Some smaller companies are already exempt from both today. What changes is the reach. The exemption would extend to almost the entire market, including the band of mid-market companies that currently carry these obligations as accelerated filers.

If you run risk at a mid-market public company, this is about you, not someone else. A company doing 50 to 500 million dollars in revenue is nowhere near 2 billion dollars in float. Under this proposal it is a non-accelerated filer, and it would sit outside both the attestation and the Risk Factors requirement.

Two safety nets, removed at the same time

It is worth being precise about what each of these did, because they did different jobs.

The 404(b) auditor attestation was an outside check on whether your controls work. Management has always had to assess its own controls. The auditor attestation added a second set of eyes that did not report to management and had to put its name on the conclusion. When that goes away, management owns the assertion alone. Nobody independent is coming behind you to catch what you missed.

The Risk Factors section did something quieter but just as useful. It forced a company to articulate its material risks in writing, every year, in a document the board and investors could read. It was not a great risk program. Plenty of Risk Factors sections are boilerplate. But it was a forcing function. It made someone sit down and name the things that could sink the business. Take the requirement away, and for many companies the only reason left to do that work is that they choose to.

So the proposal pulls back the external check on your controls and the external pressure to name your risks, in the same move, for the same companies.

What does not change

This is where most of the coverage stops short, and where the real point sits.

Management's own assessment of internal controls does not go away. Section 404(a), which requires management to assess and report on the effectiveness of its controls, still applies. The proposal removes the auditor's attestation, not management's responsibility. If anything, losing the second set of eyes makes management's own assessment carry more weight, not less.

Antifraud liability does not go away. A company that drops its Risk Factors section still cannot mislead investors about a risk it knows is material. The disclosure format changes. The duty not to hide a known problem does not.

And the people who actually hold a mid-market company accountable were never the SEC in the first place. They are your board, your private equity owner, your lenders, and the acquirer who will run diligence the day you decide to sell. None of them will lower their bar because the SEC lowered its floor. If anything, a buyer doing diligence on a company that no longer files risk factors will ask the obvious question: so where is your view of the risks, and who signed off on it?

Why this matters even if you are private

Most mid-market companies are private, so it is fair to ask why a public-company rule should change anything for you.

Two reasons. First, the public mid-market is directly hit, and many of those companies are exactly the size of your peers and your acquirers. Second, and more important, this is a signal about where the whole system is heading. The regulator is making a deliberate bet that internal accountability will carry what external mandates used to carry. That bet flows downhill. When the public-company standard moves from "an outside party will verify this" to "you are on your own," the expectation that lands on a private company in a sale process or a financing moves the same way. The buyer assumes you have your own house in order, because the market is no longer assuming someone else checked it for you.

The companies that come out ahead here are the ones whose risk work was never about the filing. They built a risk program rather than a risk register, because they wanted the clarity, not the compliance checkbox. For them, nothing changes. For everyone who was quietly leaning on the auditor and the filing to force the discipline, the discipline just became optional, and optional risk work has a way of not happening.

What to actually do about it

Treat the proposal as a prompt, not a deadline. Here is the practical response for a mid-market risk leader.

Do not read deregulation as permission to do less. The temptation, when an obligation lifts, is to reallocate the effort somewhere else. Resist it for the part of risk work that was actually producing decisions. The filing was never the value. The thinking behind it was.

If you drop the Risk Factors section, keep an internal equivalent. You lose nothing by maintaining a current, plain-language view of your material risks for the board, even if it never goes in a 10-K. A short risk appetite statement and a living risk register do the same job the filing used to force, with more honesty, because you are writing it for yourselves.

Make sure the program produces decisions, not documentation. With no auditor attestation behind you, the question is no longer "did we file it." It is "does our own assessment hold up." That is a higher bar, and it is the right one. If your risk reporting is documenting activity rather than driving choices, the safety net coming off is the moment that gap starts to cost you.

Tie it to the cadence you already run. Risk belongs in the quarterly board or audit committee conversation you already have, against the controls and the risks that actually move the business. It does not need a separate process. It needs to be real.

Treat exit and diligence readiness as the bar. The SEC just told you the floor is dropping. Your acquirer, your lender, and your board did not. Build to their standard, because they are the ones who will actually test it.

The bottom line

The SEC is proposing to stop requiring most public companies to prove their controls work and to name their risks. If that becomes the rule, the external scaffolding that propped up a lot of mediocre risk programs comes down. What is left standing is whatever you actually built. For companies with a real program, that is a quiet advantage. For companies that were relying on the auditor and the filing to do the forcing, it is a problem they will not see until something goes wrong and there is no one behind them to have caught it.

Where to Start

If you want a quick read on whether your risk program would hold up without the external scaffolding, start with the ERM scorecard. It takes a few minutes and gives you a maturity read on the spot. If you are ready to build a program that functions as the backstop rather than a filing that satisfied a requirement, the ERM Foundation Build is where that work happens.

Take the ERM Scorecard{.cta-primary} See the ERM Foundation Build{.cta-secondary}