Ctrl Worx Watch List™ report, October 2026

How long reported material weaknesses go without a reported fix, with and without auditor attestation

By Russell Tomoum, Ctrl Worx

Published October 28, 2026. Data as of October 25, 2026, end of day, Eastern Time.
From the companies’ own SEC filings. Last corrected October 28, 2026, see the corrections log.

The October Clock reading. Next reading: Wednesday, January 27, 2027. Get the January report by email: sign up for Watch List Weekly, the free weekly email.

The Ctrl Worx Watch List tracks public companies whose own SEC filings report a material weakness in internal control over financial reporting, or conclude that internal control isn’t effective, where no later annual report has said it is fixed. On October 25, 2026, 1,244 companies were on the Clock: still filing with the SEC, with the weakness on record and no annual report saying it’s fixed. The median company had been on it 3.07 years.

This report splits those companies by one line on the cover of their latest 10-K: whether an outside auditor attested to management’s assessment of internal control under Section 404(b) of the Sarbanes-Oxley Act.

Headline finding

Where the latest 10-K carries an auditor’s 404(b) attestation, the median company has been on the Clock 1.82 years (132 companies). Where management’s report stands alone, it’s 3.82 years (996 companies).

26% of the attested group have been on the Clock more than three years, against 59% of the group with management’s report alone. All 7 companies on the Clock more than seven years file management’s report alone.

This describes two groups. It doesn’t show that attestation shortens a weakness. The groups differ in other ways: the 404(b) attestation applies to accelerated and large accelerated filers, so the attested group is made up mostly of larger companies.

Auditor attestsSection 404(b) · 132 companies

1.82 years

Management's report aloneSection 404(a) · 996 companies

3.82 years

01234

Years

The other 116 companies on the Clock (no management report yet, no management report in the latest 10-K, or no 10-K on file yet) are in the table, not the chart.

Cite this chartEmbed this chart

Companies that cleared

Companies whose own annual report says the weakness is fixed are listed on the Ctrl Worx Cleared list, with the filing’s own words and how long each took: ctrlworx.com/watch-list/cleared/. The list started on October 25, 2026 and doesn’t yet count every fix since 2021, so this report gives no median time to fix.

Why it matters now

In May 2026 the SEC proposed changes to filer status that would raise the large accelerated filer threshold from $700 million to $2 billion of public float, and companies below it wouldn’t need the 404(b) attestation (SEC Release No. 33-11419). These figures show how long companies have stayed on the Clock where management’s report already stands alone.

The numbers

Two groups are set by the latest 10-K’s cover: an auditor’s attestation report, or management’s report alone. Three rows sit outside both. “No management report yet (newly public)”: the latest 10-K says it doesn’t include management’s report on internal control, under the SEC’s transition period for newly public companies. “No management report in latest 10-K”: companies that have filed more than one 10-K, but whose latest one leaves out management’s report on internal control. Eight of the nine cite the transition period for newly public companies. “No 10-K on file yet”: the company has filed 10-Qs but no annual report. Most companies (967) are grouped by the printed cover box; the rest by tagged cover data (29), filer category or Item 9A (117), or by hand (15). Percentages are of each group.

What we found

The gap holds across the range. The attested group’s median is 1.82 years; the median for management’s report alone is 3.82. At the long end, 390 companies with management’s report alone have been on the Clock more than five years, against 19 in the attested group.

The longest clocks all sit in the management’s-report-alone group. All 7 companies on the Clock more than seven years file management’s report alone: Kingfish Holding, Seguin Natural Hair Products, Nutra Pharma, Apex 11, PHI Group, Scores Holding, America Great Health. Every one of their clocks starts before January 2021 (see Limitations).

By state and industry

1,083 companies on the Clock are based in the US and 161 outside it, by the business address on each company’s EDGAR record.

Each company is listed by name, with a link to the filing that put it on the Clock, in the data file and on its company page.

How we counted

• Who’s on the Clock. Companies that file 10-Ks and 10-Qs with the SEC, whose own filing states one or more material weaknesses in internal control over financial reporting, or concludes that internal control over financial reporting isn’t effective. We read filings from January 2021 on. A company comes off when its own later annual report says the weakness is fixed or concludes internal control is effective, and not before. A 10-Q that says it’s fixed doesn’t take it off.
• When the clock starts. The earliest period end the company itself reported the weakness for. If a later annual report said internal control was effective and the weakness came back, the clock restarts.
• Who’s in each group. We read the 404(b) check box on the cover of each company’s latest 10-K. Where the cover has no printed box, we used the company’s tagged cover data, then its filer category and Item 9A. A few were read by hand.
• The figures. Years on the Clock as of October 25, 2026. Medians are the middle value in each group.
• Full method, statuses and the corrections log: Method and corrections

Limitations

• These are years on the Clock so far, not time to fix. Every company here still has the weakness on record, so its final time will be longer.
• Clocks that start before January 2021 are “at least” figures. 295 companies have clocks that start before our records begin.
• 0 companies have a later 10-K on EDGAR that we haven’t read. On Oct 18 we read all 513 we had presumed clean: 500 were clean, and 13 still reported a weakness and went on record.
• Until October 25, 2026 our search found filings by the words “material weakness.” Some filings conclude internal control isn’t effective without those words. A full check of those runs after this report. It may add companies or move start dates, and every change goes on the corrections log.
• Stale filers and stopped filers aren’t in these groups. They stay on record with their time shown on the Watch List, outside every median here.

Schedule

The Watch List report comes out on the fourth Wednesday of January, April, July and October. The next one is Wednesday, January 27, 2027. The Five-Year List comes out Wednesday, May 12, 2027.

Corrections

We correct confirmed errors within two business days, with the filing cited, on the corrections log. 185 corrections were logged before this report’s data date. If you see an error, send us the filing.

Independence

The Ctrl Worx Watch List is independent. It’s built from the companies’ own SEC filings and isn’t affiliated with the SEC or any government body. No company on the Watch List can sponsor it, advertise with us or pay us, and Ctrl Worx takes no new paid advisory work from a company while it’s on the Watch List or for 12 months after. Every company on the list can have a response posted on its page.

Disclosure

Ctrl Worx also does SOX advisory work. Its independence policy sets out the limits above.

Watch List Weekly: new material weaknesses, fixes and the longest-running cases, every Monday.

Subscribe

One email to confirm, then one email each Monday. Every email has a one-click unsubscribe. Privacy policy