Section 404 of the Sarbanes-Oxley Act of 2002 requires a company to document and periodically test its internal controls and the company’s external auditors to offer an opinion on those controls.