United States Government Accountability Office

GAO Report to the Committee on Small 

Business and Entrepreneurship, U.S. 

Senate 

SARBANES-OXLEY 

ACT 

April 2006 

Consideration of Key 

Principles Needed in 

Addressing 

Implementation for 

Smaller Public 

Companies 

 

GAO-06-361 
What GAO Found

United States Government Accountability Office

Why GAO Did This Study

Highlights

Accountability Integrity Reliability

April 2006

SARBANES-OXLEY ACT 

Consideration of Key Principles Needed 

in Addressing Implementation for Smaller 

Public Companies 

Highlights of GAO-06-361, a report to the 

Committee on Small Business and 

Entrepreneurship, U.S. Senate 

Congress passed the SarbanesOxley Act to help protect investors 

and restore investor confidence.

While the act has generally been

recognized as important and 

necessary, some concerns have

been expressed about the cost for 

small businesses. In this report, 

GAO (1) analyzes the impact of the

Sarbanes-Oxley Act on smaller 

public companies, particularly in 

terms of compliance costs; (2)

describes responses of the 

Securities and Exchange

Commission (SEC) and Public 

Company Accounting Oversight 

Board (PCAOB) to concerns raised 

by smaller public companies; and 

(3) analyzes smaller public 

companies’ access to auditing

services and the extent to which

the share of public companies 

audited by mid-sized and small 

accounting firms has changed since 

the act was passed. 

What GAO Recommends

SEC should (1) assess sufficiency 

of internal control guidance for 

smaller public companies, (2) 

coordinate with PCAOB to ensure

consistency of section 404 auditing 

standards with any additional

internal control guidance for public

companies, and (3) if further relief 

is deemed appropriate, analyze the 

unique characteristics of smaller 

public companies and their 

investors to ensure that the 

objectives of investor protection

are met and any relief provided is 

targeted and limited. 

Regulators, public companies, audit firms, and investors generally agree that 

the Sarbanes-Oxley Act of 2002 has had a positive and significant impact on 

investor protection and confidence. However, for smaller public companies 

(defined in this report as $700 million or less in market capitalization), the 

cost of compliance has been disproportionately higher (as a percentage of 

revenues) than for large public companies, particularly with respect to the 

internal control reporting provisions in section 404 and related audit fees. 

Smaller public companies noted that resource limitations and questions 

regarding the application of existing internal control over financial reporting 

guidance to smaller public companies contributed to challenges they face in 

implementing section 404. The costs associated with complying with the act, 

along with other market factors, may be encouraging some companies to 

become private. The companies going private were small by any measure 

and represented 2 percent of public companies in 2004. The full impact of 

the act on smaller public companies remains unclear because the majority of 

smaller public companies have not fully implemented section 404. 

To address concerns from smaller public companies, SEC extended the 

section 404 deadline for smaller companies with less than $75 million in 

market capitalization, with the latest extension to 2007. Additionally, SEC 

and PCAOB issued guidance intended to make the section 404 compliance 

process more economical, efficient, and effective. SEC also encouraged the 

Committee of Sponsoring Organizations of the Treadway Commission 

(COSO), to develop guidance for smaller public companies in implementing

internal control over financial reporting in a cost-effective manner. COSO’s 

guidance had not been finalized as of March 2006. SEC also formed an 

advisory committee to examine, among other things, the impact of the act on

smaller public companies. The committee plans to issue a report in April 

2006 that will recommend, in effect, a tiered approach with certain smaller 

public companies partially or fully exempt from section 404, “unless and 

until” a framework for assessing internal control over financial reporting is 

developed that recognizes the characteristics and needs of smaller public 

companies. As SEC considers these recommendations, it is essential that the 

overriding purpose of the Sarbanes-Oxley Act—investor protection—is 

preserved and that SEC assess available guidance to determine if additional 

supplemental or clarifying guidance for smaller public companies is needed. 

Smaller public companies have been able to obtain access to needed audit 

services and many moved from the largest accounting firms to mid-sized and 

small firms. The reasons for these changes range from audit cost and service 

concerns cited by companies to client profitability and risk concerns cited 

by accounting firms, including capacity constraints and assessments of 

client risk. Overall, mid-sized and small accounting firms conducted 30 

percent of total public company audits in 2004—up from 22 percent in 2002. 

However, large accounting firms continue to dominate the overall market, 

auditing 98 percent of U.S. publicly traded company sales or revenues. 

www.gao.gov/cgi-bin/getrpt?GAO-06-361.

To view the full product, including the scope 

and methodology, click on the link above. 

For more information, contact William B. 

Shear, (202) 512-8678 or shearw@gao.gov, 

or Jeanette M. Franzel, (202) 512-9471 or 

franzelj@gao.gov. 
Contents 

Letter 1

Results in Brief 4

Background 9

Smaller Public Companies Have Incurred Disproportionately 

Higher Audit Costs in Implementing the Act, but Impact on 

Access to Capital Remains Unclear 14

SEC and PCAOB Have Been Addressing Smaller Company 

Concerns Associated with the Implementation of Section 404 26

Sarbanes-Oxley Act Requirements Minimally Affected Smaller 

Private Companies, Except for Those Seeking to Enter the 

Public Market 36

Smaller Companies Appear to Have Been Able to Obtain Needed 

Auditor Services, Although the Overall Audit Market Remained 

Highly Concentrated 42

Conclusions 52

Recommendations 58

Agency Comments and Our Evaluation 58

Appendix I Objectives, Scope, and Methodology 61 

Appendix II Additional Details about GAO’s Analysis of Companies 

Going Private 73 

Appendix III Comments from the Securities and Exchange 

Commission 84 

Appendix IV Comments from the Public Company Accounting 

Oversight Board 86 

Appendix V GAO Contacts and Staff Acknowledgments 87 

Page i GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Tables 

Table 1: Summary of Selected Sarbanes-Oxley Act Provisions 

Affecting Public Companies and Registered Accounting 

Firms 11

Table 2: Primary Reasons Cited by Companies for Going Private, 

1998-2005, by Percent 23

Table 3: SEC Extensions of Section 404 Compliance Dates 27

Table 4: IPO Direct Expenses as a Percentage of Company’s 

Revenues, by Size 38

Table 5: Companies Changing Accounting Firms, 2003-2004 44

Table 6: Cross-sectional Comparison of Request Letter Questions, 

Our Report Objectives, and Selected Findings 61

Table 7: Reason for Going Private, by Category Descriptions 80

Figures 

Figure 1: Median Audit Fees as a Percentage of 2003 and 2004 

Revenues Reported by Public Companies as of August 11, 

2005 16

Figure 2: Total Number of Companies Identified as Going Private, 

1998-2005 22

Figure 3: Where Companies Traded Prior to Deregistration, July 

2003-March 2005 25

Figure 4: IPO and Stock Market Performance, 1998-2005 39

Figure 5: Average Size of Companies Changing Auditors, 2003-2004, 

by Type of Accounting Firm Change 46

Figure 6: Percentage of Clients Audited by Revenue Category, 4 

Largest Accounting Firms versus Mid-sized and Small 

Accounting Firms, 2004 49

Figure 7: Total Number of IPOs, by Size of Accounting Firm, 1999–

2004 51

Figure 8: Total Number of Companies Identified as Going Private 

from 1998 to 2005 77

Page ii GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Abbreviations 

AMEX American Stock Exchange 

CEO chief executive officer 

CFO chief financial officer 

COSO Committee of Sponsoring Organizations of the Treadway 

 Commission 

EDGAR Electronic Data Gathering, Analysis, and Retrieval system 

FCPA Foreign Corrupt Practices Act of 1977 

HHI Hirschman-Herfindahl Index 

IPO initial public offering 

NASD National Association of Securities Dealers, Inc. 

NASDAQ The Nasdaq Stock Market, Inc 

NYSE New York Stock Exchange 

PCAOB Public Company Accounting Oversight Board 

QPL Questionnaire Programming Language 

OTCBB Over the Counter Bulletin Board 

SAS statistical analysis software 

SBA Small Business Administration 

SEC Securities and Exchange Commission 

SPO secondary public offering 

This is a work of the U.S. government and is not subject to copyright protection in the 

United States. It may be reproduced and distributed in its entirety without further 

permission from GAO. However, because this work may contain copyrighted images or 

other material, permission from the copyright holder may be necessary if you wish to 

reproduce this material separately. 

Page iii GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
United States Government Accountability Office

Washington, DC 20548 

April 13, 2006 

The Honorable Olympia J. Snowe 

Chair 

Committee on Small Business and Entrepreneurship 

United States Senate 

The Honorable Michael B. Enzi 

United States Senate 

In response to numerous corporate failures arising from corporate 

mismanagement and fraud, Congress passed the Sarbanes-Oxley Act of 

2002.1

 Generally recognized as one of the most significant market reforms 

since the passage of the securities legislation of the 1930s, the act is 

intended to help protect investors and restore investor confidence by 

improving the accuracy, reliability, and transparency of corporate 

financial reporting and disclosures, and reinforce the importance of 

corporate ethical standards. Public and investor confidence in the fairness 

of financial reporting and corporate ethics is critical to the effective 

functioning of our capital markets. The act’s requirements apply to all 

public companies regardless of size and the public accounting firms that 

audit them. 

The act established the Public Company Accounting Oversight Board 

(PCAOB) as a private-sector non-profit organization to oversee the audits 

of public companies that are subject to securities laws. PCAOB, which is 

subject to oversight by the Securities and Exchange Commission (SEC), is 

responsible for establishing related auditing, quality control, ethics, and 

auditor independence standards. The act also addresses auditor 

independence and the relationship between auditors and the public 

companies they audit. The act requires public companies to assess the 

effectiveness of their internal control over financial reporting and for their 

external auditors to report on management’s assessment and the 

Sarbanes-Oxley Act Challenges for Small Companies

 

1

Pub. L. No. 107-204, 116 Stat. 745 (July 30, 2002). 

Page 1 GAO-06-361 
effectiveness of internal controls.2

 The act also contains provisions 

intended to make chief executive officers (CEO) and chief financial 

officers (CFO) more accountable, improve the oversight role of boards of 

directors and audit committees, and provide whistleblower protection. 

Finally, the act expanded the SEC’s oversight powers and mandated new 

and expanded criminal penalties for securities fraud and other corporate 

violations. 

The specific objectives of this report are to (1) analyze the impact of the 

Sarbanes-Oxley Act on smaller public companies, including costs of 

compliance and access to capital; (2) describe SEC’s and PCAOB’s efforts 

related to the implementation of the act and their responses to concerns 

raised by smaller public companies and the accounting firms that audit 

them; (3) analyze the impact of the act on smaller privately held 

companies, including costs, ability to access public markets, and the 

extent to which states and capital markets have imposed similar 

requirements on privately held companies; and (4) analyze smaller 

companies’ access to auditing services and the extent to which the share 

of public companies audited by small accounting firms has changed since 

the enactment of the act..3

To address these objectives, we reviewed information from a variety of 

sources, including the legislative history of the act, relevant regulatory 

pronouncements and public comments, research studies and papers, and 

other stakeholders (such as trade groups and market participants). To 

analyze the impact of the act on smaller public companies, we obtained 

data from SEC filings provided through a licensing agreement with Audit 

Analytics, and analyzed data elements including auditing fees and auditor 

 

2

Internal control is defined as a process effected by an entity’s board of directors, 

management, and other personnel, designed to provide reasonable assurance regarding the 

achievement of the following objectives: (1) effectiveness and efficiency of operations; (2) 

reliability of financial reporting; and (3) compliance with laws and regulations. Internal 

control over financial reporting is a process that a company puts in place to provide 

reasonable assurance regarding the reliability of financial reporting and the integrity of the 

financial statement preparation process. 

3

For the purposes of this report, we use the term smaller public company to refer to a 

company with a market capitalization of $700 million or less unless otherwise noted. We 

use the term large accounting firms to refer to the top four U.S. accounting firms in terms 

of total revenue in fiscal year 2004—Deloitte & Touche LLP, Ernst & Young LLP, 

PricewaterhouseCoopers LLP, and KPMG LLP; mid-sized firms to refer to the four next 

largest U.S. firms—Grant Thornton LLP, BDO Seidman LLP, Crowe Chizek & Company 

LLC, and McGladrey & Pullen LLP; and small firms to refer to all other accounting firms in 

the United States., which consist of regional and local firms. 

Page 2 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
changes to determine costs of compliance.4

 Similarly, we constructed a 

database of public companies that went private using SEC filings and 

press releases retrieved from Lexis-Nexis, an online periodical database. 

To obtain information on smaller public companies’ experiences with 

Sarbanes-Oxley Act compliance, we also conducted a survey of companies 

with market capitalization of $700 million or less and annual revenues of 

$100 million or less that, as of August 11, 2005, reported to SEC that they 

had complied with the act’s internal control-related requirements. One 

hundred fifty-eight of 591 companies completed the survey, for an overall 

response rate of 27 percent.5

 Additionally, we held discussions with 

representatives of SEC, the Small Business Administration (SBA), PCAOB, 

smaller public companies, the Committee of Sponsoring Organizations of 

the Treadway Commission (COSO), financial service providers, rating 

agencies, institutional investors, trade groups, accounting firms, and other 

market participants.6

Because SEC has extended the date by which registered public companies 

with less than $75 million in public float (known as non-accelerated filers) 

had to comply with the act’s internal control-related provisions (section 

404) to their first fiscal year ending on or after July 15, 2007, we could not 

analyze the impact of the internal control provisions of the act for a 

significant number of smaller public companies (SEC estimates that nonaccelerated filers represent about 60 percent of all registered public 

 

4

Audit Analytics is an online market intelligence service that provides information on U.S. 

public companies registered with SEC and accounting firms. 

5

We conducted an analysis to determine whether the respondents to our survey differed 

from the population of 591 companies in company assets, revenue, market capitalization, 

or type of company (based on the North American Industrial Classification System code) 

and found no evidence of substantial non-response bias on these characteristics. However, 

because of the low response rate, we do not consider these data to be a probability sample 

of all smaller public companies. 

6

COSO was originally formed in 1985 to sponsor the National Commission on Fraudulent 

Financial Reporting, an independent private-sector initiative that studied the causal factors 

that can lead to fraudulent financial reporting and developed recommendations for public 

companies and their independent auditors, SEC and other regulators, and educational 

institutions. 

Page 3 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
companies).7

 Thus, to gain some insight into the potential impact these 

provisions may have on smaller public companies, we analyzed public data 

and other information related to the experiences of public companies that 

have fully implemented the act’s provisions. To determine the act’s impact 

on smaller privately held companies, we interviewed officials about state 

requirements comparable to key Sarbanes-Oxley provisions and 

representatives of smaller private companies and financial institutions 

about capital access requirements. We also analyzed data on companies’ 

initial public offering (IPO) and secondary public offering (SPO) from SEC 

filings. To assess changes in the domestic public company audit market, 

we used public data—for 2002 and 2004—on public companies and their 

external accounting firms to determine how the number and mix of 

domestic public company audit clients had changed for firms other than 

the large accounting firms. As requested by your staff, we addressed nine 

specific questions contained in your request letter. 

Appendix I contains a more complete description of our scope and 

methodology, including a cross-sectional comparison between the nine 

specific questions contained in the request letter and the four objectives of 

this report. We conducted our work in California, Connecticut, Georgia, 

Maryland, New Jersey, New York, Virginia, and Washington, D.C., from 

November 2004 through March 2006 in accordance with generally 

accepted government auditing standards. 

While regulators, public companies, auditors, and investors generally 

agree that the Sarbanes-Oxley Act has had a positive impact on investor 

protection, available data indicate that smaller public companies face 

Results in Brief 

 

7

Until recently, SEC distinguished between two types of public companies for financial 

reporting purposes—accelerated filers and non-accelerated filers. SEC defined a public 

company as an accelerated filer if it met certain conditions, namely that the company had a 

public float of $75 million or more as of the last business day of its most recently 

completed second fiscal quarter and the company filed at least one annual report with SEC. 

A non-accelerated filer is generally a public company that had a public float of less than $75 

million as of the last business day of its most recently completed second fiscal quarter. In 

December 2005, SEC created a new category, the large accelerated filer. A large 

accelerated filer is generally a public company that had a public float of $700 million or 

more as of the last business day of its most recently completed second fiscal quarter. SEC 

also redefined an accelerated filer as a company that had at least $75 million but less than 

$700 million in public float. Accelerated filers and large accelerated filers are subject to 

shorter financial reporting deadlines than non-accelerated filers. SEC defines public float 

as the aggregate market value of voting and non-voting common equity held by nonaffiliates of the issuer. 

Page 4 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
disproportionately higher costs (as a percentage of revenues) in complying 

with the act, consistent with the findings of the Small Business 

Administration on the impact of regulations generally on small businesses. 

While smaller companies historically have paid disproportionately higher 

audit fees than larger companies as a percent of revenues, the percentage 

difference between median audit fees paid by smaller versus larger public 

companies grew in 2004, particularly for companies that implemented the 

act’s internal control provisions (section 404). Smaller public companies 

also cited other costs of compliance with section 404 and other provisions 

of the act, such as the use of resources for compliance rather than for 

other business activities. Moreover, the characteristics of smaller 

companies, including resource and expertise limitations and lack of 

familiarity with formal internal control frameworks, contributed to the 

difficulties and costs they experienced in implementing the act’s 

requirements. This situation was also impacted by the fact that many 

companies documented their internal control for the first time and needed 

to make significant improvements to their internal control as part of their 

first year of implementing section 404, despite the fact that most have 

been required by law since 1977 to have implemented a system of internal 

accounting controls. Smaller public companies and accounting firms noted 

that the complexity of the internal control framework and the scope and 

complexity of the audit standard and related guidance for auditors on 

section 404 issued during rather than prior to the initial year of 

implementation contributed to the costs and challenges experienced in the 

first year of implementation.8

 It is generally expected that compliance 

costs for section 404 will decrease in subsequent years, given the first-year 

investment in documenting internal controls. The act, along with other 

market forces, appeared to have been a factor in the increase in public 

companies deregistering with SEC (going private)—from 143 in 2001 to 

245 in 2004. However, these companies were small by any measure 

(market capitalization, revenue, or assets) and represented 2 percent of 

public companies in 2004. Based on our survey responses and discussions 

with smaller public companies that implemented section 404, it appears 

that the act has not adversely affected the ability of those smaller public 

companies to raise capital. However, it is too soon to assess fully the 

impact of the act on access to capital, particularly because of the large 

number of smaller public companies—the more than 5,900 small public 

 

8

This report focuses on smaller public companies, but some of the identified challenges and 

costs may also be present in larger public companies. 

Page 5 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
companies considered by SEC to be non-accelerated filers—that have 

been given an extension by SEC to implement section 404. 

In response to concerns that smaller public companies raised about 

Sarbanes-Oxley Act requirements as implemented, particularly section 

404, SEC and PCAOB have undertaken efforts to help the companies meet 

the requirements of the act. SEC initially provided those smaller public 

companies that are non-accelerated filers with additional time to comply 

with section 404 and subsequently extended the deadline several times, 

with the latest extension to July 15, 2007. SEC also formed an Advisory 

Committee on Smaller Public Companies to examine the impact of the act 

on smaller public companies. On March 3, 2006, the committee issued an 

exposure draft of its final report for public comment that contained 

recommendations that, if adopted by SEC, would exempt up to 70 percent 

of all public companies and 6 percent of U.S. equity market capitalization 

from all or some of the provisions of section 404, “unless and until” a 

framework for assessing internal control over financial reporting is 

developed that recognizes the characteristics and needs for smaller public 

companies. Specifically, the committee proposed that “microcap” 

companies (companies with market capitalization below $128 million) 

with revenues below $125 million and “smallcap” companies (companies 

with market capitalization between $128 million and $787 million) with 

revenues below $10 million would not have to comply with section 404(a) 

and section (b), management’s and the external auditor’s assessment and 

reporting on internal control over financial reporting, respectively. 

“Smallcap” companies with revenues between $10 million and $250 million 

would not have to comply with section 404(b), the external auditor’s 

attestation on management’s internal control assessment and the 

effectiveness of internal control over financial reporting. Following a 

public comment period, the committee is scheduled to issue its final 

recommendations in April 2006, at which time the recommendations 

would be considered by SEC. Additionally, SEC asked COSO to develop 

guidance designed to assist smaller public companies in using COSO’s 

internal control framework in a small business environment. COSO issued 

a draft for public comment in October 2005, and plans to finalize the 

guidance in early 2006. While not specifically focused on small business 

issues, SEC held a public “roundtable” in April 2005, in which GAO 

participated, that gave public companies and accounting firms an 

opportunity to provide feedback to SEC and PCAOB on what went well 

and what did not during the first year of section 404 implementation. In 

response, SEC and PCAOB issued additional section 404 guidance in May 

2005. PCAOB also issued a report on November 30, 2005, that detailed 

inefficiencies companies experienced in the implementation of its auditing 

Page 6 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
standard on internal control. SEC and PCAOB plan to hold another 

roundtable on the second year of section 404 implementation in May 2006. 

However, because many efforts—particularly SEC’s response to the 

exemption recommendations and COSO’s efforts to provide guidance on 

using its internal control framework in a small business environment—are 

ongoing, smaller public companies may be deferring efforts to implement 

section 404 until such issues are resolved. 

While the act does not impose new requirements on privately held 

companies, companies choosing to go public must realistically spend time 

and funds in order to demonstrate their ability to comply with the act, 

section 404 in particular, to attract investors who will seek the assurances 

and protections that compliance with section 404 provides. Such 

requirements, along with other factors, may have been a contributing 

factor in the reduced number of initial public offerings (IPO) issued by 

small companies. However, the overall performance of the stock market 

and changes in listing standards also likely affected the number of IPOs. 

From 1999 through 2004, IPOs by companies with revenues of $25 million 

or less decreased substantially from 70 percent of all IPOs in 1999 to about 

46 percent in 2004. For those privately held companies not intending to go 

public, our research and discussions with representatives of financial 

institutions suggested that financing sources were generally not imposing 

requirements on private companies similar to those contained in the 

Sarbanes-Oxley Act as a condition for obtaining access to capital or other 

financial services. While a number of states proposed legislation with 

provisions similar to the Sarbanes-Oxley Act following its passage, three 

states passed legislation calling for private companies or nonprofit 

organizations to adopt requirements similar to some of the act’s corporate 

governance provisions. In addition, our interviews and review of available 

research indicate that some privately held companies have voluntarily 

adopted some of the act’s enhanced governance practices because they 

believe these practices make pragmatic business sense. Specifically, they 

have adopted practices such as CEO/CFO financial statement certification, 

appointment of independent directors, corporate codes of ethics, 

whistleblower procedures, and approval of nonaudit services by the board. 

Smaller public companies have been able to obtain access to needed audit 

services since the passage of the act; however, data show that a 

substantial number of smaller public companies have moved from the 

large accounting firms to mid-sized and small firms. Many of these moves 

resulted from the resignation of a large accounting firm. The reasons for 

these changes range from audit cost and service concerns cited by 

companies to client profitability and risk concerns cited by accounting 

Page 7 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
firms, including capacity constraints and assessments of client risk. As a 

result, mid-sized and small accounting firms increased their share of 

smaller public company audits during 2002–2004. Our analysis of the risk 

characteristics of the companies leaving the large accounting firms shows 

that mid-sized and small accounting firms appear to be taking on a higher 

percentage of public companies with accounting issues such as going 

concern qualifications and other “risk” issues. Overall, mid-sized and small 

accounting firms conducted 30 percent of the total number of public 

company audits in 2004—up from 22 percent in 2002. However, the overall 

market for audit services remains highly concentrated, with companies 

audited by large firms representing 98 percent of total U.S. publicly traded 

company sales (revenues). In the long run, the act may reduce some of the 

competitive challenges faced by mid-sized and small accounting firms. For 

example, mid-sized and small accounting firms could increase 

opportunities to enhance their recognition and acceptance among capital 

market participants as a result of operating under PCAOB’s registration 

and inspection process. 

We have two concerns with certain draft recommendations from the 

Advisory Committee on Smaller Public Companies related to internal 

control. Our first concern relates to lack of specificity in the 

recommendations. While calling for an internal control framework that 

recognizes the needs of smaller public companies, the recommendations 

do not address what needs to be done to establish such a framework or 

what such a framework might include. In reviewing the implementation of 

section 404 for larger public companies, we noted that many, if not most, 

of the significant problems and challenges related to implementation 

issues rather than the internal control framework itself. We think it is 

essential that public companies, both large and small, have appropriate 

guidance on how to effectively implement the internal control framework 

and assess and report on the operating effectiveness of their internal 

control over financial reporting. Our second concern relates to the 

ambiguity surrounding the conditional nature of the “unless and until” 

provisions of the recommendations and the potential impact that may 

result for a large number of public companies that would qualify for either 

full or partial exemption from the requirements of section 404. Our 

concerns also include the additional time that may be needed to resolve 

the concerns of smaller public companies and the impact any further 

regulatory relief may have in delaying important investor protections 

associated with section 404. 

When SEC begins its assessment of the final recommendations of its small 

business advisory committee, it is essential that SEC balance the key 

Page 8 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
principle behind the Sarbanes-Oxley Act—investor protection—against 

the goal of reducing unnecessary regulatory burden on smaller public 

companies. This report recommends that, in considering the concerns of 

the Advisory Committee on Smaller Public Companies regarding the 

ability of smaller public companies to effectively implement section 404, 

SEC should (1) assess whether the current guidance, particularly guidance 

on management’s assessment of internal control over financial reporting, 

is sufficient or whether additional action is needed to help smaller public 

companies meet the requirements of section 404; (2) coordinate with 

PCAOB to help ensure that section 404-related audit standards and 

guidance are consistent with any additional guidance applicable to 

management’s assessment of internal control and identify additional ways 

in which auditors of public companies can achieve more economical, 

effective, and efficient implementation of the standards and guidance 

related to internal control over financial reporting; and (3) if further relief 

is deemed appropriate, analyze and consider the unique characteristics of 

smaller public companies and their investors in determining categories of 

companies for which additional relief may be appropriate so that the 

objectives of investor protection are adequately met and any relief is 

targeted and limited. 

We provided a draft of this report to the Chairman of SEC and the Acting 

Chairman of PCAOB for review and comment. We received written 

comments from SEC and PCAOB that are discussed in this report and 

reprinted in appendixes III and IV. SEC agreed that the Sarbanes-Oxley 

Act has had a positive impact on investor protection and confidence, and 

that smaller public companies face particular challenges in implementing 

certain provisions of the act, notably section 404. SEC stated that our 

recommendations should provide a useful framework for consideration of 

its advisory committee’s final recommendations. PCAOB stated that it is 

committed to working with SEC on our recommendations and that it is 

essential to maintain the overriding purpose of the Sarbanes-Oxley Act of 

investor protection while seeking to make its implementation as efficient 

and effective as possible. Both SEC and PCAOB provided technical 

comments that were incorporated into the report as appropriate. 

Responding to corporate failures and fraud that resulted in substantial 

financial losses to institutional and individual investors, Congress passed 

the Sarbanes-Oxley Act in 2002. As shown in table 1, the act contains 

Background 

Page 9 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
provisions affecting the corporate governance, auditing, and financial 

reporting of public companies, including provisions intended to deter and 

punish corporate accounting fraud and corruption.9

The Sarbanes-Oxley Act generally applies to those companies required to 

file reports with SEC under the Securities Exchange Act of 1934 and does 

not differentiate between small and large businesses.10 The definition of 

small varies among agencies, but SEC generally calls companies that had 

less than $75 million in public float non-accelerated filers. Accelerated 

filers are required by SEC regulations to file their annual and quarterly 

reports to SEC on an accelerated basis compared to non-accelerated filers. 

As of 2005, SEC estimated that about 60 percent —5,971 companies—of all 

registered public companies were non-accelerated filers. SEC recently 

further differentiated smaller companies from what it calls “well-known 

seasoned issuers”—those largest companies ($700 million or more in 

public float) with the most active market following, institutional 

ownership, and analyst coverage.11

 

9

While there is no standard definition of corporate governance, it can broadly be taken to 

refer to the system by which companies are directed and controlled, including the role of 

the board of directors, management, shareholders, and other stakeholders. According to 

the Organisation for Economic Co-operation and Development, corporate governance 

provides the structure through which the objectives of the company are set and the means 

of attaining those objectives and monitoring performance are determined. 

10In addition to those companies required to file reports with SEC under the Securities 

Exchange Act of 1934, the Sarbanes-Oxley Act also applies to companies considered to be 

issuers that have filed a Securities Act of 1933 registration statement that is not yet 

effective. 

11SEC also has a specific category of smaller companies called “small business issuers” that 

may use separate reporting requirements designed to be less onerous than those applicable 

to larger filers. Generally, “small business issuers” have less than $25 million in revenues 

and public float. See 17 C.F.R. § 228.10(a)(1). 

Page 10 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Table 1: Summary of Selected Sarbanes-Oxley Act Provisions Affecting Public Companies and Registered Accounting Firms 

Provision Main requirements 

Section 101: Public Company Accounting 

Oversight Board 

Establishes the PCAOB to oversee the audit of public companies that are subject to 

the securities laws. 

Section 201: Services Outside the Scope of 

Practice of Auditors 

Registered accounting firms cannot provide certain nonaudit services to a public 

company if the firm also serves as the auditor of the financial statements for the public 

company. Examples of prohibited nonaudit services include bookkeeping, appraisal or 

valuation services, internal audit outsourcing services, and management functions. 

Section 301: Public Company Audit 

Committees 

Listed company audit committees are responsible for the appointment, compensation, 

and oversight of the registered accounting firm, including the resolution of 

disagreements between the registered accounting firm and company management 

regarding financial reporting. Audit committee members must be independent. 

Section 302: Corporate Responsibility for 

Financial Reports 

For each annual and quarterly report filed with SEC, the CEO and CFO must certify 

that they have reviewed the report and, based on their knowledge, the report does not 

contain untrue statements or omissions of a material fact resulting in a misleading 

report and that, based on their knowledge, the financial information in the report is 

fairly presented. 

Section 404: Management Assessment of 

Internal Controls 

This section consists of two parts (a and b). First, in each annual report filed with SEC, 

company management must state its responsibility for establishing and maintaining an 

adequate internal control structure and procedures for financial reporting, and assess 

the effectiveness of its internal control structure and procedures for financial reporting. 

Second, the registered accounting firm must attest to, and report on, management’s 

assessment of the effectiveness of its internal control over financial reporting. 

Section 407: Disclosure of Audit Committee 

Financial Expert 

Public companies must disclose in periodic reports to SEC whether the audit 

committee includes at least one member who is a financial expert and, if not, the 

reasons why. 

Source: GAO. 

Title I of the act establishes PCAOB as a private-sector nonprofit 

organization to oversee the audits of public companies that are subject to 

the securities laws. PCAOB is subject to SEC oversight. The act gives 

PCAOB four primary areas of responsibility: 

• registration of accounting firms that audit public companies in the U.S. 

securities markets; 

• inspections of registered accounting firms; 

• establishment of auditing, quality control, and ethics standards for 

registered accounting firms; and 

• investigation and discipline of registered accounting firms for violations of 

law or professional standards. 

Title II of the act addresses auditor independence. It prohibits the 

registered external auditor of a public company from providing certain 

Page 11 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
nonaudit services to that public company audit client. Title II also specifies 

communication that is required between auditors and the public 

company’s audit committee (or board of directors) and requires periodic 

rotation of the audit partners managing a public company’s audits. 

Titles III and IV of the act focus on corporate responsibility and enhanced 

financial disclosures. Title III addresses listed company audit committees, 

including responsibilities and independence, and corporate 

responsibilities for financial reports, including certifications by corporate 

officers in annual and quarterly reports, among other provisions. Title IV 

addresses disclosures in financial reporting and transactions involving 

management and principal stockholders and other provisions such as 

internal control over financial reporting. More specifically, section 404 of 

the act establishes requirements for companies to publicly report on 

management’s responsibility for establishing and maintaining an adequate 

internal control structure, including controls over financial reporting and 

the results of management’s assessment of the effectiveness of internal 

control over financial reporting. Section 404 also requires the firms that 

serve as external auditors for public companies to attest to the assessment 

made by the companies’ management, and report on the results of their 

attestation and whether they agree with management’s assessment of the 

company’s internal control over financial reporting. 

SEC and PCAOB have issued regulations, standards, and guidance to 

implement the Sarbanes-Oxley Act. For instance, both SEC regulations 

and PCAOB’s Auditing Standard Number 2, “An Audit of Internal Control 

Over Financial Reporting Performed in Conjunction with an Audit of 

Financial Statements” state that management is required to base its 

assessment of the effectiveness of the company’s internal control over 

financial reporting on a suitable, recognized control framework 

established by a body of experts that followed due process procedures, 

including the broad distribution of the framework for public comment. 

Both the SEC guidance and PCAOB’s auditing standard cite the COSO 

principles as providing a suitable framework for purposes of section 404 

compliance. In 1992, COSO issued its “Internal Control—Integrated 

Framework” (the COSO Framework) to help businesses and other entities 

assess and enhance their internal control. Since that time, the COSO 

framework has been recognized by regulatory standards setters and others 

as a comprehensive framework for evaluating internal control, including 

internal control over financial reporting. The COSO framework includes a 

Page 12 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
common definition of internal control and criteria against which 

companies could evaluate the effectiveness of their internal control 

systems.12 The framework consists of five interrelated components: 

control environment, risk assessment, control activities, information and 

communication, and monitoring. While SEC and PCAOB do not mandate 

the use of any particular framework, PCAOB states that the framework 

used by a company should have elements that encompass the five COSO 

components on internal control. 

Internal control generally serves as a first line of defense in safeguarding 

assets and preventing and detecting errors and fraud. Internal control is 

defined as a process, effected by an entity’s board of directors, 

management, and other personnel, designed to provide reasonable 

assurance regarding the achievement of the following objectives: (1) 

effectiveness and efficiency of operations; (2) reliability of financial 

reporting; and (3) compliance with laws and regulations. Internal control 

over financial reporting is further defined in the SEC regulations 

implementing section 404. These regulations define internal control over 

financial reporting as providing reasonable assurance regarding the 

reliability of financial reporting and the preparation of financial 

statements, including those policies and procedures that 

• pertain to the maintenance of records that, in reasonable detail, accurately 

and fairly reflect the transactions and dispositions of the assets of the 

company; 

• provide reasonable assurance that transactions are recorded as necessary 

to permit preparation of financial statements in conformity with generally 

accepted accounting principles, and that receipts and expenditures of the 

company are being made only in accordance with authorizations of 

management and directors of the company; and 

• provide reasonable assurance regarding prevention or timely detection of 

unauthorized acquisition, use, or disposition of the company’s assets that 

could have a material effect on the financial statements. 

PCAOB’s Auditing Standard No. 2 reiterates this definition of internal 

control over financial reporting. Internal control is not a new requirement 

for public companies. In December 1977, as a result of corporate 

 

12COSO, Internal Control – Integrated Framework, 1992 and 1994. 

Page 13 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
falsification of records and improper accounting, Congress enacted the 

Foreign Corrupt Practices Act (FCPA).13 The FCPA’s internal accounting 

control requirements were intended to prevent fraudulent financial 

reporting, among other things. The FCPA required companies to: (1) make 

and keep books, records, and accounts that in reasonable detail accurately 

and fairly reflect the transactions and dispositions of assets and (2) 

develop and maintain a system of internal accounting controls sufficient to 

provide reasonable assurance over the recording and executing of 

transactions, the preparation of financial statements in accordance with 

standards, and maintaining accountability for assets. 

Smaller Public 

Companies Have 

Incurred 

Disproportionately 

Higher Audit Costs in 

Implementing the Act, 

but Impact on Access 

to Capital Remains 

Unclear 

Based on our analysis, costs associated with implementing the SarbanesOxley Act—particularly those costs associated with the internal control 

provisions in section 404—were disproportionately higher (as a 

percentage of revenues) for smaller public companies. In complying with 

the act, smaller companies noted that they incurred higher audit fees and 

other costs, such as hiring more staff or paying for outside consultants, to 

comply with the act’s provisions. Further, resource and expertise 

limitations that characterize many smaller companies as well as their 

general lack of familiarity or experience with formal internal control 

frameworks contributed to the challenges and increased costs they faced 

during section 404 implementation. Along with other market factors, the 

act may have encouraged a relatively small number of smaller public 

companies to go private, foregoing sources of funding that were 

potentially more diversified and may be less expensive for many of these 

companies. However, the ultimate impact of the Sarbanes-Oxley Act on 

smaller public companies’ access to capital remains unclear because of the 

limited time that the act has been in effect and the large number of smaller 

public companies that have not yet fully implemented the act’s internal 

control provisions. 

Our analysis indicates that audit fees have increased considerably since 

the passage of the act, particularly for those smaller public companies that 

have fully implemented the act. Both smaller and larger public companies 

have identified the internal control provisions in section 404 as the most 

costly to implement. However, audit fees may have also increased because 

of the current environment surrounding public company audits including, 

Smaller Public Companies 

Incurred 

Disproportionately Higher 

Audit Costs 

 

13Pub. L. No. 95-213, 91 Stat. 1494 (Dec. 19, 1977). 

Page 14 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
among other things, the new regulatory oversight of audit firms, new 

requirements related to audit documentation, and legal risk. Figure 1 

contains data reported by public companies on audit fees paid to external 

auditors before and after the section 404 provisions became effective for 

accelerated filers in 2004. Based on this data, we found that (1) audit fees 

already were disproportionately greater as a percentage of revenues for 

smaller public companies in 2003 and (2) the disparity in smaller and 

larger public companies’ audit fees as a percentage of revenues increased 

for those companies that implemented section 404 in 2004.14 For example, 

of the companies that reported implementing section 404, public 

companies with market capitalization of $75 million or less paid a median 

$1.14 in audit fees for every $100 of revenues compared to $0.13 in audit 

fees for public companies with market capitalization greater than $1 

billion.15 Among public companies with market capitalization of $75 

million or less (2,263 in total), the 66 companies that implemented section 

404 paid a median $0.35 more per $100 in revenues compared to those that 

had not implemented section 404. However, using publicly reported audit 

fees as an indicator of the act’s compliance costs has some limitations. 

First, the audit fees reported by companies that complied with section 404 

should include fees for both the internal control audit and the financial 

statement audit. As a result, we could not isolate the audit fees associated 

with section 404. Second, the fees paid to the external auditor do not 

include other costs companies incurred to comply with section 404 

requirements, such as testing and documenting internal controls and fees 

paid to external consultants. While the spread between what smallest and 

largest public companies that implemented section 404 paid as a 

percentage of revenue increased between 2003 and 2004, we also noted 

that, as a percentage of revenue, the relative disproportionality between 

the audit fees paid by smaller public companies and the largest public 

companies remained roughly the same between 2003 and 2004. However, 

unlike audit fees, these costs are not separately reported and, therefore, 

are difficult to analyze and measure. 

 

14We also looked at audit fees as a percentage of market capitalization. While there is less 

of a disparity when this measure is used, a significant difference is still observable between 

smaller and larger public companies. 

15As noted in figure 1, public companies with market capitalization between $75 million and 

$250 million paid roughly 4.1 times what public companies with market capitalization 

greater than $1 billion paid in 2003. For those public companies that reported implementing 

section 404, this ratio increased only slightly to 4.3. 

Page 15 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Figure 1: Median Audit Fees as a Percentage of 2003 and 2004 Revenues Reported by Public Companies as of Aug. 11, 2005 

Company size

(market

capitalization

in millions)

>$0-$75

.21

.14

.10

.12

.35

.06

>75-250

>250-500

>500-700

>700-1,000

>1,000

Median audit fee as a percentage of revenues

Difference

between 404

filers and

nonfilers

(2004)

66 of 2,263 % %

2003 (all companies)

Companies that did not file internal control reports (2004)a

Companies that filed internal control reports (2004)b

Source: GAO analysis of Audit Analytics data.

3

520 of 1,188 44

376 of 641 59

184 of 309 60

183 of 283 65

927 of 1,342 69

Number and percentage of companies

that filed internal control reports for

first year of section 404 implementation

.79

.29

1.14

.18

.35

.56

.15

.26

.40

.13

.20

.30

.07

.12

.25

.07

.13

.64%

Note: Our analysis is based on companies’ end of the fiscal year market capitalization. SEC’s criteria 

for categories of filers (accelerated versus non-accelerated filers) are based on companies’ public 

float as of the end of their second quarter. Due to the timing difference, some of the companies 

identified in this analysis as having market capitalization of less than $75 million may have been 

accelerated filers under SEC’s criteria. 

a

In addition to non-accelerated filers that were granted extensions, this includes accelerated filers that 

had not filed their internal control reports to SEC for reasons such as (1) the company’s fiscal year 

ended before November 15, 2004, which pushed their reporting date to late 2005 or early 2006, or (2) 

the company was delinquent in implementing section 404. 

b

Some of these companies were non-accelerated filers that decided to file internal control reports 

voluntarily. 

Page 16 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
According to executives of smaller public companies that we contacted, 

smaller companies incurred substantial costs in addition to the fees they 

paid to their external auditors to comply with section 404 and other 

provisions of the act. For example, 128 of the 158 smaller public 

companies that responded to our survey (81 percent of respondents) had 

hired a separate accounting firm or consultant to assist them in meeting 

section 404 requirements. Services provided included assistance with 

developing methodologies to comply with section 404, documenting and 

testing internal controls, and helping management assess the effectiveness 

of internal controls and remediate identified internal control weaknesses. 

These smaller companies reported paying fees to external consultants for 

the period leading up to their first section 404 report that ranged from 

$3,000 to more than $1.4 million. Many also reported costs related to 

training and hiring of new or temporary staff to implement the act’s 

requirements. Additionally, some of the smaller companies that responded 

to our survey reported that their CFOs and accounting staff spent as much 

as 90 percent of their time for the period leading up to their first section 

404 report on Sarbanes-Oxley Act compliance-related issues. Finally, many 

of the smaller public companies incurred missed “opportunity costs” to 

comply with the act that were significant. For example, nearly half (47 

percent) of the companies that responded to our survey reported deferring 

or canceling operational improvements and more than one-third (39 

percent) indicated that they deferred or cancelled information technology 

investments. 

Smaller Public Companies 

Incurred Other Costs in 

Complying with the Act 

While most companies, including the majority of the smaller public 

companies that responded to our survey and that we interviewed, cited 

section 404 as the most difficult provision to implement, smaller public 

companies reported challenges in complying with other Sarbanes-Oxley 

Act provisions as well. Nearly 69 percent of the smaller public companies 

that responded to our survey said that the act’s auditor independence 

requirements had decreased the amount of advice that they received from 

their external auditor on accounting- and tax-related matters. About half 

the companies that responded to our survey indicated that they incurred 

additional expenses by hiring outside counsel for assistance in complying 

with various requirements of the act. Examples mentioned included legal 

assistance with drafting charters for board committees, drafting a code of 

ethics, establishing whistleblower protection, and reviewing CEO and CFO 

certification requirements. About 13 percent of the smaller public 

companies reported incurring costs to appoint a financial expert to serve 

on the audit committee, and about 6 percent reported incurring costs to 

appoint other independent members to serve on the audit committee. 

While these types of costs were consistent with those reported for larger 

Page 17 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
companies, the impact on smaller public companies was likely greater 

given their more limited revenues and resources. 

Smaller Companies Have 

Different Characteristics 

Than Larger Companies, 

Some of Which 

Contributed to Higher 

Implementation Costs 

While public companies—both large and small—have been required to 

establish and maintain internal accounting controls since the Foreign 

Corrupt Practices Act of 1977, most public companies and their external 

auditors generally had limited practical experience in implementing and 

using a structured framework for internal control over financial reporting 

as envisioned by the implementing regulations for section 404.16 Our 

survey of smaller public companies and our discussions with external 

auditors indicated that the internal control framework—that is the COSO 

framework—referred to in SEC’s regulations and PCAOB’s standards 

implementing section 404 was not widely used by public companies, 

especially smaller companies, prior to the Sarbanes-Oxley Act. 

Many companies documented their internal controls for the first time as 

part of their first year implementation efforts to comply with section 404. 

As a result, many companies probably underestimated the time and 

resources necessary to comply with section 404, partly because of their 

lack of experience or familiarity with the framework. These challenges 

were undoubtedly compounded in companies that needed to make 

significant improvements in their internal control systems to make up for 

deferred maintenance of those systems. While this was largely true for 

both larger and smaller companies, regulators (SEC and PCAOB), public 

accounting firms, and others have indicated that smaller public companies 

often face particular challenges in implementing effective internal control 

over financial reporting.17

Resource limitations make it more difficult for smaller public companies 

to achieve economies of scale, segregate duties and responsibilities, and 

hire qualified accounting personnel to prepare and report financial 

information. Smaller companies are inherently less able to take advantage 

of economies of scale because they face higher fixed per unit costs than 

 

16See “Management’s Report on Internal Control over Financial Reporting and Certification 

of Disclosure in Exchange Act Periodic Reports,” 68 Federal Register 36636 (June 18, 

2003) (final rule). 

17See COSO’s exposure draft, “Guidance for Smaller Public Companies Reporting on 

Internal Control over Financial Reporting” (Oct. 26, 2005), for a discussion of the 

challenges that smaller companies face in implementing effective internal control over 

financial reporting. 

Page 18 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
larger companies with more resources and employees. Implementing the 

functions required to segregate transaction duties in a smaller company 

absorbs a larger percentage of the company’s revenues or assets than in a 

larger company. About 60 percent of the smaller public companies that 

responded to our survey said that it was difficult to implement effective 

segregation of duties. Several executives told us that it was difficult to 

segregate duties due to limited resources. According to COSO’s draft 

guidance for smaller public companies, smaller companies can develop 

and implement compensating controls when resource constraints 

compromise the ability to segregate duties. The American Institute of 

Certified Public Accountants noted that smaller public companies often do 

not have the internal audit functions referred to in COSO’s internal 

framework guidance. Other executives commented that it was difficult to 

achieve effective internal control over financial reporting because they 

lacked expertise within their internal accounting staff. For example, 

according to an executive from a company that reported a material 

weakness in its section 404 report, the financial accounting standards for 

stock options were too complex for his staff and it was easier to have its 

auditor fix the mistakes and cite the company for a material weakness in 

internal control over financial reporting. Two other executives told us that 

their auditors cited their companies with material weaknesses in internal 

controls over financial reporting for not having appropriate internal 

accounting staff; to remediate this weakness, the companies had to hire 

additional staff. 

According to COSO, however, some of the unique characteristics of 

smaller companies create opportunities to more efficiently achieve 

effective internal control over financial reporting and more efficiently 

evaluate internal control which can facilitate compliance with section 404. 

These opportunities can result from more centralized management 

oversight of the business, and greater exposure and transparency with the 

senior levels of the company that often exist in a smaller company. For 

instance, management’s hands-on approach in smaller companies can 

create opportunities for less formal and less expensive communications 

and control procedures without decreasing their quality. To the extent that 

smaller companies have less complex product lines and processes, and/or 

centralized geographic concentrations in operations, the process of 

achieving and evaluating effective internal control over financial reporting 

could be simplified. 

According to SEC, another characteristic of smaller public companies is 

that they tend to be much more closely held than larger public companies; 

insiders such as founders, directors, and executive officers hold a high 

Page 19 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
percentage of shares in the companies. Further, CFOs of smaller public 

companies frequently play a more integrated operational role than their 

larger company counterparts. According to a recommendation by 

participants at the September 2005 Government-Business Forum on Small 

Business Capital Formation hosted by SEC, these types of shareholders 

are classic insiders who do not need significant SEC protection.18

According to SEC’s Office of Economic Analysis, among public companies 

with a market capitalization of $125 million or less, insiders own on 

average approximately 30 percent of the company’s shares. Although the 

“insider” shareholders owners may not have the same need for significant 

investor SEC protection as investors in broadly held companies, minority 

shareholders who are not insiders may have a need for such protection. 

Complexity, Scope, and 

Timing of PCAOB 

Guidance also Appeared to 

Influence Cost of Section 

404 Implementation 

Accounting firms and public companies also have noted that the scope, 

complexity, and timing of PCAOB’s Auditing Standard No. 2 contributed to 

the challenges and higher costs in the first year of implementation of 

section 404. PCAOB’s Auditing Standard No. 2 establishes new audit 

requirements and governs both the auditor’s assessment of controls and its 

attestation to management’s report. PCAOB first issued an exposure draft 

of the standard for comment by interested parties on October 7, 2003. The 

Board received 194 comment letters from a variety of interested parties, 

including auditors, investors, internal auditors, public companies, 

regulators, and others. Due to the time needed to draft the standard, 

evaluate the comment letters, and finalize the standard, PCAOB did not 

issue the final standard until March 2004—more than 8 months after SEC 

issued its final regulations on section 404 and part way into the initial year 

of implementation for accelerated filers. SEC, which under the act is 

responsible for approving standards issued by PCAOB, did not approve 

Auditing Standard No. 2 until June 17, 2004. As a result of both timing and 

unfamiliarity with PCAOB’s Auditing Standard No. 2, auditors were not 

prepared to integrate the internal control over financial reporting 

attestation and financial audits in the first year of implementation as 

envisioned by Auditing Standard No. 2. 

Furthermore, according to PCAOB, auditors were not always consistent in 

their interpretation and application of Auditing Standard No. 2. In 

PCAOB’s report on the initial implementation of Auditing Standard No. 2, 

 

18SEC, 24th Annual SEC Government-Business Forum on Small Business Capital 

Formation, Final Report (Washington, D.C.: November 2005). 

Page 20 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
the Board found that both auditors and public companies faced enormous 

challenges in the first year of implementation arising from the limited time 

frames for implementing the new requirements; a shortage of staff with 

prior training and experience in designing, evaluating, and testing controls; 

and related strains on available resources.19 The Board found that some 

audits performed under these circumstances were not as effective or 

efficient as they should have been. Auditing firms and a number of public 

companies have stated that they expect subsequent years’ compliance 

costs for section 404 to decrease. 

Costs Associated with the 

Sarbanes-Oxley Act May 

Have Impacted the 

Decision of Some Smaller 

Public Companies to Go 

Private, but Other Factors 

also Influenced Decision to 

Go Private 

Since the passage of the act in July 2002, the number of companies going 

private (that is, ceasing to report to SEC by voluntarily deregistering their 

common stock) increased significantly.20 As shown in figure 2, the number 

of public companies that went private has increased significantly from 143 

in 2001 to 245 in 2004, with the greatest increase occurring during 2003.21

However, the 245 companies represented 2 percent of public companies as 

of January 31, 2004. Based on the trends observed in 2003 and 2004 and 

the 80 companies that went private in the first quarter of 2005, we project 

that the number of companies going private will have risen more than 87 

percent, from the 143 in 2001 to a projected 267 through the end of 2005. 

Our analysis also indicated that companies going private during this entire 

 

19PCAOB Release No. 2005-023 Report on the Initial Implementation of Auditing 

Standard No. 2, An Audit of Internal Control over Financial Reporting Performed in 

Conjunction with An Audit of Financial Statements (Washington, D.C.: Nov. 30, 2005). 

20According to the “Fast Answers” section of SEC’s website, “a company goes private when 

it reduces the number of its shareholders to fewer than 300 and is no longer required to file 

reports with SEC.” See www.sec.gov/answers/gopriv.htm. Stock of these companies no 

longer trades on the major markets; however, companies can and do continue trading on 

the less regulated Pink Sheets, which have no minimum listing standards. When a company 

suspends its duty to report to SEC but continues to trade on the Pink Sheets, it is 

commonly referred to as having “gone dark,” since investors no longer have access to 

information in the form of 8-Ks or quarterly and annual financial statements filed with SEC. 

Or, after deregistering, some companies elect to become “fully private” and are no longer 

traded or listed on any market. For purposes of this report, we consider both types of 

companies—”gone dark” and “fully private”—as private. As such, the terms deregistering 

and “going private” are used interchangeably in this report. See appendix II for more details 

on the definition of “going private” used in this report. 

21We eliminated companies that deregistered common stock as a result of acquisitions and 

mergers that were not “going private” transactions, liquidations, reorganizations, 

bankruptcy filings, or re-emergences. We also eliminated duplicate filings and filings by 

foreign registrants. These trends are consistent with a number of studies we identified, 

although data collection methodologies differ across samples. See appendix II for a full 

discussion of GAO’s analysis. 

Page 21 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
period were disproportionately small by any measure (market 

capitalization, revenue, or assets). 

Figure 2: Total Number of Companies Identified as Going Private, 1998-2005 

0

50

100

150

200

250

Q2Q1 Q3 Q1

1998 2005

Q4 Q2Q1 Q3

2003

Q2Q1 Q3 Q4

2002

Q2Q1 Q3 Q4

2001

Q2Q1 Q3 Q4

2000

Q2Q1 Q3 Q4

1999

Q4 Q2Q1 Q3

2004

Q4

Year and quarter

Sarbanes-Oxley

Yearly total

Quarterly total

Source: GAO analysis of SEC data. 

Number of companies

Note: Includes companies that deregistered, but continued to trade over the less-regulated Pink 

Sheets (“went dark”) and shell companies and blank check companies. Does not include companies 

that filed for, or are emerging from, bankruptcy, have liquidated or are in the process of liquidating, 

were headquartered in a foreign country, or were acquired by or merged into another company unless 

the transaction was initiated by an affiliate of the company and the company became a private entity. 

See appendix II for a fuller discussion of our analysis. 

The costs associated with public company status were most often cited as 

a reason for going private (see table 2). While there are many reasons for a 

company deregistering—including the inability to benefit from its public 

company status—the percentage of deregistered companies citing the 

direct cost associated with maintaining public company status grew from 

12 percent in 1998 to 62 percent during the first quarter of 2005. These 

costs include the accounting, legal, and administrative costs associated 

with compliance with SEC’s reporting requirements as well as other 

expenses such as those related to managing shareholder accounts. The 

number of companies citing indirect costs, such as the time and resources 

Page 22 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
needed to comply with securities regulations, also has increased since the 

passage of the Sarbanes-Oxley Act.22 In 2002, 64 companies that went 

private cited cost as one of the reasons for the decision; however, that 

number increased to 143 and 130 companies in 2003 and 2004, 

respectively. Many of the companies mentioned both the direct and 

indirect costs associated with maintaining their public company status. 

Over half of the companies that cited costs mentioned the Sarbanes-Oxley 

Act specifically (roughly 58 percent in 2004 and 2005 and 41 percent in 

2003). For smaller public companies, the costs of complying with 

securities laws likely required a greater portion of their revenues, and cost 

considerations (indirect and direct) were the leading reasons for 

companies exiting the public market, even prior to the enactment of the 

Sarbanes-Oxley Act.23

Table 2: Primary Reasons Cited by Companies for Going Private, 1998-2005, by Percent 

 Direct costs Indirect costs 

Market/liquidity 

issues

Private company 

benefits

Critical business 

issues Other No reason

1998 12.3 5.3 14.0 26.3 15.8 3.5 54.4

1999 33.3 12.2 33.3 42.2 8.9 3.3 37.8

2000 20.0 11.1 32.2 37.8 20.0 5.6 38.9

2001 32.2 13.3 31.5 23.8 20.3 3.5 49.0

2002 44.4 13.9 35.4 22.9 16.0 1.4 45.1

2003 57.8 27.5 38.5 21.3 19.7 0.8 31.6

2004 52.7 25.7 28.6 15.9 15.5 1.2 38.4

2005 Q1 62.2 28.9 28.9 8.9 12.2 27.8

Source: GAO analysis of SEC filings and relevant press releases. 

Note: See appendix II for a more detailed description of the categories and limitation for this analysis. 

Because companies were able to cite more than one reason for going private, the percentages may 

add up to more than 100 for each year. 

Further, the benefits of public company status historically appeared to 

have been disproportionately smaller for smaller companies, companies 

 

22See appendix II for full description of each reason. 

23Consistent with our findings, a number of research reports also find that companies most 

often cited cost savings from not having to comply with SEC regulations as a benefit of 

going private. For example, see C. Luez, et al., “Why Do Firms Go Dark? Causes and 

Economic Consequences of Voluntary SEC Deregistrations,” Wharton School Working 

Paper, University of Pennsylvania, September 2004, and S. Block, “The Latest Movement to 

Going Private: An Empirical Study,” Journal of Applied Finance, 14 (1): 2004. 

Page 23 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
with limited need for external funding, and companies whose public 

shares were traded infrequently or in low volume at low prices.24 As a 

result, issues unrelated to the Sarbanes-Oxley Act, such as market and 

liquidity issues and the benefits of being private, are also major reasons for 

companies going private. From 1999 to 2004, more companies cited market 

and liquidity issues than the indirect costs associated with maintaining 

their public company status. Companies in this category cited a wide 

variety of issues related to the company’s publicly traded stock such as a 

lack of analyst coverage and investor interest, poor stock market 

performance, limited liquidity (trading volume), and inability to use the 

secondary market to raise additional capital.25 Smaller companies also 

have cited advantages of private status such as greater flexibility, freedom 

from the short-term pressures of Wall Street, belief that the markets had 

consistently undervalued the company, and the ability to avoid disclosures 

of information that might benefit their competitors (see app. II). 

Companies that elect to go private reduce the number of financing options 

available to them and must rely on other sources of funding. In aggregate, 

equity is cheaper when it is supplied by public sources, net of any costs of 

regulatory compliance. However, in some circumstances, private equity or 

bank lending may be preferable alternatives to the public market. 

Statistics suggest bank loans are the primary source of funding for U.S. 

companies that rely on external financing. Some companies with 

insufficient market liquidity had little opportunity for follow-on stock 

offerings and going private would not have fundamentally altered the way 

they raised capital. We found that almost 25 percent of the companies that 

deregistered from 2003 through the end of the first quarter of 2005 were 

not trading on any market at all (see fig. 3). Approximately 37 percent of 

the companies that went private during this period were traded on the 

Over-the-Counter Bulletin Board (OTCBB); the general liquidity of this 

market is significantly less than major markets traded on the NASDAQ 

 

24In general, public companies will differ in the costs incurred and benefits obtained as a 

result of their public company status because of differences in size, industry, or other 

factors. 

25Well before the passage of the Sarbanes-Oxley Act, analysts noted that a decline in analyst 

and research coverage of smaller companies and other challenges had resulted in a large 

number of smaller companies with extremely low valuations and limited trading volume 

and investor interest. For example, research in 2003 suggested that, while 95 percent of all 

companies with market capitalization greater than $1 billion were covered by an analyst, 21 

percent of companies with market capitalization between $25-50 million were covered by 

an analyst, and just 3 percent of companies below $25 million market capitalization were 

covered. 

Page 24 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Stock Market, Inc. (NASDAQ) or the New York Stock Exchange (NYSE).26

Additionally, 14 percent were traded in the Pink Sheets and, therefore, 

were most likely closely held and traded sporadically, if at all. Pink Sheets 

LLC is not registered with SEC, has no minimum listing standards, does 

not require quoted companies to provide detailed information to its 

investors, and is regarded as high-risk by many investors. As a result, 

trading on the Pink Sheets may produce negative reputational effects that 

can further reduce liquidity and the market value of the company’s stock, 

thereby increasing the cost of equity capital.27

Figure 3: Where Companies Traded Prior to Deregistration, July 2003-March 2005 

1.8% NYSE

5.3%

13.6%

17.6%

24.8%

36.9%

Pink Sheets

NASDAQ

AMEX

No market

OTCBB

Source: GAO analysis of SEC data.

 

26The OTCBB is an electronic quotation system for equity securities not traded or listed on 

any of the national exchanges or NASDAQ. Generally, issuers of securities quoted on the 

OTCBB are smaller companies. 

27Although National Association of Securities Dealers, Inc. (NASD) oversees the OTCBB, 

the OTCBB is not part of the NASDAQ Stock Market. SEC has found that fraudsters often 

claim that an OTCBB company is a NASDAQ-listed company to mislead investors into 

thinking that the company is bigger than it actually is (see Microcap Stock: A Guide for 

Investors: http://www.sec.gov/investor/pubs/microcapstock.htm). Pink Sheets LLC has no 

affiliation with NASD and its activities are not regulated by SEC. 

Page 25 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
It Is Too Soon to 

Determine How SarbanesOxley Affected Access to 

Capital for Smaller Public 

Companies 

As previously discussed, a large number of smaller public companies have 

not fully implemented all the requirements of the Sarbanes-Oxley Act, 

notably non-accelerated filers (public companies with less than $75 million 

in public float). As a result, it is unlikely that the act has affected access to 

the capital markets for these companies. Moreover, the limited time that 

the act’s provisions have been in force would limit any impact on access to 

capital, even for the companies that have implemented section 404. For 

instance, more than 80 percent of the smaller public companies that 

responded to our survey indicated that the act has had no effect or that 

they had no basis to judge the effect of the act on their ability to raise 

equity or debt financing or on their cost of capital. 

There are indications that the Sarbanes–Oxley Act at a minimum has 

contributed to some smaller companies rethinking the costs and benefits 

of public company status. For example, more than 20 percent of the 

smaller companies that responded to our survey also stated that the act 

encouraged them to consider going private or deregistering. In contrast, a 

number of the smaller public companies that responded to our survey 

cited positive effects associated with the implementation of the act, 

notably positive impacts on audit committee involvement (60 percent), 

company awareness of internal controls (64 percent), and documentation 

of business processes (67 percent). 

SEC and PCAOB have taken actions to address smaller public company 

concerns about implementation of Sarbanes-Oxley Act provisions, 

particularly section 404, by giving smaller companies more time to comply, 

issuing or refining guidance, increasing communication and education 

opportunities, and establishing an advisory committee on smaller public 

companies. In particular, SEC has extended deadlines for complying with 

section 404 requirements several times since issuing its final rule in 2003 

(see table 3). In its final rulemaking on section 404 requirements, SEC 

stated that it was sensitive to concerns that many smaller public 

companies would experience difficulty in evaluating their internal control 

over financial reporting because these companies might not have as formal 

or well-structured a system of internal control over financial reporting as 

larger companies. In November 2004, SEC granted “smaller” accelerated 

filers an additional 45 days to file their reports on internal control over 

financial reporting out of concern that these companies were not in a 

position to meet the original deadline. SEC granted non-accelerated filers 

two additional extensions in March 2005 and September 2005, with the 

latter extension giving non-accelerated filers until their first fiscal year 

after July 2007 before having to report under section 404. SEC also 

SEC and PCAOB Have 

Been Addressing 

Smaller Company 

Concerns Associated 

with the 

Implementation of 

Section 404 

Page 26 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
considered the particular challenges facing smaller companies when 

granting these extensions. Further, SEC noted that there were other small 

business initiatives underway that could improve the effectiveness of nonaccelerated company filers’ implementation of the section 404 reporting 

requirements. 

Table 3: SEC Extensions of Section 404 Compliance Dates 

Action Date Description 

Final rule June 5, 2003 SEC’s rationale 

SEC adopted an extended transition period for compliance so that companies and their 

auditors would have time to prepare and satisfy the new requirements. 

The transition period would provide additional time for PCAOB to develop the new 

auditing standard for internal control over financial reporting. 

Compliance dates 

An accelerated filer (generally, a U.S. company that has public equity float of more than 

$75 million and has filed at least one annual report with SEC) was required to comply 

for its first fiscal year ending on or after June 15, 2004. 

A non-accelerated filer was required to comply for its first fiscal year ending on or after 

April 15, 2005. 

Final rule; extension of 

compliance dates 

February 24, 

2004 

SEC’s rationale 

The extension would minimize the cost and disruption of implementing a new disclosure 

requirement. 

The extension would provide companies and their auditors with a sufficient amount of 

time to perform additional testing or remediation of controls based on the final auditing 

standard. 

Compliance dates 

An accelerated filer was required to comply for its first fiscal year ending on or after 

November 15, 2004. 

A non-accelerated filer was required to comply for its first fiscal year ending on or after 

July 15, 2005. 

Exemptive order November 30, 

2004 

SEC’s rationale 

SEC was concerned that many smaller accelerated filers were not in a position to meet 

the compliance dates. 

Compliance dates 

Subject to certain conditions, a smaller accelerated filer (generally, a U.S. company with 

public float of less than $700 million) was granted an additional 45 days to comply. 

The compliance dates for non-accelerated filers did not change. 

Page 27 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Action Date Description 

Final rule; extension of 

compliance dates 

March 2, 2005 SEC’s rationale 

In December 2004, SEC established an advisory committee to, among other things, 

assess the impact of the Sarbanes-Oxley Act on smaller public companies. The 

extension was intended to give the committee additional time to conduct its work. 

In January 2005, COSO established a task force to provide guidance on how the COSO 

framework could be applied to smaller companies. The extension would give smaller 

public companies time to consider the new COSO guidance, which COSO intended to 

publish during the summer of 2005. 

Compliance dates 

The compliance dates for accelerated filers did not change. 

A non-accelerated filer was required to comply for its first fiscal year ending on or after 

July 15, 2006. 

Final rule; extension of 

compliance dates 

September 22, 

2005 

SEC’s rationale 

The extension was warranted due to ongoing efforts by the COSO task force and SEC’s 

advisory committee. 

In August 2005, the advisory committee recommended that SEC extend section 404 

compliance dates for non-accelerated filers. The extension was consistent with the 

advisory committee’s recommendation. 

Compliance dates 

The compliance dates for accelerated filers did not change. 

A non-accelerated filer is required to comply for its first fiscal year ending on or after 

July 15, 2007. 

Source: GAO analysis of SEC regulatory actions. 

While SEC’s final rule serves as basic guidance for public company 

implementation of section 404 requirements, PCAOB’s Auditing Standard 

Number 2 provides the auditing standards and requirements for an audit of 

the financial statements and internal control over financial reporting, as 

part of an integrated audit. It is a comprehensive document that addresses 

the work required by the external auditor to audit internal control over 

financial reporting, the relationship of that work to the audit of the 

financial statements, and the auditor’s attestation on management’s 

assessment of the effectiveness of internal control over financial reporting. 

The standard requires technical knowledge and professional expertise to 

effectively implement. 

While both SEC regulations and the PCAOB standard refer to COSO’s 

internal control framework, many companies were unfamiliar with or did 

not use this framework, despite the fact that public companies have been 

required by law to have implemented a system of internal accounting 

controls since 1977. According to SEC, smaller public companies and their 

auditors had expressed concern that the COSO internal control framework 

was designed primarily for larger public companies and smaller companies 

Page 28 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
lacked sufficient guidance on how they could use COSO’s internal control 

framework, resulting in disproportionate section 404 implementation 

costs. As a result, SEC staff asked COSO to develop additional guidance to 

assist smaller public companies in implementing COSO’s internal control 

framework in a small business environment. In October 2005, COSO issued 

a draft of the guidance for public comment, and anticipated issuing final 

guidance for smaller public companies in early 2006. The draft guidance 

outlined 26 principles for achieving effective internal control over financial 

reporting and provides examples on how companies can implement them. 

The draft guidance states that the fundamental concepts of good internal 

control over financial reporting are the same whether the company is large 

or small. At the same time, the draft guidance points out differences in 

approaches used by smaller companies versus their larger counterparts to 

achieve effective internal control over financial reporting and discusses 

the unique challenges faced by smaller companies. While intended to 

provide additional clarity to smaller companies for implementing an 

internal control framework, the guidance has received mixed reviews with 

some questioning whether it will significantly change the disproportionate 

cost and other burdens for smaller public companies associated with 

section 404 compliance.28

In December 2004, SEC announced its intention to establish its Advisory 

Committee on Smaller Public Companies to assess the current regulatory 

system for smaller companies under the securities laws, including the 

impact of the Sarbanes-Oxley Act. In addition to granting companies more 

time to meet the act’s requirements, SEC has been considering how its 

section 404 guidance and overall approach to implementation might be 

revised. SEC chartered the advisory committee on March 23, 2005. The 

committee plans to issue its final report to SEC by April 2006. 

On March 3, 2006, the committee published an exposure draft of its final 

report for public comment that contained 32 recommendations related to 

securities regulation for smaller public companies.29 Due to the number of 

recommendations, the advisory committee refers to its 14 highest priority 

recommendations as “primary recommendations.” One of its primary 

recommendations is an overarching recommendation calling for a “scaled” 

 

28On January 20, 2006, we submitted a comment letter to COSO on its draft guidance that 

contained specific recommendations on areas where we felt the guidance could be 

improved. 

29See 71 Federal Register 11090 (Mar. 3, 2006). 

Page 29 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
approach to securities regulation, whereby smaller public companies are 

stratified into two groups, “microcap” and “smallcap” companies. Under 

this recommendation, microcap companies would consist of companies 

whose common stock in the aggregate make up the lowest 1 percent of 

U.S. equity market capitalization. The advisory committee estimates, based 

on data from SEC’s Office of Economic Analysis, that the microcap 

category would include public companies whose individual market 

capitalization is less than $128 million, approximately 53 percent of all U.S. 

public companies. For the smallcap category, the advisory committee 

estimates that the category would include public companies whose 

individual market capitalization is less than $787 million and greater than 

$128 million, and would encompass an additional 26 percent of U.S. public 

companies and an additional 5 percent of U.S. market capitalization. 

Taken together, the categories of microcap and smallcap companies, as 

defined by the advisory committee draft recommendations, would include 

approximately 79 percent of all U.S. public companies and 6 percent of 

market capitalization, according to the advisory committee’s analysis of 

SEC data. The recommendation calling for a scaled approach for securities 

regulation based on company size was also incorporated into the 

committee’s preliminary recommendations related to internal control over 

financial reporting. 

While acknowledging that some have questioned whether smaller public 

companies’ problems with section 404 have been overstated, the advisory 

committee concluded that section 404, as currently structured, “represents 

a clear problem for smaller public companies and their investors, one for 

which relief is urgently needed.”30 In part, the advisory committee based 

its conclusion on a belief that smaller public company compliance with 

section 404 has resulted in disproportionate costs and less certain 

benefits. 

The advisory committee’s primary recommendations related to internal 

control over financial reporting address regulatory relief from section 404 

for a subset of the microcap and smallcap categories described above by 

the inclusion of revenue criteria.31 Specifically, the committee’s 

preliminary recommendations are that: 

 

3071 Federal Register 11090, 11098. 

31SEC staff told us that they had not conducted a legal analysis of the preliminary 

recommendations to determine if SEC has authority to issue exemptions from section 404. 

Page 30 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
• Unless and until a framework for assessing internal control over financial 

reporting for such companies is developed that recognizes their 

characteristics and needs, provide exemptive relief from all of the 

requirements of section 404 of the Sarbanes-Oxley Act to microcap 

companies with less than $125 million in annual revenue and to smallcap 

companies with less than $10 million in annual product revenue.32 

• Unless and until a framework for assessing internal control over financial 

reporting for smallcap companies is developed that recognizes the 

characteristics and needs of those companies, provide exemptive relief 

from section 404(b) of the act—the external auditor involvement in the 

section 404 process—to smallcap companies with less than $250 million 

but greater than $10 million in annual product revenues and microcap 

companies with between $125 million and $250 million in annual revenues. 

By including the revenue criteria, the committee’s recommendations 

regarding section 404 cover a subset of the public companies included 

within its microcap and smallcap definitions. The committee estimated 

that, after applying the revenue criteria, 4,641 “microcap” public 

companies (approximately 49 percent of 9,428 public companies identified 

in data developed for the advisory committee by SEC’s Office on 

Economic Analysis) may potentially qualify for full exemption from 

section 404 and another 1,957 “smallcap” public companies 

(approximately 21 percent of the SEC-identified public companies)—a 

total of 70 percent of SEC-identified public companies—may potentially 

qualify for exemption from the external audit requirement of section 

404(b).33 It is likely that a number of public companies that would qualify 

 

32The exposure draft of the Advisory Committee on Smaller Public Companies uses the 

term “product revenue” as one of the criteria for categorizing smallcap companies for the 

purposes of its recommendations. However, the exposure draft did not contain an 

explanation of the term “product” revenue. As a result, it was not possible to analyze how a 

$10 million “product” revenue filter might affect the number of smallcap companies that 

would become eligible for the full exemption from section 404 otherwise limited to 

microcap companies under the Advisory Committee’s preliminary recommendations. See 

71 Federal Register 11093, 11104, and 11105. 

33The 9,428 public companies identified by SEC included U.S. companies listed on the New 

York and American Stock Exchanges (NYSE and AMEX, respectively), the NASDAQ Stock 

Market, and the OTC Bulletin Board. However, data prepared for the Advisory Committee 

by SEC’s Office of Economic Analysis noted that the 9,428 public companies do not include 

approximately 3,650 U.S. public companies whose stock trades on the Pink Sheets. The 

omission of Pink Sheet companies results in an understatement of the number and 

percentage of public companies that would be affected by the committee’s 

recommendations calling for section 404 regulatory relief for smaller public companies. 

Page 31 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
for exemptive relief under the committee’s recommendations have 

probably already complied with both sections of 404(a) and (b), based on 

their status as accelerated filers. 

If adopted, these recommendations would effectively establish a “tiered 

approach” for compliance with section 404, “unless and until” a framework 

for assessing internal control over financial reporting is developed for 

microcap and smallcap companies. Under the tiered approach, larger 

public companies that do not meet the committee’s size criteria for 

exemption would continue to be required to comply with both section 

404(a)—management’s assessment of and reporting on internal control 

over financial reporting—and section 404(b)—the external auditors’ 

attestation on management’s assessment and the effectiveness of the 

company’s internal control. “Smallcap” public companies that meet the 

revenue criteria would be exempt from complying with section 404(b), but 

the companies would still be required to comply with section 404(a). 

“Microcap” and some “smallcap”companies that meet the revenue criteria 

would be entirely exempt from both section 404(a) and (b).34 The 

committee’s two primary recommendations related to regulatory relief 

from section 404 for smaller public companies also include additional 

requirements that affected public companies apply additional corporate 

governance provisions and report publicly on known material internal 

control weaknesses.35

In its next primary recommendation on internal control over financial 

reporting, which is premised on the adoption of the recommendation for 

microcap companies described above, the committee acknowledged that 

SEC might conclude, as a matter of public policy, that an audit 

requirement is necessary for smallcap companies. In that case, the 

committee recommended SEC provide for the external auditor to perform 

an audit of only the design and implementation of internal control over 

 

34Under the committee’s recommendations, “smallcap” companies with annual product 

revenues below $10 million would receive the same treatment as microcap companies and 

be exempted from having to comply with both sections 404(a) and (b). 

35The specified corporate governance provisions included (1) adherence to standards 

relating to audit committees in conformity with Rule 10A-3 under the Securities Exchange 

Act and (2) adoption of a code of ethics with the meaning of Item 406 of Regulation S-K 

applicable to all directors, officers, and employees and compliance with further obligations 

under Item 406(c) relating to the disclosure of the code of ethics. Additionally, the 

committee recommended that management continue to be required to report on any 

known material weaknesses, including those uncovered by the external auditor and 

reported to the audit committee. 

Page 32 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
financial reporting, which by its nature would be more limited than the 

audit of the effectiveness of internal control over financial reporting 

required by section 404(b) and PCAOB’s Auditing Standard No. 2, and that 

PCAOB develop a new auditing standard for such an engagement. While 

this recommendation is based on the view that having the external auditor 

perform a review of the design and implementation of internal control 

over financial reporting would be more cost-effective than the work 

otherwise required under Auditing Standard No. 2, the committee’s report 

does not address the extent to which costs for such a review would be 

lower than that required under Auditing Standard No. 2 and whether the 

lower costs would be worth the reduced assurances provided by reduced 

scope of the external auditors’ work on internal control over financial 

reporting. 

While not specifically focused on small business issues, SEC also 

conducted a public “roundtable” in April 2005 that gave public companies, 

accounting firms, and others an opportunity to provide feedback to SEC 

and PCAOB on what went well and what did not during the first year of 

section 404 implementation. GAO also participated in this roundtable. 

Following the roundtable, the SEC and PCAOB Chairmen noted the 

importance of section 404 requirements but acknowledged that initial 

implementation costs had been higher than expected and noted the need 

to improve the cost-benefit equation for small and mid-sized companies. 

Both agencies issued additional guidance in May 2005 based on findings 

from the roundtable. PCAOB’s guidance clarified that auditors (1) should 

integrate their audits of internal control over financial reporting with their 

audits of the client’s financial statements, (2) exercise judgment and tailor 

their audit plans to best meet the risks faced by their clients rather than 

relying on standardized “checklists,” (3) use a top-down approach 

beginning with company-level controls and use the risk assessment 

required by the standard, (4) take advantage of the work of others, and (5) 

engage in direct and timely communication with their audit clients, among 

other matters. Guidance by SEC and its staff emphasized the need for 

reasonable assurance, risk-based assessments, better communication 

between the auditor and client, and clarified what should be in material 

weakness disclosures. Representatives of the smaller public companies 

that we interviewed indicated that the additional guidance that SEC and 

PCAOB issued was helpful. SEC and PCAOB plan to hold a second 

roundtable in May 2006 to discuss companies’ second year experiences 

with implementing section 404. Both chairs of SEC and PCAOB have said 

that they would consider additional guidance if necessary. 

Page 33 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
On November 30, 2005, PCAOB also issued a report on the initial 

implementation of its auditing standard on internal control over financial 

reporting.36 The report included observations by PCAOB—based in 

significant part, but not exclusively, on its inspections of public 

accounting firms, which in the 2005 cycle included a review of a limited 

selection of audits of internal control over financial reporting—on why the 

internal control audits were not as efficient or effective as the standard 

intended. PCAOB also amplified the previously issued guidance of May 

2005, discussing how auditors could achieve more effective and efficient 

implementation of the standard. 

Further, PCAOB has held a series of forums nationwide to educate the 

small business community on the PCAOB inspections process and the new 

auditing standards. The goal of the forums was to provide small 

accounting firms and smaller public companies an opportunity to discuss 

PCAOB-related issues with Board members and staff. PCAOB also 

established a Standing Advisory Group to advise PCAOB on standardsetting priorities and policy implications of existing and proposed 

standards. The Standing Advisory Group has considered ways to improve 

the application of its internal control over financial reporting 

requirements—Auditing Standard No. 2—with respect to audits of smaller 

public companies. 

Finally, both SEC and PCAOB have acknowledged the challenges that 

smaller public companies faced and continue to face in implementing 

section 404 and have begun to address those challenges. SEC also has 

emphasized that smaller companies need to focus on the quality of their 

internal control over financial reporting. Data provided by SEC’s Office of 

Economic Analysis and other studies have pointed to the increased level 

of restatements as an indicator that the Sarbanes-Oxley Act—section 404 

in particular—has gotten companies to identify and correct weaknesses 

that led to financial reporting misstatements in prior fiscal years. For 

example, according to recent research conducted by Glass, Lewis and Co., 

the restatement rate for smaller public companies was more than twice 

the rate for the largest public companies (9 percent for companies with 

revenues of less than $500 million and 4 percent for companies with more 

 

36PCAOB Release No. 2005-023, Report on the Initial Implementation of Auditing 

Standard No. 2, An Audit of Internal Control over Financial Reporting Performed in 

Conjunction with An Audit of Financial Statements (Washington, D.C.: Nov. 30, 2005). 

Page 34 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
than $10 billion).37 SEC staff also noted that smaller public companies had 

a disproportionately higher rate of material weaknesses in internal control 

over financial reporting during the first year of implementing section 404. 

Our discussions with accounting firms confirmed that smaller public 

companies have had a higher rate of reported material weaknesses in 

internal control over financial reporting than larger public companies. 

A major challenge in considering any regulatory relief from section 404 is 

that the overriding purpose of the Sarbanes-Oxley Act is investor 

protection. Investor confidence in the integrity and reliability of financial 

reporting is a critical element for the efficient functioning of our capital 

markets. The purpose of internal control over financial reporting is to 

provide reasonable assurance over the integrity and reliability of the 

financial statements and related disclosures. Market reactions to financial 

misstatements illustrate the importance of accurate financial reporting, 

regardless of a company’s size. 

Given the anticipated regulatory changes, particularly those relating to 

section 404’s internal control reporting requirements, smaller public 

companies may be limiting or not taking definitive actions to improve 

internal control over financial reporting based on a perception that they 

could become exempt from section 404. Further, PCAOB officials noted 

that such a perception may have limited smaller business involvement in 

PCAOB forums. 

 

37See Glass Lewis & Co., “Restatements – Traversing Shaky Ground,” Trend Alert, June 2, 

2005. The restatement rate calculation only included companies with available financial 

data. The lack of financial data and, therefore, exclusion of these companies, may lead to a 

slight bias in the restatement rate for all companies (with a slightly larger impact on the 

rate for smaller companies). 

Page 35 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Sarbanes-Oxley Act 

Requirements 

Minimally Affected 

Smaller Private 

Companies, Except 

for Those Seeking to 

Enter the Public 

Market 

While the act does not impose new requirements on privately held 

companies, companies choosing to go public realistically must spend 

additional time and funds in order to demonstrate their ability to comply 

with the act, section 404 in particular, to attract investors.38 This may have 

been a contributing factor in the reduction of the number of initial public 

offerings (IPO) issued by small companies since 2002. However, other 

factors—stock market performance and changes in listing standards—

likely also have affected the number of IPOs. While a number of states 

proposed legislation with provisions similar to the Sarbanes-Oxley Act, 

three states39 actually enacted legislation requiring private companies or 

nonprofit organizations to adopt requirements similar to certain SarbanesOxley Act provisions. Finally, some privately held companies have been 

adopting the act’s enhanced governance practices because these 

companies believe these practices make good business sense. 

Small businesses that are not public companies typically rely on a variety 

of sources to finance their operations, including personal savings, credit 

cards, and collateralized bank loans. In addition, small businesses can use 

private equity capital sources such as venture capital funds—private 

partnerships that provide private equity financing to early- and later-stage 

high-growth small businesses—to fund their growth. Small businesses may 

also issue equity shares to other types of investors to finance further 

growth. These shares may be sold through private placements where 

shares are sold directly to investors (direct placement) or through a public 

offering where the shares are sold through an underwriter (going public).40

In addition, some small companies issue equities that trade on smaller 

markets such as the Pink Sheets.41 For those private companies desiring to 

enter the public market, the IPO process has always been recognized as a 

time-consuming and expensive endeavor. 

Sarbanes-Oxley May Have 

Affected IPO Activity; 

however, Other Important 

Factors also Influence 

Entry into the Public 

Market and Access to 

Capital 

 

38Section 404’s requirements only apply to annual reports required by section 13(a) or 

section 15(d) of the Securities Exchange Act of 1934. 

39Illinois, Texas, and California. 

40For more information on small business equity capital formation, see GAO, Small 

Business: Efforts to Facilitate Equity Capital Formation, GAO/GGD-00-190 (Washington, 

D.C.: Sept. 29, 2000). 

41Pink Sheets LLC, a privately held company, does not require companies to be registered 

with SEC; therefore, many of these companies do not make available the kind of detailed 

financial disclosures that SEC-registered companies must provide. 

Page 36 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
However, venture capitalists and private company officials told us that, as 

a result of the act and other market factors, many private companies have 

been spending additional time, effort, and money to convince investors 

that they can meet the requirements of the act. For example, investors 

have become more cautious and demanding of the private companies in 

which they invest. Consequently, private companies have hired auditors 

and additional staff to make substantial changes to their financial system 

and data-reporting capabilities, document internal controls and processes, 

and review or change accounting procedures. 

According to venture capitalists and private company officials with whom 

we spoke, a private company’s ability to meet the Sarbanes-Oxley Act’s 

requirements can significantly decrease some of the investment risk 

associated with becoming a public company. For example, both groups 

told us that companies with well-documented internal control and 

governance policies were more attractive and able to secure investor 

funding at a much lower cost. Moreover, they noted that underwriters 

expected private companies to consider and comply with the act well in 

advance of going public. If a private company were unable to meet the 

act’s requirements, venture capitalists would want the company to show 

evidence of a plan for becoming compliant as soon as the company 

became public. If not, venture capitalists noted that they would be less 

likely to invest in such a company and look elsewhere for investment 

opportunities. 

These new expectations may have served to increase the expenses 

associated with the IPO process through changes in the professional fees 

charged by auditors and potentially other costs as well. Specifically, we 

found that there has been a disproportionate increase for the smallest 

companies when IPO expenses were viewed as a percentage of revenue. 

As shown in table 4, the direct expenses (excluding underwriting fees) 

associated with the IPO represented a significant portion of a small 

company’s revenues, relative to larger companies, from 1998 through the 

second quarter of 2005. These expenses have increased disproportionably 

since 2002 for small companies going public—especially for the smallest of 

these companies ($25 million or less in revenues). While Sarbanes-Oxley 

Act requirements could explain some of this increase, legal, exchange 

listing, printing, and other fees unrelated to the act could also account for 

Page 37 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
this increase. Moreover, other market factors also could explain the 

increase in IPO expenses paid to auditors.42

Table 4: IPO Direct Expenses as a Percentage of Company’s Revenues, by Size 

$25 million or 

less 

$25 -100 

million 

$100-250 

million

$250-500 

million

$500 million1 billion Greater than $1 

billion

All 

companies

1998 12.5 3.0 1.2 0.6 0.3 0.2 0.9

1999 17.6 3.7 1.8 0.7 1.2 0.1 0.9

2000 21.3 3.3 1.9 0.8 0.3 0.1 0.6

2001 14.3 3.0 1.1 0.8 0.5 0.1 0.2

2002 10.6 3.1 1.1 0.6 0.3 0.1 0.1

2003 17.5 5.0 1.5 0.7 0.4 0.5 0.9

2004 25.9 4.9 2.2 1.5 0.4 0.3 1.3

2005 (Q1-Q2) 28.1 5.3 1.5 1.2 0.6 0.3 1.0

1998 – 2005 Q2 18.2 3.8 1.7 0.9 0.5 0.1 0.4

Source: GAO analysis of data from SEC filings. 

Note: Includes only companies with financial data available. In some cases, pro forma or un-audited 

revenue data were used. There can be significant lag between the dates when a company initially 

files for an IPO and when the stock of the company is finally priced (begins trading). The number of 

priced IPOs only includes those companies that initially filed for an IPO after November 1, 1997. See 

appendix I for more details. 

In addition to the requirements of the Sarbanes-Oxley Act and the general 

increase in direct expenses, other important factors likely have influenced 

IPO activity. To illustrate, the downward trend in IPOs occurred before the 

passage of the Sarbanes-Oxley Act in mid-2002. It is widely acknowledged 

that IPO filings and pricings tend to be closely associated with stock 

market performance. As shown in figure 4, companies generally issued 

(priced) significantly more IPOs when stock market valuations were 

higher. 

 

42Cost increases associated with concentration in the accounting industry are one of these 

potential factors. Some companies and their investment banks would consider only a large 

accounting firm when preparing for an IPO. In 2003 and 2004, over 80 percent of the 

companies completing the IPO process used a large accounting firm. 

Page 38 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Figure 4: IPO and Stock Market Performance, 1998-2005 

0.5

0.6

0.7

0.8

0.9

1.0

1.1

1.2

1.3

1.4

1.5

Average monthly stock price

 

1998 1999 2000 2001 2002 2003 2004 2005

0 0

200

400

600

800

1,000

1,200

1,400

Filed IPOs

Priced IPOs

 

Average stock price index (in thousands) IPOs

Source: GAO analysis of SEC data.

Note: The number of priced IPOs only includes those companies that initially filed for an initial public 

offering after November 1, 1997. For more information, see appendix II. 

Companies with smaller reported revenues now make up a smaller share 

of the IPO market. The number of IPOs by companies with revenues of $25 

million or less decreased substantially, from 70 percent of all IPOs in 1999 

to about 48 percent in 2004 and 31 percent during the first two quarters of 

2005. Venture capitalists told us that, on average, a private company had to 

demonstrate at least 6 quarters of profitability before it could go public 

and hire an auditor to carry it through the IPO process. According to the 

venture capitalists, an increasing number of small and mid-sized private 

companies have been pursuing mergers and acquisitions as a means of 

growing without going through the IPO process, which now typically costs 

more than a merger or acquisition. 

Page 39 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
While the Sarbanes-Oxley Act has increased corporate governance and 

accountability awareness throughout business and investor communities, 

our research and discussions with representatives of financial institutions 

suggest that financiers are not requiring privately held companies to meet 

Sarbanes-Oxley Act requirements as a condition to obtaining access to 

capital or other financial services. For example, the representatives said 

they emphasize utilization of credit scoring to make decisions and may 

make lending decisions using “personal guarantees” in lieu of audited 

financial statements and reported cash flow on financial statements for the 

smallest private companies. For larger private companies, the 

representatives stated that they require audited financial statements and 

cash flow information, but that their lending requirements existed well 

before the Sarbanes-Oxley Act and have not changed as a result of its 

passage. Overall, they noted that they do not believe that the act has 

affected the way financial institutions and lenders conduct business with 

private companies. They also noted that financial institutions and lenders 

have always enjoyed the freedom to obtain virtually any information about 

a potential borrower and to inquire about the company’s financial 

reporting process and corporate governance practices. For example, if it 

were considered necessary to help determine a company’s ability repay a 

debt, a lender could ask the company to provide copies of any corporate 

governance guidelines, business ethics policies, and key committee 

charters that the company had adopted. 

Potential Spillover Effects 

of the Sarbanes-Oxley Act 

on Private Companies 

Have Been Minimal 

Immediately following the act’s passage, several states proposed 

legislation to enact corporate governance and financial reporting reforms 

for private companies and nonprofit organizations. Specifically, several 

state legislatures proposed instituting requirements similar to those in the 

Sarbanes-Oxley Act for privately held state-registered companies. 

Subsequently, three states—Illinois, Texas, and California—passed 

legislation that mandates corporate governance and accountability 

requirements that resemble certain provisions of the Sarbanes-Oxley Act. 

For example, Illinois passed legislation in 2004 that requires enhanced 

disclosures for certain nonpublic companies and additional licensing 

requirements for certified public accountants and, in 2003, Texas passed 

legislation that imposes strict ethics and disclosure requirements for 

outside financial advisors and service providers, public or private, that 

provide financial services to the state government. On September 29, 2004, 

California adopted the Nonprofit Integrity Act of 2004, becoming the first 

state in the nation to require nonprofit organizations to meet requirements 

that resemble some provisions of the Sarbanes-Oxley Act. For instance, 

nonprofits with gross revenues of $2 million or more operating within the 

state of California currently are required to have independent auditors 

Page 40 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
and, in the case of charitable corporations, audit committees. Further, two 

other states—Nevada and Washington—have passed legislation that 

require accounting firms to retain work papers for 7 years for audits of 

both public and private companies. Furthermore, based on our research 

and discussions with representatives from the National Association of 

State Boards of Accountancy, we found that some state boards made 

changes to regulations that focus on key governance and accountability 

issues similar to those mandated by the Sarbanes-Oxley Act. For example, 

New Jersey adopted enhanced peer review requirements and Tennessee 

instituted additional work paper retention requirements for certified 

public accountants. 

Based on our discussions with private equity providers and private 

company officials, it appears that some privately held companies 

increasingly have incorporated certain elements of the Sarbanes-Oxley Act 

into their governance and internal control policies. Specifically, they have 

adopted practices such as CEO/CFO financial statement certification, 

appointment of independent directors, corporate codes of ethics, 

whistleblower procedures, and approval of nonaudit services by the board. 

According to these officials, some private companies have reported 

receiving pressure from board members, auditors, attorneys, and investors 

to implement certain “best practice” policies and guidelines, modeled after 

the requirements of the act. They noted that the act has raised the bar for 

what constitutes best practices in corporate governance and for 

expectations regarding internal control. Additionally, the officials told us 

that some private companies may have chosen to voluntarily adopt certain 

practices that resemble Sarbanes-Oxley Act provisions to satisfy external 

auditors and legal counsel looking for comparable assurances to reduce 

risk, increase confidence, and improve credibility with many stakeholders. 

Based on our research, we found that many of the aspects of corporate 

governance reform currently being adopted by private companies were 

those relatively inexpensive to implement, but information on the specific 

costs associated with adopting these provisions was not available. 

Page 41 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Since the enactment of the Sarbanes-Oxley Act, smaller public companies 

have been able to obtain needed auditor services; however, auditor 

changes suggest smaller companies have moved from using the services of 

a large accounting firm to using services of mid-sized and small firms. 

Some of this activity has resulted from the resignation of large accounting 

firms from providing audit services to small public companies. Reasons for 

these changes range from audit cost and service concerns cited by 

companies to client profitability and risk concerns cited by accounting 

firms, including capacity constraints and assessments of client risk. In 

recent years, public accounting firms have been categorized into three 

categories—the largest firms, “second tier” firms (mid-sized), and regional 

and local firms (small).43 From 2002 to 2004, 1,006 companies reported 

auditor changes involving a departure from a large accounting firm. Over 

two-thirds of these companies reported switching to a mid-sized or small 

accounting firm. Most of the companies that switched to a mid-sized or 

small accounting firm were smaller public companies with market 

capitalization or revenues of $250 million or less. Overall, mid-sized and 

small accounting firms conducted 30 percent of the total number of public 

company audits in 2004—up from 22 percent in 2002. Despite client gains 

for mid-sized and small firms, the overall market for audit services 

remained highly concentrated, with mid-sized and smaller firms auditing 

just 2 percent of total U.S. publicly traded company revenue.44 In the long 

run, mid-sized and small accounting firms could increase opportunities to 

enhance their recognition and acceptance among capital market 

participants as a result of the gains in public companies audited and 

operating under PCAOB’s registration and inspection process. 

Smaller Companies 

Appear to Have Been 

Able to Obtain 

Needed Auditor 

Services, Although the 

Overall Audit Market 

Remained Highly 

Concentrated 

 

43In addition to the four largest and four mid-sized firms, there were roughly 800 small and 

mid-sized accounting firms that issued audit opinions for U.S. companies in 2002 and 

approximately 600 that issued audit opinions in 2004. 

44The term “revenue” is used interchangeably with the term “sales” used in the Who Audits 

America database. See appendix I for more detail. 

Page 42 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Our limited review did not find evidence to suggest that the SarbanesOxley Act has made it more difficult for smaller public companies to 

obtain needed audit services, but did suggest that smaller public 

companies may have found it harder to retain a large accounting firm as a 

result of increased demand for auditing services, largely due to the 

implementation of section 404 and other requirements of the act, and the 

capacity limitations of the large accounting firms. Of the 2,819 auditor 

changes from 2003 through 2004 that we identified using Audit Analytics 

data, 79 percent were made by companies that represented the smallest of 

publicly listed companies (companies with $75 million or less in market 

capitalization or revenue).45 Although fewer mid-sized and small 

accounting firms conducted public company audits in 2004 because some 

firms did not register with PCAOB or merged with other firms, the market 

appears to have absorbed these changes effectively, with other firms 

taking on these clients. 

Our analysis showed that 1,006 of the 2,819 changes, or 36 percent, 

involved departures from a large accounting firm. Of the 1,006 auditor 

changes, less than one-third (311 or 31 percent) resulted in the public 

company moving to another large accounting firm, and slightly under twothirds (651 or 65 percent) retained a mid-sized or small accounting firm 

(see table 5).46

Smaller Companies Found 

It Harder to Keep or 

Obtain the Services of a 

Large Accounting Firm, 

but Overall Access to 

Audit Services Appeared 

Unaffected 

Recent Auditor Changes 

Resulted in Small 

Accounting Firms Gaining 

Clients 

 

45We analyzed auditor change data using the Audit Analytics database, excluding foreign 

filers, funds and trusts without market data, and benefit plans. We grouped public 

companies into five size categories based on their respective market capitalization: (1) up 

to $75 million, (2) greater than $75 million to $250 million, (3) greater than $250 million to 

$700 million, (4) greater than $700 million to $1 billion, and (5) greater than $1 billion. If 

market capitalization data were not available, revenue data were used as relevant proxies 

for company size. Companies without market capitalization or revenue data were not 

included in the analysis (643 companies). 

46Forty-four companies (less than 1 percent) reported not finding a new auditor as of 

December 2004. Some of these companies may have deregistered, gone bankrupt, merged 

with or been acquired by another company, or otherwise ceased business activity. 

Page 43 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Table 5: Companies Changing Accounting Firms, 2003-2004 

Went to large 

accounting firm 

Went to mid-sized 

accounting firm

Went to small 

accounting firm

No auditor 

reported as of 

December 2004

Total 

departures

Exiting large accounting 

firm 311 298 353 44 1,006

 Average market 

capitalization $1,829,869,346 $172,173,323 $52,108,359 -

Average revenue $1,291,589,676 $138,816,527 $50,765,823 -

Exiting mid-sized 

accounting firm 18 30 147 21 216

 Average market 

capitalization $1,285,735,282 $59,822,406 $38,111,445 -

Average revenue $1,044,690,777 $53,694,660 $22,789,900 -

Exiting small accounting 

firm 41 49 1,446 61 1,597

 Average market 

capitalization $213,223,882 $78,923,135 $18,441,598 -

Average revenue $92,138,114 $28,518,987 $5,039,327 -

Total gainsa59 347 500 126

Total lossesb(695) (186) (151)

Net gain (loss) (636) 161 349 126

Source: GAO analysis of Audit Analytics data. 

Note: Average market capitalization and revenue figures are based only on those companies with 

available relevant financial data. 

a

Total gains represent the sum of companies that went to that particular category of accounting firm 

(large, mid-sized, or small) from another category (cells highlighted in grey for the particular column). 

For example, large accounting firms gained 59 companies from 2003 to 2004 (18 from mid-sized 

firms and 41 from small accounting firms). 

b

Total losses represent the sum of companies that left that particular category of accounting firm 

(large, mid-sized, or small) for another category of firm plus those for which there was no auditor 

reported as of December 2004 (cells highlighted in grey for that particular row). For example, large 

accounting firms lost 695 companies from 2003 to 2004 (298 went to mid-sized firms, 353 went to 

small-sized firms, and 44 that had no auditor reported as of December 2004). 

Over the same period, mid-sized and small accounting firms lost fewer 

public company clients to the large accounting firms; as a result, mid-sized 

and small firms experienced a net increase of 510 public company 

clients—a net gain of 161 and 349 companies for mid-sized and smaller 

firms, respectively. Because we had no data on companies’ selection 

processes, we could not determine whether mid-sized and small firms 

competed for these clients with other large accounting firms or if they 

received these clients by default with no competition from the other large 

accounting firms. According to Who Audits America, small and mid-sized 

Page 44 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
accounting firms increased their percentage public company audit from 22 

percent in 2002 to 27 percent in 2003, and by 2004 they audited 30 percent 

of all U.S. publicly traded companies.47 Small and mid-sized firms audited 

over 38 percent of all public clients in 2004 according to Audit Analytics 

data, which include, in addition to publicly traded companies, other SEC 

reporting companies including foreign registered entities, registered funds 

and trusts, and registered public companies that are not publicly traded. 

The majority of the clients the mid-sized and small firms gained were 

smaller companies with market capitalization or revenues averaging 

$200 million or less. As shown in table 5 and figure 5, the companies 

leaving a large accounting firm and retaining another large firm tended to 

be very large—with average market capitalization (or revenue) of more 

than $1 billion. However, the average market capitalization (or revenue) of 

companies leaving a large accounting firm and retaining a mid-sized 

accounting firm was less than $175 million and the capitalization (or 

revenue) of companies retaining a small firm was significantly smaller—

less than $53 million. Similarly, companies leaving smaller and mid-sized 

firms that retained a large accounting firm tended to be much larger than 

those that retained another mid-sized or small firm. 

 

47These figures do not include foreign companies or companies that did not trade on NYSE, 

NASDAQ, AMEX, OTCBB, or the Pink Sheets. See appendix I for data reliability. 

Page 45 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Figure 5: Average Size of Companies Changing Auditors, 2003-2004, by Type of 

Accounting Firm Change 

0 .2 .4 .6 .8 1.0 1.2 1.4 1.6 1.8 2.0

Revenue

Market capitalization

Changes

from the 4

largest firms

to local/

regional firms

Changes

from the 4

largest firms

to second-tier

firms

Changes

within the 4

largest firms

Dollars in billions

Source: GAO analysis of Audit Analytics data.

Note: This figure includes only those companies with available relevant financial data. 

Reasons for Auditor 

Changes May Have 

Included Costs Related to 

the Act and Risk 

Assessments 

While the reasons for the movement of smaller public companies to midsized and small accounting firms may be somewhat speculative at this 

point, the Sarbanes-Oxley Act may have contributed to this shift. Some 

smaller companies may have preferred a large firm because of the 

perception that large accounting firms—by virtue of their reputation or 

perceived skills—can help attract investors and improve access to 

capital.48 Workload demands placed on the large firms by larger public 

companies, which represent the overwhelming majority of their clients, 

have increased with section 404 and other Sarbanes-Oxley Act 

implementing regulations. The resulting increases in workload and audit 

 

48In a previous report, Public Accounting Firms: Mandated Study on Consolidation and 

Competition, GAO-03-864 (Washington, D.C.: July 2003), we noted that public companies 

wishing to demonstrate their worthiness for debt and equity investments might continue to 

employ a large accounting firm to increase their credibility among potential lenders and 

investors and that some companies and boards of directors have been reluctant to consider 

small firms. 

Page 46 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
fees appear to have constrained smaller companies’ access to large 

accounting firms—either because smaller companies were unable to 

afford a large accounting firm or because large accounting firms resigned 

from smaller clients. According to Audit Analytics, the largest accounting 

firms resigned from three times as many clients in 2004 as in 2001, and 

three-quarters of those were companies with revenues of less than $100 

million. 

Beyond resignations by large accounting firms in response to increased 

demand for audit services, the act may have caused large accounting firms 

to reevaluate the risk in their aggregate client portfolios by increasing the 

responsibilities and liability of auditors, leading them to shed smaller 

public companies. According to the large accounting firms with whom we 

spoke, they did not have enough resources to retain all of their clients 

after the Sarbanes-Oxley Act and cited risk as a significant factor in 

choosing which clients to keep.49 Moreover, the largest audit firms could 

be applying stricter profitability guidelines in selecting their clients, 

eliminating those engagements where profit margins are smaller. 

While former clients of large accounting firms may represent opportunities 

for mid-sized and small accounting firms, they also represent some risks. 

For example, we found that a disproportionate percentage of the 

companies that left a large accounting firm for a small firm had accounting 

or risk issues. Overall, about 69 percent of the companies that left a large 

accounting firm switched to a mid-sized or small accounting firm. 

However, 92 percent of the companies that received a going concern 

qualification went to a mid-sized or small accounting firm.50 In addition, 

about 81 percent of the companies with at least one accounting issue 

(such as restatement, reportable condition, scope limitation, management 

 

49Many of the public accounting firms with whom we talked had a significant number of 

accelerated filers for 2004 and noted that the additional work challenged the firm’s 

capacity. While the firms expanded and supplemented their capacity to handle the 

additional work, these firms also acknowledged that they took the workload and capacity 

issues into account in conducting their ongoing client acceptance and retention reviews. 

Many of the firms—particularly the large accounting firms—acknowledged that since 2002, 

their review and retention processes have resulted in a reduction of their public company 

audit client base to better match workload capacity. 

50Ninety-four percent of the companies changing auditors that had going concern opinions 

had market capitalization of $75 million or less (or, if no market capitalization data were 

available, $75 million or less in revenues). A going concern opinion is issued by an auditor 

if the auditor has doubts about the company’s ability to generate or raise enough resources 

to stay operational (to continue as a “going concern”). 

Page 47 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
found to be unreliable, audit opinion concerns, illegal acts, or SEC 

investigation) went from a large to a mid-sized or small accounting firm. In 

contrast, 63 percent of the companies with no going concern qualification 

or any additional “risk” issues went to mid-sized and small firms. We also 

found that, if a large accounting firm resigned as the auditor of record, the 

company was more likely to switch to a mid-sized or small accounting 

firm. Roughly 85 percent of the smallest companies that were dropped by 

one of the largest accounting firms retained a smaller audit firm. 

Mid-sized and Small 

Accounting Firms 

Continued to Operate in a 

Highly Concentrated 

Market 

Although mid-sized and small accounting firms gained clients in 2003 and 

2004, they continued to operate in a market dominated by large accounting 

firms. The market for audit services in 2004 changed little from the market 

we described in our 2003 report.51 For example, mid-sized and small 

accounting firms increased their share of all public company revenues by 1 

percentage point in 2002–2004. The market for audit services remained 

highly concentrated—a tight oligopoly, where in 2004 the four largest 

firms audited 98 percent of the market and the remaining firms audited 2 

percent—and the potential market power was significant.52

The market for smaller public company audits was much more 

competitive than the overall and large public company market. As shown 

in figure 6, while the market for audit services for large company clients 

remained dominated by large accounting firms, the market for the smallest 

public company clients appeared to indicate healthy competition. Midsized and small firms audited 59 percent of all public company clients with 

revenues of $25 million or less, 45 percent of all clients with revenues 

greater than $25 million up to $50 million, and 32 percent of all clients with 

revenues greater than $50 million up to $100 million. When these revenue 

categories were combined, the large accounting firms combined with the 

mid-sized firms audited 75 percent of companies with revenues of $100 

 

51See GAO-03-864. 

52These concentration statistics suggest a Hirschman-Herfindahl Index (HHI) of 2,505, 

which is equivalent to the index calculated for 2002 (2,566). The HHI is calculated by 

summing the squares of the individual market shares of all the participants. An HHI above 

1,800 indicates a highly concentrated market in which firms have the potential for 

significant market power. While concentration ratios and the HHI are good indicators of 

market structure, these measures only indicate the potential for oligopolistic collusion or 

the exercise of market power and can overstate the significance of a tight oligopoly on 

competition. See GAO-03-864 for further discussion of the HHI. 

Page 48 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
million or less, while the small firms audited the remaining 25 percent.53 As 

noted in our 2003 report, as companies expanded operations around the 

world, the large audit firms globally expanded through mergers in order to 

provide service to their international clients.54

Figure 6: Percentage of Clients Audited by Revenue Category, 4 Largest 

Accounting Firms versus Mid-sized and Small Accounting Firms, 2004 

0 10 20 30 40 50 60 70 80 90 100

>$5 

>$1-$5 

>.5-$1

>$250-$500

>$100-$250

>$50-$100

>$25-$50

$1 - $25

All clients

Dollars

in millions

Dollars

in billions

4 largest accounting firms

Mid-sized and small accounting firms

Source: Who Audits America 2004.

Percentage

Note: Does not include companies that did not trade on the major exchanges or over-the-counter 

markets, foreign companies, or bankrupt companies. Figures omit certain small accounting firms that 

held a very small share of the market. 

More recently, mid-sized and small accounting firms gained more large 

clients. In 2004, these accounting firms audited approximately 3 percent of 

 

53As such, the four-firm and eight-firm (large accounting firms plus second-tier firms) 

concentration ratios are 0.55 and 0.75 respectively for this particular section of the market. 

These ratios are consistent with an HHI below 1,000. As a general rule, an HHI below 1,000 

indicates a market predisposed to perform competitively, while an HHI above 1,800 

indicates a highly concentrated market. See GAO-03-864. 

54See GAO-03-864. 

Page 49 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
the companies with revenues greater than $500 million, up from 2 percent 

in 2002. However, as shown in table 5, the average revenue of the clients 

lost to the largest accounting firms was $1.1 billion while the average 

revenue of the client gained from the largest accounting firms was $138.8 

million. Overall, mid-sized and small accounting firms conducted 30 

percent of the total number of public company audits in 2004—up from 22 

percent in 2002. While these companies make up just 2 percent of total 

public company revenue, they are a large segment of the market of 

publicly traded clients.55

Sarbanes-Oxley Act May 

Impact the Continuing 

Competitive Challenges 

Faced by Mid-Sized and 

Small Accounting Firms 

According to some experts, competitive challenges related to the ability of 

mid-sized and small firms to compete for public companies such as 

capacity, expertise, recognition, and litigation risks may have been 

strengthened since the passage of the Sarbanes-Oxley Act.56 For example, 

in a recent American Assembly report, a number of industry professionals 

indicated that large accounting firms’ facility with new requirements was 

seen as increasingly important as audits have become more complex and 

time-consuming and the financial consequences of noncompliance more 

severe. 

Additionally, even though some experts believe that large accounting 

firms’ regulatory competence has been overstated, a perception may exist 

among many large and some small U.S. companies as well as other market 

influencers and stakeholders that only the large accounting firms can 

 

55Based on a large sample analyzed from Audit Analytics, when we broadened the market 

to include SEC reporting companies that do not publicly trade, funds and trusts, the 600 

small and mid-sized firms we identified audited over 4,400 domestic public clients. 

56As we noted in our 2003 report, mid-sized and small accounting firms face challenges in 

effectively competing for large national and multinational public company audits. The 

challenges include lack of staff resources, experience, technical expertise, and global reach 

necessary to audit large multinationals; establishing recognition and credibility with larger 

companies and market participants to counter the perception that only large firms can 

provide the required auditing services; increased litigation risk and insurance costs 

associated with auditing public companies; and difficulty in raising capital to expand 

infrastructure to compete with large accounting firms. Also, at a recent conference on 

auditor concentration organized by The American Assembly, experts generally agreed that 

significant challenges restrict the ability of mid-sized accounting firms to increase their 

market share and present a major alternative to the large accounting firms. “The Future of 

the Accounting Profession: Auditor Concentration,” which was held on May 23, 2005, was a 

follow-on to the Assembly’s November 2003 meeting where 57 business leaders, academics, 

journalists, and regulatory officials discussed the challenges the accounting profession 

faced. For more information, see http://www.americanassembly.org/index.php. 

Page 50 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
provide the required auditing services necessary to meet the requirements 

of the act. For example, the venture capital industry representatives that 

we spoke with stated that this perception has been especially prevalent for 

companies issuing IPOs. As shown in figure 7, companies large and small 

tended to use large accounting firms for IPOs. 

Figure 7: Total Number of IPOs, by Size of Accounting Firm, 1999–2004 

Year

4 largest accounting firms

Total

Mid-sized and small accounting firms

Source: GAO analysis of SEC data.

Percentage Number

0 10 20 30 40 50 60 70 80 90 100

2004

2003

2002

2001

2000

1999

0 100 200 300 400 500 600

Over the long run, the Sarbanes-Oxley Act could ease some of these 

challenges. For example, mid-sized and small accounting firms have 

continued to confront the perceptions of capital market participants that 

only large firms have the skills and resources necessary to perform public 

company audits. These perceptions have constrained firms from obtaining 

or retaining many clients that the firms believed were within their capacity 

to audit. However, the increase in public company audits performed by 

mid-sized and small accounting firms has given these firms additional 

opportunities to enhance their recognition and acceptance among more 

public companies and capital market participants. Also, as smaller public 

companies begin complying with section 404 in 2007, small accounting 

firms will gain additional experience with the implementation of the act. 

Taking on additional clients will provide an important growth opportunity. 

Effectively matching company size and needs with accounting firm size 

Page 51 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
and capabilities could allow smaller public companies to find the best 

combination of quality, service value, and reach. 

In addition, the PCAOB registration and inspection process and the 

establishment of attestation, quality control, and ethics standards to be 

used by registered public accounting firms in the preparation and issuance 

of audit reports could provide increased assurance of the quality of small 

accounting firm audits. Similarly, as more information will become 

available through PCAOB’s ongoing inspection program, small accounting 

firms could establish a “track record,” allowing for additional 

opportunities for recognition and acceptance among analysts, investment 

bankers, investors, and public companies. 

The Sarbanes-Oxley Act was a watershed event—strengthening disclosure 

and internal control requirements for financial reporting, establishing new 

auditor independence standards, and introducing new corporate 

governance requirements. Regulators, public companies, audit firms, and 

investors generally have acknowledged that many of the act’s provisions 

have had a positive and significant impact on investor protection and 

confidence. Yet, for smaller public companies and companies of all sizes 

that have complied with the various provisions of the Sarbanes-Oxley Act, 

compliance costs have been higher than anticipated—with the higher cost 

being associated with the internal control over financial reporting 

requirements of section 404. 

Conclusions 

There is widespread agreement that several factors contributed to the 

costs of implementing section 404 for both larger and smaller public 

companies. Few public companies or their audit firms had prior direct 

experience with evaluating and reporting on the effectiveness of internal 

control over financial reporting or with implementing the COSO internal 

control framework, particularly in a small business environment. This was 

despite previous requirements, dating back to 1977, that public companies 

implement a system of internal accounting controls. The first year costs 

were exacerbated because many companies were documenting their 

internal control over financial reporting for the first time and remediating 

poor or nonexistent internal controls as part of their first-year 

implementation efforts to comply with section 404, both of which could be 

viewed as a positive impact of the act. In addition, the nature, timing, and 

extent of available guidance on establishing and assessing internal control 

over financial reporting made it more difficult for most public companies 

and audit firms to efficiently and effectively implement the requirements 

of section 404. As a result, management’s implementation and assessment 

Page 52 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
efforts were largely driven by PCAOB’s Auditing Standard No. 2, as 

guidance at a similar level of detail was not available for management’s 

implementation and assessment process. These factors, in conjunction 

with the changed environment and expectations resulting from the act, 

contributed to a considerable amount of “learning curve” activities and 

inefficiencies during the initial year of implementation. Auditing firms and 

a number of public companies have stated that they expect subsequent 

years’ compliance costs for section 404 to decrease. This is not 

unexpected given the significance and nature of the changes and a 

preexisting environment that did not place enough emphasis on effective 

internal control over financial reporting. 

Consistent with the findings of the Small Business Administration on the 

impact of regulations generally on smaller public companies, it is 

reasonable to conclude that smaller public companies face 

disproportionately greater costs, as a percentage of revenues, than larger 

companies in meeting the requirements of the act. While facing the same 

basic requirements, smaller public companies generally have more limited 

resources, fewer shareholders, and generally less complex structures and 

operations. Again, this is to be expected given the economies of scale and 

differing levels of corporate infrastructure and resources. However, some 

of the unique characteristics of smaller companies can create 

opportunities to efficiently achieve effective internal control over financial 

reporting. Those characteristics include more centralized management 

oversight of the business, more involvement of top management in the 

business operations, simpler operations, and limited geographic locations. 

The ultimate impact of the Sarbanes-Oxley Act on the majority of smaller 

public companies remains unclear because the time frame to comply with 

section 404 of the act was extended until fiscal years ending after July 

2007 for the approximately 5,971 public companies with less than 

$75 million in public float. Recognizing the challenges that smaller public 

companies have faced in meeting the requirements of the act, particularly 

section 404, SEC formed an advisory committee on smaller public 

companies to analyze the impact of the act and other securities laws on 

smaller public companies. The advisory committee has issued an exposure 

draft of its final reporting stating that certain smaller public companies 

need relief from section 404, “unless and until” a framework for assessing 

internal control over financial reporting is developed that recognizes the 

characteristics and needs of smaller public companies. The exposure draft 

contains specific recommendations that would essentially result in a 

“tiered approach” for compliance with section 404 requirements, where 

larger public companies would continue to be required to fully comply 

Page 53 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
with all requirements of section 404, while smaller public companies 

consisting of “microcap” and “smallcap” companies would be granted 

differing levels of exemptions until an adequate framework was in place. 

We have two specific concerns regarding the advisory committee’s 

recommendations. First, the recommendations propose relief “unless and 

until a framework for assessing internal control over financial reporting” 

for smaller companies is developed that “recognizes the characteristics 

and needs of those companies.” While the recommendations hinge on the 

need for a framework that recognizes smaller public company 

characteristics and needs of smaller public companies, they do not 

address what needs to be done to establish such a framework or how such 

a framework should take into consideration the characteristics and needs 

of smaller public companies. Many, if not most, of the significant problems 

and challenges encountered by large and small companies in implementing 

section 404 related to problems with implementation, rather than the 

internal control framework itself. In addition to having a useful internal 

control framework, appropriate implementation of a framework by public 

companies must be based on risk, facts and circumstances, and 

professional judgment. We believe that sufficient guidance covering both 

the internal control framework and the means by which it can be 

effectively implemented is essential to enable large and small public 

companies to implement a framework which would enable effective and 

efficient assessment and reporting on the effectiveness of internal control 

over financial reporting. 

Our second concern relates to the ambiguity surrounding the conditional 

nature of the “unless and until” provisions of the recommendations and its 

potential impact on a large number of companies that would likely qualify 

for the proposed exemptions. If resolution of small public company 

concerns about a framework and its implementation results in an 

extended period of exemption, then large numbers of public companies 

would potentially be exempted for additional periods from complying with 

this important investor protection component of the act. The categories of 

microcap and smallcap companies, as defined by the advisory committee 

recommendations, cover 79 percent of U.S. public companies and 

6 percent of the U.S. equity market capitalization when combined. 

Although the categories of microcap and smallcap have been further 

refined by the advisory committee through the addition of a revenue size 

filter for purposes of its primary recommendations on section 404, it 

appears that a large number of companies, up to 70 percent of all U.S. 

public companies, would be potentially exempted. Specifically, the 

committee estimates that, after applying the revenue criteria, 4,641 “micro 

Page 54 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
cap” public companies (approximately 49 percent of 9,428 public 

companies identified in data developed for the advisory committee by 

SEC’s Office on Economic Analysis) may potentially qualify for the 

proposed full exemption from section 404 and another 1,957 “smallcap” 

public companies (approximately 21 percent of the identified public 

companies) may potentially qualify for the proposed exemption from the 

external audit requirement of section 404(b). These estimates do not 

include those public companies trading on the Pink Sheets that would be 

covered by the Advisory Committee’s preliminary recommendations. In 

addition, it is likely that a number of public companies qualifying for 

exemptive relief under the committee’s recommendations are likely to 

have already complied with both sections of 404(a) and (b) of the act 

under the current category of accelerated filers. 

Also, regarding the committee’s third primary internal control 

recommendation calling for a review of the design and implementation of 

internal control if SEC concludes, as a matter of public policy, that the 

external auditor’s involvement is required, it is not clear from the 

committee’s report the extent to which, particularly in the present 

environment, such a review would result in lower costs than those being 

associated with the implementation of PCAOB’s Auditing Standard No. 2. 

Any lower costs that might result must be considered in light of the 

reduced independent assurances on the effectiveness of internal control 

over financial reporting that would result and the potential for confusion 

on the part of users of the public company’s financial statements and audit 

reports. 

Until sufficient guidance is available for smaller public companies, some 

interim regulatory relief on a limited scale may be appropriate. However, 

given the number of public companies that would potentially qualify for 

relief under the recommendations being considered, we believe that a 

significant reduction in scope of the proposed relief needs to occur to 

preserve the overriding investor protection purpose of the Sarbanes-Oxley 

Act. The purpose of internal control over financial reporting is to provide 

reasonable assurance over the integrity and reliability of the financial 

statements and related disclosures. Public and investor confidence in the 

fairness of financial reporting is critical to the effective functioning of our 

capital markets. Market reactions to financial statement misstatements 

illustrate the importance of accurate financial reporting, regardless of a 

company’s size. SEC staff and others have pointed to the increased level of 

restatements as an indicator that the Sarbanes-Oxley Act—section 404 in 

particular—has prompted companies to identify and correct weaknesses 

that led to financial reporting misstatements in prior fiscal years. 

Page 55 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Indicators also show that in some respects, smaller companies have a 

higher risk profile for investors. For instance, smaller public companies 

have higher rates of restatements generally and showed a 

disproportionately higher rate of reported material weakness in internal 

control over financial reporting during the initial year of section 404 

implementation. Over time, having the effective internal control over 

financial reporting envisioned by the act can reduce some aspects of the 

higher risk profile of smaller public companies. 

When SEC receives and considers the final recommendations of SEC’s 

small business advisory committee, it is essential that SEC consider key 

principles, under the umbrella principle of investor protection, when 

deciding whether or to what extent to provide smaller public companies 

with alternatives to full implementation of the section 404 requirements. 

These principles include (1) assuring that smaller public companies have 

sufficient useful guidance to implement, assess, and report on internal 

controls over financial reporting to meet the requirements of section 404, 

(2) if additional relief is considered appropriate, conducting further 

analysis of small public company characteristics to significantly reduce 

the scope of companies that would qualify for any type of additional relief 

while working to ensure that the Sarbanes-Oxley Act’s goal of investor 

protection is being met, and (3) acting expeditiously such that smaller 

public companies are encouraged to continue improving their internal 

control over financial reporting. 

First, it is critical that SEC carefully assess the available guidance, 

including that being developed by COSO, to determine whether it is 

sufficient or whether additional action needs to be taken, such as issuing 

supplemental or clarifying guidance to smaller public companies to help 

them meet the requirements of section 404. Our analysis of available 

research and discussions with smaller public companies and audit firms 

indicate that public companies and external auditors have had limited 

practical experience with implementing internal control frameworks in a 

smaller company environment and that additional guidance is needed. 

Moreover, it is critical that SEC coordinate its actions with PCAOB, which 

is responsible for establishing standards for the external auditor’s internal 

control attestations, to ensure that external auditors are using standards 

and guidance on section 404 compliance that are consistent with guidance 

for public companies and that they are doing so in an effective and 

efficient manner. As SEC considers the need for additional 

implementation guidance, it will be important that the guidance and 

related PCAOB audit standards be consistent and compatible. Also, it will 

be important for the PCAOB to continue to identify ways in which auditors 

Page 56 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
can achieve more economical, effective, and efficient implementation of 

audit-related standards and guidance. 

Second, as SEC considers whether and to what extent it might be 

appropriate to provide additional interim relief to some categories of 

smaller public companies, it will be important to balance the needs of the 

investing public with the concerns expressed by small businesses. In doing 

so, it is important to determine whether there are unique characteristics, 

in addition to size, that could influence the extent that some regulatory 

accommodation might be appropriate in order to arrive at a targeted and 

limited category of companies being provided with potential exemptions. 

For example, if these companies were closely held or have a higher rate of 

insider investors, regulatory relief may raise less of an investor protection 

concern. These investors may be more knowledgeable about company 

operations and receive fewer benefits from section 404’s enhanced 

disclosures. For companies that are widely traded, regulatory relief would 

raise more concerns about investor protection and relief would appear 

less appropriate. Furthermore, although the “insider” shareholder owners 

may not have the same need for investor protection as investors in broadly 

held companies, minority shareholders who are not insiders may need 

such protection. For other purposes, certain provisions of SEC’s securities 

regulations and the Employee Retirement Income Security Act of 1974 

regulations condition different types of relief, in part, on the nature and/or 

the financial sophistication of the investor, and SEC may wish to consider 

whether such approaches would help serve to balance the concerns of 

small businesses against the needs of investors. The criteria and 

characteristics used should be linked to the investor protection goals of 

the Sarbanes-Oxley Act and be geared toward limiting the numbers of 

companies that would be eligible based on those investor protection goals. 

In addition, the advisory committee’s preliminary recommendations to 

exempt “smaller public companies” from the external audit requirements 

of section 404 would include a number of companies that have already 

complied with section 404, and SEC needs to carefully consider whether it 

is appropriate to provide regulatory relief on this basis. 

Finally, we believe that SEC has an obligation to resolve section 404 

implementation requirements for smaller public companies in a way that 

creates incentives for smaller public companies to take actions to improve 

their internal control over financial reporting. Rather than delaying 

implementation, which would likely result in smaller public companies 

anticipating future extensions or relief, SEC’s resolution of these issues 

would provide needed clarity and certainty over the scope and timing of 

smaller companies’ compliance with section 404 and provide incentives to 

Page 57 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
smaller public companies to begin the process of implementing section 

404. 

Sarbanes-Oxley Act Challenges for Small Companies

In light of concerns raised by the SEC Advisory Committee on Smaller 

Public Companies and others regarding the ability of smaller public 

companies to effectively implement section 404, we recommend that the 

Chairman of SEC 

Recommendations 

• assess the guidance available, with an emphasis on implementation 

guidance for management’s assessment of internal control over financial 

reporting, to determine whether the current guidance is sufficient and 

whether additional action is needed, such as issuing supplemental or 

clarifying guidance to help smaller public companies meet the 

requirements of section 404, and 

• coordinate with PCAOB to (1) help ensure that section 404-related audit 

standards and guidance are consistent with any additional guidance 

applicable to management’s assessment of internal control and (2) identify 

additional ways in which auditors’ can achieve more economical, effective, 

and efficient implementation of the standards and guidance related to 

internal control over financial reporting. 

If, in evaluating the recommendations of its advisory committee, SEC 

determines that additional relief is appropriate beyond the current July 

2007 compliance date for non-accelerated filers, we recommend that the 

Chairman of SEC analyze and consider, in addition to size, the unique 

characteristics of smaller public companies and the knowledge base, 

educational background, and sophistication of their investors in 

determining categories of companies for which additional relief may be 

appropriate to ensure that the objectives of investor protection are 

adequately met and any relief is targeted and limited. 

We provided a draft of this report to the Chairman, SEC, and the Acting 

Chairman, PCAOB, for their review and comment. We received written 

comments from SEC and PCAOB that are summarized below and 

reprinted in appendixes III and IV. SEC agreed that the Sarbanes-Oxley 

Act has had a positive impact on investor protection and confidence, and 

that smaller public companies face particular challenges in implementing 

certain provisions of the act, notably section 404. SEC stated that our 

recommendations should provide a useful framework for consideration of 

its advisory committee’s final recommendations. PCAOB stated that it is 

Agency Comments 

and Our Evaluation 

Page 58 GAO-06-361 
committed to working with SEC on our recommendations and that it is 

essential to maintain the overriding purpose of the Sarbanes-Oxley Act of 

investor protection while seeking to make its implementation as efficient 

and effective as possible. Both SEC and PCAOB provided technical 

comments that were incorporated into the report as appropriate. 

As we agreed with your office, unless you publicly announce the contents 

of this report earlier, we plan no further distribution of it until 30 days 

from the date of this letter. At that time, we will send copies of this report 

to interested congressional committees and subcommittees; the Chairman, 

SEC; the Acting Chairman, PCAOB; and the Administrator, SBA. We will 

make copies available to others upon request. In addition, the report will 

be available at no charge on the GAO Web site at http://www.gao.gov. 

Page 59 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
If you have any questions concerning this report, please contact William B. 

Shear at (202) 512-8678 or shearw@gao.gov, or Jeanette M. Franzel at 

(202) 512-9471 or franzelj@gao.gov. Contact points for our Office of 

Congressional Relations and Public Affairs may be found on the last page 

of this report. See appendix V for a list of other staff who contributed to 

the report. 

William B. Shear 

Director, Financial Markets and 

 Community Investment 

Jeanette M. Franzel 

Director, Financial Management 

 and Assurance 

Page 60 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

Page 61 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies

Our reporting objectives were to (1) analyze the impact of the SarbanesOxley Act on smaller public companies in terms of costs of compliance 

and access to capital; (2) describe the Securities and Exchange 

Commission’s (SEC) and Public Company Accounting Oversight Board’s 

(PCAOB) efforts related to the implementation of the act and their 

responses to concerns raised by smaller public companies and the 

accounting firms that audit them; (3) analyze the impact of the act on 

smaller privately held companies, including costs, ability to access public 

markets, and the extent to which states and capital markets have imposed 

similar requirements on smaller privately held companies; and (4) analyze 

smaller companies’ access to auditing services and the extent to which the 

share of public companies audited by small accounting firms has changed 

since the enactment of the Sarbanes-Oxley Act. 

In arriving at our report objectives, we incorporated nine specific 

questions contained in your request letter. See table 6 for a cross-sectional 

comparison of the nine specific questions contained in your letter, the four 

report objectives, and our findings. 

Table 6: Cross-sectional Comparison of Request Letter Questions, Our Report Objectives, and Selected Findings 

Request letter question Report objective Findings 

1. In investigating the effects of the act 

on small public companies, please 

assess: 

(a) How requirements in the act and 

the implementing regulations, as 

adopted for publicly traded 

companies, affect small business 

equity capital formation in both the 

stock and bond markets. 

1. Analyze the impact of the Sarbanes-Oxley 

Act on smaller public companies in terms 

of costs of compliance and access to 

capital. 

2. Describe SEC’s and PCAOB’s efforts 

related to the implementation of the act 

and their responses to concerns raised by 

smaller public companies and the 

accounting firms that audit them. 

Because a large number of smaller public 

companies have not yet implemented all the 

provisions of the act and the recent and 

ongoing actions by SEC and PCAOB to 

address small business implementation 

issues, it is too soon to determine the act’s 

impact on smaller public companies’ access 

to capital. Along with other market factors, 

the act may have encouraged some smaller 

companies to go private. Going private 

reduces financing options available to those 

companies, which must rely on potentially 

more expensive alternatives to public equity 

capital. 

Appendix I: Objectives, Scope, and 

Methodology 
Appendix I: Objectives, Scope, and 

Methodology 

Request letter question Report objective Findings 

(b) What the detailed costs are that 

small public companies bear in 

complying with the act on both a 

federal and state level. 

1. Analyze the impact of the SarbanesOxley Act on smaller public companies in 

terms of costs of compliance and 

access to capital. 

2. Describe SEC’s and PCAOB’s efforts 

related to the implementation of the act 

and their responses to concerns raised 

by smaller public companies and the 

accounting firms that audit them. 

Our analysis of Audit Analytics data showed 

that the smallest companies that had fully 

implemented the act’s provisions, 

particularly section 404, spent a median of 

1.1 percent of their revenues on audit fees 

whereas companies that had not 

implemented section 404 spent 0.8 percent 

of their revenue on audit fees. Responses 

to our survey provided the following detailed 

costs for first year of implementation: fees 

to consultants for services related to section 

404 ranged from $3,000 to over $1.4 

million. 

To help smaller companies and their 

auditors develop approaches to implement 

the act’s requirements, SEC established an 

Advisory Committee on Smaller Public 

Companies. SEC recently extended the 

section 404 compliance deadline for nonaccelerated filers based on the committee’s 

recommendation, which SEC had 

previously done on two separate occasions. 

Currently, a non-accelerated filer must 

begin to comply with section 404 for its first 

fiscal year ending on or after July 15, 2007. 

The advisory committee has several other 

recommendations under consideration, 

including providing conditional total section 

404 exemptive relief for the very smallest 

public companies or staggering the 404 

requirements based on company size or 

other characteristics. Both SEC and 

PCAOB issued additional guidance to help 

both public companies and accounting firms 

in implementing section 404, expecting that 

the additional guidance would help lower 

public companies’ costs of compliance. As 

the act was a federal law, there were no 

costs for public companies on a state level. 

Page 62 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

Request letter question Report objective Findings 

(c) The challenges small companies 

face in obtaining access to auditing 

services in order to comply with the 

act. 

4. Analyze smaller companies’ access to 

auditing services and the extent to 

which the share of public companies 

audited by smaller accounting firms has 

changed since the enactment of the 

Sarbanes-Oxley Act. 

Smaller public companies appear to have 

been able to obtain needed auditing 

services, although not necessarily from their 

auditor of choice. However, many smaller 

companies moved from large accounting 

firms to smaller accounting firms and paid 

higher fees for audit services. In particular, 

smaller firms appear to be taking on a 

higher percentage of public companies with 

accounting issues. Furthermore, the act’s 

auditor independence requirements caused 

smaller companies to seek advice from 

other sources, which increased costs. 

2. In investigating the effects of the act 

on small private companies, please 

assess the extent to which: 

(a) Financial institutions require 

private small companies to comply 

with the act in order to receive capital 

financing and financial services. 

3. Analyze the impact of the act on smaller 

privately held companies, including 

costs, ability to access public markets, 

and the extent to which states and 

capital markets have imposed similar 

requirements on smaller privately held 

companies. 

The act appears to have increased 

corporate governance and accountability 

awareness throughout the business and 

investor communities. However, it does not 

appear that the capital markets, notably 

banks and venture capitalists, are denying 

private companies access to capital or other 

financial services because of failure to meet 

Sarbanes-Oxley Act requirements. 

(b) States have or are considering 

enacting provisions of the act for 

small privately held companies. 

3. Analyze the impact of the act on smaller 

privately held companies, including 

costs, ability to access public markets, 

and the extent to which states and capital 

markets have imposed similar 

requirements on smaller privately held 

companies. 

Three states—Illinois, Texas, and 

California—have passed legislation with 

corporate governance and accountability 

requirements that resemble certain 

provisions of the Sarbanes-Oxley Act. Two 

other states enacted laws covering auditor 

work paper retention requirements and 

some state boards of accountancy have 

proposed rule changes affecting, among 

other things, enhanced peer review 

requirements for CPAs. We are unaware of 

any states that enacted a version of section 

404 on internal control over financial 

reporting for privately held companies. 

(c) Small privately held companies 

are being denied access to capital or 

other financial services, because they 

do not meet the act’s requirements. 

3. Analyze the impact of the act on smaller 

privately held companies, including 

costs, ability to access public markets, 

and the extent to which states and 

capital markets have imposed similar 

requirements on smaller privately held 

companies. 

Our research and discussions with 

representatives of financial institutions 

suggest that smaller private companies 

have not been denied access to capital or 

other financial services as a result of the 

act. 

Page 63 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

Request letter question Report objective Findings 

(d) Small private companies are 

incurring additional costs to comply 

with any part of the act in order to 

receive financial services. Please 

include a detailed list of these 

compliance and accounting costs. 

3. Analyze the impact of the act on 

smaller privately held companies, 

including costs, ability to access public 

markets, and the extent to which states 

and capital markets have imposed similar 

requirements on smaller privately held 

companies. 

We found no evidence that smaller private 

companies were incurring additional costs, 

except for smaller private companies 

intending to go public or “voluntarily” 

complying with provisions of the act. 

However, information on factors that may 

have encouraged smaller private 

companies to voluntarily comply with 

provisions of the act or the specific costs for 

those smaller private companies was not 

available. 

(e) Compliance with the act has 

created significant barriers to entry for 

small privately held companies to 

reach the public markets. 

3. Analyze the impact of the act on 

smaller privately held companies, 

including costs, ability to access 

public markets, and the extent to which 

states and capital markets have imposed 

similar requirements on smaller privately 

held companies. 

We found that smaller private companies 

wanting to go public were spending 

additional time, effort, and money to 

convince investors that they could meet the 

act’s requirements. 

3. With respect to small accounting 

and auditing firms, we request that 

GAO review whether the market 

has improved for these firms since 

GAO’s findings outlined in 

“Mandated Study on Consolidation 

and Competition,” GAO-03-864, as 

required by Section 701 of the act. 

4. Analyze smaller companies’ access to 

auditing services and the extent to which 

the share of public companies audited 

by small accounting firms has changed

since the enactment of the SarbanesOxley Act. 

While the number of public companies 

audited by smaller accounting firms has 

increased since the passage of the act, 

large accounting firms continue to dominate 

the market in terms of the proportion of 

market capitalization audited. In 2004, large 

accounting firms audited 98 percent of total 

revenues. 

Source: GAO. 

To address our four objectives, we reviewed and analyzed information 

from a variety of sources, including the legislative history of the act, 

relevant regulatory pronouncements and related public comment letters, 

and available research studies and papers. We also interviewed officials at 

SEC, PCAOB, and the Small Business Administration (SBA). In addition, 

we held discussions with the chief financial officers (CFO) of smaller 

public and private companies, representatives of relevant trade 

associations, accounting firms, market participants, and experts. 

Impact of Sarbanes-Oxley 

Act on Smaller Public 

Companies 

We could not analyze the impact of the act on many smaller public 

companies because SEC has extended the date by which public registrants 

with less than $75 million public float (known as “non-accelerated” filers) 

must comply with Section 404 of the act to their first fiscal year ending on 

Page 64 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

or after July 15, 2007.1 According to SEC, non-accelerated filers represent 

about 60 percent of all registered public companies and about 1 percent of 

total available market capitalization. As a result, we analyzed public data 

and other information related to the experiences of public companies that 

have fully implemented the act’s provisions. We also compared the 

information from companies that had implemented the act with 

information from smaller companies that took the SEC extension to gain 

some insight into the potential impact of these provisions on the nonaccelerated filers. 

Audit Analytics, an on-line market intelligence service maintained by Ives 

Group, Incorporated provides, among other things, a database of audit 

fees by company back to 2000 along with demographic and financial 

information. Using this database, we analyzed changes in the audit fees 

companies have paid by various size categories. Audit Analytics also 

provides a comprehensive listing of all reported auditor changes, which 

includes data on the date of change, departing auditor, engaged auditor, 

whether the change was a dismissal or resignation, whether there was a 

going concern flag or other accounting issues, and whether a fee dispute 

or fee reduction occurred. Using this database, we identified 2,819 auditor 

changes from 2003 through 2004. 

Audit Fees and Auditor 

Changes 

We performed several checks to verify the reliability of the Audit Analytics 

data. For example, we crosschecked random samples from each of the 

Audit Analytics databases with SEC proxy and annual filings and other 

publicly available information. While we determined that these data were 

sufficiently reliable for the purpose of presenting trends in audit fees and 

auditor changes, the descriptive statistics on audit fees contained in the 

report should be viewed in light of a number of data challenges. First, the 

Audit Analytics audit fee database does not include fees for companies 

who did not disclose audit fees paid to their independent auditor in an 

SEC filing. Second, some companies included in the database—especially 

small companies—did not report complete financial data. We handled 

missing data by dropping companies with incomplete financial data from 

any analysis involving the use of such data. Therefore, it should be noted 

that we are not dealing with the entire population included in the Audit 

 

1

SEC’s definition of a non-accelerated filer is based in part on the company’s “public float,” 

which is a subset of market capitalization. Market capitalization is defined as the number of 

shares outstanding multiplied by the price per share. Generally, a company’s public float 

includes shares that are available to the public. Thus, shares held by company insiders such 

as the CEO or CFO would not be included in public float. 

Page 65 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

Analytics database but rather a large subset.2 Because of these issues, the 

results should be viewed as estimates of audit fees based on a large 

sample rather than precise estimates of all fees charged over the entire 

population. It should also be noted that SEC found issues with the data on 

market capitalization (used largely in our discussion of auditor changes 

and companies going private) which are being addressed by Audit 

Analytics. 

To determine the number of companies that have deregistered before and 

after the implementation of the Sarbanes-Oxley Act, we obtained and 

analyzed data filed with SEC. From 1998 through April 24, 2005, over 

15,000 companies filed SEC Form 15 (Certification and Notice of 

Termination of Registration). First, we analyzed all the companies to 

determine whether the company was deregistering its common stock to 

continue to operate as a privately held company. During this step, we 

eliminated companies that filed the Form 15 as a result of acquisitions, 

mergers that were not “going private” transactions liquidations, 

reorganizations, or bankruptcy filings or re-emergences.3

 We also 

eliminated duplicate filings and filings by foreign registrants. For the 

remaining companies, we reviewed their SEC filings and press releases 

and other press articles to determine their reasons for deregistration. We 

grouped the reasons into seven categories for our final analysis. 

Deregistrations 

We took a number of steps to ensure the reliability of the database, 

including testing of random samples of the coded data, 100 percent 

verification of certain areas of the database, and various other quality 

control measures. For the initial coding, we found the error rates to be 0.6 

percent or lower for all years except 2001 and 1998. Because the initial 

error rate exceeded 1.5 percent for these 2 years, we performed 100 

percent verification and corrected any errors. However, because the error 

rate for the remaining years was positive, it is unlikely that we captured 

 

2

In general, when working with any of the financial database, breaking out the number of 

companies by size will result in the loss of observations because some companies will not 

have financial data available. 

3

Companies that were merged into, or were acquired by, another company were only 

included if the transaction was initiated by an affiliate of the company (either the company 

filed a form Schedule 13E-3 with SEC or GAO analysis found evidence of a “going private” 

transaction in the case of OTCBB- and Pink Sheet-listed companies). 

Page 66 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

every company going private in 1998–2005.4 We also excluded all 

companies with one or zero holders of record unless that company also 

filed a Schedule 13E-3 (Going private transaction by certain issuers) with 

SEC.5

 In doing so, we may have missed some companies going private. 

However, an outside study found only 12 companies that filed a Form 15 

but did not file a Schedule 13E-3 from 1998 through 2003.6

 Additionally, 

our analysis of the companies that listed more than one holder of record 

on the Form 15 should have picked up some of these types of firms. As a 

result, this limitation is minor in the context of this report and does not 

alter the trends also found by a number of research reports. 

To obtain information about public companies’ views on implementing 

Sarbanes-Oxley Act requirements, we conducted a Web-based survey of 

companies with market capitalization of $700 million or less and annual 

revenues of $100 million or less that reported to SEC that they had 

complied with the act’s requirements related to internal control over 

financial reporting. To develop and test our questionnaire, we interviewed 

officials at 14 smaller public companies. We then pretested drafts of our 

questionnaire with 10 companies and then discussed their answers and 

experiences with our social science survey specialists. The pretests were 

conducted in person and by telephone with company executives in 

Virginia, Maryland, New York, Connecticut, California, Georgia, and 

Illinois. 

Survey of Public Company 

Views on Implementing the 

Sarbanes-Oxley Act 

To identify the smaller public companies eligible to participate in the 

survey, we analyzed company SEC filings from the Audit Analytics 

database. Our survey universe consisted of 591 companies that met the 

following five criteria: (1) $700 million or less in market capitalization as 

of the end of the company’s 2004 fiscal year; (2) $100 million or less in 

revenues as of the end of the company’s 2004 fiscal year end; (3) 

 

4

There may also be additional omissions due to errors on Form 15s or because some Form 

15s that were initially listed by SEC were not found or were not available in electronic 

form. In a few instances, it appeared that the Form 15 was completed incorrectly by the 

firm. Mistakes included missing fields or an obvious misunderstanding of what information 

was required. 

5

A test of a random sample of 200 of these companies found that merging, bankrupt, and 

liquidating firms typically reported one or zero as the number of holders of record. In each 

case, the companies were found to have either merged with another company or had gone 

bankrupt or liquidated. See also Marosi and Massoud (2004), “Why Do Firms Go Dark,” 

who used a similar method to exclude mergers and acquisitions. 

6

Leuz et al. (2004). 

Page 67 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

completed section 404 requirements by filing related reports of 

management and the company’s external auditor as of August 11, 2005; (4) 

were not foreign companies; and (5) were not investment vehicles such as 

mutual funds and shell companies. Of the 591, we could not reach 168 

within the survey period because we were not able to obtain e-mail 

addresses for the CFO or other executive. We began our Web-based survey 

on September 21, 2005, and included all useable responses as of November 

1, 2005. We sent follow-up e-mails on three occasions to remind 

respondents to complete the survey. One hundred fifty-eight companies 

completed the survey for an overall response rate of 27 percent. Only one 

respondent indicated that his company was a non-accelerated filer. 

The low response rate raised concerns that the views of 158 respondents 

might not be representative of all smaller public company experiences 

with the Sarbanes-Oxley Act. While we could not test this possibility for 

our primary questions (whether the act places a disproportionate burden 

on smaller companies or compromises their ability to raise capital), we did 

conduct an analysis to determine whether our sample differed from the 

population of 591 in company assets, revenue, and market capitalization 

and type (based on the North American Industrial Classification System 

code). We found no evidence of substantial non-response bias based on 

these characteristics. However, because of the low response rate we still 

could not assume that the views of the 158 respondents were 

representative of the views of other smaller public companies on 

implementing Sarbanes-Oxley Act requirements. Therefore, we do not 

consider these data to be a probability sample of all smaller public 

companies. 

In addition to potential non-response bias, the practical difficulties of 

conducting any survey may introduce other non-sampling errors. For 

example, difference in how a particular question is interpreted or the 

sources of information available to respondents may introduce errors. We 

took steps to minimize such non-sampling errors in both the data 

collection and data analysis stages. We examined the survey results and 

performed computer analyses to identify inconsistencies and other 

indications of error. A second independent analyst checked all the 

computer analyses. Further, we used GAO’s Questionnaire Programming 

Language (QPL) system to create and process the Web-based survey. This 

system facilitates the creation of the instrument, controls access, and 

ensures data quality. It also automatically generates code for reading the 

data into SAS (statistical analysis software). This tool is commonly used 

for GAO studies. 

Page 68 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

We used QPL to automate some processes, but also used analysts to code 

the open-ended questions and then had a second, independent analyst 

review them. (The survey contained both open- and close-ended 

questions.) We entered a set of possible phrases, called tags, which we 

identified for each question into QPL. When the analysts reviewed the text 

responses, they assign the tags that best reflect the meaning of what the 

respondent has written. The system then compares the tags assigned by 

the independent reviewers. Multiple tags may be assigned to a single 

response; thus, it is possible for reviewers to agree on some tags and not 

on others. Although it is possible to have reviewers resolve their 

differences until agreement is found, for this survey we only considered 

tags that were selected by all reviewers on the first pass. Tags assigned by 

only one reviewer were dropped. This process allowed a quantitative 

analysis of open comments made by respondents. Finally, we verified all 

data processing on the survey in house and found it to be accurate. 

SEC and PCAOB Efforts to 

Address Smaller Company 

Concerns 

To address our second objective describing SEC’s and PCAOB’s efforts 

related to the implementation of the act and their responses to concerns 

raised by smaller public companies and the accounting firms that audit 

them, we interviewed SEC and PCAOB staff on the rulemaking and 

standard setting processes. We also interviewed public company 

executives, representatives of relevant trade associations, and market 

participants for their reaction to the agencies’ rules, guidance, and other 

public announcements. 

During the course of our review, both SEC and PCAOB held forums and 

other open meetings to allow a public discourse on the act’s impact on 

public companies, accounting firms, investors, and other market 

participants. We attended most of these forums and open meetings and 

reviewed submitted comments. Specifically, from November 2004 to 

February 2006, we attended either in person or through a Web cast the 

following: SEC’s Advisory Committee on Smaller Public Companies open 

meetings; SEC’s Roundtable on Implementation of Internal Control 

Reporting Provisions; SEC’s Government-Business Forum on Small 

Business Capital Formation; PCAOB’s Standing Advisory Group Meetings; 

and PCAOB’s forums on auditing in the small business environment. We 

reviewed the guidance that SEC and PCAOB separately issued on May 16, 

2005, as a result of comments received at SEC’s section 404 roundtable. 

Page 69 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

To determine the act’s impact on smaller privately held companies, we 

analyzed available research and studies. We also interviewed officials of 

the National Association of State Boards of Accountancy in states that 

required or were considering requiring privately held companies to comply 

with corporate accountability, governance, and financial reporting 

measures comparable to key provisions in the Sarbanes-Oxley Act. 

Impact of Act on Smaller 

Privately Held Companies 

Further, we analyzed data and interviewed officials on whether lenders, 

financial institutions, private equity providers, or others were imposing the 

act’s requirements on privately held companies as a condition of obtaining 

capital or financial services. Finally, we interviewed officials and analyzed 

available data on whether, as a result of the act, privately held companies 

were voluntarily adopting key provisions of the act as best practices or 

whether they had faced challenges in trying to reach the public markets. 

To assess the impact of the act on privately held companies trying to reach 

the public markets, we obtained a sample from SEC’s Electronic Data 

Gathering, Analysis, and Retrieval (EDGAR) system, a database that 

includes companies’ initial public offering (IPO) and secondary public 

offering (SPO) filings. Our sample contained registration statements, 

pricings and applications for withdrawal filed with SEC from 1998 through 

July 2005. We performed various analyses of IPO and SPO activity prior to 

and after enactment of Sarbanes-Oxley, including analyses of the sizes of 

companies coming and returning to the market, types and amounts of IPO 

expenses, and the reasons cited by companies for withdrawing their IPO 

filing. We analyzed IPO expenses as a percentage of revenue and offering 

amount for companies in various size categories to determine whether the 

differences between the groups changed over time and whether the 

differences were statistically significant when controlling for other 

determining factors. 

SEC’s EDGAR database is considered the definitive source for information 

on IPOs since all companies issuing securities that list on the major 

exchanges and the OTCBB, as well as those that meet certain criteria 

listing on the Pink Sheets, must register the securities with SEC. 

Nevertheless, we crosschecked the descriptive statistics retrieved from 

EDGAR with NASDAQ’s IPO data. However, there was no financial data 

available on several companies, while others failed to provide information 

to complete all of the fields. In cases where revenue was left blank, 

individual filings were reviewed and actual revenue, 9-month revenue or 

pro-forma data was used to determine the size of the company. In cases 

were this data was not available we dropped these companies from any 

analysis involving the use of such data. Additionally, there can be 

Page 70 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

significant lag between the dates a company initially files for an IPO with 

SEC and when the stock of the company is finally priced (begins trading). 

Because we had data on IPO filings during the last 2 months of 1997, we 

were able to include those companies that priced IPOs over the 1998-2005 

period that initially filed for an IPO during that time. However, any IPOs 

that were priced during this time but had an initial filing that occurred 

prior to November 1, 1997, are not included. For this reason the number of 

priced IPOs for 1998 (and to an even lesser extent 1999) may understate 

somewhat the actual numbers of companies coming to the public market 

during that year. This limitation is insignificant in the context of this 

report. 

Company Access to 

Auditing Services and 

Changes in Share of Public 

Companies That Small 

Firms Audit 

To assess changes in the domestic public company audit market, we used 

public data—for 2002 and 2004—on public companies and their external 

accounting firm to determine how the number and mix of domestic public 

company audit clients had changed for firms other than the large 

accounting firms. To be consistent with our 2003 study of the structure of 

the audit market, we used the Who Audits America database, a directory 

of public companies with detailed information for each company, 

including the auditor of record. Only domestic public companies traded on 

the major exchanges or over-the-counter with available financial data were 

included in our analysis of audit market concentration and the results do 

not include a number of clients of the smallest audit firms. Users of our 

2003 study will also note that we used the term “sales” when referring to 

auditor concentration but use the term “revenue” in this report. Although 

Who Audits America refers to sales, our conversations with the provider 

of the data, confirmed that although the terms can be used 

interchangeably, “revenue” is a better term than “sales” in accurately 

describing the contents of the database. 

To verify the reliability of these data sources, we performed several 

checks to test the completeness and accuracy of the data. Previously GAO 

crosschecked random samples of the Who Audits America database with 

SEC proxy filings and other publicly available information. Descriptive 

statistics calculated using the database were also compared with similar 

statistics from published research. Moreover, academics who worked with 

GAO in the past also compared random samples from Compustat, DowJones Disclosure, and Who Audits America and found no discrepancies. 

We also crosschecked the results with estimates obtained using Audit 

Analytics’ audit opinion database. The results were not significantly 

different and confirm the finding outlined in the body of the report. 

However, because of the lag in updating some of the financial information 

Page 71 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix I: Objectives, Scope, and 

Methodology 

and the omission of a number of small public clients, the results should be 

viewed as estimates useful for describing the market for audit services. 

We conducted our work in California, Connecticut, Georgia, Maryland, 

New Jersey, New York, Virginia, and Washington, D.C., from November 

2004 through March 2006 in accordance with generally accepted 

government auditing standards. 

Page 72 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s Appendix II: Additional Details about GAO’s Analysis of Companies Going Private 

Analysis of Companies Going Private 

A number of research studies and anecdotal evidence suggest that a 

significant number of small companies have gone private as a result of 

costs associated with the increased disclosure and internal control 

requirements introduced by the Sarbanes-Oxley Act of 2002. To provide a 

better understanding of companies going private, we analyzed Form 15s 

filed by companies, related Securities and Exchange Commission (SEC) 

filings and press releases to determine the total number of companies 

exiting the public market and the reasons for the change in corporate 

structure. See appendix I for our scope and methodology. This appendix 

provides additional information on the construction of our database and 

descriptive statistics. 

Our Database Included 

Firms That “Went Dark” as 

Well as Firms That 

Completely Exited the 

Public Market 

Although there is no consensus on the term “going private,” we started 

with the description used in the “Fast Answers” section of SEC’s Web site: 

a company “goes private” when it reduces the number of its shareholders 

to fewer than 300 (or 500 in some instances) and is no longer required to 

file reports with SEC.1

 To reduce the number of holders of record, a 

company can undertake a number of transactions including tender offers, 

reverse stock splits, and cash-out mergers. In many cases, the company 

already meets the requirement for deregistration and therefore the 

registrant need only file a Form 15 (which notifies SEC of a company’s 

intent to deregister) with SEC to meet this description of “going private.” 

As a result, we use the terms “going private” and “deregistering” 

interchangeably. However, not all companies that deregister completely 

exit the public markets; some elect to continue trading on the less 

regulated Pink Sheets.2

 Companies that deregister their shares with SEC 

but continue public trading on the Pink Sheets are often considered as 

having “gone dark” rather than private in the academic literature. 

However, our final “going private” numbers include companies that no 

longer trade on any exchange and those that continue to trade on the less 

 

1

Under certain SEC rules, public companies voluntarily can deregister by filing a Form 15 

with SEC if they have fewer than 300 holders of record or fewer than 500 holders of record 

if the company’s total assets have not exceeded $10 million at the end of the company’s 3 

most recent fiscal years and if the company meets some additional criteria. Many of these 

companies can have thousands of actual beneficial shareholders. For example, Ced & Co., 

the nominee of Depository Trust Company would be counted as one certificate holder of 

record for many thousands of investors served by the brokerage firms that are members of 

the Depository Trust Company. 

2

The Pink Sheets LLC does not require companies whose securities are quoted upon its 

systems to meet any listing requirements or require the companies to be registered with 

SEC. 

Page 73 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

regulated Pink Sheets (“went dark”).3 It should be noted that SEC does not 

have rules that define “going dark” and the term is used here as it is used 

in academic research. 

The companies contained in our database include only those companies 

that deregistered common stock, were no longer subject to SEC filing 

requirements, and were headquartered in the United States. Moreover, the 

database excludes most cases where the company was acquired by, or 

merged into another company; filed for, or was emerging from, 

bankruptcy; or was undergoing or planning liquidation. We also excluded a 

significant number of companies that filed for an initial public offering and 

subsequently filed a Form 15 within a year; filed no annual or quarterly 

financials between the first filing with SEC and the Form 15; or filed as a 

result of reorganization where the company remained a public registrant. 

Based on the information contained on the Form 15, we were able to 

exclude four types of filers: (1) companies that deregistered securities 

other than their common stock; (2) companies that continued to be 

subject to public reporting requirements; (3) companies that were 

headquartered in a foreign country; and (4) companies for which a Form 

15 could not be retrieved electronically.4

In addition to SEC filings, we used press releases located through LexisNexis to investigate whether the companies experienced any of the 

disqualifying conditions (bankruptcy, merger, acquisition, liquidation, 

etc.). Companies that were merged into, or were acquired by, another 

company were only included if the transaction was initiated by an affiliate 

of the company (either the company filed a Schedule 13E-3 with SEC or 

our analysis found evidence of a “going private” transaction in the case of 

Over-the-Counter Bulletin Board (OTCBB) and Pink Sheet-quoted 

 

3

Because we are addressing the potential effects on the access to capital, our database 

focuses on “going private” from a public disclosure requirement perspective—not 

necessarily from a trading perspective. Some companies actively trade but are not required 

to disclose information to SEC via periodic filings—these are considered private; some 

companies do not trade actively but report to SEC—these are considered public and when 

they file a Form 15 and cease filing with SEC are considered to have gone private. 

4

In a few cases, we found companies that deregistered their common stock and had other 

public securities that were still subject to SEC reporting requirements, but later 

deregistered those securities shortly after the initial Form 15 filing. These types of 

companies are also included in our final numbers. 

Page 74 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

companies).5 Moreover, if the transaction resulted in the company 

becoming a subsidiary of another publicly traded company or a foreign 

entity, or if the transaction met any of the other disqualifying conditions, 

that company was excluded from our final numbers. 

Each Form 15 also contained the number of holders of record. We 

excluded all companies with one or zero holders of record unless that 

company also filed a Schedule 13E-3 with SEC. A test of a random sample 

of 200 of these companies found that merging, bankrupt, and liquidating 

firms typically reported one or zero as the number of holders of record.6

Because there may have been some companies that went private by way of 

merger that did not file a Schedule 13E-3, our database may have excluded 

some companies going private as a result of using this qualifier. However, 

this limitation is minor in the context of this report (see app. I for 

additional information on data reliability). In total, these exclusions left us 

with 1,093 U.S. companies going private from 1998 through the first 

quarter of 2005 out of the 15,462 Form 15 filings initially provided to us by 

SEC.7

 

5

Generally, if the transaction is initiated by an affiliate (an insider) of the company, Rule 

13e-3 of the Securities Exchange Act of 1934 requires the affiliate to file a Schedule 13E-3 

with SEC. The filing of a Schedule 13E-3 may also be required when affiliated transactions 

result in a company’s publicly held securities no longer being traded on a national 

securities exchange or an inter-dealer quotation system, such as NASDAQ. The Schedule 

13E-3 requires a discussion of the purposes of the transaction, any alternatives that the 

company considered, and whether the transaction is fair to all shareholders. The schedule 

also discloses whether and why any of its directors disagreed with the transaction or 

abstained from voting on the transaction and whether a majority of directors,who are not 

company employees, approved the transaction. 

6

The companies were found to have either merged with another company or, in some 

cases, had gone bankrupt or were liquidated. See also Marosi and Massoud (2004), “Why 

Do Firms Go Dark,” University of Alberta, March 2004, who used a similar criterion to 

exclude companies. 

7

Ten additional companies went private between April 1, 2005, and April 24, 2005, bringing 

the total to 1,103. 

Page 75 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

The number of public companies going private increased significantly 

from 143 in 2001 to 245 in 2004 (see fig. 8). Based on the number of 

companies going private during the first quarter of 2005, we project that 

the number of companies going private will increase, to 267 companies by 

the end of 2005. While these numbers constitute a small percentage of the 

total number of public companies, the trends we identified suggest that 

more small companies are reconsidering the cost and benefits of 

remaining public and raising capital on domestic public equity markets. As 

figure 8 shows, the number of companies going private increased 

significantly, whether or not we excluded the types of companies 

explicitly considered as speculative investments by SEC—blank check and 

shell companies.8

 Overall, these companies, identified as such by Standard 

Industry Classification code, represent 17 percent of the companies going 

private in 2004 but just 2.5 percent of the companies going private during 

the first quarter 2005 and 8.4 percent of the overall sample.9

Consistent with Outside 

Studies, We Found That 

the Number of Companies 

That Went Private 

Increased Significantly 

from 2001 through 2004 

 

8

SEC recently targeted regulatory problems that they identified where shell companies 

have been used as vehicles to commit fraud and abuse SEC’s regulatory processes. 

9

Blank check companies are typically development stage companies that have no specific 

business plan or purpose or have indicated that their business plan was to engage in a 

merger or acquisition with an unidentified company or companies, entities, or persons. 

SEC defines a shell company as a company with no or nominal operations and either no or 

nominal assets, assets consisting solely of cash and cash equivalents, or assets consisting 

of any amount of cash and cash equivalents and nominal other assets. SEC noted that many 

investors have been victimized in shell company schemes over the years. However, their 

corporate structures and status as publicly listed entities and fully reporting issuers are 

features of interest for some small companies with a desire to go public by way of reverse 

merger. In a reverse merger, a private company merges with a public company and 

continues as the dominant successor. 

Page 76 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

Figure 8: Total Number of Companies Identified as Going Private from 1998 to 2005 

Notes: Includes companies that deregistered but continued to trade over the less regulated Pink 

Sheets (“went dark”) and public shells and blank check companies. Does not include companies that 

have filed for, or are emerging from, bankruptcy, have liquidated or are in the process of liquidating, 

were headquartered in a foreign country or that have been acquired by or merged into another 

company unless the transaction was initiated by an affiliate of the company and the company became 

a private entity. The estimate for 2005 is projected based on the number of companies going private 

in the first quarter and the pattern of deregistration activity found in 2003 and 2004. 

a

Partial year, only includes the first 2 quarters of 2005. 

A number of research reports have also found that the number of 

companies exiting the public market has increased since 2002. Although 

there are differences in the search methodologies and types of companies 

included, each study found similar trends and reached similar conclusions 

(see fig. 9). For example, in Leuz et al. (2004) the number of companies 

going dark or private increased from 144 to 313 between 2002 and 2003. 

Moreover the authors found that the bulk of the increase was made up of 

companies that continued trading on the Pink Sheets after deregistration. 

Engel et al. (2004), which was based on a smaller subset of deregistering 

companies, found a statistically significant increase in the rate at which 

companies went private. Marosi and Massoud (2004) excluded all mergerPage 77 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

related transactions and found that the number of companies going dark 

increased from 71 in 2002 to 127 in 2003.10

Figure 9: Companies Going Private or Dark, by Research Study 

Note: Leuz et al. data includes going private and going dark companies in 1998–2003. The Marosi 

and Massoud data only includes companies going dark in 2001–2003. The Engel study includes data 

on going private transactions based on 13E-3 filings in 1998–2003. Additional differences in the types 

of companies excluded exist across these samples. GAO’s number for 2005 is projected based on 

the number of companies going private in the first quarter and the pattern of deregistration activity 

found in 2003 and 2004. 

a

Partial year, only includes the first 2 quarters of 2005. 

 

10E. Engel, R. Hayes, and X. Wang, “The Sarbanes-Oxley Act and Firms’ Going Private 

Decisions,” University of Chicago Working Paper, May 2004; C. Luez, A. Triantis, and T. 

Wang, “Why Do firms Go Dark? Causes and Economic Consequences of Voluntary SEC 

Deregistration,” University of Pennsylvania Working Paper, September 2004; and Marosi 

and Massoud (2004), “Why Do Firms Go Dark,” University of Alberta, March 2004. 

Page 78 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

In analyzing company decisions, we used various sources to determine 

why the companies included in our database deregistered their common 

stock. Because companies did not always disclose the reasons for their 

decision in an SEC filing, we also searched press releases and newswire 

announcements using the Lexis-Nexis search engine. We then used the 

reasons given in the various filings and other media to construct seven 

broad categories, summarized in table 7. Because companies often gave 

multiple reasons for the decision to deregister (go private) and it was 

difficult to tell which were the most important, we allowed up to six 

reasons for each company included in our database.11 For example, 

Westerbeke Corporation went private in 2004 and cited the following 

reasons for the decision: “a small public float,” inability to use its stock as 

currency for acquisitions, benefits the company would receive as private 

entity such as “greater flexibility,” the ability to make “decisions that 

negatively affect quarterly earnings in the short run,” and the costs and 

time devoted by employees and management “resulting from the adoption 

of the Sarbanes-Oxley Act of 2002.” This company is included in our 

database with following coded reasons for going private: (1) 

market/liquidity issues; (2) private company benefits; (3) direct costs; and 

(4) indirect costs. 

We Grouped Reasons for 

Company Decisions to Go 

Private into Seven 

Categories 

 

11It should be noted that these reasons are self reported by the company and are not based 

on any additional (and more complex) analysis of company behavior. Furthermore, 

because the Schedule 13E-3 requires a discussion of the purposes of the transaction, any 

alternatives that the company considered, and whether the transaction is fair to all 

shareholders, affiliates of the company that are advocating the transaction may list all the 

pros and cons of going private. As a result, in cases where a company is required to file a 

Schedule 13E-3 with SEC, cost savings are generally listed as a benefit of going private and 

therefore captured in our database as one of the reasons for the decision. 

Page 79 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

Table 7: Reason for Going Private, by Category Descriptions 

Direct costs Company cites the costs associated with being a public company. Includes listing costs, regulatory 

compliance costs, expenses paid for outside advice, audit and attestation requirements, other 

expenses directly related to the implementation of the Sarbanes-Oxley Act, taxes at the corporate 

level, and costs related to shareholders and shareholder accounts. 

Indirect costs Company cites the amount of time and effort required to meet periodic reporting requirements, adhere 

to securities laws, and service shareholders. Includes time and company resources spent on 

Sarbanes-Oxley-specific requirements instead of regular business activities. 

Market/liquidity issues Company cites thinly traded stock or general illiquidity of company shares, poor market conditions, an 

undervalued or low stock price, lack of analyst coverage, or disinterest on the part of investors. 

Includes inability or difficulty in raising capital through follow-on offerings or using stock as currency 

for mergers, acquisitions, or employee compensation. 

Private company benefits Company cites benefits of becoming a private company including ability to act quickly without market 

pressure, keep information from competitors, or provide more flexibility in corporate operations. Also 

includes normal business decisions, changes in strategy, and belief that going private would provide 

better growth and investment opportunities. 

Critical business issues Company cites negative business prospects or critical issues that could undermine the ability of the 

company to remain profitable or continue as a going concern. Includes lawsuits, SEC actions, 

exchange delisting, general bad business, intense competition, or failure of plans that could have 

made the company more viable. 

Other Company cites reasons not covered by the listed categories. 

No reason Company provides no information on why it decided to deregister. Includes companies that indicated 

they deregistered simply because they met the requirements to do so. 

Source: GAO. 

More Companies Have 

Cited Costs as Reasons for 

Going Private Since 2002 

Although companies go private for a variety of reasons, in recent years, 

more companies cited the direct costs of maintaining public company 

status as at least one of the reasons for going private. As shown in figure 

10, the number of companies citing costs as at least one reason for going 

private increased from 64 in 2002 to 143 and 130 in 2003 and 2004. 

However, the percentage of companies citing cost as the only reason for 

exiting the market has increased significantly in recent years. While only 

21 cited costs and no other reason in 2003 (15 percent of the total citing 

cost), 43 did so in 2004 (33 percent of the total citing cost). During the first 

quarter of 2005, nearly 50 percent of the companies mentioning cost, cited 

costs as the only reason for going private. 

Page 80 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

Figure 10: Companies Citing Costs as One of the Reasons for Going Private 

2005a 1998 1999 2000 2001 2002 2003 2004

Only cites direct or indirect costs

Cites direct or indirect costs

Source: GAO analysis of SEC data.

Number of companies

0

20

40

60

80

100

120

140

160

a

Partial year, only includes the first 2 quarters of 2005. 

Companies Going Private 

Typically Were among the 

Smallest of Publicly 

Traded Companies 

By any measure (market capitalization, revenue or assets), the companies 

that went private over the 2004–2005 period represent some of the 

smallest companies in the public arena (see figs. 11 and 12). Because these 

companies were on average very small, they enjoyed limited analyst 

coverage and limited market liquidity—one of the primary benefits cited 

for going or remaining public. The median market capitalization and 

revenue for these companies was less than $15 million. 

Page 81 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

Figure 11: Average and Median Sizes of Companies Going Private, 2004-2005 

Average

Median

Dollars in millions

Source: GAO analysis of SEC and Audit Analytics data.

0 20 40 60 80 100 120

Assets

Revenue

Market

capitalization

Note: Only includes companies with financial data available. 

Figure 12 also illustrates that companies going private were 

disproportionately small, which reflected that the net benefits from being 

public likely were smallest for small firms and the costs of complying with 

securities laws likely required a higher proportion of a smaller company’s 

revenue. For example, 84 percent of the companies that went private in 

2004 and 2005 had revenues of $100 million or less and nearly 69 percent 

had revenues of $25 million or less.12 We also found that a significant 

portion of these companies—12.5 percent of those that went private in 

2004–2005—had not filed quarterly or annual financial statements with 

SEC in more than 2 years; therefore, we did not have access to recent 

financial information. 

 

12Given that the financial data are based on the company’s last annual filing, these results 

should be viewed as estimates of company size. 

Page 82 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix II: Additional Details about GAO’s 

Analysis of Companies Going Private 

Figure 12: Revenue Categories for Companies Going Private, 2004-2005 

Size

(revenue

in millions)

Percentage 

Source: GAO analysis based of SEC and Audit Analytics data.

0 10 20 30 40 50 60 70 80 90 100

>$250

>$100-250

>$25-100

$1-25

Note: Only includes companies with financial data available. 

Page 83 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix III: Comments from the Securities Appendix III: Comments from the Securities and Exchange Commission 

and Exchange Commission 

Page 84 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix III: Comments from the Securities 

and Exchange Commission 

Page 85 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix IV: Comments from the Public Company Appendix IV: Comments from the Public Accounting Oversight Board 

Company Accounting Oversight Board 

Page 86 GAO-06-361 Sarbanes-Oxley Act Challenges for Small Companies
Appendix V: GAO Contacts and Staff Acknowledgments 

Sarbanes-Oxley Act Challenges for Small Companies

William B. Shear (202) 512-8678 

Jeanette M. Franzel (202) 512-9471 

In addition to those named above, Harry Medina and John Reilly, Assistant 

Directors; E. Brandon Booth; Michelle E. Bowsky; Carolyn M. Boyce; Tania 

L. Calhoun; Martha Chow; Bonnie Derby; Barbara El Osta; Lawrance L. 

Evans Jr.; Gabrielle M. Fagan; Cynthia L. Grant; Maxine L. Hattery; Wilfred 

B. Holloway; Kevin L. Jackson; May M. Lee; Kimberly A. McGatlin; Marc W. 

Molino; Karen V. O’Conor; Eric E. Petersen; David M. Pittman; Robert F. 

Pollard; Carl M. Ramirez; Philip D. Reiff; Barbara M. Roesmann; Jeremy S. 

Schwartz; and Carrie Watkins also made key contributions to this report. 

GAO Contacts 

Appendix V: GAO Contacts and Staff 

Acknowledgments 

Acknowledgments 

Page 87 GAO-06-361 (250224) 
GAO’s Mission The Government Accountability Office, the audit, evaluation and 

investigative arm of Congress, exists to support Congress in meeting its 

constitutional responsibilities and to help improve the performance and 

accountability of the federal government for the American people. GAO 

examines the use of public funds; evaluates federal programs and policies; 

and provides analyses, recommendations, and other assistance to help 

Congress make informed oversight, policy, and funding decisions. GAO’s 

commitment to good government is reflected in its core values of 

accountability, integrity, and reliability. 

The fastest and easiest way to obtain copies of GAO documents at no cost 

is through GAO’s Web site (www.gao.gov). Each weekday, GAO posts 

newly released reports, testimony, and correspondence on its Web site. To 

have GAO e-mail you a list of newly posted products every afternoon, go 

to www.gao.gov and select “Subscribe to Updates.” 

The first copy of each printed report is free. Additional copies are $2 each. 

A check or money order should be made out to the Superintendent of 

Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 

more copies mailed to a single address are discounted 25 percent. Orders 

should be sent to: 

U.S. Government Accountability Office 

441 G Street NW, Room LM 

Washington, D.C. 20548 

To order by Phone: Voice: (202) 512-6000 

TDD: (202) 512-2537 

Fax: (202) 512-6061 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm

E-mail: fraudnet@gao.gov

Automated answering system: (800) 424-5454 or (202) 512-7470 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 

U.S. Government Accountability Office, 441 G Street NW, Room 7125 

Washington, D.C. 20548 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 

U.S. Government Accountability Office, 441 G Street NW, Room 7149 

Washington, D.C. 20548 

Obtaining Copies of 

GAO Reports and 

Testimony 

Order by Mail or Phone 

To Report Fraud, 

Waste, and Abuse in 

Federal Programs 

Congressional 

Relations 

Public Affairs 

PRINTED ON RECYCLED PAPER