This is the accessible text file for GAO report number GAO-06-361
entitled 'Sarbanes-Oxley Act: Consideration of Key Principles Needed in
Addressing Implementation for Smaller Public Companies' which was
released on May 8, 2006.
This text file was formatted by the U.S. Government Accountability
Office (GAO) to be accessible to users with visual impairments, as part
of a longer term project to improve GAO products' accessibility. Every
attempt has been made to maintain the structural and data integrity of
the original printed product. Accessibility features, such as text
descriptions of tables, consecutively numbered footnotes placed at the
end of the file, and the text of agency comment letters, are provided
but may not exactly duplicate the presentation or format of the printed
version. The portable document format (PDF) file is an exact electronic
replica of the printed version. We welcome your feedback. Please E-mail
your comments regarding the contents or accessibility features of this
document to Webmaster@gao.gov.
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed
in its entirety without further permission from GAO. Because this work
may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this
material separately.
United States Government Accountability Office:
GAO:
Report to the Committee on Small Business and Entrepreneurship, U.S.
Senate:
April 2006:
Sarbanes-Oxley Act:
Consideration of Key Principles Needed in Addressing Implementation for
Smaller Public Companies:
GAO-06-361:
GAO Highlights:
Highlights of GAO-06-361, a report to the Committee on Small Business
and Entrepreneurship, U.S. Senate.
Why GAO Did This Study:
Congress passed the Sarbanes-Oxley Act to help protect investors and
restore investor confidence. While the act has generally been
recognized as important and necessary, some concerns have been
expressed about the cost for small businesses. In this report, GAO (1)
analyzes the impact of the Sarbanes-Oxley Act on smaller public
companies, particularly in terms of compliance costs; (2) describes
responses of the Securities and Exchange Commission (SEC) and Public
Company Accounting Oversight Board (PCAOB) to concerns raised by
smaller public companies; and (3) analyzes smaller public companies’
access to auditing services and the extent to which the share of public
companies audited by mid-sized and small accounting firms has changed
since the act was passed.
What GAO Found:
Regulators, public companies, audit firms, and investors generally
agree that the Sarbanes-Oxley Act of 2002 has had a positive and
significant impact on investor protection and confidence. However, for
smaller public companies (defined in this report as $700 million or
less in market capitalization), the cost of compliance has been
disproportionately higher (as a percentage of revenues) than for large
public companies, particularly with respect to the internal control
reporting provisions in section 404 and related audit fees. Smaller
public companies noted that resource limitations and questions
regarding the application of existing internal control over financial
reporting guidance to smaller public companies contributed to
challenges they face in implementing section 404. The costs associated
with complying with the act, along with other market factors, may be
encouraging some companies to become private. The companies going
private were small by any measure and represented 2 percent of public
companies in 2004. The full impact of the act on smaller public
companies remains unclear because the majority of smaller public
companies have not fully implemented section 404.
To address concerns from smaller public companies, SEC extended the
section 404 deadline for smaller companies with less than $75 million
in market capitalization, with the latest extension to 2007.
Additionally, SEC and PCAOB issued guidance intended to make the
section 404 compliance process more economical, efficient, and
effective. SEC also encouraged the Committee of Sponsoring
Organizations of the Treadway Commission (COSO), to develop guidance
for smaller public companies in implementing internal control over
financial reporting in a cost-effective manner. COSO’s guidance had
not been finalized as of March 2006. SEC also formed an advisory
committee to examine, among other things, the impact of the act on
smaller public companies. The committee plans to issue a report in
April 2006 that will recommend, in effect, a tiered approach with
certain smaller public companies partially or fully exempt from section
404, “unless and until” a framework for assessing internal control over
financial reporting is developed that recognizes the characteristics
and needs of smaller public companies. As SEC considers these
recommendations, it is essential that the overriding purpose of the
Sarbanes-Oxley Act—investor protection—is preserved and that SEC assess
available guidance to determine if additional supplemental or
clarifying guidance for smaller public companies is needed.
Smaller public companies have been able to obtain access to needed
audit services and many moved from the largest accounting firms to mid-
sized and small firms. The reasons for these changes range from audit
cost and service concerns cited by companies to client profitability
and risk concerns cited by accounting firms, including capacity
constraints and assessments of client risk. Overall, mid-sized and
small accounting firms conducted 30 percent of total public company
audits in 2004—up from 22 percent in 2002. However, large accounting
firms continue to dominate the overall market, auditing 98 percent of
U.S. publicly traded company sales or revenues.
What GAO Recommends:
SEC should (1) assess sufficiency of internal control guidance for
smaller public companies, (2) coordinate with PCAOB to ensure
consistency of section 404 auditing standards with any additional
internal control guidance for public companies, and (3) if further
relief is deemed appropriate, analyze the unique characteristics of
smaller public companies and their investors to ensure that the
objectives of investor protection are met and any relief provided is
targeted and limited.
[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-06-361].
To view the full product, including the scope and methodology, click on
the link above. For more information, contact William B. Shear, (202)
512-8678 or shearw@gao.gov, or Jeanette M. Franzel, (202) 512-9471 or
franzelj@gao.gov.
[End of section]
Contents:
Letter:
Results in Brief:
Background:
Smaller Public Companies Have Incurred Disproportionately Higher Audit
Costs in Implementing the Act, but Impact on Access to Capital Remains
Unclear:
SEC and PCAOB Have Been Addressing Smaller Company Concerns Associated
with the Implementation of Section 404:
Sarbanes-Oxley Act Requirements Minimally Affected Smaller Private
Companies, Except for Those Seeking to Enter the Public Market:
Smaller Companies Appear to Have Been Able to Obtain Needed Auditor
Services, Although the Overall Audit Market Remained Highly
Concentrated:
Conclusions:
Recommendations:
Agency Comments and Our Evaluation:
Appendix I: Objectives, Scope, and Methodology:
Appendix II: Additional Details about GAO's Analysis of Companies Going
Private:
Appendix III: Comments from the Securities and Exchange Commission:
Appendix IV: Comments from the Public Company Accounting Oversight
Board:
Appendix V: GAO Contacts and Staff Acknowledgments:
Tables:
Table 1: Summary of Selected Sarbanes-Oxley Act Provisions Affecting
Public Companies and Registered Accounting Firms:
Table 2: Primary Reasons Cited by Companies for Going Private, 1998-
2005, by Percent:
Table 3: SEC Extensions of Section 404 Compliance Dates:
Table 4: IPO Direct Expenses as a Percentage of Company's Revenues, by
Size:
Table 5: Companies Changing Accounting Firms, 2003-2004:
Table 6: Cross-sectional Comparison of Request Letter Questions, Our
Report Objectives, and Selected Findings:
Table 7: Reason for Going Private, by Category Descriptions:
Figures:
Figure 1: Median Audit Fees as a Percentage of 2003 and 2004 Revenues
Reported by Public Companies as of August 11, 2005:
Figure 2: Total Number of Companies Identified as Going Private, 1998-
2005:
Figure 3: Where Companies Traded Prior to Deregistration, July 2003-
March 2005:
Figure 4: IPO and Stock Market Performance, 1998-2005:
Figure 5: Average Size of Companies Changing Auditors, 2003-2004, by
Type of Accounting Firm Change:
Figure 6: Percentage of Clients Audited by Revenue Category, 4 Largest
Accounting Firms versus Mid-sized and Small Accounting Firms, 2004:
Figure 7: Total Number of IPOs, by Size of Accounting Firm, 1999-2004:
Figure 8: Total Number of Companies Identified as Going Private from
1998 to 2005:
Abbreviations:
AMEX: American Stock Exchange:
CEO: chief executive officer:
CFO: chief financial officer:
COSO: Committee of Sponsoring Organizations of the Treadway Commission:
EDGAR: Electronic Data Gathering, Analysis, and Retrieval system:
FCPA: Foreign Corrupt Practices Act of 1977:
HHI: Hirschman-Herfindahl Index:
IPO: initial public offering:
NASD: National Association of Securities Dealers, Inc.:
NASDAQ: The Nasdaq Stock Market, Inc:
NYSE: New York Stock Exchange:
PCAOB: Public Company Accounting Oversight Board:
QPL: Questionnaire Programming Language:
OTCBB: Over the Counter Bulletin Board:
SAS: statistical analysis software:
SBA: Small Business Administration:
SEC: Securities and Exchange Commission:
SPO: secondary public offering:
United States Government Accountability Office:
Washington, DC 20548:
April 13, 2006:
The Honorable Olympia J. Snowe:
Chair:
Committee on Small Business and Entrepreneurship:
United States Senate:
The Honorable Michael B. Enzi:
United States Senate:
In response to numerous corporate failures arising from corporate
mismanagement and fraud, Congress passed the Sarbanes-Oxley Act of
2002.[Footnote 1] Generally recognized as one of the most significant
market reforms since the passage of the securities legislation of the
1930s, the act is intended to help protect investors and restore
investor confidence by improving the accuracy, reliability, and
transparency of corporate financial reporting and disclosures, and
reinforce the importance of corporate ethical standards. Public and
investor confidence in the fairness of financial reporting and
corporate ethics is critical to the effective functioning of our
capital markets. The act's requirements apply to all public companies
regardless of size and the public accounting firms that audit them.
The act established the Public Company Accounting Oversight Board
(PCAOB) as a private-sector non-profit organization to oversee the
audits of public companies that are subject to securities laws. PCAOB,
which is subject to oversight by the Securities and Exchange Commission
(SEC), is responsible for establishing related auditing, quality
control, ethics, and auditor independence standards. The act also
addresses auditor independence and the relationship between auditors
and the public companies they audit. The act requires public companies
to assess the effectiveness of their internal control over financial
reporting and for their external auditors to report on management's
assessment and the effectiveness of internal controls.[Footnote 2] The
act also contains provisions intended to make chief executive officers
(CEO) and chief financial officers (CFO) more accountable, improve the
oversight role of boards of directors and audit committees, and provide
whistleblower protection. Finally, the act expanded the SEC's oversight
powers and mandated new and expanded criminal penalties for securities
fraud and other corporate violations.
The specific objectives of this report are to (1) analyze the impact of
the Sarbanes-Oxley Act on smaller public companies, including costs of
compliance and access to capital; (2) describe SEC's and PCAOB's
efforts related to the implementation of the act and their responses to
concerns raised by smaller public companies and the accounting firms
that audit them; (3) analyze the impact of the act on smaller privately
held companies, including costs, ability to access public markets, and
the extent to which states and capital markets have imposed similar
requirements on privately held companies; and (4) analyze smaller
companies' access to auditing services and the extent to which the
share of public companies audited by small accounting firms has changed
since the enactment of the act.[Footnote 3]
To address these objectives, we reviewed information from a variety of
sources, including the legislative history of the act, relevant
regulatory pronouncements and public comments, research studies and
papers, and other stakeholders (such as trade groups and market
participants). To analyze the impact of the act on smaller public
companies, we obtained data from SEC filings provided through a
licensing agreement with Audit Analytics, and analyzed data elements
including auditing fees and auditor changes to determine costs of
compliance.[Footnote 4] Similarly, we constructed a database of public
companies that went private using SEC filings and press releases
retrieved from Lexis-Nexis, an online periodical database. To obtain
information on smaller public companies' experiences with Sarbanes-
Oxley Act compliance, we also conducted a survey of companies with
market capitalization of $700 million or less and annual revenues of
$100 million or less that, as of August 11, 2005, reported to SEC that
they had complied with the act's internal control-related requirements.
One hundred fifty-eight of 591 companies completed the survey, for an
overall response rate of 27 percent.[Footnote 5] Additionally, we held
discussions with representatives of SEC, the Small Business
Administration (SBA), PCAOB, smaller public companies, the Committee of
Sponsoring Organizations of the Treadway Commission (COSO), financial
service providers, rating agencies, institutional investors, trade
groups, accounting firms, and other market participants.[Footnote 6]
Because SEC has extended the date by which registered public companies
with less than $75 million in public float (known as non-accelerated
filers) had to comply with the act's internal control-related
provisions (section 404) to their first fiscal year ending on or after
July 15, 2007, we could not analyze the impact of the internal control
provisions of the act for a significant number of smaller public
companies (SEC estimates that non-accelerated filers represent about 60
percent of all registered public companies).[Footnote 7] Thus, to gain
some insight into the potential impact these provisions may have on
smaller public companies, we analyzed public data and other information
related to the experiences of public companies that have fully
implemented the act's provisions. To determine the act's impact on
smaller privately held companies, we interviewed officials about state
requirements comparable to key Sarbanes-Oxley provisions and
representatives of smaller private companies and financial institutions
about capital access requirements. We also analyzed data on companies'
initial public offering (IPO) and secondary public offering (SPO) from
SEC filings. To assess changes in the domestic public company audit
market, we used public data--for 2002 and 2004--on public companies and
their external accounting firms to determine how the number and mix of
domestic public company audit clients had changed for firms other than
the large accounting firms. As requested by your staff, we addressed
nine specific questions contained in your request letter.
Appendix I contains a more complete description of our scope and
methodology, including a cross-sectional comparison between the nine
specific questions contained in the request letter and the four
objectives of this report. We conducted our work in California,
Connecticut, Georgia, Maryland, New Jersey, New York, Virginia, and
Washington, D.C., from November 2004 through March 2006 in accordance
with generally accepted government auditing standards.
Results in Brief:
While regulators, public companies, auditors, and investors generally
agree that the Sarbanes-Oxley Act has had a positive impact on investor
protection, available data indicate that smaller public companies face
disproportionately higher costs (as a percentage of revenues) in
complying with the act, consistent with the findings of the Small
Business Administration on the impact of regulations generally on small
businesses. While smaller companies historically have paid
disproportionately higher audit fees than larger companies as a percent
of revenues, the percentage difference between median audit fees paid
by smaller versus larger public companies grew in 2004, particularly
for companies that implemented the act's internal control provisions
(section 404). Smaller public companies also cited other costs of
compliance with section 404 and other provisions of the act, such as
the use of resources for compliance rather than for other business
activities. Moreover, the characteristics of smaller companies,
including resource and expertise limitations and lack of familiarity
with formal internal control frameworks, contributed to the
difficulties and costs they experienced in implementing the act's
requirements. This situation was also impacted by the fact that many
companies documented their internal control for the first time and
needed to make significant improvements to their internal control as
part of their first year of implementing section 404, despite the fact
that most have been required by law since 1977 to have implemented a
system of internal accounting controls. Smaller public companies and
accounting firms noted that the complexity of the internal control
framework and the scope and complexity of the audit standard and
related guidance for auditors on section 404 issued during rather than
prior to the initial year of implementation contributed to the costs
and challenges experienced in the first year of
implementation.[Footnote 8] It is generally expected that compliance
costs for section 404 will decrease in subsequent years, given the
first-year investment in documenting internal controls. The act, along
with other market forces, appeared to have been a factor in the
increase in public companies deregistering with SEC (going private)--
from 143 in 2001 to 245 in 2004. However, these companies were small by
any measure (market capitalization, revenue, or assets) and represented
2 percent of public companies in 2004. Based on our survey responses
and discussions with smaller public companies that implemented section
404, it appears that the act has not adversely affected the ability of
those smaller public companies to raise capital. However, it is too
soon to assess fully the impact of the act on access to capital,
particularly because of the large number of smaller public companies--
the more than 5,900 small public companies considered by SEC to be non-
accelerated filers--that have been given an extension by SEC to
implement section 404.
In response to concerns that smaller public companies raised about
Sarbanes-Oxley Act requirements as implemented, particularly section
404, SEC and PCAOB have undertaken efforts to help the companies meet
the requirements of the act. SEC initially provided those smaller
public companies that are non-accelerated filers with additional time
to comply with section 404 and subsequently extended the deadline
several times, with the latest extension to July 15, 2007. SEC also
formed an Advisory Committee on Smaller Public Companies to examine the
impact of the act on smaller public companies. On March 3, 2006, the
committee issued an exposure draft of its final report for public
comment that contained recommendations that, if adopted by SEC, would
exempt up to 70 percent of all public companies and 6 percent of U.S.
equity market capitalization from all or some of the provisions of
section 404, "unless and until" a framework for assessing internal
control over financial reporting is developed that recognizes the
characteristics and needs for smaller public companies. Specifically,
the committee proposed that "microcap" companies (companies with market
capitalization below $128 million) with revenues below $125 million and
"smallcap" companies (companies with market capitalization between $128
million and $787 million) with revenues below $10 million would not
have to comply with section 404(a) and section (b), management's and
the external auditor's assessment and reporting on internal control
over financial reporting, respectively. "Smallcap" companies with
revenues between $10 million and $250 million would not have to comply
with section 404(b), the external auditor's attestation on management's
internal control assessment and the effectiveness of internal control
over financial reporting. Following a public comment period, the
committee is scheduled to issue its final recommendations in April
2006, at which time the recommendations would be considered by SEC.
Additionally, SEC asked COSO to develop guidance designed to assist
smaller public companies in using COSO's internal control framework in
a small business environment. COSO issued a draft for public comment in
October 2005, and plans to finalize the guidance in early 2006. While
not specifically focused on small business issues, SEC held a public
"roundtable" in April 2005, in which GAO participated, that gave public
companies and accounting firms an opportunity to provide feedback to
SEC and PCAOB on what went well and what did not during the first year
of section 404 implementation. In response, SEC and PCAOB issued
additional section 404 guidance in May 2005. PCAOB also issued a report
on November 30, 2005, that detailed inefficiencies companies
experienced in the implementation of its auditing standard on internal
control. SEC and PCAOB plan to hold another roundtable on the second
year of section 404 implementation in May 2006. However, because many
efforts--particularly SEC's response to the exemption recommendations
and COSO's efforts to provide guidance on using its internal control
framework in a small business environment--are ongoing, smaller public
companies may be deferring efforts to implement section 404 until such
issues are resolved.
While the act does not impose new requirements on privately held
companies, companies choosing to go public must realistically spend
time and funds in order to demonstrate their ability to comply with the
act, section 404 in particular, to attract investors who will seek the
assurances and protections that compliance with section 404 provides.
Such requirements, along with other factors, may have been a
contributing factor in the reduced number of initial public offerings
(IPO) issued by small companies. However, the overall performance of
the stock market and changes in listing standards also likely affected
the number of IPOs. From 1999 through 2004, IPOs by companies with
revenues of $25 million or less decreased substantially from 70 percent
of all IPOs in 1999 to about 46 percent in 2004. For those privately
held companies not intending to go public, our research and discussions
with representatives of financial institutions suggested that financing
sources were generally not imposing requirements on private companies
similar to those contained in the Sarbanes-Oxley Act as a condition for
obtaining access to capital or other financial services. While a number
of states proposed legislation with provisions similar to the Sarbanes-
Oxley Act following its passage, three states passed legislation
calling for private companies or nonprofit organizations to adopt
requirements similar to some of the act's corporate governance
provisions. In addition, our interviews and review of available
research indicate that some privately held companies have voluntarily
adopted some of the act's enhanced governance practices because they
believe these practices make pragmatic business sense. Specifically,
they have adopted practices such as CEO/CFO financial statement
certification, appointment of independent directors, corporate codes of
ethics, whistleblower procedures, and approval of nonaudit services by
the board.
Smaller public companies have been able to obtain access to needed
audit services since the passage of the act; however, data show that a
substantial number of smaller public companies have moved from the
large accounting firms to mid-sized and small firms. Many of these
moves resulted from the resignation of a large accounting firm. The
reasons for these changes range from audit cost and service concerns
cited by companies to client profitability and risk concerns cited by
accounting firms, including capacity constraints and assessments of
client risk. As a result, mid-sized and small accounting firms
increased their share of smaller public company audits during 2002-
2004. Our analysis of the risk characteristics of the companies leaving
the large accounting firms shows that mid-sized and small accounting
firms appear to be taking on a higher percentage of public companies
with accounting issues such as going concern qualifications and other
"risk" issues. Overall, mid-sized and small accounting firms conducted
30 percent of the total number of public company audits in 2004--up
from 22 percent in 2002. However, the overall market for audit services
remains highly concentrated, with companies audited by large firms
representing 98 percent of total U.S. publicly traded company sales
(revenues). In the long run, the act may reduce some of the competitive
challenges faced by mid-sized and small accounting firms. For example,
mid-sized and small accounting firms could increase opportunities to
enhance their recognition and acceptance among capital market
participants as a result of operating under PCAOB's registration and
inspection process.
We have two concerns with certain draft recommendations from the
Advisory Committee on Smaller Public Companies related to internal
control. Our first concern relates to lack of specificity in the
recommendations. While calling for an internal control framework that
recognizes the needs of smaller public companies, the recommendations
do not address what needs to be done to establish such a framework or
what such a framework might include. In reviewing the implementation of
section 404 for larger public companies, we noted that many, if not
most, of the significant problems and challenges related to
implementation issues rather than the internal control framework
itself. We think it is essential that public companies, both large and
small, have appropriate guidance on how to effectively implement the
internal control framework and assess and report on the operating
effectiveness of their internal control over financial reporting. Our
second concern relates to the ambiguity surrounding the conditional
nature of the "unless and until" provisions of the recommendations and
the potential impact that may result for a large number of public
companies that would qualify for either full or partial exemption from
the requirements of section 404. Our concerns also include the
additional time that may be needed to resolve the concerns of smaller
public companies and the impact any further regulatory relief may have
in delaying important investor protections associated with section 404.
When SEC begins its assessment of the final recommendations of its
small business advisory committee, it is essential that SEC balance the
key principle behind the Sarbanes-Oxley Act--investor protection--
against the goal of reducing unnecessary regulatory burden on smaller
public companies. This report recommends that, in considering the
concerns of the Advisory Committee on Smaller Public Companies
regarding the ability of smaller public companies to effectively
implement section 404, SEC should (1) assess whether the current
guidance, particularly guidance on management's assessment of internal
control over financial reporting, is sufficient or whether additional
action is needed to help smaller public companies meet the requirements
of section 404; (2) coordinate with PCAOB to help ensure that section
404-related audit standards and guidance are consistent with any
additional guidance applicable to management's assessment of internal
control and identify additional ways in which auditors of public
companies can achieve more economical, effective, and efficient
implementation of the standards and guidance related to internal
control over financial reporting; and (3) if further relief is deemed
appropriate, analyze and consider the unique characteristics of smaller
public companies and their investors in determining categories of
companies for which additional relief may be appropriate so that the
objectives of investor protection are adequately met and any relief is
targeted and limited.
We provided a draft of this report to the Chairman of SEC and the
Acting Chairman of PCAOB for review and comment. We received written
comments from SEC and PCAOB that are discussed in this report and
reprinted in appendixes III and IV. SEC agreed that the Sarbanes-Oxley
Act has had a positive impact on investor protection and confidence,
and that smaller public companies face particular challenges in
implementing certain provisions of the act, notably section 404. SEC
stated that our recommendations should provide a useful framework for
consideration of its advisory committee's final recommendations. PCAOB
stated that it is committed to working with SEC on our recommendations
and that it is essential to maintain the overriding purpose of the
Sarbanes-Oxley Act of investor protection while seeking to make its
implementation as efficient and effective as possible. Both SEC and
PCAOB provided technical comments that were incorporated into the
report as appropriate.
Background:
Responding to corporate failures and fraud that resulted in substantial
financial losses to institutional and individual investors, Congress
passed the Sarbanes-Oxley Act in 2002. As shown in table 1, the act
contains provisions affecting the corporate governance, auditing, and
financial reporting of public companies, including provisions intended
to deter and punish corporate accounting fraud and corruption.[Footnote
9]
The Sarbanes-Oxley Act generally applies to those companies required to
file reports with SEC under the Securities Exchange Act of 1934 and
does not differentiate between small and large businesses.[Footnote 10]
The definition of small varies among agencies, but SEC generally calls
companies that had less than $75 million in public float non-
accelerated filers. Accelerated filers are required by SEC regulations
to file their annual and quarterly reports to SEC on an accelerated
basis compared to non-accelerated filers. As of 2005, SEC estimated
that about 60 percent --5,971 companies--of all registered public
companies were non-accelerated filers. SEC recently further
differentiated smaller companies from what it calls "well-known
seasoned issuers"--those largest companies ($700 million or more in
public float) with the most active market following, institutional
ownership, and analyst coverage.[Footnote 11]
Table 1: Summary of Selected Sarbanes-Oxley Act Provisions Affecting
Public Companies and Registered Accounting Firms:
Provision: Section 101: Public Company Accounting Oversight Board;
Main requirements: Establishes the PCAOB to oversee the audit of public
companies that are subject to the securities laws.
Provision: Section 201: Services Outside the Scope of Practice of
Auditors;
Main requirements: Registered accounting firms cannot provide certain
nonaudit services to a public company if the firm also serves as the
auditor of the financial statements for the public company. Examples of
prohibited nonaudit services include bookkeeping, appraisal or
valuation services, internal audit outsourcing services, and management
functions.
Provision: Section 301: Public Company Audit Committees;
Main requirements: Listed company audit committees are responsible for
the appointment, compensation, and oversight of the registered
accounting firm, including the resolution of disagreements between the
registered accounting firm and company management regarding financial
reporting. Audit committee members must be independent.
Provision: Section 302: Corporate Responsibility for Financial Reports;
Main requirements: For each annual and quarterly report filed with SEC,
the CEO and CFO must certify that they have reviewed the report and,
based on their knowledge, the report does not contain untrue statements
or omissions of a material fact resulting in a misleading report and
that, based on their knowledge, the financial information in the report
is fairly presented.
Provision: Section 404: Management Assessment of Internal Controls;
Main requirements: This section consists of two parts (a and b). First,
in each annual report filed with SEC, company management must state its
responsibility for establishing and maintaining an adequate internal
control structure and procedures for financial reporting, and assess
the effectiveness of its internal control structure and procedures for
financial reporting. Second, the registered accounting firm must attest
to, and report on, management's assessment of the effectiveness of its
internal control over financial reporting.
Provision: Section 407: Disclosure of Audit Committee Financial Expert;
Main requirements: Public companies must disclose in periodic reports
to SEC whether the audit committee includes at least one member who is
a financial expert and, if not, the reasons why.
Source: GAO.
[End of table]
Title I of the act establishes PCAOB as a private-sector nonprofit
organization to oversee the audits of public companies that are subject
to the securities laws. PCAOB is subject to SEC oversight. The act
gives PCAOB four primary areas of responsibility:
* registration of accounting firms that audit public companies in the
U.S. securities markets;
* inspections of registered accounting firms;
* establishment of auditing, quality control, and ethics standards for
registered accounting firms; and:
* investigation and discipline of registered accounting firms for
violations of law or professional standards.
Title II of the act addresses auditor independence. It prohibits the
registered external auditor of a public company from providing certain
nonaudit services to that public company audit client. Title II also
specifies communication that is required between auditors and the
public company's audit committee (or board of directors) and requires
periodic rotation of the audit partners managing a public company's
audits.
Titles III and IV of the act focus on corporate responsibility and
enhanced financial disclosures. Title III addresses listed company
audit committees, including responsibilities and independence, and
corporate responsibilities for financial reports, including
certifications by corporate officers in annual and quarterly reports,
among other provisions. Title IV addresses disclosures in financial
reporting and transactions involving management and principal
stockholders and other provisions such as internal control over
financial reporting. More specifically, section 404 of the act
establishes requirements for companies to publicly report on
management's responsibility for establishing and maintaining an
adequate internal control structure, including controls over financial
reporting and the results of management's assessment of the
effectiveness of internal control over financial reporting. Section 404
also requires the firms that serve as external auditors for public
companies to attest to the assessment made by the companies'
management, and report on the results of their attestation and whether
they agree with management's assessment of the company's internal
control over financial reporting.
SEC and PCAOB have issued regulations, standards, and guidance to
implement the Sarbanes-Oxley Act. For instance, both SEC regulations
and PCAOB's Auditing Standard Number 2, "An Audit of Internal Control
Over Financial Reporting Performed in Conjunction with an Audit of
Financial Statements" state that management is required to base its
assessment of the effectiveness of the company's internal control over
financial reporting on a suitable, recognized control framework
established by a body of experts that followed due process procedures,
including the broad distribution of the framework for public comment.
Both the SEC guidance and PCAOB's auditing standard cite the COSO
principles as providing a suitable framework for purposes of section
404 compliance. In 1992, COSO issued its "Internal Control--Integrated
Framework" (the COSO Framework) to help businesses and other entities
assess and enhance their internal control. Since that time, the COSO
framework has been recognized by regulatory standards setters and
others as a comprehensive framework for evaluating internal control,
including internal control over financial reporting. The COSO framework
includes a common definition of internal control and criteria against
which companies could evaluate the effectiveness of their internal
control systems.[Footnote 12] The framework consists of five
interrelated components: control environment, risk assessment, control
activities, information and communication, and monitoring. While SEC
and PCAOB do not mandate the use of any particular framework, PCAOB
states that the framework used by a company should have elements that
encompass the five COSO components on internal control.
Internal control generally serves as a first line of defense in
safeguarding assets and preventing and detecting errors and fraud.
Internal control is defined as a process, effected by an entity's board
of directors, management, and other personnel, designed to provide
reasonable assurance regarding the achievement of the following
objectives: (1) effectiveness and efficiency of operations; (2)
reliability of financial reporting; and (3) compliance with laws and
regulations. Internal control over financial reporting is further
defined in the SEC regulations implementing section 404. These
regulations define internal control over financial reporting as
providing reasonable assurance regarding the reliability of financial
reporting and the preparation of financial statements, including those
policies and procedures that:
* pertain to the maintenance of records that, in reasonable detail,
accurately and fairly reflect the transactions and dispositions of the
assets of the company;
* provide reasonable assurance that transactions are recorded as
necessary to permit preparation of financial statements in conformity
with generally accepted accounting principles, and that receipts and
expenditures of the company are being made only in accordance with
authorizations of management and directors of the company; and:
* provide reasonable assurance regarding prevention or timely detection
of unauthorized acquisition, use, or disposition of the company's
assets that could have a material effect on the financial statements.
PCAOB's Auditing Standard No. 2 reiterates this definition of internal
control over financial reporting. Internal control is not a new
requirement for public companies. In December 1977, as a result of
corporate falsification of records and improper accounting, Congress
enacted the Foreign Corrupt Practices Act (FCPA).[Footnote 13] The
FCPA's internal accounting control requirements were intended to
prevent fraudulent financial reporting, among other things. The FCPA
required companies to: (1) make and keep books, records, and accounts
that in reasonable detail accurately and fairly reflect the
transactions and dispositions of assets and (2) develop and maintain a
system of internal accounting controls sufficient to provide reasonable
assurance over the recording and executing of transactions, the
preparation of financial statements in accordance with standards, and
maintaining accountability for assets.
Smaller Public Companies Have Incurred Disproportionately Higher Audit
Costs in Implementing the Act, but Impact on Access to Capital Remains
Unclear:
Based on our analysis, costs associated with implementing the Sarbanes-
Oxley Act--particularly those costs associated with the internal
control provisions in section 404--were disproportionately higher (as a
percentage of revenues) for smaller public companies. In complying with
the act, smaller companies noted that they incurred higher audit fees
and other costs, such as hiring more staff or paying for outside
consultants, to comply with the act's provisions. Further, resource and
expertise limitations that characterize many smaller companies as well
as their general lack of familiarity or experience with formal internal
control frameworks contributed to the challenges and increased costs
they faced during section 404 implementation. Along with other market
factors, the act may have encouraged a relatively small number of
smaller public companies to go private, foregoing sources of funding
that were potentially more diversified and may be less expensive for
many of these companies. However, the ultimate impact of the Sarbanes-
Oxley Act on smaller public companies' access to capital remains
unclear because of the limited time that the act has been in effect and
the large number of smaller public companies that have not yet fully
implemented the act's internal control provisions.
Smaller Public Companies Incurred Disproportionately Higher Audit Costs:
Our analysis indicates that audit fees have increased considerably
since the passage of the act, particularly for those smaller public
companies that have fully implemented the act. Both smaller and larger
public companies have identified the internal control provisions in
section 404 as the most costly to implement. However, audit fees may
have also increased because of the current environment surrounding
public company audits including, among other things, the new regulatory
oversight of audit firms, new requirements related to audit
documentation, and legal risk. Figure 1 contains data reported by
public companies on audit fees paid to external auditors before and
after the section 404 provisions became effective for accelerated
filers in 2004. Based on this data, we found that (1) audit fees
already were disproportionately greater as a percentage of revenues for
smaller public companies in 2003 and (2) the disparity in smaller and
larger public companies' audit fees as a percentage of revenues
increased for those companies that implemented section 404 in
2004.[Footnote 14] For example, of the companies that reported
implementing section 404, public companies with market capitalization
of $75 million or less paid a median $1.14 in audit fees for every $100
of revenues compared to $0.13 in audit fees for public companies with
market capitalization greater than $1 billion.[Footnote 15] Among
public companies with market capitalization of $75 million or less
(2,263 in total), the 66 companies that implemented section 404 paid a
median $0.35 more per $100 in revenues compared to those that had not
implemented section 404. However, using publicly reported audit fees as
an indicator of the act's compliance costs has some limitations. First,
the audit fees reported by companies that complied with section 404
should include fees for both the internal control audit and the
financial statement audit. As a result, we could not isolate the audit
fees associated with section 404. Second, the fees paid to the external
auditor do not include other costs companies incurred to comply with
section 404 requirements, such as testing and documenting internal
controls and fees paid to external consultants. While the spread
between what smallest and largest public companies that implemented
section 404 paid as a percentage of revenue increased between 2003 and
2004, we also noted that, as a percentage of revenue, the relative
disproportionality between the audit fees paid by smaller public
companies and the largest public companies remained roughly the same
between 2003 and 2004. However, unlike audit fees, these costs are not
separately reported and, therefore, are difficult to analyze and
measure.
Figure 1: Median Audit Fees as a Percentage of 2003 and 2004 Revenues
Reported by Public Companies as of Aug. 11, 2005:
[See PDF for image]
Source: GAO analysis of Audit Analytics data.
Note: Our analysis is based on companies' end of the fiscal year market
capitalization. SEC's criteria for categories of filers (accelerated
versus non-accelerated filers) are based on companies' public float as
of the end of their second quarter. Due to the timing difference, some
of the companies identified in this analysis as having market
capitalization of less than $75 million may have been accelerated
filers under SEC's criteria.
[A] In addition to non-accelerated filers that were granted extensions,
this includes accelerated filers that had not filed their internal
control reports to SEC for reasons such as (1) the company's fiscal
year ended before November 15, 2004, which pushed their reporting date
to late 2005 or early 2006, or (2) the company was delinquent in
implementing section 404.
[B] Some of these companies were non-accelerated filers that decided to
file internal control reports voluntarily.
[End of figure]
Smaller Public Companies Incurred Other Costs in Complying with the Act:
According to executives of smaller public companies that we contacted,
smaller companies incurred substantial costs in addition to the fees
they paid to their external auditors to comply with section 404 and
other provisions of the act. For example, 128 of the 158 smaller public
companies that responded to our survey (81 percent of respondents) had
hired a separate accounting firm or consultant to assist them in
meeting section 404 requirements. Services provided included assistance
with developing methodologies to comply with section 404, documenting
and testing internal controls, and helping management assess the
effectiveness of internal controls and remediate identified internal
control weaknesses. These smaller companies reported paying fees to
external consultants for the period leading up to their first section
404 report that ranged from $3,000 to more than $1.4 million. Many also
reported costs related to training and hiring of new or temporary staff
to implement the act's requirements. Additionally, some of the smaller
companies that responded to our survey reported that their CFOs and
accounting staff spent as much as 90 percent of their time for the
period leading up to their first section 404 report on Sarbanes-Oxley
Act compliance-related issues. Finally, many of the smaller public
companies incurred missed "opportunity costs" to comply with the act
that were significant. For example, nearly half (47 percent) of the
companies that responded to our survey reported deferring or canceling
operational improvements and more than one-third (39 percent) indicated
that they deferred or cancelled information technology investments.
While most companies, including the majority of the smaller public
companies that responded to our survey and that we interviewed, cited
section 404 as the most difficult provision to implement, smaller
public companies reported challenges in complying with other Sarbanes-
Oxley Act provisions as well. Nearly 69 percent of the smaller public
companies that responded to our survey said that the act's auditor
independence requirements had decreased the amount of advice that they
received from their external auditor on accounting-and tax-related
matters. About half the companies that responded to our survey
indicated that they incurred additional expenses by hiring outside
counsel for assistance in complying with various requirements of the
act. Examples mentioned included legal assistance with drafting
charters for board committees, drafting a code of ethics, establishing
whistleblower protection, and reviewing CEO and CFO certification
requirements. About 13 percent of the smaller public companies reported
incurring costs to appoint a financial expert to serve on the audit
committee, and about 6 percent reported incurring costs to appoint
other independent members to serve on the audit committee. While these
types of costs were consistent with those reported for larger
companies, the impact on smaller public companies was likely greater
given their more limited revenues and resources.
Smaller Companies Have Different Characteristics Than Larger Companies,
Some of Which Contributed to Higher Implementation Costs:
While public companies--both large and small--have been required to
establish and maintain internal accounting controls since the Foreign
Corrupt Practices Act of 1977, most public companies and their external
auditors generally had limited practical experience in implementing and
using a structured framework for internal control over financial
reporting as envisioned by the implementing regulations for section
404.[Footnote 16] Our survey of smaller public companies and our
discussions with external auditors indicated that the internal control
framework--that is the COSO framework--referred to in SEC's regulations
and PCAOB's standards implementing section 404 was not widely used by
public companies, especially smaller companies, prior to the Sarbanes-
Oxley Act.
Many companies documented their internal controls for the first time as
part of their first year implementation efforts to comply with section
404. As a result, many companies probably underestimated the time and
resources necessary to comply with section 404, partly because of their
lack of experience or familiarity with the framework. These challenges
were undoubtedly compounded in companies that needed to make
significant improvements in their internal control systems to make up
for deferred maintenance of those systems. While this was largely true
for both larger and smaller companies, regulators (SEC and PCAOB),
public accounting firms, and others have indicated that smaller public
companies often face particular challenges in implementing effective
internal control over financial reporting.[Footnote 17]
Resource limitations make it more difficult for smaller public
companies to achieve economies of scale, segregate duties and
responsibilities, and hire qualified accounting personnel to prepare
and report financial information. Smaller companies are inherently less
able to take advantage of economies of scale because they face higher
fixed per unit costs than larger companies with more resources and
employees. Implementing the functions required to segregate transaction
duties in a smaller company absorbs a larger percentage of the
company's revenues or assets than in a larger company. About 60 percent
of the smaller public companies that responded to our survey said that
it was difficult to implement effective segregation of duties. Several
executives told us that it was difficult to segregate duties due to
limited resources. According to COSO's draft guidance for smaller
public companies, smaller companies can develop and implement
compensating controls when resource constraints compromise the ability
to segregate duties. The American Institute of Certified Public
Accountants noted that smaller public companies often do not have the
internal audit functions referred to in COSO's internal framework
guidance. Other executives commented that it was difficult to achieve
effective internal control over financial reporting because they lacked
expertise within their internal accounting staff. For example,
according to an executive from a company that reported a material
weakness in its section 404 report, the financial accounting standards
for stock options were too complex for his staff and it was easier to
have its auditor fix the mistakes and cite the company for a material
weakness in internal control over financial reporting. Two other
executives told us that their auditors cited their companies with
material weaknesses in internal controls over financial reporting for
not having appropriate internal accounting staff; to remediate this
weakness, the companies had to hire additional staff.
According to COSO, however, some of the unique characteristics of
smaller companies create opportunities to more efficiently achieve
effective internal control over financial reporting and more
efficiently evaluate internal control which can facilitate compliance
with section 404. These opportunities can result from more centralized
management oversight of the business, and greater exposure and
transparency with the senior levels of the company that often exist in
a smaller company. For instance, management's hands-on approach in
smaller companies can create opportunities for less formal and less
expensive communications and control procedures without decreasing
their quality. To the extent that smaller companies have less complex
product lines and processes, and/or centralized geographic
concentrations in operations, the process of achieving and evaluating
effective internal control over financial reporting could be simplified.
According to SEC, another characteristic of smaller public companies is
that they tend to be much more closely held than larger public
companies; insiders such as founders, directors, and executive officers
hold a high percentage of shares in the companies. Further, CFOs of
smaller public companies frequently play a more integrated operational
role than their larger company counterparts. According to a
recommendation by participants at the September 2005 Government-
Business Forum on Small Business Capital Formation hosted by SEC, these
types of shareholders are classic insiders who do not need significant
SEC protection.[Footnote 18] According to SEC's Office of Economic
Analysis, among public companies with a market capitalization of $125
million or less, insiders own on average approximately 30 percent of
the company's shares. Although the "insider" shareholders owners may
not have the same need for significant investor SEC protection as
investors in broadly held companies, minority shareholders who are not
insiders may have a need for such protection.
Complexity, Scope, and Timing of PCAOB Guidance also Appeared to
Influence Cost of Section 404 Implementation:
Accounting firms and public companies also have noted that the scope,
complexity, and timing of PCAOB's Auditing Standard No. 2 contributed
to the challenges and higher costs in the first year of implementation
of section 404. PCAOB's Auditing Standard No. 2 establishes new audit
requirements and governs both the auditor's assessment of controls and
its attestation to management's report. PCAOB first issued an exposure
draft of the standard for comment by interested parties on October 7,
2003. The Board received 194 comment letters from a variety of
interested parties, including auditors, investors, internal auditors,
public companies, regulators, and others. Due to the time needed to
draft the standard, evaluate the comment letters, and finalize the
standard, PCAOB did not issue the final standard until March 2004--more
than 8 months after SEC issued its final regulations on section 404 and
part way into the initial year of implementation for accelerated
filers. SEC, which under the act is responsible for approving standards
issued by PCAOB, did not approve Auditing Standard No. 2 until June 17,
2004. As a result of both timing and unfamiliarity with PCAOB's
Auditing Standard No. 2, auditors were not prepared to integrate the
internal control over financial reporting attestation and financial
audits in the first year of implementation as envisioned by Auditing
Standard No. 2.
Furthermore, according to PCAOB, auditors were not always consistent in
their interpretation and application of Auditing Standard No. 2. In
PCAOB's report on the initial implementation of Auditing Standard No.
2, the Board found that both auditors and public companies faced
enormous challenges in the first year of implementation arising from
the limited time frames for implementing the new requirements; a
shortage of staff with prior training and experience in designing,
evaluating, and testing controls; and related strains on available
resources.[Footnote 19] The Board found that some audits performed
under these circumstances were not as effective or efficient as they
should have been. Auditing firms and a number of public companies have
stated that they expect subsequent years' compliance costs for section
404 to decrease.
Costs Associated with the Sarbanes-Oxley Act May Have Impacted the
Decision of Some Smaller Public Companies to Go Private, but Other
Factors also Influenced Decision to Go Private:
Since the passage of the act in July 2002, the number of companies
going private (that is, ceasing to report to SEC by voluntarily
deregistering their common stock) increased significantly.[Footnote 20]
As shown in figure 2, the number of public companies that went private
has increased significantly from 143 in 2001 to 245 in 2004, with the
greatest increase occurring during 2003.[Footnote 21] However, the 245
companies represented 2 percent of public companies as of January 31,
2004. Based on the trends observed in 2003 and 2004 and the 80
companies that went private in the first quarter of 2005, we project
that the number of companies going private will have risen more than 87
percent, from the 143 in 2001 to a projected 267 through the end of
2005. Our analysis also indicated that companies going private during
this entire period were disproportionately small by any measure (market
capitalization, revenue, or assets).
Figure 2: Total Number of Companies Identified as Going Private, 1998-
2005:
[See PDF for image]
Source: GAO analysis of SEC data.
Note: Includes companies that deregistered, but continued to trade over
the less-regulated Pink Sheets ("went dark") and shell companies and
blank check companies. Does not include companies that filed for, or
are emerging from, bankruptcy, have liquidated or are in the process of
liquidating, were headquartered in a foreign country, or were acquired
by or merged into another company unless the transaction was initiated
by an affiliate of the company and the company became a private entity.
See appendix II for a fuller discussion of our analysis.
[End of figure]
The costs associated with public company status were most often cited
as a reason for going private (see table 2). While there are many
reasons for a company deregistering--including the inability to benefit
from its public company status--the percentage of deregistered
companies citing the direct cost associated with maintaining public
company status grew from 12 percent in 1998 to 62 percent during the
first quarter of 2005. These costs include the accounting, legal, and
administrative costs associated with compliance with SEC's reporting
requirements as well as other expenses such as those related to
managing shareholder accounts. The number of companies citing indirect
costs, such as the time and resources needed to comply with securities
regulations, also has increased since the passage of the Sarbanes-Oxley
Act.[Footnote 22] In 2002, 64 companies that went private cited cost as
one of the reasons for the decision; however, that number increased to
143 and 130 companies in 2003 and 2004, respectively. Many of the
companies mentioned both the direct and indirect costs associated with
maintaining their public company status. Over half of the companies
that cited costs mentioned the Sarbanes-Oxley Act specifically (roughly
58 percent in 2004 and 2005 and 41 percent in 2003). For smaller public
companies, the costs of complying with securities laws likely required
a greater portion of their revenues, and cost considerations (indirect
and direct) were the leading reasons for companies exiting the public
market, even prior to the enactment of the Sarbanes-Oxley Act.[Footnote
23]
Table 2: Primary Reasons Cited by Companies for Going Private, 1998-
2005, by Percent:
1998: Direct costs: 12.3%;
Indirect costs: 5.3%;
Market/liquidity issues: 14.0%;
Private company benefits: 26.3%;
Critical business issues: 15.8%;
Other: 3.5%;
No reason: 54.4%.
1999: Direct costs: 33.3%;
Indirect costs: 12.2%;
Market/liquidity issues: 33.3%;
Private company benefits: 42.2%;
Critical business issues: 8.9%;
Other: 3.3%;
No reason: 37.8%.
2000: Direct costs: 20.0%;
Indirect costs: 11.1%;
Market/liquidity issues: 32.2%;
Private company benefits: 37.8%;
Critical business issues: 20.0%;
Other: 5.6%;
No reason: 38.9%.
2001: Direct costs: 32.2%;
Indirect costs: 13.3%;
Market/liquidity issues: 31.5%;
Private company benefits: 23.8%;
Critical business issues: 20.3%;
Other: 3.5%;
No reason: 49.0%.
2002: Direct costs: 44.4%;
Indirect costs: 13.9%;
Market/liquidity issues: 35.4%;
Private company benefits: 22.9%;
Critical business issues: 16.0%;
Other: 1.4%;
No reason: 45.1%.
2003: Direct costs: 57.8%;
Indirect costs: 27.5%;
Market/liquidity issues: 38.5%;
Private company benefits: 21.3%;
Critical business issues: 19.7%;
Other: 0.8%;
No reason: 31.6%.
2004: Direct costs: 52.7%;
Indirect costs: 25.7%;
Market/liquidity issues: 28.6%;
Private company benefits: 15.9%;
Critical business issues: 15.5%;
Other: 1.2%;
No reason: 38.4%.
2005 Q1: Direct costs: 62.2%;
Indirect costs: 28.9%;
Market/liquidity issues: 28.9%;
Private company benefits: 8.9%;
Critical business issues: 12.2%;
Other: [Empty];
No reason: 27.8%.
Source: GAO analysis of SEC filings and relevant press releases.
Note: See appendix II for a more detailed description of the categories
and limitation for this analysis. Because companies were able to cite
more than one reason for going private, the percentages may add up to
more than 100 for each year.
[End of table]
Further, the benefits of public company status historically appeared to
have been disproportionately smaller for smaller companies, companies
with limited need for external funding, and companies whose public
shares were traded infrequently or in low volume at low
prices.[Footnote 24] As a result, issues unrelated to the Sarbanes-
Oxley Act, such as market and liquidity issues and the benefits of
being private, are also major reasons for companies going private. From
1999 to 2004, more companies cited market and liquidity issues than the
indirect costs associated with maintaining their public company status.
Companies in this category cited a wide variety of issues related to
the company's publicly traded stock such as a lack of analyst coverage
and investor interest, poor stock market performance, limited liquidity
(trading volume), and inability to use the secondary market to raise
additional capital.[Footnote 25] Smaller companies also have cited
advantages of private status such as greater flexibility, freedom from
the short-term pressures of Wall Street, belief that the markets had
consistently undervalued the company, and the ability to avoid
disclosures of information that might benefit their competitors (see
app. II).
Companies that elect to go private reduce the number of financing
options available to them and must rely on other sources of funding. In
aggregate, equity is cheaper when it is supplied by public sources, net
of any costs of regulatory compliance. However, in some circumstances,
private equity or bank lending may be preferable alternatives to the
public market. Statistics suggest bank loans are the primary source of
funding for U.S. companies that rely on external financing. Some
companies with insufficient market liquidity had little opportunity for
follow-on stock offerings and going private would not have
fundamentally altered the way they raised capital. We found that almost
25 percent of the companies that deregistered from 2003 through the end
of the first quarter of 2005 were not trading on any market at all (see
fig. 3). Approximately 37 percent of the companies that went private
during this period were traded on the Over-the-Counter Bulletin Board
(OTCBB); the general liquidity of this market is significantly less
than major markets traded on the NASDAQ Stock Market, Inc. (NASDAQ) or
the New York Stock Exchange (NYSE).[Footnote 26] Additionally, 14
percent were traded in the Pink Sheets and, therefore, were most likely
closely held and traded sporadically, if at all. Pink Sheets LLC is not
registered with SEC, has no minimum listing standards, does not require
quoted companies to provide detailed information to its investors, and
is regarded as high-risk by many investors. As a result, trading on the
Pink Sheets may produce negative reputational effects that can further
reduce liquidity and the market value of the company's stock, thereby
increasing the cost of equity capital.[Footnote 27]
Figure 3: Where Companies Traded Prior to Deregistration, July 2003-
March 2005:
[See PDF for image]
Source: GAO analysis of SEC data.
[End of figure]
It Is Too Soon to Determine How Sarbanes-Oxley Affected Access to
Capital for Smaller Public Companies:
As previously discussed, a large number of smaller public companies
have not fully implemented all the requirements of the Sarbanes-Oxley
Act, notably non-accelerated filers (public companies with less than
$75 million in public float). As a result, it is unlikely that the act
has affected access to the capital markets for these companies.
Moreover, the limited time that the act's provisions have been in force
would limit any impact on access to capital, even for the companies
that have implemented section 404. For instance, more than 80 percent
of the smaller public companies that responded to our survey indicated
that the act has had no effect or that they had no basis to judge the
effect of the act on their ability to raise equity or debt financing or
on their cost of capital.
There are indications that the Sarbanes-Oxley Act at a minimum has
contributed to some smaller companies rethinking the costs and benefits
of public company status. For example, more than 20 percent of the
smaller companies that responded to our survey also stated that the act
encouraged them to consider going private or deregistering. In
contrast, a number of the smaller public companies that responded to
our survey cited positive effects associated with the implementation of
the act, notably positive impacts on audit committee involvement (60
percent), company awareness of internal controls (64 percent), and
documentation of business processes (67 percent).
SEC and PCAOB Have Been Addressing Smaller Company Concerns Associated
with the Implementation of Section 404:
SEC and PCAOB have taken actions to address smaller public company
concerns about implementation of Sarbanes-Oxley Act provisions,
particularly section 404, by giving smaller companies more time to
comply, issuing or refining guidance, increasing communication and
education opportunities, and establishing an advisory committee on
smaller public companies. In particular, SEC has extended deadlines for
complying with section 404 requirements several times since issuing its
final rule in 2003 (see table 3). In its final rulemaking on section
404 requirements, SEC stated that it was sensitive to concerns that
many smaller public companies would experience difficulty in evaluating
their internal control over financial reporting because these companies
might not have as formal or well-structured a system of internal
control over financial reporting as larger companies. In November 2004,
SEC granted "smaller" accelerated filers an additional 45 days to file
their reports on internal control over financial reporting out of
concern that these companies were not in a position to meet the
original deadline. SEC granted non-accelerated filers two additional
extensions in March 2005 and September 2005, with the latter extension
giving non-accelerated filers until their first fiscal year after July
2007 before having to report under section 404. SEC also considered the
particular challenges facing smaller companies when granting these
extensions. Further, SEC noted that there were other small business
initiatives underway that could improve the effectiveness of non-
accelerated company filers' implementation of the section 404 reporting
requirements.
Table 3: SEC Extensions of Section 404 Compliance Dates:
Action: Final rule;
Date: June 5, 2003;
Description: SEC's rationale; SEC adopted an extended transition period
for compliance so that companies and their auditors would have time to
prepare and satisfy the new requirements; The transition period would
provide additional time for PCAOB to develop the new auditing standard
for internal control over financial reporting; Compliance dates; An
accelerated filer (generally, a U.S. company that has public equity
float of more than $75 million and has filed at least one annual report
with SEC) was required to comply for its first fiscal year ending on or
after June 15, 2004; A non-accelerated filer was required to comply for
its first fiscal year ending on or after April 15, 2005.
Action: Final rule; extension of compliance dates;
Date: February 24, 2004;
Description: SEC's rationale; The extension would minimize the cost and
disruption of implementing a new disclosure requirement; The extension
would provide companies and their auditors with a sufficient amount of
time to perform additional testing or remediation of controls based on
the final auditing standard; Compliance dates; An accelerated filer was
required to comply for its first fiscal year ending on or after
November 15, 2004; A non-accelerated filer was required to comply for
its first fiscal year ending on or after July 15, 2005.
Action: Exemptive order;
Date: November 30, 2004;
Description: SEC's rationale; SEC was concerned that many smaller
accelerated filers were not in a position to meet the compliance dates;
Compliance dates; Subject to certain conditions, a smaller accelerated
filer (generally, a U.S. company with public float of less than $700
million) was granted an additional 45 days to comply; The compliance
dates for non- accelerated filers did not change.
Action: Final rule; extension of compliance dates;
Date: March 2, 2005;
Description: SEC's rationale; In December 2004, SEC established an
advisory committee to, among other things, assess the impact of the
Sarbanes-Oxley Act on smaller public companies. The extension was
intended to give the committee additional time to conduct its work; In
January 2005, COSO established a task force to provide guidance on how
the COSO framework could be applied to smaller companies. The extension
would give smaller public companies time to consider the new COSO
guidance, which COSO intended to publish during the summer of 2005;
Compliance dates; The compliance dates for accelerated filers did not
change; A non-accelerated filer was required to comply for its first
fiscal year ending on or after July 15, 2006.
Action: Final rule; extension of compliance dates;
Date: September 22, 2005;
Description: SEC's rationale; The extension was warranted due to
ongoing efforts by the COSO task force and SEC's advisory committee; In
August 2005, the advisory committee recommended that SEC extend section
404 compliance dates for non-accelerated filers. The extension was
consistent with the advisory committee's recommendation; Compliance
dates; The compliance dates for accelerated filers did not change; A
non-accelerated filer is required to comply for its first fiscal year
ending on or after July 15, 2007.
Source: GAO analysis of SEC regulatory actions.
[End of table]
While SEC's final rule serves as basic guidance for public company
implementation of section 404 requirements, PCAOB's Auditing Standard
Number 2 provides the auditing standards and requirements for an audit
of the financial statements and internal control over financial
reporting, as part of an integrated audit. It is a comprehensive
document that addresses the work required by the external auditor to
audit internal control over financial reporting, the relationship of
that work to the audit of the financial statements, and the auditor's
attestation on management's assessment of the effectiveness of internal
control over financial reporting. The standard requires technical
knowledge and professional expertise to effectively implement.
While both SEC regulations and the PCAOB standard refer to COSO's
internal control framework, many companies were unfamiliar with or did
not use this framework, despite the fact that public companies have
been required by law to have implemented a system of internal
accounting controls since 1977. According to SEC, smaller public
companies and their auditors had expressed concern that the COSO
internal control framework was designed primarily for larger public
companies and smaller companies lacked sufficient guidance on how they
could use COSO's internal control framework, resulting in
disproportionate section 404 implementation costs. As a result, SEC
staff asked COSO to develop additional guidance to assist smaller
public companies in implementing COSO's internal control framework in a
small business environment. In October 2005, COSO issued a draft of the
guidance for public comment, and anticipated issuing final guidance for
smaller public companies in early 2006. The draft guidance outlined 26
principles for achieving effective internal control over financial
reporting and provides examples on how companies can implement them.
The draft guidance states that the fundamental concepts of good
internal control over financial reporting are the same whether the
company is large or small. At the same time, the draft guidance points
out differences in approaches used by smaller companies versus their
larger counterparts to achieve effective internal control over
financial reporting and discusses the unique challenges faced by
smaller companies. While intended to provide additional clarity to
smaller companies for implementing an internal control framework, the
guidance has received mixed reviews with some questioning whether it
will significantly change the disproportionate cost and other burdens
for smaller public companies associated with section 404
compliance.[Footnote 28]
In December 2004, SEC announced its intention to establish its Advisory
Committee on Smaller Public Companies to assess the current regulatory
system for smaller companies under the securities laws, including the
impact of the Sarbanes-Oxley Act. In addition to granting companies
more time to meet the act's requirements, SEC has been considering how
its section 404 guidance and overall approach to implementation might
be revised. SEC chartered the advisory committee on March 23, 2005. The
committee plans to issue its final report to SEC by April 2006.
On March 3, 2006, the committee published an exposure draft of its
final report for public comment that contained 32 recommendations
related to securities regulation for smaller public companies.[Footnote
29] Due to the number of recommendations, the advisory committee refers
to its 14 highest priority recommendations as "primary
recommendations." One of its primary recommendations is an overarching
recommendation calling for a "scaled" approach to securities
regulation, whereby smaller public companies are stratified into two
groups, "microcap" and "smallcap" companies. Under this recommendation,
microcap companies would consist of companies whose common stock in the
aggregate make up the lowest 1 percent of U.S. equity market
capitalization. The advisory committee estimates, based on data from
SEC's Office of Economic Analysis, that the microcap category would
include public companies whose individual market capitalization is less
than $128 million, approximately 53 percent of all U.S. public
companies. For the smallcap category, the advisory committee estimates
that the category would include public companies whose individual
market capitalization is less than $787 million and greater than $128
million, and would encompass an additional 26 percent of U.S. public
companies and an additional 5 percent of U.S. market capitalization.
Taken together, the categories of microcap and smallcap companies, as
defined by the advisory committee draft recommendations, would include
approximately 79 percent of all U.S. public companies and 6 percent of
market capitalization, according to the advisory committee's analysis
of SEC data. The recommendation calling for a scaled approach for
securities regulation based on company size was also incorporated into
the committee's preliminary recommendations related to internal control
over financial reporting.
While acknowledging that some have questioned whether smaller public
companies' problems with section 404 have been overstated, the advisory
committee concluded that section 404, as currently structured,
"represents a clear problem for smaller public companies and their
investors, one for which relief is urgently needed."[Footnote 30] In
part, the advisory committee based its conclusion on a belief that
smaller public company compliance with section 404 has resulted in
disproportionate costs and less certain benefits.
The advisory committee's primary recommendations related to internal
control over financial reporting address regulatory relief from section
404 for a subset of the microcap and smallcap categories described
above by the inclusion of revenue criteria.[Footnote 31] Specifically,
the committee's preliminary recommendations are that:
* Unless and until a framework for assessing internal control over
financial reporting for such companies is developed that recognizes
their characteristics and needs, provide exemptive relief from all of
the requirements of section 404 of the Sarbanes-Oxley Act to microcap
companies with less than $125 million in annual revenue and to smallcap
companies with less than $10 million in annual product
revenue.[Footnote 32]
* Unless and until a framework for assessing internal control over
financial reporting for smallcap companies is developed that recognizes
the characteristics and needs of those companies, provide exemptive
relief from section 404(b) of the act--the external auditor involvement
in the section 404 process--to smallcap companies with less than $250
million but greater than $10 million in annual product revenues and
microcap companies with between $125 million and $250 million in annual
revenues.
By including the revenue criteria, the committee's recommendations
regarding section 404 cover a subset of the public companies included
within its microcap and smallcap definitions. The committee estimated
that, after applying the revenue criteria, 4,641 "microcap" public
companies (approximately 49 percent of 9,428 public companies
identified in data developed for the advisory committee by SEC's Office
on Economic Analysis) may potentially qualify for full exemption from
section 404 and another 1,957 "smallcap" public companies
(approximately 21 percent of the SEC-identified public companies)--a
total of 70 percent of SEC-identified public companies--may potentially
qualify for exemption from the external audit requirement of section
404(b).[Footnote 33] It is likely that a number of public companies
that would qualify for exemptive relief under the committee's
recommendations have probably already complied with both sections of
404(a) and (b), based on their status as accelerated filers.
If adopted, these recommendations would effectively establish a "tiered
approach" for compliance with section 404, "unless and until" a
framework for assessing internal control over financial reporting is
developed for microcap and smallcap companies. Under the tiered
approach, larger public companies that do not meet the committee's size
criteria for exemption would continue to be required to comply with
both section 404(a)--management's assessment of and reporting on
internal control over financial reporting--and section 404(b)--the
external auditors' attestation on management's assessment and the
effectiveness of the company's internal control. "Smallcap" public
companies that meet the revenue criteria would be exempt from complying
with section 404(b), but the companies would still be required to
comply with section 404(a). "Microcap" and some "smallcap"companies
that meet the revenue criteria would be entirely exempt from both
section 404(a) and (b).[Footnote 34] The committee's two primary
recommendations related to regulatory relief from section 404 for
smaller public companies also include additional requirements that
affected public companies apply additional corporate governance
provisions and report publicly on known material internal control
weaknesses.[Footnote 35]
In its next primary recommendation on internal control over financial
reporting, which is premised on the adoption of the recommendation for
microcap companies described above, the committee acknowledged that SEC
might conclude, as a matter of public policy, that an audit requirement
is necessary for smallcap companies. In that case, the committee
recommended SEC provide for the external auditor to perform an audit of
only the design and implementation of internal control over financial
reporting, which by its nature would be more limited than the audit of
the effectiveness of internal control over financial reporting required
by section 404(b) and PCAOB's Auditing Standard No. 2, and that PCAOB
develop a new auditing standard for such an engagement. While this
recommendation is based on the view that having the external auditor
perform a review of the design and implementation of internal control
over financial reporting would be more cost-effective than the work
otherwise required under Auditing Standard No. 2, the committee's
report does not address the extent to which costs for such a review
would be lower than that required under Auditing Standard No. 2 and
whether the lower costs would be worth the reduced assurances provided
by reduced scope of the external auditors' work on internal control
over financial reporting.
While not specifically focused on small business issues, SEC also
conducted a public "roundtable" in April 2005 that gave public
companies, accounting firms, and others an opportunity to provide
feedback to SEC and PCAOB on what went well and what did not during the
first year of section 404 implementation. GAO also participated in this
roundtable. Following the roundtable, the SEC and PCAOB Chairmen noted
the importance of section 404 requirements but acknowledged that
initial implementation costs had been higher than expected and noted
the need to improve the cost-benefit equation for small and mid-sized
companies. Both agencies issued additional guidance in May 2005 based
on findings from the roundtable. PCAOB's guidance clarified that
auditors (1) should integrate their audits of internal control over
financial reporting with their audits of the client's financial
statements, (2) exercise judgment and tailor their audit plans to best
meet the risks faced by their clients rather than relying on
standardized "checklists," (3) use a top-down approach beginning with
company-level controls and use the risk assessment required by the
standard, (4) take advantage of the work of others, and (5) engage in
direct and timely communication with their audit clients, among other
matters. Guidance by SEC and its staff emphasized the need for
reasonable assurance, risk-based assessments, better communication
between the auditor and client, and clarified what should be in
material weakness disclosures. Representatives of the smaller public
companies that we interviewed indicated that the additional guidance
that SEC and PCAOB issued was helpful. SEC and PCAOB plan to hold a
second roundtable in May 2006 to discuss companies' second year
experiences with implementing section 404. Both chairs of SEC and PCAOB
have said that they would consider additional guidance if necessary.
On November 30, 2005, PCAOB also issued a report on the initial
implementation of its auditing standard on internal control over
financial reporting.[Footnote 36] The report included observations by
PCAOB--based in significant part, but not exclusively, on its
inspections of public accounting firms, which in the 2005 cycle
included a review of a limited selection of audits of internal control
over financial reporting--on why the internal control audits were not
as efficient or effective as the standard intended. PCAOB also
amplified the previously issued guidance of May 2005, discussing how
auditors could achieve more effective and efficient implementation of
the standard.
Further, PCAOB has held a series of forums nationwide to educate the
small business community on the PCAOB inspections process and the new
auditing standards. The goal of the forums was to provide small
accounting firms and smaller public companies an opportunity to discuss
PCAOB-related issues with Board members and staff. PCAOB also
established a Standing Advisory Group to advise PCAOB on standard-
setting priorities and policy implications of existing and proposed
standards. The Standing Advisory Group has considered ways to improve
the application of its internal control over financial reporting
requirements--Auditing Standard No. 2--with respect to audits of
smaller public companies.
Finally, both SEC and PCAOB have acknowledged the challenges that
smaller public companies faced and continue to face in implementing
section 404 and have begun to address those challenges. SEC also has
emphasized that smaller companies need to focus on the quality of their
internal control over financial reporting. Data provided by SEC's
Office of Economic Analysis and other studies have pointed to the
increased level of restatements as an indicator that the Sarbanes-Oxley
Act--section 404 in particular--has gotten companies to identify and
correct weaknesses that led to financial reporting misstatements in
prior fiscal years. For example, according to recent research conducted
by Glass, Lewis and Co., the restatement rate for smaller public
companies was more than twice the rate for the largest public companies
(9 percent for companies with revenues of less than $500 million and 4
percent for companies with more than $10 billion).[Footnote 37] SEC
staff also noted that smaller public companies had a disproportionately
higher rate of material weaknesses in internal control over financial
reporting during the first year of implementing section 404. Our
discussions with accounting firms confirmed that smaller public
companies have had a higher rate of reported material weaknesses in
internal control over financial reporting than larger public companies.
A major challenge in considering any regulatory relief from section 404
is that the overriding purpose of the Sarbanes-Oxley Act is investor
protection. Investor confidence in the integrity and reliability of
financial reporting is a critical element for the efficient functioning
of our capital markets. The purpose of internal control over financial
reporting is to provide reasonable assurance over the integrity and
reliability of the financial statements and related disclosures. Market
reactions to financial misstatements illustrate the importance of
accurate financial reporting, regardless of a company's size.
Given the anticipated regulatory changes, particularly those relating
to section 404's internal control reporting requirements, smaller
public companies may be limiting or not taking definitive actions to
improve internal control over financial reporting based on a perception
that they could become exempt from section 404. Further, PCAOB
officials noted that such a perception may have limited smaller
business involvement in PCAOB forums.
Sarbanes-Oxley Act Requirements Minimally Affected Smaller Private
Companies, Except for Those Seeking to Enter the Public Market:
While the act does not impose new requirements on privately held
companies, companies choosing to go public realistically must spend
additional time and funds in order to demonstrate their ability to
comply with the act, section 404 in particular, to attract
investors.[Footnote 38] This may have been a contributing factor in the
reduction of the number of initial public offerings (IPO) issued by
small companies since 2002. However, other factors--stock market
performance and changes in listing standards--likely also have affected
the number of IPOs. While a number of states proposed legislation with
provisions similar to the Sarbanes-Oxley Act, three states[Footnote 39]
actually enacted legislation requiring private companies or nonprofit
organizations to adopt requirements similar to certain Sarbanes-Oxley
Act provisions. Finally, some privately held companies have been
adopting the act's enhanced governance practices because these
companies believe these practices make good business sense.
Sarbanes-Oxley May Have Affected IPO Activity; however, Other Important
Factors also Influence Entry into the Public Market and Access to
Capital:
Small businesses that are not public companies typically rely on a
variety of sources to finance their operations, including personal
savings, credit cards, and collateralized bank loans. In addition,
small businesses can use private equity capital sources such as venture
capital funds--private partnerships that provide private equity
financing to early-and later-stage high-growth small businesses--to
fund their growth. Small businesses may also issue equity shares to
other types of investors to finance further growth. These shares may be
sold through private placements where shares are sold directly to
investors (direct placement) or through a public offering where the
shares are sold through an underwriter (going public).[Footnote 40] In
addition, some small companies issue equities that trade on smaller
markets such as the Pink Sheets.[Footnote 41] For those private
companies desiring to enter the public market, the IPO process has
always been recognized as a time-consuming and expensive endeavor.
However, venture capitalists and private company officials told us
that, as a result of the act and other market factors, many private
companies have been spending additional time, effort, and money to
convince investors that they can meet the requirements of the act. For
example, investors have become more cautious and demanding of the
private companies in which they invest. Consequently, private companies
have hired auditors and additional staff to make substantial changes to
their financial system and data-reporting capabilities, document
internal controls and processes, and review or change accounting
procedures.
According to venture capitalists and private company officials with
whom we spoke, a private company's ability to meet the Sarbanes-Oxley
Act's requirements can significantly decrease some of the investment
risk associated with becoming a public company. For example, both
groups told us that companies with well-documented internal control and
governance policies were more attractive and able to secure investor
funding at a much lower cost. Moreover, they noted that underwriters
expected private companies to consider and comply with the act well in
advance of going public. If a private company were unable to meet the
act's requirements, venture capitalists would want the company to show
evidence of a plan for becoming compliant as soon as the company became
public. If not, venture capitalists noted that they would be less
likely to invest in such a company and look elsewhere for investment
opportunities.
These new expectations may have served to increase the expenses
associated with the IPO process through changes in the professional
fees charged by auditors and potentially other costs as well.
Specifically, we found that there has been a disproportionate increase
for the smallest companies when IPO expenses were viewed as a
percentage of revenue. As shown in table 4, the direct expenses
(excluding underwriting fees) associated with the IPO represented a
significant portion of a small company's revenues, relative to larger
companies, from 1998 through the second quarter of 2005. These expenses
have increased disproportionally since 2002 for small companies going
public--especially for the smallest of these companies ($25 million or
less in revenues). While Sarbanes-Oxley Act requirements could explain
some of this increase, legal, exchange listing, printing, and other
fees unrelated to the act could also account for this increase.
Moreover, other market factors also could explain the increase in IPO
expenses paid to auditors.[Footnote 42]
Table 4: IPO Direct Expenses as a Percentage of Company's Revenues, by
Size:
1998: $25 million or less: 12.5%;
$25 -100 million: 3.0%;
$100-250 million: 1.2%;
$250-500 million: 0.6%;
$500 million-1 billion: 0.3%;
Greater than $1 billion: 0.2%;
All companies: 0.9%.
1999: $25 million or less: 17.6%;
$25 -100 million: 3.7%;
$100-250 million: 1.8%;
$250-500 million: 0.7%;
$500 million-1 billion: 1.2%;
Greater than $1 billion: 0.1%;
All companies: 0.9%.
2000: $25 million or less: 21.3%;
$25 -100 million: 3.3%;
$100-250 million: 1.9%;
$250-500 million: 0.8%;
$500 million-1 billion: 0.3%;
Greater than $1 billion: 0.1%;
All companies: 0.6%.
2001; $25 million or less: 14.3%;
$25 -100 million: 3.0%;
$100-250 million: 1.1%;
$250-500 million: 0.8%;
$500 million-1 billion: 0.5%;
Greater than $1 billion: 0.1%;
All companies: 0.2%.
2002: $25 million or less: 10.6%;
$25 -100 million: 3.1%;
$100-250 million: 1.1%;
$250-500 million: 0.6%;
$500 million-1 billion: 0.3%;
Greater than $1 billion: 0.1%;
All companies: 0.1%.
2003: $25 million or less: 17.5%;
$25 -100 million: 5.0%;
$100-250 million: 1.5%;
$250-500 million: 0.7%;
$500 million-1 billion: 0.4%;
Greater than $1 billion: 0.5%;
All companies: 0.9%.
2004: $25 million or less: 25.9%;
$25 -100 million: 4.9%;
$100-250 million: 2.2%;
$250-500 million: 1.5%;
$500 million-1 billion: 0.4%;
Greater than $1 billion: 0.3%;
All companies: 1.3%.
2005 (Q1-Q2): $25 million or less: 28.1%;
$25 -100 million: 5.3%;
$100- 250 million: 1.5%;
$250-500 million: 1.2%;
$500 million-1 billion: 0.6%;
Greater than $1 billion: 0.3%;
All companies: 1.0%.
1998 - 2005 Q2: $25 million or less: 18.2%;
$25 -100 million: 3.8%;
$100- 250 million: 1.7%;
$250-500 million: 0.9%;
$500 million-1 billion: 0.5%;
Greater than $1 billion: 0.1%;
All companies: 0.4%.
Source: GAO analysis of data from SEC filings.
Note: Includes only companies with financial data available. In some
cases, pro forma or un-audited revenue data were used. There can be
significant lag between the dates when a company initially files for an
IPO and when the stock of the company is finally priced (begins
trading). The number of priced IPOs only includes those companies that
initially filed for an IPO after November 1, 1997. See appendix I for
more details.
[End of table]
In addition to the requirements of the Sarbanes-Oxley Act and the
general increase in direct expenses, other important factors likely
have influenced IPO activity. To illustrate, the downward trend in IPOs
occurred before the passage of the Sarbanes-Oxley Act in mid-2002. It
is widely acknowledged that IPO filings and pricings tend to be closely
associated with stock market performance. As shown in figure 4,
companies generally issued (priced) significantly more IPOs when stock
market valuations were higher.
Figure 4: IPO and Stock Market Performance, 1998-2005:
[See PDF for image]
Source: GAP analysis of SEC data.
Note: The number of priced IPOs only includes those companies that
initially filed for an initial public offering after November 1, 1997.
For more information, see appendix II.
[End of figure]
Companies with smaller reported revenues now make up a smaller share of
the IPO market. The number of IPOs by companies with revenues of $25
million or less decreased substantially, from 70 percent of all IPOs in
1999 to about 48 percent in 2004 and 31 percent during the first two
quarters of 2005. Venture capitalists told us that, on average, a
private company had to demonstrate at least 6 quarters of profitability
before it could go public and hire an auditor to carry it through the
IPO process. According to the venture capitalists, an increasing number
of small and mid-sized private companies have been pursuing mergers and
acquisitions as a means of growing without going through the IPO
process, which now typically costs more than a merger or acquisition.
Potential Spillover Effects of the Sarbanes-Oxley Act on Private
Companies Have Been Minimal:
While the Sarbanes-Oxley Act has increased corporate governance and
accountability awareness throughout business and investor communities,
our research and discussions with representatives of financial
institutions suggest that financiers are not requiring privately held
companies to meet Sarbanes-Oxley Act requirements as a condition to
obtaining access to capital or other financial services. For example,
the representatives said they emphasize utilization of credit scoring
to make decisions and may make lending decisions using "personal
guarantees" in lieu of audited financial statements and reported cash
flow on financial statements for the smallest private companies. For
larger private companies, the representatives stated that they require
audited financial statements and cash flow information, but that their
lending requirements existed well before the Sarbanes-Oxley Act and
have not changed as a result of its passage. Overall, they noted that
they do not believe that the act has affected the way financial
institutions and lenders conduct business with private companies. They
also noted that financial institutions and lenders have always enjoyed
the freedom to obtain virtually any information about a potential
borrower and to inquire about the company's financial reporting process
and corporate governance practices. For example, if it were considered
necessary to help determine a company's ability repay a debt, a lender
could ask the company to provide copies of any corporate governance
guidelines, business ethics policies, and key committee charters that
the company had adopted.
Immediately following the act's passage, several states proposed
legislation to enact corporate governance and financial reporting
reforms for private companies and nonprofit organizations.
Specifically, several state legislatures proposed instituting
requirements similar to those in the Sarbanes-Oxley Act for privately
held state-registered companies. Subsequently, three states--Illinois,
Texas, and California--passed legislation that mandates corporate
governance and accountability requirements that resemble certain
provisions of the Sarbanes-Oxley Act. For example, Illinois passed
legislation in 2004 that requires enhanced disclosures for certain
nonpublic companies and additional licensing requirements for certified
public accountants and, in 2003, Texas passed legislation that imposes
strict ethics and disclosure requirements for outside financial
advisors and service providers, public or private, that provide
financial services to the state government. On September 29, 2004,
California adopted the Nonprofit Integrity Act of 2004, becoming the
first state in the nation to require nonprofit organizations to meet
requirements that resemble some provisions of the Sarbanes-Oxley Act.
For instance, nonprofits with gross revenues of $2 million or more
operating within the state of California currently are required to have
independent auditors and, in the case of charitable corporations, audit
committees. Further, two other states--Nevada and Washington--have
passed legislation that require accounting firms to retain work papers
for 7 years for audits of both public and private companies.
Furthermore, based on our research and discussions with representatives
from the National Association of State Boards of Accountancy, we found
that some state boards made changes to regulations that focus on key
governance and accountability issues similar to those mandated by the
Sarbanes-Oxley Act. For example, New Jersey adopted enhanced peer
review requirements and Tennessee instituted additional work paper
retention requirements for certified public accountants.
Based on our discussions with private equity providers and private
company officials, it appears that some privately held companies
increasingly have incorporated certain elements of the Sarbanes-Oxley
Act into their governance and internal control policies. Specifically,
they have adopted practices such as CEO/CFO financial statement
certification, appointment of independent directors, corporate codes of
ethics, whistleblower procedures, and approval of nonaudit services by
the board. According to these officials, some private companies have
reported receiving pressure from board members, auditors, attorneys,
and investors to implement certain "best practice" policies and
guidelines, modeled after the requirements of the act. They noted that
the act has raised the bar for what constitutes best practices in
corporate governance and for expectations regarding internal control.
Additionally, the officials told us that some private companies may
have chosen to voluntarily adopt certain practices that resemble
Sarbanes-Oxley Act provisions to satisfy external auditors and legal
counsel looking for comparable assurances to reduce risk, increase
confidence, and improve credibility with many stakeholders. Based on
our research, we found that many of the aspects of corporate governance
reform currently being adopted by private companies were those
relatively inexpensive to implement, but information on the specific
costs associated with adopting these provisions was not available.
Smaller Companies Appear to Have Been Able to Obtain Needed Auditor
Services, Although the Overall Audit Market Remained Highly
Concentrated:
Since the enactment of the Sarbanes-Oxley Act, smaller public companies
have been able to obtain needed auditor services; however, auditor
changes suggest smaller companies have moved from using the services of
a large accounting firm to using services of mid-sized and small firms.
Some of this activity has resulted from the resignation of large
accounting firms from providing audit services to small public
companies. Reasons for these changes range from audit cost and service
concerns cited by companies to client profitability and risk concerns
cited by accounting firms, including capacity constraints and
assessments of client risk. In recent years, public accounting firms
have been categorized into three categories--the largest firms, "second
tier" firms (mid-sized), and regional and local firms (small).[Footnote
43] From 2002 to 2004, 1,006 companies reported auditor changes
involving a departure from a large accounting firm. Over two-thirds of
these companies reported switching to a mid-sized or small accounting
firm. Most of the companies that switched to a mid-sized or small
accounting firm were smaller public companies with market
capitalization or revenues of $250 million or less. Overall, mid-sized
and small accounting firms conducted 30 percent of the total number of
public company audits in 2004--up from 22 percent in 2002. Despite
client gains for mid-sized and small firms, the overall market for
audit services remained highly concentrated, with mid-sized and smaller
firms auditing just 2 percent of total U.S. publicly traded company
revenue.[Footnote 44] In the long run, mid-sized and small accounting
firms could increase opportunities to enhance their recognition and
acceptance among capital market participants as a result of the gains
in public companies audited and operating under PCAOB's registration
and inspection process.
Smaller Companies Found It Harder to Keep or Obtain the Services of a
Large Accounting Firm, but Overall Access to Audit Services Appeared
Unaffected:
Our limited review did not find evidence to suggest that the Sarbanes-
Oxley Act has made it more difficult for smaller public companies to
obtain needed audit services, but did suggest that smaller public
companies may have found it harder to retain a large accounting firm as
a result of increased demand for auditing services, largely due to the
implementation of section 404 and other requirements of the act, and
the capacity limitations of the large accounting firms. Of the 2,819
auditor changes from 2003 through 2004 that we identified using Audit
Analytics data, 79 percent were made by companies that represented the
smallest of publicly listed companies (companies with $75 million or
less in market capitalization or revenue).[Footnote 45] Although fewer
mid-sized and small accounting firms conducted public company audits in
2004 because some firms did not register with PCAOB or merged with
other firms, the market appears to have absorbed these changes
effectively, with other firms taking on these clients.
Recent Auditor Changes Resulted in Small Accounting Firms Gaining
Clients:
Our analysis showed that 1,006 of the 2,819 changes, or 36 percent,
involved departures from a large accounting firm. Of the 1,006 auditor
changes, less than one-third (311 or 31 percent) resulted in the public
company moving to another large accounting firm, and slightly under two-
thirds (651 or 65 percent) retained a mid-sized or small accounting
firm (see table 5).[Footnote 46]
Table 5: Companies Changing Accounting Firms, 2003-2004:
Exiting large accounting firm: Went to large accounting firm: 311;
Went to mid-sized accounting firm: 298;
Went to small accounting firm: 353;
No auditor reported as of December 2004: 44;
Total departures: 1,006.
Exiting large accounting firm: Average market capitalization:
Went to large accounting firm: $1,829,869,346;
Went to mid-sized accounting firm: $172,173,323;
Went to small accounting firm: $52,108,359;
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Exiting large accounting firm: Average revenue:
Went to large accounting firm: $1,291,589,676;
Went to mid-sized accounting firm: $138,816,527;
Went to small accounting firm: $50,765,823;
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Exiting mid-sized accounting firm:
Went to large accounting firm: 18;
Went to mid-sized accounting firm: 30;
Went to small accounting firm: 147;
No auditor reported as of December 2004: 21;
Total departures: 216.
Exiting mid-sized accounting firm: Average market capitalization:
Went to large accounting firm: $1,285,735,282;
Went to mid-sized accounting firm: $59,822,406;
Went to small accounting firm: $38,111,445;
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Exiting mid-sized accounting firm: Average revenue:
Went to large accounting firm: $1,044,690,777;
Went to mid-sized accounting firm: $53,694,660;
Went to small accounting firm: $22,789,900;
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Exiting small accounting firm:
Went to large accounting firm: 41;
Went to mid-sized accounting firm: 49;
Went to small accounting firm: 1,446;
No auditor reported as of December 2004: 61;
Total departures: 1,597.
Exiting small accounting firm: Average market capitalization:
Went to large accounting firm: $213,223,882;
Went to mid-sized accounting firm: $78,923,135;
Went to small accounting firm: $18,441,598;
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Exiting small accounting firm: Average revenue;
Went to large accounting firm: $92,138,114;
Went to mid-sized accounting firm: $28,518,987;
Went to small accounting firm: $5,039,327;
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Total gains[A]:
Went to large accounting firm: 59;
Went to mid-sized accounting firm: 347;
Went to small accounting firm: 500;
No auditor reported as of December 2004: 126;
Total departures: N/A.
Total losses[B]:
Went to large accounting firm: (695);
Went to mid- sized accounting firm: (186);
Went to small accounting firm: (151);
No auditor reported as of December 2004: N/A;
Total departures: N/A.
Net gain (loss):
Went to large accounting firm: (636);
Went to mid- sized accounting firm: 161;
Went to small accounting firm: 349;
No auditor reported as of December 2004: 126;
Total departures: N/A.
Source: GAO analysis of Audit Analytics data.
Note: Average market capitalization and revenue figures are based only
on those companies with available relevant financial data.
[A] Total gains represent the sum of companies that went to that
particular category of accounting firm (large, mid-sized, or small)
from another category (cells highlighted in grey for the particular
column). For example, large accounting firms gained 59 companies from
2003 to 2004 (18 from mid-sized firms and 41 from small accounting
firms).
[B] Total losses represent the sum of companies that left that
particular category of accounting firm (large, mid-sized, or small) for
another category of firm plus those for which there was no auditor
reported as of December 2004 (cells highlighted in grey for that
particular row). For example, large accounting firms lost 695 companies
from 2003 to 2004 (298 went to mid-sized firms, 353 went to small-sized
firms, and 44 that had no auditor reported as of December 2004).
[End of table]
Over the same period, mid-sized and small accounting firms lost fewer
public company clients to the large accounting firms; as a result, mid-
sized and small firms experienced a net increase of 510 public company
clients--a net gain of 161 and 349 companies for mid-sized and smaller
firms, respectively. Because we had no data on companies' selection
processes, we could not determine whether mid-sized and small firms
competed for these clients with other large accounting firms or if they
received these clients by default with no competition from the other
large accounting firms. According to Who Audits America, small and mid-
sized accounting firms increased their percentage public company audit
from 22 percent in 2002 to 27 percent in 2003, and by 2004 they audited
30 percent of all U.S. publicly traded companies.[Footnote 47] Small
and mid-sized firms audited over 38 percent of all public clients in
2004 according to Audit Analytics data, which include, in addition to
publicly traded companies, other SEC reporting companies including
foreign registered entities, registered funds and trusts, and
registered public companies that are not publicly traded.
The majority of the clients the mid-sized and small firms gained were
smaller companies with market capitalization or revenues averaging $200
million or less. As shown in table 5 and figure 5, the companies
leaving a large accounting firm and retaining another large firm tended
to be very large--with average market capitalization (or revenue) of
more than $1 billion. However, the average market capitalization (or
revenue) of companies leaving a large accounting firm and retaining a
mid-sized accounting firm was less than $175 million and the
capitalization (or revenue) of companies retaining a small firm was
significantly smaller--less than $53 million. Similarly, companies
leaving smaller and mid-sized firms that retained a large accounting
firm tended to be much larger than those that retained another mid-
sized or small firm.
Figure 5: Average Size of Companies Changing Auditors, 2003-2004, by
Type of Accounting Firm Change:
[See PDF for image]
Source: GAO analysis of Audit Analytics data.
Note: This figure includes only those companies with available relevant
financial data.
[End of figure]
Reasons for Auditor Changes May Have Included Costs Related to the Act
and Risk Assessments:
While the reasons for the movement of smaller public companies to mid-
sized and small accounting firms may be somewhat speculative at this
point, the Sarbanes-Oxley Act may have contributed to this shift. Some
smaller companies may have preferred a large firm because of the
perception that large accounting firms--by virtue of their reputation
or perceived skills--can help attract investors and improve access to
capital.[Footnote 48] Workload demands placed on the large firms by
larger public companies, which represent the overwhelming majority of
their clients, have increased with section 404 and other Sarbanes-Oxley
Act implementing regulations. The resulting increases in workload and
audit fees appear to have constrained smaller companies' access to
large accounting firms--either because smaller companies were unable to
afford a large accounting firm or because large accounting firms
resigned from smaller clients. According to Audit Analytics, the
largest accounting firms resigned from three times as many clients in
2004 as in 2001, and three-quarters of those were companies with
revenues of less than $100 million.
Beyond resignations by large accounting firms in response to increased
demand for audit services, the act may have caused large accounting
firms to reevaluate the risk in their aggregate client portfolios by
increasing the responsibilities and liability of auditors, leading them
to shed smaller public companies. According to the large accounting
firms with whom we spoke, they did not have enough resources to retain
all of their clients after the Sarbanes-Oxley Act and cited risk as a
significant factor in choosing which clients to keep.[Footnote 49]
Moreover, the largest audit firms could be applying stricter
profitability guidelines in selecting their clients, eliminating those
engagements where profit margins are smaller.
While former clients of large accounting firms may represent
opportunities for mid-sized and small accounting firms, they also
represent some risks. For example, we found that a disproportionate
percentage of the companies that left a large accounting firm for a
small firm had accounting or risk issues. Overall, about 69 percent of
the companies that left a large accounting firm switched to a mid-sized
or small accounting firm. However, 92 percent of the companies that
received a going concern qualification went to a mid-sized or small
accounting firm.[Footnote 50] In addition, about 81 percent of the
companies with at least one accounting issue (such as restatement,
reportable condition, scope limitation, management found to be
unreliable, audit opinion concerns, illegal acts, or SEC investigation)
went from a large to a mid-sized or small accounting firm. In contrast,
63 percent of the companies with no going concern qualification or any
additional "risk" issues went to mid-sized and small firms. We also
found that, if a large accounting firm resigned as the auditor of
record, the company was more likely to switch to a mid-sized or small
accounting firm. Roughly 85 percent of the smallest companies that were
dropped by one of the largest accounting firms retained a smaller audit
firm.
Mid-sized and Small Accounting Firms Continued to Operate in a Highly
Concentrated Market:
Although mid-sized and small accounting firms gained clients in 2003
and 2004, they continued to operate in a market dominated by large
accounting firms. The market for audit services in 2004 changed little
from the market we described in our 2003 report.[Footnote 51] For
example, mid-sized and small accounting firms increased their share of
all public company revenues by 1 percentage point in 2002-2004. The
market for audit services remained highly concentrated--a tight
oligopoly, where in 2004 the four largest firms audited 98 percent of
the market and the remaining firms audited 2 percent--and the potential
market power was significant.[Footnote 52]
The market for smaller public company audits was much more competitive
than the overall and large public company market. As shown in figure 6,
while the market for audit services for large company clients remained
dominated by large accounting firms, the market for the smallest public
company clients appeared to indicate healthy competition. Mid-sized and
small firms audited 59 percent of all public company clients with
revenues of $25 million or less, 45 percent of all clients with
revenues greater than $25 million up to $50 million, and 32 percent of
all clients with revenues greater than $50 million up to $100 million.
When these revenue categories were combined, the large accounting firms
combined with the mid-sized firms audited 75 percent of companies with
revenues of $100 million or less, while the small firms audited the
remaining 25 percent.[Footnote 53] As noted in our 2003 report, as
companies expanded operations around the world, the large audit firms
globally expanded through mergers in order to provide service to their
international clients.[Footnote 54]
Figure 6: Percentage of Clients Audited by Revenue Category, 4 Largest
Accounting Firms versus Mid-sized and Small Accounting Firms, 2004:
[See PDF for image]
Source: Who Audits America 2004.
Note: Does not include companies that did not trade on the major
exchanges or over-the-counter markets, foreign companies, or bankrupt
companies. Figures omit certain small accounting firms that held a very
small share of the market.
[End of figure]
More recently, mid-sized and small accounting firms gained more large
clients. In 2004, these accounting firms audited approximately 3
percent of the companies with revenues greater than $500 million, up
from 2 percent in 2002. However, as shown in table 5, the average
revenue of the clients lost to the largest accounting firms was $1.1
billion while the average revenue of the client gained from the largest
accounting firms was $138.8 million. Overall, mid-sized and small
accounting firms conducted 30 percent of the total number of public
company audits in 2004--up from 22 percent in 2002. While these
companies make up just 2 percent of total public company revenue, they
are a large segment of the market of publicly traded clients.[Footnote
55]
Sarbanes-Oxley Act May Impact the Continuing Competitive Challenges
Faced by Mid-Sized and Small Accounting Firms:
According to some experts, competitive challenges related to the
ability of mid-sized and small firms to compete for public companies
such as capacity, expertise, recognition, and litigation risks may have
been strengthened since the passage of the Sarbanes-Oxley Act.[Footnote
56] For example, in a recent American Assembly report, a number of
industry professionals indicated that large accounting firms' facility
with new requirements was seen as increasingly important as audits have
become more complex and time-consuming and the financial consequences
of noncompliance more severe.
Additionally, even though some experts believe that large accounting
firms' regulatory competence has been overstated, a perception may
exist among many large and some small U.S. companies as well as other
market influencers and stakeholders that only the large accounting
firms can provide the required auditing services necessary to meet the
requirements of the act. For example, the venture capital industry
representatives that we spoke with stated that this perception has been
especially prevalent for companies issuing IPOs. As shown in figure 7,
companies large and small tended to use large accounting firms for IPOs.
Figure 7: Total Number of IPOs, by Size of Accounting Firm, 1999-2004:
[See PDF for image]
Source: GAO analysis of SEC data.
[End of figure]
Over the long run, the Sarbanes-Oxley Act could ease some of these
challenges. For example, mid-sized and small accounting firms have
continued to confront the perceptions of capital market participants
that only large firms have the skills and resources necessary to
perform public company audits. These perceptions have constrained firms
from obtaining or retaining many clients that the firms believed were
within their capacity to audit. However, the increase in public company
audits performed by mid-sized and small accounting firms has given
these firms additional opportunities to enhance their recognition and
acceptance among more public companies and capital market participants.
Also, as smaller public companies begin complying with section 404 in
2007, small accounting firms will gain additional experience with the
implementation of the act. Taking on additional clients will provide an
important growth opportunity. Effectively matching company size and
needs with accounting firm size and capabilities could allow smaller
public companies to find the best combination of quality, service
value, and reach.
In addition, the PCAOB registration and inspection process and the
establishment of attestation, quality control, and ethics standards to
be used by registered public accounting firms in the preparation and
issuance of audit reports could provide increased assurance of the
quality of small accounting firm audits. Similarly, as more information
will become available through PCAOB's ongoing inspection program, small
accounting firms could establish a "track record," allowing for
additional opportunities for recognition and acceptance among analysts,
investment bankers, investors, and public companies.
Conclusions:
The Sarbanes-Oxley Act was a watershed event--strengthening disclosure
and internal control requirements for financial reporting, establishing
new auditor independence standards, and introducing new corporate
governance requirements. Regulators, public companies, audit firms, and
investors generally have acknowledged that many of the act's provisions
have had a positive and significant impact on investor protection and
confidence. Yet, for smaller public companies and companies of all
sizes that have complied with the various provisions of the Sarbanes-
Oxley Act, compliance costs have been higher than anticipated--with the
higher cost being associated with the internal control over financial
reporting requirements of section 404.
There is widespread agreement that several factors contributed to the
costs of implementing section 404 for both larger and smaller public
companies. Few public companies or their audit firms had prior direct
experience with evaluating and reporting on the effectiveness of
internal control over financial reporting or with implementing the COSO
internal control framework, particularly in a small business
environment. This was despite previous requirements, dating back to
1977, that public companies implement a system of internal accounting
controls. The first year costs were exacerbated because many companies
were documenting their internal control over financial reporting for
the first time and remediating poor or nonexistent internal controls as
part of their first-year implementation efforts to comply with section
404, both of which could be viewed as a positive impact of the act. In
addition, the nature, timing, and extent of available guidance on
establishing and assessing internal control over financial reporting
made it more difficult for most public companies and audit firms to
efficiently and effectively implement the requirements of section 404.
As a result, management's implementation and assessment efforts were
largely driven by PCAOB's Auditing Standard No. 2, as guidance at a
similar level of detail was not available for management's
implementation and assessment process. These factors, in conjunction
with the changed environment and expectations resulting from the act,
contributed to a considerable amount of "learning curve" activities and
inefficiencies during the initial year of implementation. Auditing
firms and a number of public companies have stated that they expect
subsequent years' compliance costs for section 404 to decrease. This is
not unexpected given the significance and nature of the changes and a
preexisting environment that did not place enough emphasis on effective
internal control over financial reporting.
Consistent with the findings of the Small Business Administration on
the impact of regulations generally on smaller public companies, it is
reasonable to conclude that smaller public companies face
disproportionately greater costs, as a percentage of revenues, than
larger companies in meeting the requirements of the act. While facing
the same basic requirements, smaller public companies generally have
more limited resources, fewer shareholders, and generally less complex
structures and operations. Again, this is to be expected given the
economies of scale and differing levels of corporate infrastructure and
resources. However, some of the unique characteristics of smaller
companies can create opportunities to efficiently achieve effective
internal control over financial reporting. Those characteristics
include more centralized management oversight of the business, more
involvement of top management in the business operations, simpler
operations, and limited geographic locations.
The ultimate impact of the Sarbanes-Oxley Act on the majority of
smaller public companies remains unclear because the time frame to
comply with section 404 of the act was extended until fiscal years
ending after July 2007 for the approximately 5,971 public companies
with less than $75 million in public float. Recognizing the challenges
that smaller public companies have faced in meeting the requirements of
the act, particularly section 404, SEC formed an advisory committee on
smaller public companies to analyze the impact of the act and other
securities laws on smaller public companies. The advisory committee has
issued an exposure draft of its final reporting stating that certain
smaller public companies need relief from section 404, "unless and
until" a framework for assessing internal control over financial
reporting is developed that recognizes the characteristics and needs of
smaller public companies. The exposure draft contains specific
recommendations that would essentially result in a "tiered approach"
for compliance with section 404 requirements, where larger public
companies would continue to be required to fully comply with all
requirements of section 404, while smaller public companies consisting
of "microcap" and "smallcap" companies would be granted differing
levels of exemptions until an adequate framework was in place.
We have two specific concerns regarding the advisory committee's
recommendations. First, the recommendations propose relief "unless and
until a framework for assessing internal control over financial
reporting" for smaller companies is developed that "recognizes the
characteristics and needs of those companies." While the
recommendations hinge on the need for a framework that recognizes
smaller public company characteristics and needs of smaller public
companies, they do not address what needs to be done to establish such
a framework or how such a framework should take into consideration the
characteristics and needs of smaller public companies. Many, if not
most, of the significant problems and challenges encountered by large
and small companies in implementing section 404 related to problems
with implementation, rather than the internal control framework itself.
In addition to having a useful internal control framework, appropriate
implementation of a framework by public companies must be based on
risk, facts and circumstances, and professional judgment. We believe
that sufficient guidance covering both the internal control framework
and the means by which it can be effectively implemented is essential
to enable large and small public companies to implement a framework
which would enable effective and efficient assessment and reporting on
the effectiveness of internal control over financial reporting.
Our second concern relates to the ambiguity surrounding the conditional
nature of the "unless and until" provisions of the recommendations and
its potential impact on a large number of companies that would likely
qualify for the proposed exemptions. If resolution of small public
company concerns about a framework and its implementation results in an
extended period of exemption, then large numbers of public companies
would potentially be exempted for additional periods from complying
with this important investor protection component of the act. The
categories of microcap and smallcap companies, as defined by the
advisory committee recommendations, cover 79 percent of U.S. public
companies and 6 percent of the U.S. equity market capitalization when
combined. Although the categories of microcap and smallcap have been
further refined by the advisory committee through the addition of a
revenue size filter for purposes of its primary recommendations on
section 404, it appears that a large number of companies, up to 70
percent of all U.S. public companies, would be potentially exempted.
Specifically, the committee estimates that, after applying the revenue
criteria, 4,641 "micro cap" public companies (approximately 49 percent
of 9,428 public companies identified in data developed for the advisory
committee by SEC's Office on Economic Analysis) may potentially qualify
for the proposed full exemption from section 404 and another 1,957
"smallcap" public companies (approximately 21 percent of the identified
public companies) may potentially qualify for the proposed exemption
from the external audit requirement of section 404(b). These estimates
do not include those public companies trading on the Pink Sheets that
would be covered by the Advisory Committee's preliminary
recommendations. In addition, it is likely that a number of public
companies qualifying for exemptive relief under the committee's
recommendations are likely to have already complied with both sections
of 404(a) and (b) of the act under the current category of accelerated
filers.
Also, regarding the committee's third primary internal control
recommendation calling for a review of the design and implementation of
internal control if SEC concludes, as a matter of public policy, that
the external auditor's involvement is required, it is not clear from
the committee's report the extent to which, particularly in the present
environment, such a review would result in lower costs than those being
associated with the implementation of PCAOB's Auditing Standard No. 2.
Any lower costs that might result must be considered in light of the
reduced independent assurances on the effectiveness of internal control
over financial reporting that would result and the potential for
confusion on the part of users of the public company's financial
statements and audit reports.
Until sufficient guidance is available for smaller public companies,
some interim regulatory relief on a limited scale may be appropriate.
However, given the number of public companies that would potentially
qualify for relief under the recommendations being considered, we
believe that a significant reduction in scope of the proposed relief
needs to occur to preserve the overriding investor protection purpose
of the Sarbanes-Oxley Act. The purpose of internal control over
financial reporting is to provide reasonable assurance over the
integrity and reliability of the financial statements and related
disclosures. Public and investor confidence in the fairness of
financial reporting is critical to the effective functioning of our
capital markets. Market reactions to financial statement misstatements
illustrate the importance of accurate financial reporting, regardless
of a company's size. SEC staff and others have pointed to the increased
level of restatements as an indicator that the Sarbanes-Oxley Act--
section 404 in particular--has prompted companies to identify and
correct weaknesses that led to financial reporting misstatements in
prior fiscal years. Indicators also show that in some respects, smaller
companies have a higher risk profile for investors. For instance,
smaller public companies have higher rates of restatements generally
and showed a disproportionately higher rate of reported material
weakness in internal control over financial reporting during the
initial year of section 404 implementation. Over time, having the
effective internal control over financial reporting envisioned by the
act can reduce some aspects of the higher risk profile of smaller
public companies.
When SEC receives and considers the final recommendations of SEC's
small business advisory committee, it is essential that SEC consider
key principles, under the umbrella principle of investor protection,
when deciding whether or to what extent to provide smaller public
companies with alternatives to full implementation of the section 404
requirements. These principles include (1) assuring that smaller public
companies have sufficient useful guidance to implement, assess, and
report on internal controls over financial reporting to meet the
requirements of section 404, (2) if additional relief is considered
appropriate, conducting further analysis of small public company
characteristics to significantly reduce the scope of companies that
would qualify for any type of additional relief while working to ensure
that the Sarbanes-Oxley Act's goal of investor protection is being met,
and (3) acting expeditiously such that smaller public companies are
encouraged to continue improving their internal control over financial
reporting.
First, it is critical that SEC carefully assess the available guidance,
including that being developed by COSO, to determine whether it is
sufficient or whether additional action needs to be taken, such as
issuing supplemental or clarifying guidance to smaller public companies
to help them meet the requirements of section 404. Our analysis of
available research and discussions with smaller public companies and
audit firms indicate that public companies and external auditors have
had limited practical experience with implementing internal control
frameworks in a smaller company environment and that additional
guidance is needed. Moreover, it is critical that SEC coordinate its
actions with PCAOB, which is responsible for establishing standards for
the external auditor's internal control attestations, to ensure that
external auditors are using standards and guidance on section 404
compliance that are consistent with guidance for public companies and
that they are doing so in an effective and efficient manner. As SEC
considers the need for additional implementation guidance, it will be
important that the guidance and related PCAOB audit standards be
consistent and compatible. Also, it will be important for the PCAOB to
continue to identify ways in which auditors can achieve more
economical, effective, and efficient implementation of audit-related
standards and guidance.
Second, as SEC considers whether and to what extent it might be
appropriate to provide additional interim relief to some categories of
smaller public companies, it will be important to balance the needs of
the investing public with the concerns expressed by small businesses.
In doing so, it is important to determine whether there are unique
characteristics, in addition to size, that could influence the extent
that some regulatory accommodation might be appropriate in order to
arrive at a targeted and limited category of companies being provided
with potential exemptions. For example, if these companies were closely
held or have a higher rate of insider investors, regulatory relief may
raise less of an investor protection concern. These investors may be
more knowledgeable about company operations and receive fewer benefits
from section 404's enhanced disclosures. For companies that are widely
traded, regulatory relief would raise more concerns about investor
protection and relief would appear less appropriate. Furthermore,
although the "insider" shareholder owners may not have the same need
for investor protection as investors in broadly held companies,
minority shareholders who are not insiders may need such protection.
For other purposes, certain provisions of SEC's securities regulations
and the Employee Retirement Income Security Act of 1974 regulations
condition different types of relief, in part, on the nature and/or the
financial sophistication of the investor, and SEC may wish to consider
whether such approaches would help serve to balance the concerns of
small businesses against the needs of investors. The criteria and
characteristics used should be linked to the investor protection goals
of the Sarbanes-Oxley Act and be geared toward limiting the numbers of
companies that would be eligible based on those investor protection
goals. In addition, the advisory committee's preliminary
recommendations to exempt "smaller public companies" from the external
audit requirements of section 404 would include a number of companies
that have already complied with section 404, and SEC needs to carefully
consider whether it is appropriate to provide regulatory relief on this
basis.
Finally, we believe that SEC has an obligation to resolve section 404
implementation requirements for smaller public companies in a way that
creates incentives for smaller public companies to take actions to
improve their internal control over financial reporting. Rather than
delaying implementation, which would likely result in smaller public
companies anticipating future extensions or relief, SEC's resolution of
these issues would provide needed clarity and certainty over the scope
and timing of smaller companies' compliance with section 404 and
provide incentives to smaller public companies to begin the process of
implementing section 404.
Recommendations:
In light of concerns raised by the SEC Advisory Committee on Smaller
Public Companies and others regarding the ability of smaller public
companies to effectively implement section 404, we recommend that the
Chairman of SEC:
* assess the guidance available, with an emphasis on implementation
guidance for management's assessment of internal control over financial
reporting, to determine whether the current guidance is sufficient and
whether additional action is needed, such as issuing supplemental or
clarifying guidance to help smaller public companies meet the
requirements of section 404, and:
* coordinate with PCAOB to (1) help ensure that section 404-related
audit standards and guidance are consistent with any additional
guidance applicable to management's assessment of internal control and
(2) identify additional ways in which auditors' can achieve more
economical, effective, and efficient implementation of the standards
and guidance related to internal control over financial reporting.
If, in evaluating the recommendations of its advisory committee, SEC
determines that additional relief is appropriate beyond the current
July 2007 compliance date for non-accelerated filers, we recommend that
the Chairman of SEC analyze and consider, in addition to size, the
unique characteristics of smaller public companies and the knowledge
base, educational background, and sophistication of their investors in
determining categories of companies for which additional relief may be
appropriate to ensure that the objectives of investor protection are
adequately met and any relief is targeted and limited.
Agency Comments and Our Evaluation:
We provided a draft of this report to the Chairman, SEC, and the Acting
Chairman, PCAOB, for their review and comment. We received written
comments from SEC and PCAOB that are summarized below and reprinted in
appendixes III and IV. SEC agreed that the Sarbanes-Oxley Act has had a
positive impact on investor protection and confidence, and that smaller
public companies face particular challenges in implementing certain
provisions of the act, notably section 404. SEC stated that our
recommendations should provide a useful framework for consideration of
its advisory committee's final recommendations. PCAOB stated that it is
committed to working with SEC on our recommendations and that it is
essential to maintain the overriding purpose of the Sarbanes-Oxley Act
of investor protection while seeking to make its implementation as
efficient and effective as possible. Both SEC and PCAOB provided
technical comments that were incorporated into the report as
appropriate.
As we agreed with your office, unless you publicly announce the
contents of this report earlier, we plan no further distribution of it
until 30 days from the date of this letter. At that time, we will send
copies of this report to interested congressional committees and
subcommittees; the Chairman, SEC; the Acting Chairman, PCAOB; and the
Administrator, SBA. We will make copies available to others upon
request. In addition, the report will be available at no charge on the
GAO Web site at [Hyperlink, http://www.gao.gov].
If you have any questions concerning this report, please contact
William B. Shear at (202) 512-8678 or shearw@gao.gov, or Jeanette M.
Franzel at (202) 512-9471 or franzelj@gao.gov. Contact points for our
Office of Congressional Relations and Public Affairs may be found on
the last page of this report. See appendix V for a list of other staff
who contributed to the report.
Signed By:
William B. Shear:
Director:
Financial Markets and Community Investment:
Signed By:
Jeanette M. Franzel:
Director:
Financial Management and Assurance:
[End of section]
Appendix I: Objectives, Scope, and Methodology:
Our reporting objectives were to (1) analyze the impact of the Sarbanes-
Oxley Act on smaller public companies in terms of costs of compliance
and access to capital; (2) describe the Securities and Exchange
Commission's (SEC) and Public Company Accounting Oversight Board's
(PCAOB) efforts related to the implementation of the act and their
responses to concerns raised by smaller public companies and the
accounting firms that audit them; (3) analyze the impact of the act on
smaller privately held companies, including costs, ability to access
public markets, and the extent to which states and capital markets have
imposed similar requirements on smaller privately held companies; and
(4) analyze smaller companies' access to auditing services and the
extent to which the share of public companies audited by small
accounting firms has changed since the enactment of the Sarbanes-Oxley
Act.
In arriving at our report objectives, we incorporated nine specific
questions contained in your request letter. See table 6 for a cross-
sectional comparison of the nine specific questions contained in your
letter, the four report objectives, and our findings.
Table 6: Cross-sectional Comparison of Request Letter Questions, Our
Report Objectives, and Selected Findings:
Request letter question: 1. In investigating the effects of the act on
small public companies, please assess: (a) How requirements in the act
and the implementing regulations, as adopted for publicly traded
companies, affect small business equity capital formation in both the
stock and bond markets;
Report objective: 1. Analyze the impact of the Sarbanes- Oxley Act on
smaller public companies in terms of costs of compliance and access to
capital; 2. Describe SEC's and PCAOB's efforts related to the
implementation of the act and their responses to concerns raised by
smaller public companies and the accounting firms that audit them;
Findings: Because a large number of smaller public companies have not
yet implemented all the provisions of the act and the recent and
ongoing actions by SEC and PCAOB to address small business
implementation issues, it is too soon to determine the act's impact on
smaller public companies' access to capital. Along with other market
factors, the act may have encouraged some smaller companies to go
private. Going private reduces financing options available to those
companies, which must rely on potentially more expensive alternatives
to public equity capital.
Request letter question: 1. In investigating the effects of the act on
small public companies, please assess: (b) What the detailed costs are
that small public companies bear in complying with the act on both a
federal and state level;
Report objective: 1. Analyze the impact of the Sarbanes- Oxley Act on
smaller public companies in terms of costs of compliance and access to
capital; 2. Describe SEC's and PCAOB's efforts related to the
implementation of the act and their responses to concerns raised by
smaller public companies and the accounting firms that audit them;
Findings: Our analysis of Audit Analytics data showed that the smallest
companies that had fully implemented the act's provisions, particularly
section 404, spent a median of 1.1 percent of their revenues on audit
fees whereas companies that had not implemented section 404 spent 0.8
percent of their revenue on audit fees. Responses to our survey
provided the following detailed costs for first year of implementation:
fees to consultants for services related to section 404 ranged from
$3,000 to over $1.4 million; To help smaller companies and their
auditors develop approaches to implement the act's requirements, SEC
established an Advisory Committee on Smaller Public Companies. SEC
recently extended the section 404 compliance deadline for non-
accelerated filers based on the committee's recommendation, which SEC
had previously done on two separate occasions. Currently, a non-
accelerated filer must begin to comply with section 404 for its first
fiscal year ending on or after July 15, 2007. The advisory committee
has several other recommendations under consideration, including
providing conditional total section 404 exemptive relief for the very
smallest public companies or staggering the 404 requirements based on
company size or other characteristics. Both SEC and PCAOB issued
additional guidance to help both public companies and accounting firms
in implementing section 404, expecting that the additional guidance
would help lower public companies' costs of compliance. As the act was
a federal law, there were no costs for public companies on a state
level.
Request letter question: 1. In investigating the effects of the act on
small public companies, please assess: (c) The challenges small
companies face in obtaining access to auditing services in order to
comply with the act;
Report objective: 4. Analyze smaller companies' access to auditing
services and the extent to which the share of public companies audited
by smaller accounting firms has changed since the enactment of the
Sarbanes-Oxley Act;
Findings: Smaller public companies appear to have been able to obtain
needed auditing services, although not necessarily from their auditor
of choice. However, many smaller companies moved from large accounting
firms to smaller accounting firms and paid higher fees for audit
services. In particular, smaller firms appear to be taking on a higher
percentage of public companies with accounting issues. Furthermore, the
act's auditor independence requirements caused smaller companies to
seek advice from other sources, which increased costs.
Request letter question: In investigating the effects of the act on
small private companies, please assess the extent to which: (a)
Financial institutions require private small companies to comply with
the act in order to receive capital financing and financial services;
Report objective: 3. Analyze the impact of the act on smaller privately
held companies, including costs, ability to access public markets, and
the extent to which states and capital markets have imposed similar
requirements on smaller privately held companies;
Findings: The act appears to have increased corporate governance and
accountability awareness throughout the business and investor
communities. However, it does not appear that the capital markets,
notably banks and venture capitalists, are denying private companies
access to capital or other financial services because of failure to
meet Sarbanes-Oxley Act requirements.
Request letter question: In investigating the effects of the act on
small private companies, please assess the extent to which: (b) States
have or are considering enacting provisions of the act for small
privately held companies;
Report objective: 3. Analyze the impact of the act on smaller privately
held companies, including costs, ability to access public markets, and
the extent to which states and capital markets have imposed similar
requirements on smaller privately held companies;
Findings: Three states--Illinois, Texas, and California--have passed
legislation with corporate governance and accountability requirements
that resemble certain provisions of the Sarbanes-Oxley Act. Two other
states enacted laws covering auditor work paper retention requirements
and some state boards of accountancy have proposed rule changes
affecting, among other things, enhanced peer review requirements for
CPAs. We are unaware of any states that enacted a version of section
404 on internal control over financial reporting for privately held
companies.
Request letter question: In investigating the effects of the act on
small private companies, please assess the extent to which: (c) Small
privately held companies are being denied access to capital or other
financial services, because they do not meet the act's requirements;
Report objective: Analyze the impact of the act on smaller privately
held companies, including costs, ability to access public markets, and
the extent to which states and capital markets have imposed similar
requirements on smaller privately held companies;
Findings: Our research and discussions with representatives of
financial institutions suggest that smaller private companies have not
been denied access to capital or other financial services as a result
of the act.
Request letter question: In investigating the effects of the act on
small private companies, please assess the extent to which: (d) Small
private companies are incurring additional costs to comply with any
part of the act in order to receive financial services. Please include
a detailed list of these compliance and accounting costs;
Report objective: Analyze the impact of the act on smaller privately
held companies, including costs, ability to access public markets, and
the extent to which states and capital markets have imposed similar
requirements on smaller privately held companies;
Findings: We found no evidence that smaller private companies were
incurring additional costs, except for smaller private companies
intending to go public or "voluntarily" complying with provisions of
the act. However, information on factors that may have encouraged
smaller private companies to voluntarily comply with provisions of the
act or the specific costs for those smaller private companies was not
available.
Request letter question: In investigating the effects of the act on
small private companies, please assess the extent to which: (e)
Compliance with the act has created significant barriers to entry for
small privately held companies to reach the public markets;
Report objective: Analyze the impact of the act on smaller privately
held companies, including costs, ability to access public markets, and
the extent to which states and capital markets have imposed similar
requirements on smaller privately held companies;
Findings: We found that smaller private companies wanting to go public
were spending additional time, effort, and money to convince investors
that they could meet the act's requirements.
Request letter question: In investigating the effects of the act on
small private companies, please assess the extent to which: 3. With
respect to small accounting and auditing firms, we request that GAO
review whether the market has improved for these firms since GAO's
findings outlined in "Mandated Study on Consolidation and Competition,"
GAO-03-864, as required by Section 701 of the act;
Report objective: 4. Analyze smaller companies' access to auditing
services and the extent to which the share of public companies audited
by small accounting firms has changed since the enactment of the
Sarbanes-Oxley Act;
Findings: While the number of public companies audited by smaller
accounting firms has increased since the passage of the act, large
accounting firms continue to dominate the market in terms of the
proportion of market capitalization audited. In 2004, large accounting
firms audited 98 percent of total revenues.
Source: GAO.
[End of table]
To address our four objectives, we reviewed and analyzed information
from a variety of sources, including the legislative history of the
act, relevant regulatory pronouncements and related public comment
letters, and available research studies and papers. We also interviewed
officials at SEC, PCAOB, and the Small Business Administration (SBA).
In addition, we held discussions with the chief financial officers
(CFO) of smaller public and private companies, representatives of
relevant trade associations, accounting firms, market participants, and
experts.
Impact of Sarbanes-Oxley Act on Smaller Public Companies:
We could not analyze the impact of the act on many smaller public
companies because SEC has extended the date by which public registrants
with less than $75 million public float (known as "non-accelerated"
filers) must comply with Section 404 of the act to their first fiscal
year ending on or after July 15, 2007.[Footnote 57] According to SEC,
non-accelerated filers represent about 60 percent of all registered
public companies and about 1 percent of total available market
capitalization. As a result, we analyzed public data and other
information related to the experiences of public companies that have
fully implemented the act's provisions. We also compared the
information from companies that had implemented the act with
information from smaller companies that took the SEC extension to gain
some insight into the potential impact of these provisions on the non-
accelerated filers.
Audit Fees and Auditor Changes:
Audit Analytics, an on-line market intelligence service maintained by
Ives Group, Incorporated provides, among other things, a database of
audit fees by company back to 2000 along with demographic and financial
information. Using this database, we analyzed changes in the audit fees
companies have paid by various size categories. Audit Analytics also
provides a comprehensive listing of all reported auditor changes, which
includes data on the date of change, departing auditor, engaged
auditor, whether the change was a dismissal or resignation, whether
there was a going concern flag or other accounting issues, and whether
a fee dispute or fee reduction occurred. Using this database, we
identified 2,819 auditor changes from 2003 through 2004.
We performed several checks to verify the reliability of the Audit
Analytics data. For example, we crosschecked random samples from each
of the Audit Analytics databases with SEC proxy and annual filings and
other publicly available information. While we determined that these
data were sufficiently reliable for the purpose of presenting trends in
audit fees and auditor changes, the descriptive statistics on audit
fees contained in the report should be viewed in light of a number of
data challenges. First, the Audit Analytics audit fee database does not
include fees for companies who did not disclose audit fees paid to
their independent auditor in an SEC filing. Second, some companies
included in the database--especially small companies--did not report
complete financial data. We handled missing data by dropping companies
with incomplete financial data from any analysis involving the use of
such data. Therefore, it should be noted that we are not dealing with
the entire population included in the Audit Analytics database but
rather a large subset.[Footnote 58] Because of these issues, the
results should be viewed as estimates of audit fees based on a large
sample rather than precise estimates of all fees charged over the
entire population. It should also be noted that SEC found issues with
the data on market capitalization (used largely in our discussion of
auditor changes and companies going private) which are being addressed
by Audit Analytics.
Deregistrations:
To determine the number of companies that have deregistered before and
after the implementation of the Sarbanes-Oxley Act, we obtained and
analyzed data filed with SEC. From 1998 through April 24, 2005, over
15,000 companies filed SEC Form 15 (Certification and Notice of
Termination of Registration). First, we analyzed all the companies to
determine whether the company was deregistering its common stock to
continue to operate as a privately held company. During this step, we
eliminated companies that filed the Form 15 as a result of
acquisitions, mergers that were not "going private" transactions
liquidations, reorganizations, or bankruptcy filings or re-
emergences.[Footnote 59] We also eliminated duplicate filings and
filings by foreign registrants. For the remaining companies, we
reviewed their SEC filings and press releases and other press articles
to determine their reasons for deregistration. We grouped the reasons
into seven categories for our final analysis.
We took a number of steps to ensure the reliability of the database,
including testing of random samples of the coded data, 100 percent
verification of certain areas of the database, and various other
quality control measures. For the initial coding, we found the error
rates to be 0.6 percent or lower for all years except 2001 and 1998.
Because the initial error rate exceeded 1.5 percent for these 2 years,
we performed 100 percent verification and corrected any errors.
However, because the error rate for the remaining years was positive,
it is unlikely that we captured every company going private in 1998-
2005.[Footnote 60] We also excluded all companies with one or zero
holders of record unless that company also filed a Schedule 13E-3
(Going private transaction by certain issuers) with SEC.[Footnote 61]
In doing so, we may have missed some companies going private. However,
an outside study found only 12 companies that filed a Form 15 but did
not file a Schedule 13E-3 from 1998 through 2003.[Footnote 62]
Additionally, our analysis of the companies that listed more than one
holder of record on the Form 15 should have picked up some of these
types of firms. As a result, this limitation is minor in the context of
this report and does not alter the trends also found by a number of
research reports.
Survey of Public Company Views on Implementing the Sarbanes-Oxley Act:
To obtain information about public companies' views on implementing
Sarbanes-Oxley Act requirements, we conducted a Web-based survey of
companies with market capitalization of $700 million or less and annual
revenues of $100 million or less that reported to SEC that they had
complied with the act's requirements related to internal control over
financial reporting. To develop and test our questionnaire, we
interviewed officials at 14 smaller public companies. We then pretested
drafts of our questionnaire with 10 companies and then discussed their
answers and experiences with our social science survey specialists. The
pretests were conducted in person and by telephone with company
executives in Virginia, Maryland, New York, Connecticut, California,
Georgia, and Illinois.
To identify the smaller public companies eligible to participate in the
survey, we analyzed company SEC filings from the Audit Analytics
database. Our survey universe consisted of 591 companies that met the
following five criteria: (1) $700 million or less in market
capitalization as of the end of the company's 2004 fiscal year; (2)
$100 million or less in revenues as of the end of the company's 2004
fiscal year end; (3) completed section 404 requirements by filing
related reports of management and the company's external auditor as of
August 11, 2005; (4) were not foreign companies; and (5) were not
investment vehicles such as mutual funds and shell companies. Of the
591, we could not reach 168 within the survey period because we were
not able to obtain e-mail addresses for the CFO or other executive. We
began our Web-based survey on September 21, 2005, and included all
useable responses as of November 1, 2005. We sent follow-up e-mails on
three occasions to remind respondents to complete the survey. One
hundred fifty-eight companies completed the survey for an overall
response rate of 27 percent. Only one respondent indicated that his
company was a non-accelerated filer.
The low response rate raised concerns that the views of 158 respondents
might not be representative of all smaller public company experiences
with the Sarbanes-Oxley Act. While we could not test this possibility
for our primary questions (whether the act places a disproportionate
burden on smaller companies or compromises their ability to raise
capital), we did conduct an analysis to determine whether our sample
differed from the population of 591 in company assets, revenue, and
market capitalization and type (based on the North American Industrial
Classification System code). We found no evidence of substantial non-
response bias based on these characteristics. However, because of the
low response rate we still could not assume that the views of the 158
respondents were representative of the views of other smaller public
companies on implementing Sarbanes-Oxley Act requirements. Therefore,
we do not consider these data to be a probability sample of all smaller
public companies.
In addition to potential non-response bias, the practical difficulties
of conducting any survey may introduce other non-sampling errors. For
example, difference in how a particular question is interpreted or the
sources of information available to respondents may introduce errors.
We took steps to minimize such non-sampling errors in both the data
collection and data analysis stages. We examined the survey results and
performed computer analyses to identify inconsistencies and other
indications of error. A second independent analyst checked all the
computer analyses. Further, we used GAO's Questionnaire Programming
Language (QPL) system to create and process the Web-based survey. This
system facilitates the creation of the instrument, controls access, and
ensures data quality. It also automatically generates code for reading
the data into SAS (statistical analysis software). This tool is
commonly used for GAO studies.
We used QPL to automate some processes, but also used analysts to code
the open-ended questions and then had a second, independent analyst
review them. (The survey contained both open-and close-ended
questions.) We entered a set of possible phrases, called tags, which we
identified for each question into QPL. When the analysts reviewed the
text responses, they assign the tags that best reflect the meaning of
what the respondent has written. The system then compares the tags
assigned by the independent reviewers. Multiple tags may be assigned to
a single response; thus, it is possible for reviewers to agree on some
tags and not on others. Although it is possible to have reviewers
resolve their differences until agreement is found, for this survey we
only considered tags that were selected by all reviewers on the first
pass. Tags assigned by only one reviewer were dropped. This process
allowed a quantitative analysis of open comments made by respondents.
Finally, we verified all data processing on the survey in house and
found it to be accurate.
SEC and PCAOB Efforts to Address Smaller Company Concerns:
To address our second objective describing SEC's and PCAOB's efforts
related to the implementation of the act and their responses to
concerns raised by smaller public companies and the accounting firms
that audit them, we interviewed SEC and PCAOB staff on the rulemaking
and standard setting processes. We also interviewed public company
executives, representatives of relevant trade associations, and market
participants for their reaction to the agencies' rules, guidance, and
other public announcements.
During the course of our review, both SEC and PCAOB held forums and
other open meetings to allow a public discourse on the act's impact on
public companies, accounting firms, investors, and other market
participants. We attended most of these forums and open meetings and
reviewed submitted comments. Specifically, from November 2004 to
February 2006, we attended either in person or through a Web cast the
following: SEC's Advisory Committee on Smaller Public Companies open
meetings; SEC's Roundtable on Implementation of Internal Control
Reporting Provisions; SEC's Government-Business Forum on Small Business
Capital Formation; PCAOB's Standing Advisory Group Meetings; and
PCAOB's forums on auditing in the small business environment. We
reviewed the guidance that SEC and PCAOB separately issued on May 16,
2005, as a result of comments received at SEC's section 404 roundtable.
Impact of Act on Smaller Privately Held Companies:
To determine the act's impact on smaller privately held companies, we
analyzed available research and studies. We also interviewed officials
of the National Association of State Boards of Accountancy in states
that required or were considering requiring privately held companies to
comply with corporate accountability, governance, and financial
reporting measures comparable to key provisions in the Sarbanes-Oxley
Act.
Further, we analyzed data and interviewed officials on whether lenders,
financial institutions, private equity providers, or others were
imposing the act's requirements on privately held companies as a
condition of obtaining capital or financial services. Finally, we
interviewed officials and analyzed available data on whether, as a
result of the act, privately held companies were voluntarily adopting
key provisions of the act as best practices or whether they had faced
challenges in trying to reach the public markets.
To assess the impact of the act on privately held companies trying to
reach the public markets, we obtained a sample from SEC's Electronic
Data Gathering, Analysis, and Retrieval (EDGAR) system, a database that
includes companies' initial public offering (IPO) and secondary public
offering (SPO) filings. Our sample contained registration statements,
pricings and applications for withdrawal filed with SEC from 1998
through July 2005. We performed various analyses of IPO and SPO
activity prior to and after enactment of Sarbanes-Oxley, including
analyses of the sizes of companies coming and returning to the market,
types and amounts of IPO expenses, and the reasons cited by companies
for withdrawing their IPO filing. We analyzed IPO expenses as a
percentage of revenue and offering amount for companies in various size
categories to determine whether the differences between the groups
changed over time and whether the differences were statistically
significant when controlling for other determining factors.
SEC's EDGAR database is considered the definitive source for
information on IPOs since all companies issuing securities that list on
the major exchanges and the OTCBB, as well as those that meet certain
criteria listing on the Pink Sheets, must register the securities with
SEC. Nevertheless, we crosschecked the descriptive statistics retrieved
from EDGAR with NASDAQ's IPO data. However, there was no financial data
available on several companies, while others failed to provide
information to complete all of the fields. In cases where revenue was
left blank, individual filings were reviewed and actual revenue, 9-
month revenue or pro-forma data was used to determine the size of the
company. In cases were this data was not available we dropped these
companies from any analysis involving the use of such data.
Additionally, there can be significant lag between the dates a company
initially files for an IPO with SEC and when the stock of the company
is finally priced (begins trading). Because we had data on IPO filings
during the last 2 months of 1997, we were able to include those
companies that priced IPOs over the 1998-2005 period that initially
filed for an IPO during that time. However, any IPOs that were priced
during this time but had an initial filing that occurred prior to
November 1, 1997, are not included. For this reason the number of
priced IPOs for 1998 (and to an even lesser extent 1999) may understate
somewhat the actual numbers of companies coming to the public market
during that year. This limitation is insignificant in the context of
this report.
Company Access to Auditing Services and Changes in Share of Public
Companies That Small Firms Audit:
To assess changes in the domestic public company audit market, we used
public data--for 2002 and 2004--on public companies and their external
accounting firm to determine how the number and mix of domestic public
company audit clients had changed for firms other than the large
accounting firms. To be consistent with our 2003 study of the structure
of the audit market, we used the Who Audits America database, a
directory of public companies with detailed information for each
company, including the auditor of record. Only domestic public
companies traded on the major exchanges or over-the-counter with
available financial data were included in our analysis of audit market
concentration and the results do not include a number of clients of the
smallest audit firms. Users of our 2003 study will also note that we
used the term "sales" when referring to auditor concentration but use
the term "revenue" in this report. Although Who Audits America refers
to sales, our conversations with the provider of the data, confirmed
that although the terms can be used interchangeably, "revenue" is a
better term than "sales" in accurately describing the contents of the
database.
To verify the reliability of these data sources, we performed several
checks to test the completeness and accuracy of the data. Previously
GAO crosschecked random samples of the Who Audits America database with
SEC proxy filings and other publicly available information. Descriptive
statistics calculated using the database were also compared with
similar statistics from published research. Moreover, academics who
worked with GAO in the past also compared random samples from
Compustat, Dow-Jones Disclosure, and Who Audits America and found no
discrepancies. We also crosschecked the results with estimates obtained
using Audit Analytics' audit opinion database. The results were not
significantly different and confirm the finding outlined in the body of
the report. However, because of the lag in updating some of the
financial information and the omission of a number of small public
clients, the results should be viewed as estimates useful for
describing the market for audit services.
We conducted our work in California, Connecticut, Georgia, Maryland,
New Jersey, New York, Virginia, and Washington, D.C., from November
2004 through March 2006 in accordance with generally accepted
government auditing standards.
[End of section]
Appendix II: Additional Details about GAO's Analysis of Companies Going
Private:
A number of research studies and anecdotal evidence suggest that a
significant number of small companies have gone private as a result of
costs associated with the increased disclosure and internal control
requirements introduced by the Sarbanes-Oxley Act of 2002. To provide a
better understanding of companies going private, we analyzed Form 15s
filed by companies, related Securities and Exchange Commission (SEC)
filings and press releases to determine the total number of companies
exiting the public market and the reasons for the change in corporate
structure. See appendix I for our scope and methodology. This appendix
provides additional information on the construction of our database and
descriptive statistics.
Our Database Included Firms That "Went Dark" as Well as Firms That
Completely Exited the Public Market:
Although there is no consensus on the term "going private," we started
with the description used in the "Fast Answers" section of SEC's Web
site: a company "goes private" when it reduces the number of its
shareholders to fewer than 300 (or 500 in some instances) and is no
longer required to file reports with SEC.[Footnote 63] To reduce the
number of holders of record, a company can undertake a number of
transactions including tender offers, reverse stock splits, and cash-
out mergers. In many cases, the company already meets the requirement
for deregistration and therefore the registrant need only file a Form
15 (which notifies SEC of a company's intent to deregister) with SEC to
meet this description of "going private." As a result, we use the terms
"going private" and "deregistering" interchangeably. However, not all
companies that deregister completely exit the public markets; some
elect to continue trading on the less regulated Pink Sheets.[Footnote
64] Companies that deregister their shares with SEC but continue public
trading on the Pink Sheets are often considered as having "gone dark"
rather than private in the academic literature. However, our final
"going private" numbers include companies that no longer trade on any
exchange and those that continue to trade on the less regulated Pink
Sheets ("went dark").[Footnote 65] It should be noted that SEC does not
have rules that define "going dark" and the term is used here as it is
used in academic research.
The companies contained in our database include only those companies
that deregistered common stock, were no longer subject to SEC filing
requirements, and were headquartered in the United States. Moreover,
the database excludes most cases where the company was acquired by, or
merged into another company; filed for, or was emerging from,
bankruptcy; or was undergoing or planning liquidation. We also excluded
a significant number of companies that filed for an initial public
offering and subsequently filed a Form 15 within a year; filed no
annual or quarterly financials between the first filing with SEC and
the Form 15; or filed as a result of reorganization where the company
remained a public registrant. Based on the information contained on the
Form 15, we were able to exclude four types of filers: (1) companies
that deregistered securities other than their common stock; (2)
companies that continued to be subject to public reporting
requirements; (3) companies that were headquartered in a foreign
country; and (4) companies for which a Form 15 could not be retrieved
electronically.[Footnote 66]
In addition to SEC filings, we used press releases located through
Lexis-Nexis to investigate whether the companies experienced any of the
disqualifying conditions (bankruptcy, merger, acquisition, liquidation,
etc.) Companies that were merged into, or were acquired by, another
company were only included if the transaction was initiated by an
affiliate of the company (either the company filed a Schedule 13E-3
with SEC or our analysis found evidence of a "going private"
transaction in the case of Over-the-Counter Bulletin Board (OTCBB) and
Pink Sheet-quoted companies).[Footnote 67] Moreover, if the transaction
resulted in the company becoming a subsidiary of another publicly
traded company or a foreign entity, or if the transaction met any of
the other disqualifying conditions, that company was excluded from our
final numbers.
Each Form 15 also contained the number of holders of record. We
excluded all companies with one or zero holders of record unless that
company also filed a Schedule 13E-3 with SEC. A test of a random sample
of 200 of these companies found that merging, bankrupt, and liquidating
firms typically reported one or zero as the number of holders of
record.[Footnote 68] Because there may have been some companies that
went private by way of merger that did not file a Schedule 13E-3, our
database may have excluded some companies going private as a result of
using this qualifier. However, this limitation is minor in the context
of this report (see app. I for additional information on data
reliability). In total, these exclusions left us with 1,093 U.S.
companies going private from 1998 through the first quarter of 2005 out
of the 15,462 Form 15 filings initially provided to us by SEC.[Footnote
69]
Consistent with Outside Studies, We Found That the Number of Companies
That Went Private Increased Significantly from 2001 through 2004:
The number of public companies going private increased significantly
from 143 in 2001 to 245 in 2004 (see fig. 8). Based on the number of
companies going private during the first quarter of 2005, we project
that the number of companies going private will increase, to 267
companies by the end of 2005. While these numbers constitute a small
percentage of the total number of public companies, the trends we
identified suggest that more small companies are reconsidering the cost
and benefits of remaining public and raising capital on domestic public
equity markets. As figure 8 shows, the number of companies going
private increased significantly, whether or not we excluded the types
of companies explicitly considered as speculative investments by SEC--
blank check and shell companies.[Footnote 70] Overall, these companies,
identified as such by Standard Industry Classification code, represent
17 percent of the companies going private in 2004 but just 2.5 percent
of the companies going private during the first quarter 2005 and 8.4
percent of the overall sample.[Footnote 71]
Figure 8: Total Number of Companies Identified as Going Private from
1998 to 2005:
[See PDF for image]
Source: GAO analysis of SEC data.
Notes: Includes companies that deregistered but continued to trade over
the less regulated Pink Sheets ("went dark") and public shells and
blank check companies. Does not include companies that have filed for,
or are emerging from, bankruptcy, have liquidated or are in the process
of liquidating, were headquartered in a foreign country or that have
been acquired by or merged into another company unless the transaction
was initiated by an affiliate of the company and the company became a
private entity. The estimate for 2005 is projected based on the number
of companies going private in the first quarter and the pattern of
deregistration activity found in 2003 and 2004.
[A] Partial year, only includes the first 2 quarters of 2005.
[End of figure]
A number of research reports have also found that the number of
companies exiting the public market has increased since 2002. Although
there are differences in the search methodologies and types of
companies included, each study found similar trends and reached similar
conclusions (see fig. 9). For example, in Leuz et al. (2004) the number
of companies going dark or private increased from 144 to 313 between
2002 and 2003. Moreover the authors found that the bulk of the increase
was made up of companies that continued trading on the Pink Sheets
after deregistration. Engel et al. (2004), which was based on a smaller
subset of deregistering companies, found a statistically significant
increase in the rate at which companies went private. Marosi and
Massoud (2004) excluded all merger-related transactions and found that
the number of companies going dark increased from 71 in 2002 to 127 in
2003.[Footnote 72]
Figure 9: Companies Going Private or Dark, by Research Study:
[See PDF for image]
Source: GAO analysis of SEC data and selected studies.
Note: Leuz et al. data includes going private and going dark companies
in 1998-2003. The Marosi and Massoud data only includes companies going
dark in 2001-2003. The Engel study includes data on going private
transactions based on 13E-3 filings in 1998-2003. Additional
differences in the types of companies excluded exist across these
samples. GAO's number for 2005 is projected based on the number of
companies going private in the first quarter and the pattern of
deregistration activity found in 2003 and 2004.
[A] Partial year, only includes the first 2 quarters of 2005.
[End of figure]
We Grouped Reasons for Company Decisions to Go Private into Seven
Categories:
In analyzing company decisions, we used various sources to determine
why the companies included in our database deregistered their common
stock. Because companies did not always disclose the reasons for their
decision in an SEC filing, we also searched press releases and newswire
announcements using the Lexis-Nexis search engine. We then used the
reasons given in the various filings and other media to construct seven
broad categories, summarized in table 7. Because companies often gave
multiple reasons for the decision to deregister (go private) and it was
difficult to tell which were the most important, we allowed up to six
reasons for each company included in our database.[Footnote 73] For
example, Westerbeke Corporation went private in 2004 and cited the
following reasons for the decision: "a small public float," inability
to use its stock as currency for acquisitions, benefits the company
would receive as private entity such as "greater flexibility," the
ability to make "decisions that negatively affect quarterly earnings in
the short run," and the costs and time devoted by employees and
management "resulting from the adoption of the Sarbanes-Oxley Act of
2002." This company is included in our database with following coded
reasons for going private: (1) market/liquidity issues; (2) private
company benefits; (3) direct costs; and (4) indirect costs.
Table 7: Reason for Going Private, by Category Descriptions:
Direct costs: Company cites the costs associated with being a public
company. Includes listing costs, regulatory compliance costs, expenses
paid for outside advice, audit and attestation requirements, other
expenses directly related to the implementation of the Sarbanes-Oxley
Act, taxes at the corporate level, and costs related to shareholders
and shareholder accounts;
Indirect costs: Company cites the amount of time and effort required to
meet periodic reporting requirements, adhere to securities laws, and
service shareholders. Includes time and company resources spent on
Sarbanes-Oxley-specific requirements instead of regular business
activities;
Market/liquidity issues: Company cites thinly traded stock or general
illiquidity of company shares, poor market conditions, an undervalued
or low stock price, lack of analyst coverage, or disinterest on the
part of investors. Includes inability or difficulty in raising capital
through follow-on offerings or using stock as currency for mergers,
acquisitions, or employee compensation.
Private company benefits: Company cites benefits of becoming a private
company including ability to act quickly without market pressure, keep
information from competitors, or provide more flexibility in corporate
operations. Also includes normal business decisions, changes in
strategy, and belief that going private would provide better growth and
investment opportunities.
Critical business issues: Company cites negative business prospects or
critical issues that could undermine the ability of the company to
remain profitable or continue as a going concern. Includes lawsuits,
SEC actions, exchange delisting, general bad business, intense
competition, or failure of plans that could have made the company more
viable.
Other: Company cites reasons not covered by the listed categories.
No reason: Company provides no information on why it decided to
deregister. Includes companies that indicated they deregistered simply
because they met the requirements to do so.
Source: GAO.
[End of table]
More Companies Have Cited Costs as Reasons for Going Private Since 2002:
Although companies go private for a variety of reasons, in recent
years, more companies cited the direct costs of maintaining public
company status as at least one of the reasons for going private. As
shown in figure 10, the number of companies citing costs as at least
one reason for going private increased from 64 in 2002 to 143 and 130
in 2003 and 2004. However, the percentage of companies citing cost as
the only reason for exiting the market has increased significantly in
recent years. While only 21 cited costs and no other reason in 2003 (15
percent of the total citing cost), 43 did so in 2004 (33 percent of the
total citing cost). During the first quarter of 2005, nearly 50 percent
of the companies mentioning cost, cited costs as the only reason for
going private.
Figure 10: Companies Citing Costs as One of the Reasons for Going
Private:
[See PDF for image]
Source: GAO analysis of SEC data.
[A]Partial year, only includes the first 2 quarters of 2005.
[End of figure]
Companies Going Private Typically Were among the Smallest of Publicly
Traded Companies:
By any measure (market capitalization, revenue or assets), the
companies that went private over the 2004-2005 period represent some of
the smallest companies in the public arena (see figs. 11 and 12).
Because these companies were on average very small, they enjoyed
limited analyst coverage and limited market liquidity--one of the
primary benefits cited for going or remaining public. The median market
capitalization and revenue for these companies was less than $15
million.
Figure 11: Average and Median Sizes of Companies Going Private, 2004-
2005:
[See PDF for Image]
Source: GAO analysis of SEC and Audit Analytics data.
Note: Only includes companies with financial data available.
[End of figure]
Figure 12 also illustrates that companies going private were
disproportionately small, which reflected that the net benefits from
being public likely were smallest for small firms and the costs of
complying with securities laws likely required a higher proportion of a
smaller company's revenue. For example, 84 percent of the companies
that went private in 2004 and 2005 had revenues of $100 million or less
and nearly 69 percent had revenues of $25 million or less.[Footnote 74]
We also found that a significant portion of these companies--12.5
percent of those that went private in 2004-2005--had not filed
quarterly or annual financial statements with SEC in more than 2 years;
therefore, we did not have access to recent financial information.
Figure 12: Revenue Categories for Companies Going Private, 2004-2005:
[See PDF for image]
Source: GAO analysis based on SEC and Audit Analytics data.
Note: Only includes companies with financial data available.
[End of figure]
[End of section]
Appendix III: Comments from the Securities and Exchange Commission:
United States:
Securities And Exchange Commission:
Washington, D.C. 20549:
March 31, 2006:
Mr. William B. Shear:
Director:
Financial Markets and Community Investment:
United States Government Accountability Office:
441 G Street, N.W.:
Washington, DC 20548:
Dear Mr. Shear:
Thank you for the opportunity to comment on your draft report entitled
Sarbanes-Oxley Act: Consideration of Key Principles Needed in
Addressing Implementation for Smaller Public Companies. We agree with
you that the Sarbanes-Oxley Act has had a positive impact on investor
protection and confidence, but share your concern that smaller public
companies are facing particular challenges in implementing certain
provisions of the Act, most notably Section 404.
As you note in your draft report, the Securities and Exchange
Commission has undertaken a number of initiatives to assess the costs
of compliance with the Sarbanes-Oxley Act, particularly Section 404,
and to appropriately balance those costs with the benefits for smaller
public companies. The Commission has extended filing deadlines, issued
guidance, established the SEC Advisory Committee on Smaller Public
Companies, and sponsored a Section 404 roundtable event in April 2005.
In addition, the Commission will be conducting a second Section 404
roundtable event on May 10, 2006, which should provide further insight
into the experiences of companies and their accountants in the second
year of Section 404 implementation. The information gained at the
roundtable may be useful to smaller companies.
Your draft report stresses the importance for the Commission, in
assessing the final recommendations of the SEC Advisory Committee, of
balancing the key principle behind the Sarbanes-Oxley Act-investor
protection-against the goal of reducing the regulatory burden on
smaller public companies.
The draft GAO report also makes three specific recommendations for the
Commission's consideration in reviewing the final report of the
Advisory Committee, as it relates to Section 404: (1) assess whether
additional guidance is needed to help smaller public companies meet the
requirements of Section 404, (2) work with the PCAOB to ensure
consistency and efficient implementation of Section 404 guidance and
standards, and (3) ensure that the objectives of investor protection
are met and that any Section 404 relief granted is targeted and limited.
These recommendations should provide a useful framework for
consideration of the Advisory Committee's final recommendations, which
are due to the Commission by April 23, 2006. We do not believe,
however, that it would be appropriate for us to speculate or comment on
the Committee's recommendations in this letter before they are
finalized and submitted to the Commission. We wish to emphasize that
the Commission continues to support the mission of the Advisory
Committee, very much appreciates its work, and looks forward to
receiving its final recommendations.
Thank you again for the chance to comment upon your draft report. We
appreciate the GAO's attention to these important issues.
Sincerely,
Signed By:
John W. White:
Director:
Division of Corporation Finance:
Signed By:
Scott A. Taub:
Acting Chief Accountant:
[End of section]
Appendix IV: Comments from the Public Company Accounting Oversight
Board:
PCAOB:
Public Company Accounting Oversight Board:
1666 K Street, N.W.:
Washington, DC 20006:
Telephone: (202) 207-9100:
Facsimile: (202) 862-8430:
[Hyperlink, www.pcaobus.org]:
April 7, 2006:
William B. Shear:
Director:
Financial Markets and Community Investments:
U.S. Government Accountability Office:
441 G Street, NW:
Washington, DC 20548:
Dear Mr. Shear:
We have received and reviewed your draft report entitled Sarbanes-Oxley
Act: Consideration of Key Principles Needed in Addressing
Implementation for Smaller Public Companies. We appreciate your
providing the Public Company Accounting Oversight Board with an
opportunity to comment on this report.
Among the report's recommendations is for the Securities and Exchange
Commission to work with the PCAOB to ensure that Section 404-related
auditing guidance is consistent with any additional SEC guidance.
The PCAOB is committed to working with the SEC on GAO's
recommendations. We agree that it is essential to preserve the
overriding purpose of the Sarbanes-Oxley Act of investor protection
while we seek ways to make its implementation as efficient and
effective as possible. Technical comments have been provided to your
evaluators separately. We do not have any additional comments at this
time.
Sincerely,
Signed By:
Bill Gradison:
Acting Chairman:
[End of section]
Appendix V: GAO Contacts and Staff Acknowledgments:
GAO Contacts:
William B. Shear (202) 512-8678 Jeanette M. Franzel (202) 512-9471:
Acknowledgments:
In addition to those named above, Harry Medina and John Reilly,
Assistant Directors; E. Brandon Booth; Michelle E. Bowsky; Carolyn M.
Boyce; Tania L. Calhoun; Martha Chow; Bonnie Derby; Barbara El Osta;
Lawrance L. Evans Jr; Gabrielle M. Fagan; Cynthia L. Grant; Maxine L.
Hattery; Wilfred B. Holloway; Kevin L. Jackson; May M. Lee; Kimberly A.
McGatlin; Marc W. Molino; Karen V. O'Conor; Eric E. Petersen; David M.
Pittman; Robert F. Pollard; Carl M. Ramirez; Philip D. Reiff; Barbara
M. Roesmann; Jeremy S. Schwartz; and Carrie Watkins also made key
contributions to this report.
(250224):
[End of section]
FOOTNOTES
[1] Pub. L. No. 107-204, 116 Stat. 745 (July 30, 2002).
[2] Internal control is defined as a process effected by an entity's
board of directors, management, and other personnel, designed to
provide reasonable assurance regarding the achievement of the following
objectives: (1) effectiveness and efficiency of operations; (2)
reliability of financial reporting; and (3) compliance with laws and
regulations. Internal control over financial reporting is a process
that a company puts in place to provide reasonable assurance regarding
the reliability of financial reporting and the integrity of the
financial statement preparation process.
[3] For the purposes of this report, we use the term smaller public
company to refer to a company with a market capitalization of $700
million or less unless otherwise noted. We use the term large
accounting firms to refer to the top four U.S. accounting firms in
terms of total revenue in fiscal year 2004--Deloitte & Touche LLP,
Ernst & Young LLP, PricewaterhouseCoopers LLP, and KPMG LLP; mid-sized
firms to refer to the four next largest U.S. firms--Grant Thornton LLP,
BDO Seidman LLP, Crowe Chizek & Company LLC, and McGladrey & Pullen
LLP; and small firms to refer to all other accounting firms in the
United States., which consist of regional and local firms.
[4] Audit Analytics is an online market intelligence service that
provides information on U.S. public companies registered with SEC and
accounting firms.
[5] We conducted an analysis to determine whether the respondents to
our survey differed from the population of 591 companies in company
assets, revenue, market capitalization, or type of company (based on
the North American Industrial Classification System code) and found no
evidence of substantial non-response bias on these characteristics.
However, because of the low response rate, we do not consider these
data to be a probability sample of all smaller public companies.
[6] COSO was originally formed in 1985 to sponsor the National
Commission on Fraudulent Financial Reporting, an independent private-
sector initiative that studied the causal factors that can lead to
fraudulent financial reporting and developed recommendations for public
companies and their independent auditors, SEC and other regulators, and
educational institutions.
[7] Until recently, SEC distinguished between two types of public
companies for financial reporting purposes--accelerated filers and non-
accelerated filers. SEC defined a public company as an accelerated
filer if it met certain conditions, namely that the company had a
public float of $75 million or more as of the last business day of its
most recently completed second fiscal quarter and the company filed at
least one annual report with SEC. A non-accelerated filer is generally
a public company that had a public float of less than $75 million as of
the last business day of its most recently completed second fiscal
quarter. In December 2005, SEC created a new category, the large
accelerated filer. A large accelerated filer is generally a public
company that had a public float of $700 million or more as of the last
business day of its most recently completed second fiscal quarter. SEC
also redefined an accelerated filer as a company that had at least $75
million but less than $700 million in public float. Accelerated filers
and large accelerated filers are subject to shorter financial reporting
deadlines than non-accelerated filers. SEC defines public float as the
aggregate market value of voting and non-voting common equity held by
non-affiliates of the issuer.
[8] This report focuses on smaller public companies, but some of the
identified challenges and costs may also be present in larger public
companies.
[9] While there is no standard definition of corporate governance, it
can broadly be taken to refer to the system by which companies are
directed and controlled, including the role of the board of directors,
management, shareholders, and other stakeholders. According to the
Organization for Economic Co-operation and Development, corporate
governance provides the structure through which the objectives of the
company are set and the means of attaining those objectives and
monitoring performance are determined.
[10] In addition to those companies required to file reports with SEC
under the Securities Exchange Act of 1934, the Sarbanes-Oxley Act also
applies to companies considered to be issuers that have filed a
Securities Act of 1933 registration statement that is not yet effective.
[11] SEC also has a specific category of smaller companies called
"small business issuers" that may use separate reporting requirements
designed to be less onerous than those applicable to larger filers.
Generally, "small business issuers" have less than $25 million in
revenues and public float. See 17 C.F.R. § 228.10(a)(1).
[12] COSO, Internal Control - Integrated Framework, 1992 and 1994.
[13] Pub. L. No. 95-213, 91 Stat. 1494 (Dec. 19, 1977).
[14] We also looked at audit fees as a percentage of market
capitalization. While there is less of a disparity when this measure is
used, a significant difference is still observable between smaller and
larger public companies.
[15] As noted in figure 1, public companies with market capitalization
between $75 million and $250 million paid roughly 4.1 times what public
companies with market capitalization greater than $1 billion paid in
2003. For those public companies that reported implementing section
404, this ratio increased only slightly to 4.3.
[16] See "Management's Report on Internal Control over Financial
Reporting and Certification of Disclosure in Exchange Act Periodic
Reports," 68 Federal Register 36636 (June 18, 2003) (final rule).
[17] See COSO's exposure draft, "Guidance for Smaller Public Companies
Reporting on Internal Control over Financial Reporting" (Oct. 26,
2005), for a discussion of the challenges that smaller companies face
in implementing effective internal control over financial reporting.
[18] SEC, 24th Annual SEC Government-Business Forum on Small Business
Capital Formation, Final Report (Washington, D.C.: November 2005).
[19] PCAOB Release No. 2005-023 Report on the Initial Implementation of
Auditing Standard No. 2, An Audit of Internal Control over Financial
Reporting Performed in Conjunction with An Audit of Financial
Statements (Washington, D.C.: Nov. 30, 2005).
[20] According to the "Fast Answers" section of SEC's website, "a
company goes private when it reduces the number of its shareholders to
fewer than 300 and is no longer required to file reports with SEC." See
www.sec.gov/answers/gopriv.htm. Stock of these companies no longer
trades on the major markets; however, companies can and do continue
trading on the less regulated Pink Sheets, which have no minimum
listing standards. When a company suspends its duty to report to SEC
but continues to trade on the Pink Sheets, it is commonly referred to
as having "gone dark," since investors no longer have access to
information in the form of 8-Ks or quarterly and annual financial
statements filed with SEC. Or, after deregistering, some companies
elect to become "fully private" and are no longer traded or listed on
any market. For purposes of this report, we consider both types of
companies--"gone dark" and "fully private"--as private. As such, the
terms deregistering and "going private" are used interchangeably in
this report. See appendix II for more details on the definition of
"going private" used in this report.
[21] We eliminated companies that deregistered common stock as a result
of acquisitions and mergers that were not "going private" transactions,
liquidations, reorganizations, bankruptcy filings, or re-emergences. We
also eliminated duplicate filings and filings by foreign registrants.
These trends are consistent with a number of studies we identified,
although data collection methodologies differ across samples. See
appendix II for a full discussion of GAO's analysis.
[22] See appendix II for full description of each reason.
[23] Consistent with our findings, a number of research reports also
find that companies most often cited cost savings from not having to
comply with SEC regulations as a benefit of going private. For example,
see C. Luez, et al., "Why Do Firms Go Dark? Causes and Economic
Consequences of Voluntary SEC Deregistrations," Wharton School Working
Paper, University of Pennsylvania, September 2004, and S. Block, "The
Latest Movement to Going Private: An Empirical Study," Journal of
Applied Finance, 14 (1): 2004.
[24] In general, public companies will differ in the costs incurred and
benefits obtained as a result of their public company status because of
differences in size, industry, or other factors.
[25] Well before the passage of the Sarbanes-Oxley Act, analysts noted
that a decline in analyst and research coverage of smaller companies
and other challenges had resulted in a large number of smaller
companies with extremely low valuations and limited trading volume and
investor interest. For example, research in 2003 suggested that, while
95 percent of all companies with market capitalization greater than $1
billion were covered by an analyst, 21 percent of companies with market
capitalization between $25-50 million were covered by an analyst, and
just 3 percent of companies below $25 million market capitalization
were covered.
[26] The OTCBB is an electronic quotation system for equity securities
not traded or listed on any of the national exchanges or NASDAQ.
Generally, issuers of securities quoted on the OTCBB are smaller
companies.
[27] Although National Association of Securities Dealers, Inc. (NASD)
oversees the OTCBB, the OTCBB is not part of the NASDAQ Stock Market.
SEC has found that fraudsters often claim that an OTCBB company is a
NASDAQ-listed company to mislead investors into thinking that the
company is bigger than it actually is (see Microcap Stock: A Guide for
Investors: http://www.sec.gov/investor/pubs/microcapstock.htm). Pink
Sheets LLC has no affiliation with NASD and its activities are not
regulated by SEC.
[28] On January 20, 2006, we submitted a comment letter to COSO on its
draft guidance that contained specific recommendations on areas where
we felt the guidance could be improved.
[29] See 71 Federal Register 11090 (Mar. 3, 2006).
[30] 71 Federal Register 11090, 11098.
[31] SEC staff told us that they had not conducted a legal analysis of
the preliminary recommendations to determine if SEC has authority to
issue exemptions from section 404.
[32] The exposure draft of the Advisory Committee on Smaller Public
Companies uses the term "product revenue" as one of the criteria for
categorizing smallcap companies for the purposes of its
recommendations. However, the exposure draft did not contain an
explanation of the term "product" revenue. As a result, it was not
possible to analyze how a $10 million "product" revenue filter might
affect the number of smallcap companies that would become eligible for
the full exemption from section 404 otherwise limited to microcap
companies under the Advisory Committee's preliminary recommendations.
See 71 Federal Register 11093, 11104, and 11105.
[33] The 9,428 public companies identified by SEC included U.S.
companies listed on the New York and American Stock Exchanges (NYSE and
AMEX, respectively), the NASDAQ Stock Market, and the OTC Bulletin
Board. However, data prepared for the Advisory Committee by SEC's
Office of Economic Analysis noted that the 9,428 public companies do
not include approximately 3,650 U.S. public companies whose stock
trades on the Pink Sheets. The omission of Pink Sheet companies results
in an understatement of the number and percentage of public companies
that would be affected by the committee's recommendations calling for
section 404 regulatory relief for smaller public companies.
[34] Under the committee's recommendations, "smallcap" companies with
annual product revenues below $10 million would receive the same
treatment as microcap companies and be exempted from having to comply
with both sections 404(a) and (b).
[35] The specified corporate governance provisions included (1)
adherence to standards relating to audit committees in conformity with
Rule 10A-3 under the Securities Exchange Act and (2) adoption of a code
of ethics with the meaning of Item 406 of Regulation S-K applicable to
all directors, officers, and employees and compliance with further
obligations under Item 406(c) relating to the disclosure of the code of
ethics. Additionally, the committee recommended that management
continue to be required to report on any known material weaknesses,
including those uncovered by the external auditor and reported to the
audit committee.
[36] PCAOB Release No. 2005-023, Report on the Initial Implementation
of Auditing Standard No. 2, An Audit of Internal Control over Financial
Reporting Performed in Conjunction with An Audit of Financial
Statements (Washington, D.C.: Nov. 30, 2005).
[37] See Glass Lewis & Co., "Restatements - Traversing Shaky Ground,"
Trend Alert, June 2, 2005. The restatement rate calculation only
included companies with available financial data. The lack of financial
data and, therefore, exclusion of these companies, may lead to a slight
bias in the restatement rate for all companies (with a slightly larger
impact on the rate for smaller companies).
[38] Section 404's requirements only apply to annual reports required
by section 13(a) or section 15(d) of the Securities Exchange Act of
1934.
[39] Illinois, Texas, and California.
[40] For more information on small business equity capital formation,
see GAO, Small Business: Efforts to Facilitate Equity Capital
Formation, GAO/GGD-00-190 (Washington, D.C.: Sept. 29, 2000).
[41] Pink Sheets LLC, a privately held company, does not require
companies to be registered with SEC; therefore, many of these companies
do not make available the kind of detailed financial disclosures that
SEC-registered companies must provide.
[42] Cost increases associated with concentration in the accounting
industry are one of these potential factors. Some companies and their
investment banks would consider only a large accounting firm when
preparing for an IPO. In 2003 and 2004, over 80 percent of the
companies completing the IPO process used a large accounting firm.
[43] In addition to the four largest and four mid-sized firms, there
were roughly 800 small and mid-sized accounting firms that issued audit
opinions for U.S. companies in 2002 and approximately 600 that issued
audit opinions in 2004.
[44] The term "revenue" is used interchangeably with the term "sales"
used in the Who Audits America database. See appendix I for more detail.
[45] We analyzed auditor change data using the Audit Analytics
database, excluding foreign filers, funds and trusts without market
data, and benefit plans. We grouped public companies into five size
categories based on their respective market capitalization: (1) up to
$75 million, (2) greater than $75 million to $250 million, (3) greater
than $250 million to $700 million, (4) greater than $700 million to $1
billion, and (5) greater than $1 billion. If market capitalization data
were not available, revenue data were used as relevant proxies for
company size. Companies without market capitalization or revenue data
were not included in the analysis (643 companies).
[46] Forty-four companies (less than 1 percent) reported not finding a
new auditor as of December 2004. Some of these companies may have
deregistered, gone bankrupt, merged with or been acquired by another
company, or otherwise ceased business activity.
[47] These figures do not include foreign companies or companies that
did not trade on NYSE, NASDAQ, AMEX, OTCBB, or the Pink Sheets. See
appendix I for data reliability.
[48] In a previous report, Public Accounting Firms: Mandated Study on
Consolidation and Competition, GAO-03-864 (Washington, D.C.: July
2003), we noted that public companies wishing to demonstrate their
worthiness for debt and equity investments might continue to employ a
large accounting firm to increase their credibility among potential
lenders and investors and that some companies and boards of directors
have been reluctant to consider small firms.
[49] Many of the public accounting firms with whom we talked had a
significant number of accelerated filers for 2004 and noted that the
additional work challenged the firm's capacity. While the firms
expanded and supplemented their capacity to handle the additional work,
these firms also acknowledged that they took the workload and capacity
issues into account in conducting their ongoing client acceptance and
retention reviews. Many of the firms--particularly the large accounting
firms--acknowledged that since 2002, their review and retention
processes have resulted in a reduction of their public company audit
client base to better match workload capacity.
[50] Ninety-four percent of the companies changing auditors that had
going concern opinions had market capitalization of $75 million or less
(or, if no market capitalization data were available, $75 million or
less in revenues). A going concern opinion is issued by an auditor if
the auditor has doubts about the company's ability to generate or raise
enough resources to stay operational (to continue as a "going concern").
[51] See GAO-03-864.
[52] These concentration statistics suggest a Hirschman-Herfindahl
Index (HHI) of 2,505, which is equivalent to the index calculated for
2002 (2,566). The HHI is calculated by summing the squares of the
individual market shares of all the participants. An HHI above 1,800
indicates a highly concentrated market in which firms have the
potential for significant market power. While concentration ratios and
the HHI are good indicators of market structure, these measures only
indicate the potential for oligopolistic collusion or the exercise of
market power and can overstate the significance of a tight oligopoly on
competition. See GAO-03-864 for further discussion of the HHI.
[53] As such, the four-firm and eight-firm (large accounting firms plus
second-tier firms) concentration ratios are 0.55 and 0.75 respectively
for this particular section of the market. These ratios are consistent
with an HHI below 1,000. As a general rule, an HHI below 1,000
indicates a market predisposed to perform competitively, while an HHI
above 1,800 indicates a highly concentrated market. See GAO-03-864.
[54] See GAO-03-864.
[55] Based on a large sample analyzed from Audit Analytics, when we
broadened the market to include SEC reporting companies that do not
publicly trade, funds and trusts, the 600 small and mid-sized firms we
identified audited over 4,400 domestic public clients.
[56] As we noted in our 2003 report, mid-sized and small accounting
firms face challenges in effectively competing for large national and
multinational public company audits. The challenges include lack of
staff resources, experience, technical expertise, and global reach
necessary to audit large multinationals; establishing recognition and
credibility with larger companies and market participants to counter
the perception that only large firms can provide the required auditing
services; increased litigation risk and insurance costs associated with
auditing public companies; and difficulty in raising capital to expand
infrastructure to compete with large accounting firms. Also, at a
recent conference on auditor concentration organized by The American
Assembly, experts generally agreed that significant challenges restrict
the ability of mid-sized accounting firms to increase their market
share and present a major alternative to the large accounting firms.
"The Future of the Accounting Profession: Auditor Concentration," which
was held on May 23, 2005, was a follow-on to the Assembly's November
2003 meeting where 57 business leaders, academics, journalists, and
regulatory officials discussed the challenges the accounting profession
faced. For more information, see [Hyperlink,
http://www.americanassembly.org/] index.php.
[57] SEC's definition of a non-accelerated filer is based in part on
the company's "public float," which is a subset of market
capitalization. Market capitalization is defined as the number of
shares outstanding multiplied by the price per share. Generally, a
company's public float includes shares that are available to the
public. Thus, shares held by company insiders such as the CEO or CFO
would not be included in public float.
[58] In general, when working with any of the financial database,
breaking out the number of companies by size will result in the loss of
observations because some companies will not have financial data
available.
[59] Companies that were merged into, or were acquired by, another
company were only included if the transaction was initiated by an
affiliate of the company (either the company filed a form Schedule 13E-
3 with SEC or GAO analysis found evidence of a "going private"
transaction in the case of OTCBB-and Pink Sheet-listed companies).
[60] There may also be additional omissions due to errors on Form 15s
or because some Form 15s that were initially listed by SEC were not
found or were not available in electronic form. In a few instances, it
appeared that the Form 15 was completed incorrectly by the firm.
Mistakes included missing fields or an obvious misunderstanding of what
information was required.
[61] A test of a random sample of 200 of these companies found that
merging, bankrupt, and liquidating firms typically reported one or zero
as the number of holders of record. In each case, the companies were
found to have either merged with another company or had gone bankrupt
or liquidated. See also Marosi and Massoud (2004), "Why Do Firms Go
Dark," who used a similar method to exclude mergers and acquisitions.
[62] Leuz et al. (2004).
[63] Under certain SEC rules, public companies voluntarily can
deregister by filing a Form 15 with SEC if they have fewer than 300
holders of record or fewer than 500 holders of record if the company's
total assets have not exceeded $10 million at the end of the company's
3 most recent fiscal years and if the company meets some additional
criteria. Many of these companies can have thousands of actual
beneficial shareholders. For example, Ced & Co., the nominee of
Depository Trust Company would be counted as one certificate holder of
record for many thousands of investors served by the brokerage firms
that are members of the Depository Trust Company.
[64] The Pink Sheets LLC does not require companies whose securities
are quoted upon its systems to meet any listing requirements or require
the companies to be registered with SEC.
[65] Because we are addressing the potential effects on the access to
capital, our database focuses on "going private" from a public
disclosure requirement perspective--not necessarily from a trading
perspective. Some companies actively trade but are not required to
disclose information to SEC via periodic filings--these are considered
private; some companies do not trade actively but report to SEC--these
are considered public and when they file a Form 15 and cease filing
with SEC are considered to have gone private.
[66] In a few cases, we found companies that deregistered their common
stock and had other public securities that were still subject to SEC
reporting requirements, but later deregistered those securities shortly
after the initial Form 15 filing. These types of companies are also
included in our final numbers.
[67] Generally, if the transaction is initiated by an affiliate (an
insider) of the company, Rule 13e-3 of the Securities Exchange Act of
1934 requires the affiliate to file a Schedule 13E-3 with SEC. The
filing of a Schedule 13E-3 may also be required when affiliated
transactions result in a company's publicly held securities no longer
being traded on a national securities exchange or an inter-dealer
quotation system, such as NASDAQ. The Schedule 13E-3 requires a
discussion of the purposes of the transaction, any alternatives that
the company considered, and whether the transaction is fair to all
shareholders. The schedule also discloses whether and why any of its
directors disagreed with the transaction or abstained from voting on
the transaction and whether a majority of directors,who are not company
employees, approved the transaction.
[68] The companies were found to have either merged with another
company or, in some cases, had gone bankrupt or were liquidated. See
also Marosi and Massoud (2004), "Why Do Firms Go Dark," University of
Alberta, March 2004, who used a similar criterion to exclude companies.
[69] Ten additional companies went private between April 1, 2005, and
April 24, 2005, bringing the total to 1,103.
[70] SEC recently targeted regulatory problems that they identified
where shell companies have been used as vehicles to commit fraud and
abuse SEC's regulatory processes.
[71] Blank check companies are typically development stage companies
that have no specific business plan or purpose or have indicated that
their business plan was to engage in a merger or acquisition with an
unidentified company or companies, entities, or persons. SEC defines a
shell company as a company with no or nominal operations and either no
or nominal assets, assets consisting solely of cash and cash
equivalents, or assets consisting of any amount of cash and cash
equivalents and nominal other assets. SEC noted that many investors
have been victimized in shell company schemes over the years. However,
their corporate structures and status as publicly listed entities and
fully reporting issuers are features of interest for some small
companies with a desire to go public by way of reverse merger. In a
reverse merger, a private company merges with a public company and
continues as the dominant successor.
[72] E. Engel, R. Hayes, and X. Wang, "The Sarbanes-Oxley Act and
Firms' Going Private Decisions," University of Chicago Working Paper,
May 2004; C. Luez, A. Triantis, and T. Wang, "Why Do firms Go Dark?
Causes and Economic Consequences of Voluntary SEC Deregistration,"
University of Pennsylvania Working Paper, September 2004; and Marosi
and Massoud (2004), "Why Do Firms Go Dark," University of Alberta,
March 2004.
[73] It should be noted that these reasons are self reported by the
company and are not based on any additional (and more complex) analysis
of company behavior. Furthermore, because the Schedule 13E-3 requires a
discussion of the purposes of the transaction, any alternatives that
the company considered, and whether the transaction is fair to all
shareholders, affiliates of the company that are advocating the
transaction may list all the pros and cons of going private. As a
result, in cases where a company is required to file a Schedule 13E-3
with SEC, cost savings are generally listed as a benefit of going
private and therefore captured in our database as one of the reasons
for the decision.
[74] Given that the financial data are based on the company's last
annual filing, these results should be viewed as estimates of company
size.
GAO's Mission:
The Government Accountability Office, the investigative arm of
Congress, exists to support Congress in meeting its constitutional
responsibilities and to help improve the performance and accountability
of the federal government for the American people. GAO examines the use
of public funds; evaluates federal programs and policies; and provides
analyses, recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's commitment to
good government is reflected in its core values of accountability,
integrity, and reliability.
Obtaining Copies of GAO Reports and Testimony:
The fastest and easiest way to obtain copies of GAO documents at no
cost is through the Internet. GAO's Web site ( www.gao.gov ) contains
abstracts and full-text files of current reports and testimony and an
expanding archive of older products. The Web site features a search
engine to help you locate documents using key words and phrases. You
can print these documents in their entirety, including charts and other
graphics.
Each day, GAO issues a list of newly released reports, testimony, and
correspondence. GAO posts this list, known as "Today's Reports," on its
Web site daily. The list contains links to the full-text document
files. To have GAO e-mail this list to you every afternoon, go to
www.gao.gov and select "Subscribe to e-mail alerts" under the "Order
GAO Products" heading.
Order by Mail or Phone:
The first copy of each printed report is free. Additional copies are $2
each. A check or money order should be made out to the Superintendent
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or
more copies mailed to a single address are discounted 25 percent.
Orders should be sent to:
U.S. Government Accountability Office
441 G Street NW, Room LM
Washington, D.C. 20548:
To order by Phone:
Voice: (202) 512-6000:
TDD: (202) 512-2537:
Fax: (202) 512-6061:
To Report Fraud, Waste, and Abuse in Federal Programs:
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm
E-mail: fraudnet@gao.gov
Automated answering system: (800) 424-5454 or (202) 512-7470:
Public Affairs:
Jeff Nelligan, managing director,
NelliganJ@gao.gov
(202) 512-4800
U.S. Government Accountability Office,
441 G Street NW, Room 7149
Washington, D.C. 20548: