SARBANES-OXLEY ACT

Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones

Report to the Chairman of the Subcommittee on Capital Markets, Committee on Financial Services, House of Representatives

June 2025

GAO-25-107500

United States Government Accountability Office

For more information, contact Michael E. Clements at clementsm@gao.gov.

Highlights of GAO-25-107500, a report to the Chairman of the Subcommittee on Capital Markets, Committee on Financial Services, House of Representatives

June 2025

SARBANES-OXLEY ACT

Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones

Why GAO Did This Study

Amendments to the Sarbanes-Oxley Act since its 2002 passage sought to promote capital formation and reduce unnecessary cost burdens for smaller companies. These changes include exempting certain smaller and emerging growth companies from the auditor attestation requirement.

GAO was asked to review the compliance costs and other effects of the Sarbanes-Oxley Act. Among its objectives, this report examines the compliance costs associated with Section 404 of the act, and the effects of the Section 404(b) exemption, such as on companies and the reliability of their financial information.

GAO analyzed a nongeneralizable sample of SEC audit fee data for 2019–2023 (most recent available) as a proxy measure for Section 404(b) costs; a nongeneralizable sample of financial restatements; and SEC enforcement actions in 2022–2023. GAO also reviewed laws, annual cost surveys of public companies, relevant research studies, and prior GAO reports. GAO interviewed SEC and Public Company Accounting Oversight Board officials; 17 audit committee members from exempt and nonexempt companies; and representatives or members of seven trade associations (representing businesses, investors, accounting academics, auditing professionals, and financial executives).

What GAO Found

The Sarbanes-Oxley Act of 2002 was enacted to improve the reliability of public company financial reporting and auditing. Section 404 of the act has two key subsections that apply to public companies:

·         Section 404(a) requires management to assess the effectiveness of internal control over financial reporting in annual reports filed with the Securities and Exchange Commission (SEC).

·         Section 404(b), auditor attestation, requires auditors for public companies to attest to management’s assessment of these internal controls.

Amendments to the act exempted certain smaller and emerging growth companies from Section 404(b) requirements.

Companies’ costs to comply with these provisions include expenses related to personnel, technology, and auditor fees. Companies incur internal costs to develop, test, and document internal control over financial reporting. But these internal costs are difficult to isolate from broader expenses, such as costs for software also used for other purposes. Similarly, auditor fees are not itemized specifically for Section 404(b) compliance (they typically are included in total audit fees). Thus, available data and analysis on compliance costs are limited.

Larger (nonexempt) companies generally incurred higher overall Sarbanes-Oxley compliance costs, but these costs were proportionally more burdensome for smaller (exempt) companies. Nonexempt companies (generally those with $75 million or more in publicly held shares or companies not qualifying as emerging growth companies) had higher costs (19 percent) than their exempt counterparts, according to GAO’s analysis of a nongeneralizable sample of 96 companies. Companies generally experienced increased audit costs when they transitioned from exempt to nonexempt status (became subject to auditor attestation because their public float or revenues grew above exemption thresholds). Audits of nonexempt companies involve more work because the incremental auditing standards that apply to them require more planning, control testing, and quality review. GAO’s analysis found a median increase of $219,000 (13 percent) in audit fees in the year a company became nonexempt. Audit fees generally leveled off in the year after transition.

The Section 404(b) exemption has had some positive effects for companies. Research suggests that not having to obtain auditor attestations provides financial and nonfinancial relief for smaller (exempt) companies. Companies can redirect the time and money saved from compliance toward business growth and development. But research also suggests companies that announced they had to restate financial statements (due to material errors) tended to have weak internal control over financial reporting or be smaller. GAO’s analysis of a nongeneralizable sample of 100 restatements in 2022 and 2023 also found that 41 of 56 exempt companies (73 percent) in its sample cited both ineffective internal control over financial reporting and material weaknesses compared to 26 of 44 nonexempt companies (59 percent).

 

 

 

Abbreviations
EDGAR	Electronic Data Gathering, Analysis and Retrieval [database]
IPO	initial public offering
JOBS Act	Jumpstart Our Business Startups Act
PCAOB	Public Company Accounting Oversight Board
SEC	Securities and Exchange Commission

 

June 18, 2025

The Honorable Ann Wagner
Chairman
Subcommittee on Capital Markets
Committee on Financial Services
House of Representatives

Dear Madam Chairman:

In the wake of multiple, high-profile accounting scandals at public companies, the Sarbanes-Oxley Act of 2002 was enacted to improve the reliability of financial reporting and auditing at such companies.[1] Section 404 of the act includes two provisions that require assessment of internal control over financial reporting. More specifically, Section 404(a) requires that the Securities and Exchange Commission (SEC) promulgate rules requiring that annual reports of public companies include a statement by management assessing the effectiveness of the issuer’s internal control over financial reporting.[2] Section 404(b) requires that a public company’s independent auditor annually attest to and report on management’s assessment of the effectiveness of the company’s internal control over financial reporting.[3]

Concerns about compliance costs, management’s preparedness, and impact on public company listings resulted in legislative changes to the act that grant exemptions to certain public companies. In 2010, the Dodd-Frank Wall Street Reform and Consumer Protection Act exempted companies with less than $75 million in public float (publicly held shares) from the auditor attestation requirement.[4] In 2012, the Jumpstart Our Business Startups Act (JOBS Act) expanded the exemption from auditor attestation to provide relief and improve access to the public capital market for emerging growth companies.[5] In addition, certain regulations modified eligibility thresholds related to the auditor attestation requirement.[6]

Initial assessments of the effect of the auditor attestation exemption on the quality of financial reporting for smaller public companies and investors produced mixed findings. As we reported in 2013, auditor attestation costs could be significant, especially for small companies, although these costs declined for companies of all sizes since 2004.[7] Our 2013 report also found that exempt companies had more restatements of publicly reported financial information than nonexempt companies.[8] Additionally, the percentage of exempt companies restating previously issued financial statements generally exceeded that of nonexempt companies.

As Congress considers additional JOBS Act amendments and other reforms to stimulate initial public offerings, you asked us to review the costs and other effects of the Sarbanes-Oxley Act—particularly as they relate to internal control over financial reporting (Section 404(a) and (b)). This report examines (1) the compliance costs associated with Section 404(a) and (b), (2) the effects of the auditor attestation exemptions—the Section 404(b) exemption—on fraud risks and the reliability of companies’ financial information, and (3) other effects of the Section 404(b) exemption on companies and investors.

For the first objective, we obtained available filer status (exempt and nonexempt), voluntarily compliance with Section 404(b), and audit fee data (2019–2023) from a SEC database.[9] We selected this time period because 2023 was the most recent year with available data and the range allowed sufficient time to observe changes in audit fees for companies that transitioned from exempt to nonexempt status.

We merged those data for a random nongeneralizable sample of 98 companies with revenue and market capitalization data retrieved from the Bloomberg terminal, giving us panel data for 96 companies.[10] We used econometric techniques to examine the effect of filing status (exempt versus nonexempt) on total audit fees for these companies in 2019–2023, and how these fees changed when a company lost its Section 404(b) exemption. Our analysis, while useful for understanding compliance costs, is not generalizable to the population of U.S.-based public companies. We also reviewed surveys on audit fees of public companies subject to Section 404 requirements for assessing internal control over financial reporting.

For the second objective, we obtained and analyzed enforcement data (for cases involving accounting violations) from SEC for 2022 and 2023 to identify if violations involved internal control weaknesses or materially misleading statements or were fraud-related.[11] We also reviewed a random nongeneralizable sample (100 companies) of SEC 8-K financial restatements filed during this period.[12] For the third objective, we reviewed SEC and Public Company Accounting Oversight Board (PCAOB) documents, including reports, guidance, and a final rule.[13]

For all three objectives, we reviewed laws and regulations, and our prior reports. We also conducted literature searches of relevant research published from January 2013 through December 2024 on the costs and effects of Section 404(a) and (b). We conducted searches across several specialized and multidisciplinary databases such as ProQuest and Scopus and performed the searches using keywords and manual review. We also interviewed officials from SEC and PCAOB; associations representing businesses, investors, accounting academics, the public company audit profession, and financial executives; and selected audit committee members of exempt and nonexempt companies. See appendix I for a more detailed description of our scope and methodology. For a list of articles we reviewed, see the bibliography at the end of this report.

We conducted this performance audit from April 2024 to June 2025 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Major failures in financial reporting at public companies beginning in 2001, including at Enron and WorldCom, led to financial restatements and bankruptcies that adversely affected thousands of shareholders and employees. In response, the Sarbanes-Oxley Act of 2002 was enacted to protect investors by improving the accuracy and reliability of public company disclosures. It introduced reforms to enhance company responsibility for financial reporting, strengthen auditor independence, and create PCAOB.

Internal Control over Financial Reporting

Internal control serves as a first line of defense for public companies in safeguarding assets and preventing and detecting errors and fraud. Effective internal control over financial reporting is intended to provide reasonable assurance about the reliability of financial reporting and the preparation of financial statements for external purposes. If one or more material weaknesses exist, management cannot conclude that a company’s internal control over financial reporting is considered effective.[14]

Section 404(a) and (b) of the Sarbanes-Oxley Act

Title IV, Section 404 of the Sarbanes-Oxley Act aims to help protect investors by improving the accuracy, reliability, and transparency of corporate financial reporting and disclosures. It has two key sections:

·         Section 404(a), management’s assessment of internal control over financial reporting: Requires SEC to promulgate rules requiring reporting company management to include a statement in each annual report acknowledging their responsibility for establishing and maintaining an adequate internal control structure and procedures for financial reporting. Management also must assess, as of the end of the company’s most recent fiscal year, the effectiveness of its internal control over financial reporting in each annual report filed with SEC.[15]

·         Section 404(b), auditor attestation: Requires auditors of public companies to attest to and report on the internal control assessment made by the company’s management about the effectiveness of the company’s internal control over financial reporting.[16]

Oversight of Public Company Audits

Title I, Section 101 of the Sarbanes-Oxley Act, established PCAOB as a private-sector nonprofit organization to oversee the audits of public companies subject to U.S. securities laws and related matters.[17] PCAOB is subject to SEC oversight, including approval of its rules, standards, and budget.

The act gives PCAOB four primary areas of responsibility:

·         Registration of public accounting firms that prepare audit reports for public companies in the U.S. securities markets

·         Inspections of registered public accounting firms[18]

·         Establishment of auditing, quality control, ethics, independence, and other standards relating to the preparation of audit reports by registered public accounting firms

·         Investigations, disciplinary proceedings, and sanctions concerning registered public accounting firms and associated persons for violations of law or professional standards

In 2004, PCAOB adopted a standard for audits of internal control over financial reporting performed in conjunction with an audit of financial statements. In 2007, PCAOB adopted a revised auditing standard outlining requirements for auditors evaluating management’s assessment of the effectiveness of internal control over financial reporting. The revised standard was intended to align with guidance SEC issued for management and to eliminate procedures PCAOB considered unnecessary for an effective audit of internal control.[19] PCAOB has continued to issue alerts and updated guidance related to audits of internal control over financial reporting.

Auditors and Integrated Audits

The auditor, an independent third party, is responsible for planning and performing an audit to obtain reasonable assurance about whether financial statements are free from material misstatements due to error or fraud. The auditor provides an opinion on the financial statements in an audit report.

According to PCAOB’s current auditing standard (2007), financial statement audits should be integrated with the audit of internal control over financial reporting (for which the auditor provides an attestation) for nonexempt companies.[20] The attestation process involves the auditor testing the company’s internal control over financial reporting (including relevant documentation) and evaluating any identified deficiencies to provide an opinion on the effectiveness of those controls as of year-end. Although the auditor must achieve the objectives of both audits, they may choose to issue a combined report or separate reports on the company’s financial statements and on its internal control over financial reporting.

Applicability of Section 404(a) and (b) Requirements

All public companies must comply with the Section 404(a) requirement that management assess internal control over financial reporting. In contrast, not all companies must comply with the auditor attestation requirement (Section 404(b)). All domestic public companies are registered with SEC and must file annual reports on Form 10-K and quarterly reports on Form 10-Q. If applicable, companies file a Form 8-K to disclose material events or information (such as restatement of previously issued financial statements) prior to their next quarterly or annual report.[21] Foreign private issuers registered with SEC must file annual reports on Form 20-F.

The attestation requirement is based on a company’s filing status, which in turn is determined by its public float and annual revenues.

·         Public float. Public companies with an initial public float of $75 million or more (accelerated or large accelerated filers) have been subject to the auditor attestation requirement since 2004.[22] For those with less than $75 million in public float, SEC delayed implementation multiple times until July 2010, when the Dodd-Frank Wall Street Reform and Consumer Protection Act permanently exempted them from the requirement.[23]

·         Annual revenues. In 2020, SEC adopted amendments revising the definition of accelerated and large accelerated filers.[24] A revenue test was introduced to exempt low-revenue businesses with large public floats, such as biotechnology firms developing products for years before generating revenues. According to SEC, these changes were intended to tailor issuer categories more appropriately, promote capital formation, preserve capital, and reduce unnecessary burdens for certain smaller issuers, while maintaining investor protections.

Emerging growth companies, introduced in the JOBS Act, are issuers with less than $1.235 billion in annual gross revenue (adjusted for inflation every 5 years) and meeting certain other criteria. They are exempt from the auditor attestation requirement as long as they retain emerging growth company status (5 years maximum).[25] Table 1 summarizes the applicability of Section 404 requirements for assessing internal control over financial reporting by filer status.[26]

Filer Status	Public floatc	Annual revenues	Require management’s assessment of internal control over financial reporting (Section 404(a))	Require auditor attestation (Section 404(b))
Nonaccelerated filer	Less than $75 million	Not applicable	Yes	No, exempt
	$75 million to less than $700 million	Less than $100 million	Yes	No, exempt
Accelerated filera	$75 million to less than $700 million	$100 million or more	Yes	Yes
Large accelerated filer	$700 million or more	Not applicable	Yes	Yes
Emerging growth companyb	Not applicable	Less than $1.235 billion	Yes	No, exempt

Source: GAO analysis of Securities and Exchange Commission documents.  |  GAO‑25‑107500

^aExcept for emerging growth companies.

^bEmerging growth companies are defined as issuers with annual gross revenue below a certain threshold (adjusted for inflation), currently at $1.235 billion, and meeting certain other criteria.

^cPublic float refers to the portion of company shares held by public investors, measured in aggregate market value.

Companies Experience Significant Cost Increases in the First Year of Compliance, with Greater Cost Burden for Smaller Companies

Section 404 Compliance Costs Include Technology and External Audit Fees, but Cost Data Are Limited

Public companies incur both internal and external costs to comply with Section 404(a) and Section 404(b) (see table 2). For example, companies incur internal costs (personnel, technology, and travel) to develop, document, implement, monitor, and test their internal control over financial reporting.

Internal costs	Personnel	Cost of hiring or training internal staff or external consultants to develop, document, implement, monitor, and test internal controls for complying with Section 404(a).
	Technology	Cost of using technology, including software and hardware, to automate compliance with Section 404(a). Some existing technology may support multiple business functions, including compliance with aspects of Section 404(a).
	Travel	Costs of traveling for purposes related to compliance with Section 404(a), such as to visit a company’s multiple offices.
Auditor costsa	Audit fees	Cost of fees paid to auditor to attest to and report on management’s assessment of the company’s internal controls as required under Section 404(b).

Source: GAO analysis.  |  GAO‑25‑107500

^aAuditor refers to an external auditor.

Internal compliance costs may be difficult to disaggregate from other company expenses because resources and technology often serve purposes other than Section 404 compliance. For example, an industry research company noted that control activities related to Section 404 may be embedded in broader corporate compliance efforts. Additionally, some costs—such as staff time spent responding to auditors, retrieving documents, or licensing and maintaining technology—may not be fully captured.

Companies subject to Section 404(b) incur additional—external—costs (fees for auditors) to assess the effectiveness of their internal controls as part of the integrated financial statement audit. Moreover, the external audit fees are a significant expense. For example, a 2013 study based on survey data reported that auditor fees were the largest Section 404 expense for companies subject to Section 404(b). Our analysis of information from that study suggests these fees represented almost half of total Section 404 compliance costs for companies that reported these costs in the survey.[27]

Similar to internal costs, Section 404(b)-related external audit fees largely cannot be disentangled from total external audit fees. The Sarbanes-Oxley Act and PCAOB standards require an integrated audit of financial statements and internal controls. Therefore, the auditor attestation fee is embedded within total audit fees. Data on fees paid by companies specifically for audit work related to Section 404(b) are limited, partly because auditors may not separately provide such information. Although two reports we reviewed studied audit fees, these reports generally did not isolate fees specifically attributable to Section 404(b).[28]

Available Data Show Compliance Costs Were More Burdensome for Smaller Companies and Increased with Change to Nonexempt Status

Cost Burden for Smaller and Larger Companies

Smaller companies incurred higher Section 404 compliance costs as a percentage of assets than larger companies, according to two studies we reviewed. One study found that fixed costs associated with Section 404 compliance weighed disproportionately on smaller companies.[29] Larger companies, with more extensive resources, were able to develop more sophisticated internal control systems, which reduced audit procedures and costs for auditors. In contrast, auditors of smaller companies may need to perform more extensive internal control testing, resulting in higher fees.[30]

Although small companies were proportionally more cost-burdened, larger companies incurred higher overall compliance costs due to complexity and size. Researchers used various methods to assess complexity, such as geographic dispersion and research and development expenditures.[31] For example, a 2023 nongeneralizable survey by Protiviti of more than 500 respondents representing Sarbanes-Oxley-compliant companies found those with operations in a single location averaged approximately $700,000 in internal compliance costs, and those with 10 or more locations averaged around $1.6 million.[32] The survey also found that internal compliance costs increased with company size:

·         Companies in the study with from $1 billion to $10 billion in revenue averaged from $1 million to $1.3 million in internal compliance costs.

·         Companies in the study with more than $10 billion in revenue averaged around $1.8 million in such costs.

Effects of Change in Filer Status

Companies experience an increase in audit fees when they transition from exempt to nonexempt filer status and become subject to Section 404(b).[33] Because Sarbanes-Oxley-related external audit fees cannot be disentangled from total external audit fees, we analyzed the change in audit fees when companies transition from exempt to nonexempt filer status, for a sample of 98 companies, as a proxy measure for audit fees associated with Section 404(b).

·         Our data analysis, based on 98 companies, showed a median increase of $219,000, or 13 percent, in audit fees in the year of transition (see fig. 1).

·         Audit committee members, academics, and an auditing firm told us that exempt companies sometimes pay their auditor to assess the effectiveness of their controls in anticipation of becoming nonexempt, which may result in higher audit fees prior to the change in filing status. Our analysis showed a median increase of $80,000 in the year preceding transition.

·         Audit fees generally levelled off in the year after the transition. Our analysis found a $47,000 median increase in the year following transition.

Note: External audit fees related to Sarbanes-Oxley Section 404(b) largely cannot be disentangled from total external audit fees. Thus, we analyzed the increase in audit fees for a sample of 98 companies that transitioned from exempt to nonexempt filer status under Section 404(b).

Industry representatives we interviewed reported similar observations. For example, a representative of a Section 404(b)-exempt biotechnology company estimated that if it lost its exemption, compliance requirements would double the company’s audit fees from $500,000 to $1 million. Additionally, the company projected an increase of $400,000 in internal costs, comprising a mix of one-time and ongoing expenses. An auditing firm representative similarly said fees typically rise during the transition to nonexempt status but level off in subsequent years due to management gaining expertise in effective controls and efficiency gains in auditing operations.

We also conducted regression analysis to examine the effect of status change on audit fees using our data on 96 companies and a panel data approach.[34] Our model controlled for the size of the company, as measured by revenue, because audit fees typically increase as size increases, irrespective of filer status.[35] Our results showed that a change from exempt to nonexempt status was associated with increased audit fees. For our sample of 96 companies, audit fees increased with revenue irrespective of the filer status of the company, but we found that nonexempt companies had 19 percent higher costs than exempt companies.

Although our results are not generalizable and have limitations, the results are consistent with other evidence. Studies we reviewed similarly estimated audit fee increases resulting from Section 404(b) compliance.[36] For example, one study estimated audit fees increased more than 50 percent for companies in the year they transitioned to nonexempt status (from 2004 through 2007).[37] Comparatively, audit fees increased around 8 percent for companies that remained nonexempt during that time period.

Reasons for Higher Audit Fees for Nonexempt Companies

Audits of nonexempt companies involve more work than those of exempt companies because nonexempt companies are subject to Section 404(b)’s auditor attestation requirement, which, under PCAOB’s Auditing Standard No. 5 (later renumbered as Auditing Standard 2201), requires more planning, control testing, and quality review associated with Section 404(b).[38] According to PCAOB’s auditing standards, for an auditor to express an opinion on internal control over financial reporting, they must test the design and operating effectiveness of controls that would not ordinarily be tested in an audit focused solely on the financial statements.

Available Information Shows Mixed Trends in Compliance Costs

Due to limited data, as previously discussed, analyses and reporting on trends in Section 404(a) and (b) compliance costs are challenging. An industry survey and our data analysis based on a nongeneralizable sample showed that compliance costs generally remained flat in recent years. However, industry stakeholders reported that Section 404 compliance costs have increased. Determining whether compliance costs have risen is difficult because, as previously described, Section 404-related costs—internal costs and external audit fees—are difficult to disaggregate. Thus, data specifically on these costs are limited.

Representatives from Protiviti said results from the company’s annual Sarbanes-Oxley compliance surveys show that internal compliance costs remained relatively flat from 2016 to 2023.[39] Protiviti representatives attributed this trend to companies’ use of outsourcing and offshoring for noncore business processes. For example, outsourcing IT services has reduced costs due to lower input costs in some geographic areas. Our analysis of 98 companies similarly found that audit fees did not change significantly from 2019 through 2023.[40]

In contrast, representatives from the public company audit profession, financial executives, and audit committee members we interviewed said Section 404(b) compliance costs generally increased in recent years. Representatives from associations of public company auditors, financial executives, and audit committee members told us that PCAOB’s focus on internal controls contributed to rising Section 404(b) costs. They said PCAOB has found more lower-level issues through its inspections and required more documentation—resulting in higher Section 404(b) costs. For example, an audit committee member told us auditor hours spent testing controls increased from 3,000 in 2012 to 8,000 in 2024, raising audit fees from about $900,000 to $3 million. The member said this increase was not proportionate to the company’s growth, attributing it instead to evolving PCAOB requirements.

However, according to PCAOB officials, the auditing standards for internal control over financial reporting have not changed since PCAOB adopted its current standard in 2007. The 2007 standard reduced the audit procedures, and PCAOB officials indicated their approach to inspections and application of the standard has remained consistent over time.

In recent years, companies also made large investments in technology—such as artificial intelligence, machine learning, and cloud computing applications—to support Section 404 compliance. Industry representatives for financial executives said that beyond the up-front cost of developing and implementing new technology, auditors must test these systems during the first year of implementation, adding complexity to the audit process and increasing costs. But over time these technology improvements may help companies improve control efficiency and reduce compliance costs. The 2023 Protiviti report noted that implementation of such technologies helps automate routine tasks, reduce errors, and provide more insightful risk assessments. It said that as these systems mature and efficiencies are realized, companies may experience a reduction in compliance costs.

Companies That Announced Restatements Tended to Have Weak Internal Control over Financial Reporting or Be Smaller

Weak internal controls are associated with less reliable financial reporting and increased fraud risk. Section 404(a) and (b) is intended to reduce financial misstatements and the likelihood of financial fraud.

Restatements of Financial Reporting Among Exempt and Nonexempt Companies

Our analysis, including from studies we reviewed and interviews, found companies that announced restatements were likely to have weak internal control over financial reporting.[41] Of the nongeneralizable sample of 100 restatements we reviewed, company management cited ineffective internal control over financial reporting—including material weaknesses—in 93 cases.[42] We also found that the share of exempt firms—generally, smaller firms—specifically citing both ineffective internal control over financial reporting and material weaknesses was 14 percentage points higher than that of nonexempt firms.[43]

In the period following the JOBS Act, SEC found that companies that were nonaccelerated and accelerated filers restated at similar rates, but emerging growth companies restated at higher rates. According to SEC’s 2019 analysis, nonaccelerated (excluding emerging growth companies) and accelerated filers had an average annual material restatement rate of 2.5 and 2.7 percent, respectively, during 2014–2016 (see table 3).[44] Emerging growth companies, an exempt category, had the highest average annual material restatement rate (4 percent) during that period. Emerging growth companies are generally younger firms.

	Nonaccelerated/exempt (excluding emerging growth companies)	Accelerated/not exempt (excluding emerging growth companies)	Large accelerated/not exempt	Emerging growth companies/exempt
2014	3.3%	2.9%	2.1%	4.9%
2015	2.6%	3.1%	1.4%	4.7%
2016	1.7%	2.1%	1.0%	2.5%
Average / year	2.5%	2.7%	1.5%	4.0%

Source: Securities and Exchange Commission.  |  GAO‑25‑107500

Using more recent data and looking over a longer time period, an Ideagen Audit Analytics report found that more exempt companies (nonaccelerated filers) issued restatements than nonexempt companies (accelerated or large accelerated filers) from 2005 through 2023. The number of restatements peaked in 2006 and again in 2021. Specifically, exempt companies accounted for 77 percent of all restatements in 2021 (although they account for 49 percent of all filers, according to SEC officials), 60 percent of which were special purpose acquisition companies.[45] Although restatements generally returned to pre-2021 levels, exempt companies continued to account for the largest share—62 percent in 2023.[46]

Representatives of two accounting firms told us that effective internal control over financial reporting, audited by an independent auditor, contributes to reliable financial reporting. Representatives of one firm noted that exempt companies may not operate internal controls as rigorously as nonexempt companies. Similarly, some industry representatives for investors, accounting academics, and an auditing firm told us that smaller, exempt companies tend to have less developed internal control systems.

Research published in 2019 also suggests a positive association between reported material weaknesses in internal controls and financial statement restatements for both exempt and nonexempt filers.[47] Furthermore, the 2024 Center for Audit Quality report on restatement trends found public companies that announced material restatements were more likely to have ineffective control over financial reporting.[48] However, the report also found that reports of ineffective internal control over financial reporting are not predictive of restatements, regardless of materiality.[49]

Weak Internal Control Associated with Fraud Risk

Weak internal controls also are associated with fraud, according to our analysis and reports we reviewed. A 2019 statement by then SEC Chief Accountant stated that adequate internal controls are the first line of defense in detecting and preventing material errors or fraud in financial reporting.[50]

Our analysis of a sample of 55 SEC enforcement cases involving accounting violations announced in 2022 and 2023 found 47 involved weak or insufficient internal controls, or materially misleading statements.[51] Of those, 37 cases were fraud-related violations.

Other analyses also linked weak internal controls and fraud. In a 2024 report, the Association of Certified Fraud Examiners found the most common contributors to fraud were a lack of internal controls (32 percent) and the override of existing internal controls (19 percent).[52] A 2017 study reported that weak internal controls were associated with a higher risk of unrevealed accounting fraud, particularly for top managers.[53] Of the 127 fraud cases in the study’s sample, 36 (28 percent) were preceded by auditor reports of material weaknesses in internal control. Its findings also indicate that such material weaknesses were a predictor of subsequent fraud discovery within 3 years. Finally, a 2013 survey found that U.S. and Canadian investor analysts cited material internal control weakness as a “red flag,” signaling management intentionally misrepresented financial statements.[54]

According to the Center for Audit Quality’s 2024 report on financial restatement trends in 2013–2022, fraud generally was more prevalent among companies issuing material restatements, although the absolute number of fraud cases remained relatively low.[55] Approximately 3 percent of all restatements issued in that period were associated with fraud, consistent with what we found in our review of 100 restatements (the vast majority of which cited ineffective internal control over financial reporting). And 7 percent of material restatements involved fraud. A separate study covering 25 years, from March 1995 to October 2020, found that less than 2 percent of restatements were associated with fraud—312 cases out of 18,797 restatements.[56]

Auditor Attestation Exemption May Free Up Resources but Could Reduce Investor Confidence to Varying Degrees

The auditor attestation exemption can allow exempt companies, typically smaller firms, to redirect the cost, time, and resources saved from compliance toward business growth and development. However, the exemption also may lead to reduced investor confidence, particularly for certain small companies, because the attestation provides some added assurance about a company’s financial reporting.

Attestation Exemption May Allow Smaller Companies to Invest More in Business Development and Growth

The auditor attestation exemption is intended to provide financial and nonfinancial relief to smaller companies. As discussed previously, external audit fees are a significant expense.

Several studies we reviewed identified cost savings from not paying audit fees as a key measurable benefit of the exemption. For example, one study found that following the passage of the JOBS Act, reduced compliance costs allowed companies to invest more in research and development and innovation.[57] Another study reported that relaxed disclosure requirements helped emerging growth companies save money and other resources that otherwise would be needed to prepare documents.[58] A separate study noted that the exemption freed up management and employee time that otherwise would have been spent with auditors.[59]

Similarly, several representatives of industry associations—including accounting academics, investors, and financial executives—as well as audit committee members told us the exemption provides financial or nonfinancial savings for smaller companies. For example, one audit committee member told us that with the Section 404(b) exemption, the company was able to save money by relying on its internal team to evaluate financials rather than hiring outside consultants.

Stakeholders also said the exemption allows companies to redirect resources toward other priorities, including research and development or developing control systems. In letters to SEC about its proposed amendments to filer definitions, several companies (including small biotechnology companies) described using funds that would have been spent on the attestation requirement to support innovation, hire scientists, and conduct clinical trials.[60] One biotech company estimated the exemption would save about $1 million in 2020, which it said it would allocate to research and development.

In addition, several audit committee members told us the exemption gave small companies preparing to go public additional time to develop internal controls. One audit committee member explained the exemption provided additional time for smaller companies to develop controls and prepare for additional accounting requirements when the companies lost exempt status.

Exempt Companies May Face Reduced Investor Confidence in Their Financial Reporting

Some exempt companies may face some degree of reduced investor confidence in their financial reporting because they lack an auditor’s attestation.

Potential Positive Effects of Auditor Attestation

As we previously reported, auditor attestation of internal controls generally has a positive impact on investor confidence.[61] The attestations are viewed as providing reasonable assurance about the effectiveness of companies’ internal controls and the reliability of their financial reporting, as demonstrated by fewer restatements. This added assurance can boost investor confidence for some companies.

These views generally align with findings or results of recent studies we reviewed, results of an annual survey of public companies, and our interviews with audit committee members. For example:

·         A 2023 study concluded that auditors were somewhat effective in providing early warnings (that is, before restatements) about the existence of severe internal control deficiencies.[62] The study found that of the sampled companies with unreliable financial statements—those that were subsequently restated—34 percent received adverse opinions from auditors during the misrepresentation period or the year prior. The remaining 66 percent received a favorable internal control opinion, which was revised after the problem had been publicly disclosed.

·         Another 2023 study, based on a survey of 14 biotech executives, found that auditor attestation was perceived to positively affect internal controls, the audit committee’s confidence in internal control over financial reporting, and the reliability of financial statements.[63] The study also found a smaller but positively perceived effect on financial reporting quality, fraud detection, capital raising, and investor confidence.

·         The majority of respondents to Protiviti’s annual survey of public companies from 2019 to 2021 said that one of the primary benefits of auditor attestation was improved internal control over the financial reporting structure.[64]

In addition, several audit committee members told us that auditor attestation instills rigor and discipline over internal controls, raising investor confidence. One member noted that Section 404 has resulted in more disciplined internal control over financial reporting and reliable systems supporting it. Another member added that the Sarbanes-Oxley provision helps produce good management controls, discipline, and rigor in accounting policies and reconciliation processes. Several audit committee members said that as a result, shareholders have gained confidence knowing that both management and auditors scrutinized internal controls.

Potential Negative Effects of Not Having Auditor Attestation

Without the assurance provided by auditor attestation, the quality of internal controls for exempt (smaller) companies may be less transparent. For example, two studies we reviewed found that diminished disclosures associated with the exemption increased information asymmetry (where one party has more or better information than the other) between company management and investors.[65]

This information asymmetry (and potentially less reliable internal control disclosure in the absence of third-party attestation) can increase the cost of capital because investors face increased risks. In turn, heightened investor risk can have negative consequences for companies, such as requiring them to offer a higher rate of return to attract capital.

Several studies we reviewed demonstrated this effect by using cost-of-capital proxies such as initial public offering (IPO) underpricing and bid-ask spreads, both indicators of investor confidence.[66] For example:

·         A 2017 study found that several provisions of the JOBS Act were significantly associated with greater information uncertainty at the IPO, and that emerging growth companies had significantly larger bid-ask spreads.[67]

·         Another 2017 study found that underpricing was higher for emerging growth companies (which are eligible for reduced disclosures) than for similar firms that went public before the JOBS Act, implying a higher cost of capital.[68]

·         A 2021 study similarly found that while emerging growth companies benefitted from lower underwriting fees, they also faced higher indirect costs due to information asymmetry, as measured by post-JOBS Act underpricing.[69]

As the less-informed parties in these transactions, investors’ reduced confidence in company disclosures and financial reporting may lead to undervaluation, raising the cost of capital for smaller companies.

However, reliable financial reporting is but one of a number of factors that could affect investor confidence. For example, a 2017 paper prepared for the then SEC Director and Chief Economist of the Division of Economic and Risk Analysis identified “investor optimism” and “investor trust” as two primary elements of investor confidence.[70] The paper noted that while regulatory activities and disclosure rules, such as auditor attestation, could affect investor trust (by providing assurances that could reduce the perception of exposure to risks and potential losses), investor optimism also could play a role in investor’s decisions. Investors also assess various dimensions of company quality, including profitability, growth, and stability of earnings. To make these assessments, investors need firm-specific information. But the basis for such information may depend on financial analysts’ coverage, which could be at a reduced level for smaller companies.

As of April 2020, SEC added a check box on Form 10-K for companies to indicate whether an auditor attestation is included in their annual reporting with SEC (applicable for exempt companies voluntarily complying with the requirement).[71] Representatives of credit rating agencies had mixed views on the effects of exempt companies opting for voluntary disclosures. According to two credit rating agency representatives, voluntary compliance would raise their confidence in the financial reporting of an issuer they were assessing. However, another credit rating agency representative said it might not affect a company’s credit rating, as each case depends on the company’s unique circumstances.

Effect of JOBS Act Provisions on the Number of IPOs Is Unclear

The effect of JOBS Act provisions (reduced compliance requirements) on the number of IPOs for emerging growth companies is unclear. Since the act’s passage in 2012, the majority of IPOs have been for emerging growth companies, but it is unknown whether such IPOs would have increased in the absence of the act.

As shown in figure 2, the number of IPOs (excluding special purpose acquisition companies) fluctuated modestly in most years after 2012. IPO numbers rose in 2013 but declined in subsequent years until increasing again in 2020 and 2021 (although at below-2013 levels). IPOs then declined sharply in 2022.

Several studies we reviewed indicated the JOBS Act increased IPO issuance by lowering the expected costs of going and staying public. Companies eligible for emerging growth status benefited from various reduced compliance requirements, discussed later in this section. For example, a 2023 study found that JOBS Act provisions—such as confidential filings, “testing-the-waters,” and reduced disclosures—were associated with a roughly 33 percent higher likelihood of IPO issuance among emerging growth companies during the public filing stage than for non-emerging growth companies.[72] The reduced disclosure provisions, including the exemption from auditor attestation over internal controls, lowered compliance costs and reduced the expected burden of remaining public. This likely lowered companies’ reservation prices for IPOs, decreasing the likelihood of withdrawal and increasing the rate of issuance during the public filing stage.[73]

A 2017 study of 312 emerging growth companies found that the vast majority opted for scaled-back disclosures and lower compliance standards, believing that the benefits of the JOBS Act exceeded the costs.[74] Another study noted that expectations of lower ongoing regulatory compliance costs also influenced issuers’ decisions to go public, as reduced future costs could make an IPO more attractive.[75]

However, these studies did not pinpoint which JOBS Act provisions influenced the decision to go public. The JOBS Act introduced multiple reforms, making it challenging to isolate the impact of the Section 404(b) exemption on such decisions. Emerging growth companies also were allowed to

1.    include less extensive narrative disclosure, particularly regarding executive compensation,

2.    provide audited financial statements for 2 fiscal years instead of 3,

3.    defer compliance with certain new accounting standards, and

4.    use “test the waters” communication with qualified institutional buyers and institutional accredited investors.[76]

Given the array of provisions, the direct effects on IPOs of the exemption allowing emerging growth companies to omit an auditor attestation is unclear.

Moreover, several studies and stakeholders we interviewed suggested the JOBS Act may not have had substantial effects on IPOs due to other factors. For instance, market conditions—including market volatility, overall economic conditions, and alternatives to raising capital—can affect a company’s decision to go public.[77] Two investor industry representatives and one consulting firm told us that such factors, along with a company’s financial health and growth potential, are likely to weigh more heavily on IPO decisions than JOBS Act exemptions. Moreover, one study found that some issuers eligible for emerging growth company status instead may have opted to raise capital in private offerings.[78] Another study that sampled venture capital-backed firms (which account for about half of all IPOs) suggested that nonregulatory factors could play a more important role in the decline in the number of firms going public.[79]

Decisions by emerging growth companies to go public also may be influenced by the possibility of losing that status—and the associated exemptions—before the 5-year eligibility period expires. As described previously, a company can lose its emerging growth status if it surpasses certain growth thresholds within 5 fiscal years after its IPO. One study of 40 firms found that 17 (42.5 percent) lost their status within 2 years of going public.[80]

High regulatory costs to operate as a public company also could affect a company’s decision to go public. According to an SEC report, chief financial officers estimated that, on average, 12 percent of their recurring incremental costs of being public companies were for regulatory compliance (not specific to Sarbanes-Oxley).[81] A 2014 study found that the substantial costs of going public and maintaining Sarbanes-Oxley compliance infrastructure caused some smaller private U.S. companies to opt for acquisition by another public company as an exit strategy rather than going public themselves.[82]

Agency Comments

We provided a draft of this report to SEC and PCAOB for review and comment. Both SEC and PCAOB provided technical comments, which we incorporated as appropriate.

As agreed with your office, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the report date. At that time, we will send copies to the appropriate congressional committees, the Chairman of SEC, the Chair of the PCAOB, and other interested parties. In addition, the report will be available at no charge on the GAO website at https://www.gao.gov.

If you or your staff have any questions about this report, please contact me at clementsm@gao.gov. Contact points for our Offices of Congressional Relations and Public Affairs may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix II.

Sincerely,
Michael E. Clements
Director, Financial Markets and Community Investment

The objectives of this report were to examine (1) the compliance costs associated with Section 404(a) and (b) of the Sarbanes-Oxley Act, (2) the effects of the auditor attestation exemptions—the Section 404(b) exemption—on fraud risks and the reliability of companies’ financial information, and (3) other effects of the Section 404(b) exemption on companies and investors.

Review of Compliance Costs Associated with Section 404

To address the first objective, we analyzed changes in total audit fees for a nongeneralizable sample of public companies that transitioned from exempt to nonexempt filer status. This analysis served as a proxy for auditor fees associated with Section 404(b), which cannot be disaggregated from total audit fees. No data were available specifically on Section 404(b) audit fees. We used a nongeneralizable sample because we believe the random, nongeneralizable approach balanced a size sufficient for quantitative analysis with the time required for manual review, as discussed below.

We first obtained filer status (exempt or nonexempt), voluntary compliance with Section 404(b), audit fee, and industry classification data for 2019–2023 on 8,085 public companies from the Securities and Exchange Commission’s (SEC) Electronic Data Gathering, Analysis, and Retrieval (EDGAR) database.[83] We identified companies that transitioned to nonexempt filer status in 2020, 2021, or 2022—years selected to allow observation of audit fees at least 1 year before and after the transition. We excluded firms that voluntarily complied with Section 404(b) before transition or had previously held nonexempt status. After applying these criteria, 539 companies remained.

From this group, we randomly selected 102 U.S.-based firms—34 firms from each transition year. We obtained audit fee data for 98 of the 102 firms (data were unavailable for four) from EDGAR. To assess the reliability of the EDGAR data, we reviewed relevant documentation on data collection methodology and assessments of the data conducted for prior GAO work. We verified the accuracy of the imported data by manually comparing them with filings submitted in portable document format by 10 randomly selected companies.

We also obtained revenue and market capitalization data from the Bloomberg Terminal for the 102 companies for 2019 through 2023. Of the 98 companies with audit data, two reported no revenue for 2019–2023. To assess the reliability of these data, we reviewed Bloomberg’s data collection methodology and prior GAO work that assessed it. We found these data were sufficiently reliable for analyzing cost changes.

For this nongeneralizable sample of firms, we used the audit fee and filer type data to calculate median audit fees and median change in audit fees in the year of transition, the year before, and the year after.

To isolate the effect of filer status on audit fees, we conducted an econometric analysis using a panel data approach on the sample of 96 companies with revenue data that changed from exempt to nonexempt status during 2020–2022.[84] We observed total audit fees and revenues of these companies from 2019 through 2023, giving us panel data containing repeated observations on these 96 companies from 2019 through 2023. We used a panel data model to account for variation across both time and companies and to reduce the risk of omitted variable bias. This approach was preferable to a pooled cross-sectional model, which would not capture time-based variation. Additionally, we used log transformations for our dependent and independent variables because we found the data for our sample to be skewed. Our model is specified below:

Log (Cit) = αit + βLogRit + ΩAit +Tt + εit

εit= μi + eit

Cit represents the audit costs of company “i” at time t, and Rit represents the revenue of company i at time t, to control for company size. Ait represents the accounting status dummy for company i at time t, and Tt are yearly dummy variables representing the year. εit is the error term (that also includes time-invariant, company-specific unobservable characteristics represented by μi).

Limitations of this analysis include that we only had data on total audit costs and that it was not possible to isolate and analyze the Section 404(b) compliance costs in our model. Therefore, the effect of status change on audit costs is at best an approximation of its effect on Section 404(b) compliance costs. Also, our analysis may be prone to some selection bias to the extent that the data only include companies that changed status during this period.

Additionally, we reviewed industry reports and surveys on Section 404 compliance costs, trends, and experiences. These included Protiviti’s annual survey of companies on internal Sarbanes-Oxley compliance costs and trends (2016–2023), Audit Analytics’ 2023 20-year review of audit fee trends report, Financial Executives International’s annual public company audit fee survey, and KPMG’s 2023 Sarbanes-Oxley report.[85]

Assessment of Section 404(b)’s Effects on Fraud Risks and Financial Data Reliability

To address the second objective, we obtained enforcement data from SEC to identify common types of accounting violations and if they involved fraud-related actions, internal control weaknesses, or materially misleading statements. SEC provided information on accounting violations from 2013 through 2023, including case file date, matter or registrant name, defendant or respondent name, and related press or litigation releases. We manually reviewed and analyzed the 97 cases SEC identified for 2022 and 2023 (most recent data available).

To assess the reliability of the data, we first verified the enforcement action date and company name in each case using the corresponding press or litigation release. Using both releases and EDGAR data, we excluded cases involving foreign entities, private companies, or auditing firms, as well as those involving violations occurring before 2019.[86] This process resulted in the removal of 42 cases. For the remaining 55 cases, we analyzed the press or litigation releases to determine whether violations involved internal control weaknesses or materially misleading statements. We also interviewed SEC officials to understand their procedures for validating the list of enforcement cases. On the basis of these steps, we determined the data were sufficiently reliable for identifying common types of violations.

We also randomly selected a nongeneralizable sample of 100 SEC 8-K financial restatements filed in 2022 and 2023 to explore the relationship between filer status, internal control weaknesses, and financial reporting reliability.[87] For each case, we reviewed Item 4.02 disclosures to identify the cause of the restatement and management’s assessment of internal control. Using filer status data from EDGAR, we categorized each company as exempt or nonexempt. We also reviewed reports from nongovernmental organizations and conducted a targeted literature search (described below).[88]

Assessment of Section 404(b)’s Other Effects on Companies and Investors

To address the third objective, we reviewed documents from SEC and the Public Company Accounting Oversight Board (PCAOB), including reports, guidance, and a final rule.[89] We also obtained data on the number of initial public offerings (IPO) from 2003 through 2024 from the Bloomberg Terminal to illustrate IPO trends. To assess the reliability of the Bloomberg data, we reviewed relevant documentation on data collection methodology and assessments of these data done for prior GAO work. We found the data were sufficiently reliable for illustrating trends in IPOs.

Document and Literature Reviews and Interviews

To address all the objectives, we reviewed our prior reports, laws and regulations, including the Dodd-Frank Wall Street Reform and Consumer Protection Act and the Jumpstart Our Business Startups Act (JOBS Act).[90] We also reviewed relevant research published from January 2013 through December 2024, selecting 2013 as the starting point to avoid duplicating the literature review from our prior report on auditor attestation.[91] We conducted searches with librarian assistance across several specialized and multidisciplinary databases including ProQuest, Scopus, EBSCO, Dialog, and Lexis+.

First, we performed the searches using keywords and manual review to limit the scope to Sarbanes-Oxley Section 404 and compliance costs. We used variations of terms, including but not limited to, “Sarbanes Oxley,” “Section 404,” “IPO,” “JOBS Act,” “cost,” and “regulatory burden.” Our search identified 71 studies, including scholarly articles and research studies from academics and nongovernmental organizations. To assess the relevance of these studies, we reviewed their abstracts to determine whether they discussed at least one of five topics: (1) Section 404 or 404(b), (2) IPOs related to the Sarbanes-Oxley Act or the JOBS Act, (3) the JOBS Act and emerging growth companies, (4) auditor attestation or the financial reporting exemption, or (5) compliance costs associated with Section 404 or 404(b). We determined 40 of the studies met our criteria for in-depth review. After further review and evaluation of methodological quality and relevance, we narrowed our selection to 26 studies and cited 11 in this report.[92]

Similarly, we performed another search focused on fraud risks for use in addressing the second objective. Using the same databases and time frame (beginning in January 2013) as our broader literature review, we conducted keyword searches with variations of terms such as “Section 404,” “internal control over financial reporting,” “fraud,” and “disclosure.” This targeted search identified 50 studies. We conducted in-depth reviews of 14 and reference three in this report. Additionally, we supplemented this review with four studies cited in a 2020 SEC final rule and interviews with industry experts as well as two older studies (published before 2013) on Section 404 costs that were referenced multiple times in the literature our librarian identified.[93] See the list of publications in the bibliography at the end of this report.

We interviewed officials from SEC and PCAOB regarding all our objectives. We also interviewed 17 audit committee members of exempt (four) and nonexempt companies (13), selected because audit committees play a vital role in promoting high-quality auditing through their oversight of the audit process and the auditor.[94] We also interviewed representatives or members of seven trade associations representing businesses (U.S. Chamber of Commerce), investors (Council of Institutional Investors and CFA Institute), accounting academics and public company auditing professionals (Center for Audit Quality, American Accounting Association, and American Institute of Certified Public Accountants), and financial executives (Financial Executives International). We selected the trade associations because they had been identified as relevant in our prior report or had submitted comments on SEC’s proposed rule for amendments to the accelerated filer and large accelerated filer definitions.

We also interviewed representatives of two audit firms and three credit rating agencies. These firms were selected because they are among the largest in their industry. Additionally, we interviewed representatives of a biotechnology company, selected because it had commented on SEC’s proposed rule. Finally, to better understand their annual cost compliance surveys, we interviewed representatives of Protiviti.

We conducted this performance audit from April 2024 to June 2025 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

GAO Contact

Michael E. Clements, clementsm@gao.gov.

Staff
Acknowledgments

In addition to the contact named above, Karen Tremba (Assistant Director), Chir-Jen Huang (Analyst in Charge), Shirley Araiza Santaella, Namita Bhatia-Sabharwal, Natasha Guerra, Risto Laboski, Jill Lacey, Megan McGehrin, Matt Mitchell, Marc Molino, Barbara Roesmann, Christopher Ross, Jessica Sandler, Lindsay Shapray, Anne Sit-Williams, and Jared Smith made key contributions to this report.

We reviewed the findings of the following research to identify the costs and effects of Section 404(a) and (b) of the Sarbanes-Oxley Act of 2002. See appendix I for information on how we identified and selected these studies.

Alexander, Cindy R., Scott W. Bauguess, Gennaro Bernile, Yoon-Ho Alex Lee, and Jennifer Marietta-Westberg. “Economic Effects of SOX Section 404 Compliance: A Corporate Insider Perspective.” Journal of Accounting and Economics, vol. 56 (2013).

Barth, Mary E., Wayne R. Landsman, and Daniel J. Taylor. “The JOBS Act and Information Uncertainty in IPO Firms.” The Accounting Review, vol. 92, no. 6 (November 2017).

Berdejó, Carlos. “Going Public After the JOBS Act.” Ohio State Law Journal, vol. 76, no. 1 (2015).

Bova, Francesco, Miguel Minutti-Meza, Gordon Richardson, and Dushyantkumar Vyas. “The Sarbanes-Oxley Act and Exit Strategies of Private Firms.” Contemporary Accounting Research, vol. 31, no. 3 (Fall 2014).

Brown, Lawrence D., Andrew C. Call, Michael B. Clement, and Nathan Y. Sharp. “The Activities of Buy-Side Analysts and the Determinants of Their Stock Recommendations.” Journal of Accounting and Economics, vol. 62 (2016).

Chaplinsky, Susan, Kathleen Weiss Hanley, and S. Katie Moon. “The JOBS Act and the Costs of Going Public.” Journal of Accounting Research, vol. 55, no. 4 (September 2017).

Cheng, Mengyao. “The JOBS Act and IPO Issuance Rate.” Journal of Accounting and Public Policy, vol. 42 (2023).

Cortes, Felipe. “Firm Opacity and the Opportunity Cost of Cash.” Journal of Corporate Finance, vol. 68 (2021).

Donelson, Dain C., Matthew S. Ege, and John M. McInnis. “Internal Control Weaknesses and Financial Reporting Fraud.” Auditing: A Journal of Practice & Theory, vol. 36, no. 3 (August 2017).

Evans Jr., Lawrance, and Jeremy Schwartz. “The Effect of Concentration and Regulation on Audit Fees: An Application of Panel Data Techniques.” Journal of Empirical Finance, vol. 27 (2014).

Ewens, Michael, Kairong Xiao, and Ting Xu. “Regulatory Costs of Being Public: Evidence from Bunching Estimation.” Journal of Financial Economics, vol. 153 (2024).

Fischer, Mary, and David Kyle Shumburger. “Corporate Financial Restatements From 1995-2020.” Journal of Accounting and Finance, vol. 22, no. 1 (2022).

Ge, Weili, Allison Koester, and Sarah McVay. “Benefits and Costs of Sarbanes-Oxley 404(b) Exemption: Evidence from Small Firms’ Internal Control Disclosures.” Journal of Accounting and Economics, vol. 63 (2017).

Guragi, Binod, and Paul D. Hutchinson. “Material Weakness Disclosures and Restatements: Value of External Auditor Attestation.” Accounting Research Journal, vol. 32, no. 3 (2019).

Holder, Anthony D., Khondkar E. Karim, and Ashok Robin. “Was Dodd-Frank Justified in Exempting Small Firms from Section 404b Compliance?” Accounting Horizons, vol. 27, no. 1 (2013).

Iliev, Peter. “The Effect of SOX Section 404: Costs, Earnings Quality and Stock Prices.” The Journal of Finance, vol. 65, no. 3 (June 2010).

Kinney Jr., William R., and Marcy L. Shepardson. “Do Control Effectiveness Disclosures Require SOX 404(b) Internal Control Audits? A Natural Experiment with Small U.S. Public Companies.” Journal of Accounting Research, vol. 49, no. 2 (May 2011).

Lewis, Craig M., and Joshua T. White. “Deregulating Innovation Capital: The Effects of the JOBS Act on Biotech Startups.” The Review of Corporate Finance Studies, vol. 12, no. 2 (2023).

Radu, Camélia, and Aline Segalin Zanella. “The Effectiveness of the Auditor’s Opinion on the Internal Controls Over Financial Reporting.” Journal of Financial Crime, vol. 30, no. 4 (2023).

Yu, Ji, Lei Gao, Zabihollah Rezaee, and Shipeng Han. “The JOBS Act, Underwriting Costs, and Voluntary Disclosure.” The Journal of Corporate Accounting & Finance, vol. 32 (2021).

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday afternoon, GAO posts on its website newly released reports, testimony, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Order by Phone

The price of each GAO publication reflects GAO’s actual cost of production and distribution and depends on the number of pages in the publication and whether the publication is printed in color or black and white. Pricing and ordering information is posted on GAO’s website, https://www.gao.gov/ordering.htm.

Place orders by calling (202) 512-6000, toll free (866) 801-7077, or
TDD (202) 512-2537.

Orders may be paid for using American Express, Discover Card, MasterCard, Visa, check, or money order. Call for additional information.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

A. Nicole Clowers, Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us