Earlier this month, the General Accounting Office issued a report on the impact of the exemption of small public companies from the Sarbanes-Oxley Act’s internal control attestation requirements. In 2010, the Dodd-Frank Act exempted public companies with market capitalization of less than $75 million from section 404(b) of the Sarbanes-Oxley Act, which requires that public companies obtain an annual audit by a registered public accounting firm of their internal control over financial reporting. The Act also directed the GAO to conduct a study of the impact of this exemption and report to Congress within three years of enactment of the Dodd-Frank Act.

The report found that since the implementation of the auditor attestation requirement, companies exempt from the requirement have had more financial restatements that nonexempt companies, and the percentage of exempt companies restating generally has exceeded that of nonexempt companies. The GAO considered, but did not reach any firm conclusions on, whether the costs of compliance with the attestation requirement by small companies exceeded the benefits. The report did cite evidence that compliance with the auditor attestation requirement has a positive impact on investor confidence.

The GAO’s only recommendation was that the SEC consider requiring exempted public companies to explicitly disclose whether they obtained an auditor attestation of their internal controls. The SEC advised the GAO that such information can be easily determined by investors from information that is already disclosed in the annual report. But the GAO nonetheless concluded that an explicit disclosure “would increase transparency and investor protection by making investors readily aware of this important information.”