Sarbanes-Oxley Compliance Costs: Size Matters, Burden Differs
In June 2025 the Government Accountability Office released report GAO-25-107500, authored by Michael E. Clements and his team for the House Subcommittee on Capital Markets. Drawing on SEC data, academic literature and interviews with seventeen audit-committee members, the study explores what it actually costs public companies to comply with section 404 of the Sarbanes-Oxley Act and how the longstanding exemption from auditor attestation affects smaller issuers.
GAO confirms that section 404 drives two broad categories of expense. Internally, firms must hire or train staff, deploy technology, and devote travel and other resources to document, test and monitor their controls over financial reporting — costs that are embedded in day-to-day operations and therefore hard to peel away from ordinary overhead. Because these systems often serve multiple business purposes, precise accounting for compliance outlays remains elusive; even staff time spent retrieving documents for external auditors frequently goes untracked. Externally, companies pay auditors for an integrated audit that covers both the financial statements and management’s control assessment, so the attestation fee is folded into total audit fees rather than called out separately.
For large companies the dollar amount is obviously higher, yet GAO finds that the relative burden weighs heaviest on smaller issuers. In its nongeneralizable sample of ninety-six firms, those required to obtain auditor attestations (non-exempt accelerated and large accelerated filers) spent roughly nineteen percent more than similarly situated exempt companies, but when compliance cost is scaled to assets, the hit to small companies is proportionally greater. Crossing the $75 million public-float or revenue threshold that triggers attestation brings a one-time jolt: audit fees rose a median $219,000, or 13 percent, in the first year a company became non-exempt, then leveled off as both auditors and management moved down the learning curve.
Why does this matter? Effective internal control is the first line of defense against error and fraud. GAO’s separate review of 2022-2023 restatements underscores the link: 73 percent of exempt companies that had to restate financials cited both ineffective controls and material weaknesses, compared with 59 percent of their non-exempt peers. Weak controls also appeared in most SEC accounting-fraud actions the report examined. These findings suggest that, although the exemption saves money, forfeiting auditor attestation may come at the cost of diminished control rigor and diminished investor assurance.
Still, the exemption delivers tangible benefits. Smaller companies told GAO that foregoing the auditor opinion frees scarce capital and managerial bandwidth for research, clinical trials, IT upgrades and other growth priorities; some firms estimated seven-figure savings in the first exempt year. Investors, however, may discount earnings where an independent opinion on controls is absent, raising the cost of capital. Studies cited by GAO document wider IPO bid-ask spreads and greater underpricing for emerging-growth companies that enjoy reduced disclosure requirements, a signal that markets price in the extra uncertainty.
The report does not recommend statutory changes but supplies Congress with data to weigh further relaxation against potential erosion in reporting quality. It also highlights information gaps: neither companies nor auditors routinely itemize section 404 costs, and many surveys rely on unverifiable self-reporting. GAO therefore urges caution in generalizing its cost figures, yet the directional insights are clear. Compliance costs remain material, especially for the smallest public firms; investors value the added assurance of an auditor’s opinion; and, where that opinion is absent, the incidence of control-related restatements is noticeably higher.
Readers interested in the full analysis can find “Sarbanes-Oxley Act: Compliance Costs Are Higher for Larger Companies but More Burdensome for Smaller Ones” (GAO-25-107500) at gao.gov. Credit is due to Director Michael E. Clements and the GAO team for an evidence-rich contribution to the debate over regulatory balance in U.S. capital markets.
Disclaimer: This post summarizes GAO findings for general information only. While every effort was made to ensure accuracy, it does not constitute legal, accounting or investment advice and should not be relied upon as such.