Tom Johansmeyer President and CEO j-Knowledge

The cost of compliance has been most pronounced in smaller public companies. Without vast resources and economies of scale to support their efforts, smaller public companies struggle to comply with SOX. While absolute costs are lower for smaller companies, they pay a disproportionately high amount to attain SOX compliance. Larger public companies can accept SOX as part of the cost of doing business, however grudgingly. For smaller public companies, SOX is a salient barrier to growth.

Methodology
Micro cap companies have received a steady stream of deferments, sparing them the disproportionately high costs of compliance. Though larger companies have had to comply, their relative sizes and maturities of operation make it difficult to apply their lessons to smaller counterparts. Smaller companies can learn from "mid cap" companies, which currently have to comply but which lack the financial and human resources of the Fortune 1000.

For the purposes of this study, mid-cap companies have total revenues of between US$500 million and US$750 million, with market capitalizations that range from approximately US$500 million to around US$3 billion (with limited exceptions). According to OneSource, 911 public companies fall into this range. Among them, 91 have disclosed their recent fiscal year spend on SOX (in annual 10-K filings with the US Securities and Exchange Commission). While results did vary by company, mid-caps spent on average US$1.75 million to comply with SOX. More telling, though, is that for these 91 companies, SOX compliance equated to an average of 0.29% of total revenues and 0.34% of total shareholder value. Essentially, one accounting initiative can require a substantial portion of company revenues and erode shareholder value noticeably.

Findings
Mid-cap companies exhibit interesting spending behavior in regards to SOX compliance spending. On an absolute basis, the cost of compliance increases as total revenues decline. A mid-cap with total revenues of US$700 million, for example, tends to spend less, on average, than a company with US$500 million to address SOX compliance. The curve is not smooth, but the trend is evident.

For the purposes of this study, the 91 public companies who disclosed SOX spending were broken into eight groups of ten and one group of eleven. Groups were formed by placement in the list of 91 companies as determined by total revenues, e.g. the top ten companies comprise the first group, and the next ten comprise the second group. The average total revenues, market capitalization and SOX spend for each group was used for the comparison.

With some exceptions, SOX spending for each group increases as the average total revenues for each group declines. Group 1 shows an average compliance spend of only US$1.2 million while the three groups with the smallest companies on the list have average compliance spends of around US$2 million.

As absolute compliance spend increases with declining total revenues, the ratio of SOX spending to total sales naturally increases, and it increases more rapidly than absolute SOX spend. Companies in Group 1 committed an average of 0.17%of total sales to address SOX compliance, gradually increasing to 0.29% of revenues for companies in Group 6. The ratio spikes for the last three groups, reaching 0.42% of total revenues for Groups 7 and 9.

Conclusion
The burden of compliance clearly increases for mid-cap companies as they are smaller - in both relative and absolute scales. At first glance, it seems counterintuitive; one would expect the vast, complex and involved operations of larger companies to require a larger investment in SOX compliance. Certain critical factors, though, converge to make SOX compliance more costly for smaller companies.

Economies of Scale: Larger companies can build once and propagate continually. An investment in SOX compliance for one segment of the business can yield a solution that can be duplicated across other divisions at a fraction of the cost. For companies with centralized operations, especially, the savings are tangible.

Operational Maturity: Processes and systems drive the operations of larger companies. As a result, control is easier to implement. The processes already exist, often with some measure of control already. Smaller companies often have to define business processes and implement control at the same time.

Existing Audit Diligence: The role of auditors in larger companies is more extensive in larger companies, requiring some control validation already. The incremental spend needed to attain SOX compliance is lower because some of the work already has been completed. Smaller companies need to adopt a more mature audit in conjunction with SOX compliance efforts.

The cost of compliance for smaller companies is necessarily higher than it is for their larger counterparts. Smaller companies have to do more than just comply with SOX; they have to refine operations while completing compliance efforts. This compliance "plus" approach results in the higher costs experienced by smaller companies.

The lessons of mid-cap SOX compliance spending behaviors signal the potential impact of SOX on small cap and micro-cap companies. When the SEC requires companies with smaller market caps to comply, their compliance costs likely will be even higher than those of mid-caps, squeezing an already vulnerable subset of the market.