Which Companies Are Covered By SOX?
When exactly does the Sarbanes-Oxley Act apply to a company?
The provisions of the Sarbanes-Oxley Act (a.k.a. SOX) sometimes apply to "issuers" (i.e. companies that are going public pursuant to the 1933 Securities Act and companies that have already gone public which are regulated by the 1934 Securities Exchange Act) and sometimes only to companies that have already gone public which are regulated by and required to make reports the 1934 Securities Exchange Act.
But, some provisions of the Act and its regulations exempt or alter its requirements, mostly in regard to audits of and establishment of "internal controls" in the case of "small" publicly held companies.
The law also applies to accountants, securities professionals, members of a board of directors, officers and major shareholders of such corporations.
SOX does not apply to private offerings of stock made pursuant to an SEC regulatory exemption from the securities laws for closely held companies, to companies that are not publicly held, and to foreign companies that are not listed on any U.S. stock exchange which have never been listed on any U.S. stock exchange.
What Does SOX require?
what do they have to do in order to avoid criminal penalties? What
about civil penalties?
Short answer: They have to not violate the provisions of SOX.
Long answer: They must
Establish "internal controls", which are steps taken by a company to prevent accounting fraud by insiders, by methods set forth in the law and related regulations. Companies then have to have an external audit of the adequacy of the company's "internal controls" conducted annually pursuant to standards set by the Public Company Accounting Oversight Board. The work necessary to establish internal controls and then conduct the audits of these internal controls (the internal controls audit is Section 404 of SOX) is the main source of compliance costs.
Disclose material off balance sheet transactions.
Not defraud, coerce or bribe outside auditors.
Not knowingly alter, destroy, mutilate, conceal, cover up, falsify, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence an investigation by a government agency, or in a bankruptcy case.
Not retaliate against whistleblowers who report fraud.
Not sign off as a CEO or CFO as required by the act on financial statements and tax returns knowing that they are fraudulent or do not comply with securities laws and accounting standards.
There are overlapping civil and criminal penalties, with criminal penalties generally requiring that the individual charged personally had knowledge of, or participated in intentional misconduct.
What Impact Does SOX Have On The Cost Of Going Public?
it seems SOX increases the cost tremendously if it is required for all
This is inaccurate propaganda.
SOX compliance costs are on the order of 0.4% of the revenues and have been offset by a 0.5-1.5 percentage point drop in interest rates on corporate bonds due to the fact that it reduces the risk of defaults caused by fraud. SOX did not make foreign companies less likely to list their stocks on U.S. Exchanges.
The costs of compliance with SOX net of the benefits arising from compliance with SOX are negligible rather than "tremendous" for most companies, although they can become material. Compliance costs would have been up to about 2.4% of revenues if it weren't for the small public company exemptions in the smallest publicly held companies.
SOX modestly shifts the scale at which it makes economics sense to go public towards largely companies, a concern that has been significantly offset by more lenient exemptions for private offerings of stock and bonds.
This isn't to say that going public and being publicly held isn't expensive:
Underwriting makes up the largest component of IPO costs by far. Based
on the public registration statements of 315 companies, on average,
companies incur an underwriter fee equal to 4-7% of gross proceeds,
plus an additional $4.2 million of offering costs directly
attributable to the IPO. Legal and Accounting fees also add up and can
increase significantly for larger companies that may face additional
complexities in preparing for an IPO.
Being publicly held costs $1 million to $1.9 million a year in compliance costs, and in addition disqualifies a company from using pass through taxation (requiring them to pay a corporate level tax on their profits in addition to taxes owed by shareholders, resulting in double taxation).
The desire to secure pass through taxation is generally a much more important motivation than the desire to avoid the compliance costs associated with being publicly held in most "going private" transactions (usually involving leveraged buy outs of companies by their own management which are financed by large banks, or buy outs by private equity companies and hedge funds).
But, the lion's share of the costs of going public and being publicly held were unchanged by SOX, which had no real impact on underwriters fees, for example. SOX's main impact is that it mainly moderately increases the accounting costs involved.
What Is A Publicly Held Company?
Generally speaking, a company is "publicly held" if (1) it has made a public offering under the '33 Act, (2) it is listed on a U.S. stock exchange, (3) it has more than 500 unaccredited investors, or (4) it has more than 2000 investors (including accredited investors) and has more than $10,000,000 of net worth per its balance sheet at year end (even if it has fewer than 500 accredited investors). It is also subject to SOX if it was formerly listed on a U.S. stock exchange and became a foreign company not listed on a U.S. stock exchange.
As a matter of empirical reality, the vast majority of companies in the U.S. either have few than 50 investors, or are publicly held. Companies in between are quite rare and are economically fairly insignificant in the U.S. economy. The are several million privately held companies, the number of publicly held companies is in the low tens of thousands, and the number of companies in between is probably in the single digit thousands.
Generally speaking, an offering of stock, bonds or investment opportunities that is open to unaccredited investors and involves more than $5,000,000 of funds raised, or is marketed to the general public, it must be registered under the '33 Act before investments can be offered to the public.
There are two main "private offering" exemptions from the '33 Act found in SEC Regulation D that allow stock of privately held companies to be sold without registering under the '33 Act.
Rule 504 of Regulation D allows investments of up to $5,000,000 a year with minimal requirements but strict limitations on marketing to the general public, and requires stock to be held for at least one year.
Rule 506 of Regulation D allows unlimited investments by accredited investors in privately held companies with disclosures that are a simplified bare bones version of what companies that are going public must disclose. "Accredited investors" include affluent individuals, certain kinds of professionals, and institutional investors.
Regulation A provides additional crowdfunding exemptions, one of which applies to smaller single state offerings regulated by state securities laws, and the other of which applies to larger national crowdfunding campaigns.
This summary should not be relied upon as legal advice. It intentionally oversimplifies a complex body of law to convey the broad outlines of what is covered, but omits details that could be material in a particular case.