One of the great things about being a privately-held company is that you don't have to worry about Sarbanes-Oxley, right? Well, not if you are considering a sale. The fact is if an exit is in your near-term horizon (next three years), you should take the financial controls mandated under Sarbanes-Oxley very seriously. As part of evolving your management team, this means hiring a CFO who has experience in creating a strong control environment. I don't think prior SOX experience is as important as prior experience putting in place and running financial systems. The problem with SOX is not its complexity, it's the vague nature of it that makes it so hard to interpret.
As a corporate buyer, it is very important to me that a target has taken the time to implement internal control and financial reporting systems that are compliant with SOX. In addition, those systems should be in place for more that just a few months or a year prior to the sale. Due diligence is a disastrous time to start making your company SOX compliant. That will surely delay the closing by several months and cost you a lot of money.
I think private targets that can prove compliance with the requirements of Sections 302 and 404 are worthy of a valuation premium that would out-weight the costs of such implementation.
Why is this so important? Well, Section 302 requires that the CEO and CFO of a publicly-held company certify the financial results and internal controls of the company, including any acquisitions made during that quarter. Section 404 is similar but governs the entire year and includes an auditor's assessment and examination of the company's internal controls and financial reporting, including acquisitions. If the auditor finds any "material weakness" it must issue a adverse opinion. In addition, the Act allow criminal charges to be brought against the CEO and CFO for falsely certifying financial results. While there is a materiality threshold for acquisitions, it is quite vague.