Sarbanes-Oxley, often abbreviated to SOX, is a set of accounting rules that were introduced by congress in response to the accounting scandals of Enron, Worldcom and their like during the dotcom boom. It is a mixture of different regulations, some concerned with how companies are audited, some concerned with liability a CEO and CFO have for irregularities in their companies, and so on. Many provisions are completely uncontroversial.
But the biggest problem, especially for startups, comes about from section 302 and 404. Section 302 says that companies must have internal financial controls, that the management of the company must have evaluated them in the previous 90 days. Section 404 says that management and the auditors must report on the adequacy and effectiveness of the internal controls.
In practice this means that auditors must repeatedly go over every minute piece of data, such as every cell in a spreadsheet, every line on every invoice, before they can sign off. For a small company, the audit fees for doing this are a minimum of $3M per year. For larger companies the amount grows, of course, but slowly so that it is much less burdensome for a large established company (where it might be 0.06% revenue) than for a small one.
Only public companies are required to comply with SOX so you could argue that it doesn’t matter that much for a small venture funded startup. At one level that is true. But it has also meant that a company has to be much larger to go public.
In the past, an EDA company with $20M in revenue and $3M in profit (with good growth) could go public. But now a private company like that must comply with SOX to go public, so that $3M cost suddenly hits and the company has $20M in revenue and no profit at all. It must wait until it is, perhaps, $80M in revenue with $12M in profit (which would have been $15M without SOX). In EDA, in particular, this is extremely difficult to achieve with a single product since most sub-markets are not that large. In effect, EDA companies can no longer go public.
This applies to many venture-backed startups in whatever industry. Since the introduction of SOX most IPOs have taken place in either London or Hong-Kong. It is controversial just how much of that is directly due to SOX but clear that a lot of companies that could have gone public in the past in the US have not done so, and as a result have been acquired for lower valuations that would otherwise have been the case.
In the early 2000s (SOX was passed in 2002) the stock market was not friendly to IPOs as it recovered from the downturn. But venture backed IPOs in 2005 and 2006 were way below what they were in the 1990s, and Q2 2008 was the first quarter in 30 years in which no venture-backed IPOs took place in the US. This has been another reason that VCs are rarely willing to invest in EDA companies.