The smallest of public companies may have won their long-fought battle to escape an audit of internal controls—but that doesn’t mean they are free from scrutiny.

The Dodd-Frank Wall Street Reform and Consumer Protection Act gave small public companies (those with a market capitalization below $75 million) a permanent exemption from the Sarbanes-Oxley Section 404(b) requirement to obtain an audit of internal controls over financial reporting. The audit requirement was due to take effect for fiscal years ending on or after June 15, following numerous delays granted by the Securities and Exchange Commission as larger companies and regulators worked their ...