We all agree that privately held companies are not required by law to follow SOx regulations. However, would it not be a good decision to implement strong internal controls regardless of the size of the organization? What are some of the controls that could be effective to put in place for smaller companies that do not have the budgets of larger organizations?