Going public means subjecting your company to a significantly greater degree of financial and regulatory scrutiny. But in the pre-IPO hustle for market share, organizations often leave a linchpin of their financial infrastructure to the very last minute: internal control over financial reporting (ICFR).

Designed to address risks related to financial reporting, ICFR helps ensure the accuracy of corporate financial statements and protect against fraud and errors. For example, such controls may include limiting access to accounting software, or segregating duties so individuals can’t bypass financial checks and balances. Federal law requires public companies to establish and maintain ICFR; under the Sarbanes-Oxley Act of 2002 (SOX), companies must also assess the effectiveness of those controls and disclose the results annually.

Insufficient controls can have far-reaching consequences for a company, impacting its financial performance, reputation, legal standing and long-term viability. Disclosure of material weaknesses in financial reporting controls can send a company’s stock price tumbling; failing to remediate those issues can result in hefty regulatory penalties.

Strong financial controls build a secure platform for future growth, offering numerous advantages in addition to ensuring the accuracy and reliability of financial reporting and preventing fraud and errors. ICFR supports effective decision making and optimizes resource allocation, contributing to overall cost reduction and enhanced profitability.

Companies with strong financial controls are also generally more attractive to investors. Such systems boost confidence in the company’s financial management and governance practices, increasing the likelihood of a successful IPO and potentially resulting in a higher valuation. Solid internal financial controls also reduce audit risk — and can potentially lower audit fees. When controls are robust, auditors can avoid time and cost-intensive retesting of financial metrics.

As the IPO window reopens and startups prepare to go public, bankers and investors are paying closer attention to how those companies operate and whether their financial controls are sound. The key to success is starting early. Instead of taking on ICFR when you’re sprinting through the countdown to a public listing — a moment in which your teams are already stretched thin — build up effective protocols as your business grows so that they’re second nature by the time you ring the opening bell.

In what follows, we’ll discuss key ICFR considerations, pitfalls and best practices for pre-IPO companies, from technical challenges and data integrity to testing and remediation.

Navigating ICFR hurdles

Building the foundation for your company’s internal financial reporting controls takes time, attention and patience — all of which can be in short supply in the runup to an IPO. Here are some common ICFR pitfalls and how to address them:

• Time constraints. Bolting on a controls framework hastily at the IPO date or during the one-year grace period window for complying with SOX requirements leaves little time or bandwidth to adjust—especially if testing reveals gaps or failures.
  • Start focusing on ICFR one to three years before you plan to list. That allows adequate time to get systems in place that both ensure compliance and fit your organization’s needs.
• Resource limitations. Companies and private-equity portfolio managers keeping a careful eye on cash flow in the runup to an IPO may be reluctant to spend money on financial controls—even if doing so now will benefit them in the long run.
  • You don’t have to do everything on day one. Prioritize the most essential ICFR measures for your business, then address the rest.
• Staffing constraints. Fast-growing companies often lack experienced accounting professionals. Employees sometimes struggle to meet day-to-day work requirements and even larger teams may not have the bandwidth to set up SOX-compliant infrastructure; at the same time, introducing controls into an already stressed environment increases the likelihood of failure.
  • Reduce the load on accounting staff by working with qualified external partners to ramp up ICFR efforts before that critical IPO period.
  • Once those protocols are in place, ensure ICFR is part of employees’ daily routine, so it doesn’t present an additional burden in the runup to a listing.
  • In a tight labor market, well documented internal controls can streamline on-boarding new employees and ensure consistency.
• Technology challenges. In a digitized world, your IT systems need to reflect—and reinforce—the controls set up on the accounting side. For instance, does everyone have access to company financial and enterprise resource planning (ERP) systems and data? Could technical changes on the IT side hurt data integrity?
  • Segment system access according to financial duties, limiting the number of employees with the keys to the kingdom.
  • Institute change management protocols to ensure IT updates don’t introduce unauthorized or untested changes to IT system that result in errors, data integrity issues and system failures.

Plan early and start small

Establishing and maintaining strong internal controls requires an adequate runway. While there’s no one-size-fits-all solution, in our experience it’s preferable to act early instead of trying to get it all done at once. Fortunately, even early-stage startups can lay the groundwork for internal controls that will serve them well as public companies. Here’s how to get started:

• Assess financial statements and infrastructure. Determine what processes are driving the business and what functions are in place, such as material revenue processes, accounts payable or the financial close and reporting process. What systems support these functions? How mature is the company — is it on QuickBooks, or an ERP system?
• Draw up your ICFR roadmap. Set priorities by ranking accounting processes according to risk. Financial reporting, for example, is very important, be it account reconciliation or journal entry controls to monitor that balances reported in financial statements reflect the proper underlying transactions and account activity. Create a timeline and action plan, so you can pick an area, digest it and move on to the next process.
• Evaluate your significant processes and system design. Identify and document your process/system from inception to reporting, along with related controls. Log any gaps and take steps to remediate them by creating procedures and controls to ensure financial data in each process is complete, timely and accurate. For instance, make sure all invoices are reviewed and approved — with a formal signoff — before they get paid.
• Assess effectiveness. Evaluate control activities to make sure they operate effectively, making sure to retain adequate evidence for all controls. Are there records to back up financial processes and show that the controls are being performed regularly? Establish monitoring protocols to verify ICFR on an ongoing basis.


Strong ICFR sets you up for post-IPO success

As the IPO market picks up, companies looking to tap public markets should carve out time and resources to make sure their financial controls pass muster — now, and in the years to come. The benefits extend beyond regulatory compliance, from boosting your chance of a successful IPO to building a strong foundation for future growth.

But it’s not something that can happen overnight. If your company has IPO plans, get started on ICFR now to build investor confidence and position your company for long-term success.

Have questions? Connect with one of our IPO experts today.

By Allison Flusche

---

Copyright © 2024, CBIZ, Inc. All rights reserved. Contents of this publication may not be reproduced without the express written consent of CBIZ. This publication is distributed with the understanding that CBIZ is not rendering legal, accounting or other professional advice. The reader is advised to contact a tax professional prior to taking any action based upon this information. CBIZ assumes no liability whatsoever in connection with the use of this information and assumes no obligation to inform the reader of any changes in tax laws or other factors that could affect the information contained herein.

CBIZ MHM is the brand name for CBIZ MHM, LLC, a national professional services company providing tax, financial advisory and consulting services to individuals, tax-exempt organizations and a wide range of publicly traded and privately held companies. CBIZ MHM, LLC is a fully owned subsidiary of CBIZ, Inc. (NYSE: CBZ).