Private companies must undertake certain regulatory obligations in order to conduct an Initial Public Offering (IPO). In addition to preparing financial statements and complying with appropriate accounting standards, a company considering going public must also assess their system of Internal Controls over Financial Reporting (ICFR) under the Sarbanes-Oxley Act of 2002.
Section 404 of the Sarbanes-Oxley Act (SOX 404) requires companies to review their ICFR and declare whether they are “effective” or “ineffective”. Essentially, companies must determine if their ICFR are adequate enough to produce financial statements that are complete and accurate.
For the process of establishing and evaluating internal controls, companies are required to use a framework, the most predominant of which is the 2013 COSO Internal Control – Integrated Framework. The framework provides the foundation for defining internal controls and underlying principles, and provides direction for all levels of management in regards to designing and implementing internal controls and assessing effectiveness.
When a company is considering going public, it is imperative to establish certain compliance practices and develop a robust system of internal controls, including (but not limited to):
- Dedicating sufficient resources, such as accounting personnel with knowledge of and experience with U.S. Generally Accepted Accounting Principles (GAAP).
- Establishing appropriate tone-at-the-top to minimize fraud or other unethical practices.
- Developing a top-down risk-based approach to minimize risk of filing financial statements with material errors.
- Implementing automation when possible, such as Enterprise Resource Management (ERP) software, to automatically integrate management of main business processes.
- Maintaining a relationship with external auditors.
To get a sense of how prepared new IPOs are in terms of ICFR, this analysis looks at the effectiveness of controls as disclosed by SEC registrants in the first management report on ICFR after the IPO year.
As many companies that undergo an IPO are eligible to register as an Emerging Growth Company (EGC), and are therefore not required to obtain an auditor’s attestation on management’s assessment of ICFR, this analysis looks at the Management Report on ICFR after an IPO.
The amount of reports disclosing ineffective ICFR after an IPO has increased from 12% in 2010 to 21% in 2018, with a high point of 24% in 2016.
As an important note, 2019 is excluded from the above longitudinal analysis on ineffective ICFR after an IPO due to incomplete data; less than 20% of IPOs conducted in 2019 have subsequently filed a management’s report on ICFR. However, based on the reports currently available, 39% have disclosed a weakness in internal controls.
Issues Identified in Management’s Report on ICFR
Looking at the top internal control issues disclosed on the first management report on ICFR after an IPO, the top three issues are understandable based on known challenges of smaller companies becoming public. SOX 404 requirements are extensive, and smaller companies may not have the infrastructure in place prior to their IPO that would constitute effective internal controls.
Nearly all of first management reports on ICFR that disclose ineffective controls include an issue with accounting documentation, policy and/or procedures, while three-quarters of reports disclose an issue related to accounting personnel resources, and over half disclose an issue pertaining to segregation of duties issues.
Some companies have smaller accounting departments prior to going public that are not in compliance with SOX 404. For example, if a company has one employee in their accounting department who is responsible for both cash receipts and bank reconciliations due to an overall lack of other accounting personnel, this would be considered a segregation of duty issue.
Conversely to internal control related issues, an analysis of the top accounting-related issues identified in the first management report on ICFR after an IPO containing ineffective controls shows that, overall, fewer management reports identify material weaknesses resulting in or resulting from an accounting issue.
The most commonly identified accounting-related issue in ineffective controls after an IPO are issues relating to revenue recognition (11.8% of filings), which consist of control deficiencies in approach, understanding or calculation associated with the recognition of revenue. This is followed by issues relating to liabilities, payables, reserves, and accrual estimate failures (10.1%); from an internal control perspective, issues in this area most often occur because of cut-off failures in recording liabilities and matching them to related revenue or inventory accounts.
Time to Remediate Internal Control Weaknesses
Based on the companies in this population that identified ineffective internal controls in the first management’s report after an IPO, the majority were able to remediate the issues by the next management’s report. This only includes registrants that subsequently disclosed effective ICFR; it does not include registrants that stopped filing annual reports due to mergers/acquisitions or registration termination (Form 15).
Subsequent Events
Despite many registrants successfully remediating weaknesses in ICFR after an IPO, an additional analysis of other accounting and control events reveals interesting trends.
Registrants that disclosed ineffective internal controls on their first management report after an IPO were more likely in subsequent years to have a late filing, disclose an impairment or financial restatement, in addition to being more likely to receive a going concern audit opinion.
The higher likelihood of a company experiencing one of these adverse events may not be directly related to the material control weaknesses initially disclosed after an IPO. However, a higher likelihood of late filings, impairments, and restatements does suggest that there are pervasive issues in the control environments of these companies that can affect financial statements for years after becoming public.
Deficiencies in internal controls over financial reporting that are deemed to be material weaknesses could result in losing investor confidence in the accuracy and completeness of financial reports, which could cause stock price to decline. Moreover, an effective system of internal controls over financial reporting mitigates the risk of committing an error that later necessitates a financial restatement. Errors resulting from material weaknesses in controls that must be corrected in a restatement can result in reduced investor confidence and shareholder value, SEC fines, reputational damage, and lawsuits.
However, developing effective ICFR can be costly and many private companies must complete extensive work in order to establish an internal control system prior to conducting an IPO. While some companies can successfully remediate these problems in a timely manner due to an influx of capital from the IPO process, some companies cannot.
For more information about Audit Analytics or this analysis, please contact us.
Interested in our content? Be sure to subscribe to receive our email notifications.