Are you getting what you pay for?

  • Share

Make sure you have your internal controls in order.

Jasmine, CEO of 123 Innovations, closed the door as Max, the CFO, took a seat.

“What do you think?” Jasmine asked. “Are we ready to go public?”

Shepherding 123 through the initial public offering (IPO) process in an environment of increased regulatory and investor scrutiny would require a significant commitment, both in terms of time and resources.

Max was not confident that 123’s internal controls and procedures were sufficient to meet public company requirements. After all, 123 would have to begin acting like a public company long before it went public.

1. What’s the issue?

Initiating an IPO is one of the biggest decisions a private company can make. This is especially true in today’s environment, where investor and regulatory scrutiny are high, and investment dollars remain scarce.

Although the IPO filing and marketing process may last only three to four months, it is only one step in a much longer journey when evolving from a private to a public company. Our research and experience suggest that companies with the most successful IPOs consistently approach the IPO as a transformational process and begin to act and operate as public companies at least one year prior to the IPO event.

As a key member of the IPO management team, the CFO will need to determine that the company’s infrastructure preparations are complete. Financial reporting systems, governance and compliance, and internal controls all need to be in place.

Strong governance, risk and compliance systems, along with robust financial reporting systems and processes, not only promote timely and accurate reporting, but also foster a culture of accountability.

2. Why now?

As the global economy continues to recover and investors look for growth companies to drive portfolio value, investor interest in IPOs is heating up. Although the number of IPOs was low in 2012 compared with other years, 82% of institutional investors surveyed have invested in IPO and pre-IPO stock in the past 12 months, according to our survey.

60% of survey respondents say that they base their IPO investment decision on a company’s financial performance measures, and 66% say that systems and controls should be implemented and operating effectively prior to the IPO.

Private companies considering an IPO need to put strengthening internal controls at the top of their priority list.

3. How does this affect you?

CEOs looking to go public often cite enhancing internal controls as one of their most challenging corporate governance issues.

In particular, companies struggle to “devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances,” regarding the reliability of financial reporting and the preparation of financial statements — as required by the US Securities Exchange Act of 1934 and the Foreign Corrupt Practices Act of 1977.

In addition, in 2002, the Sarbanes-Oxley Act (SOX) strengthened issuers’ accountability for, and public disclosure of compliance with, the Foreign Corrupt Practices Act’s internal controls requirements.

4. What’s the fix?

Companies can take several steps to make the journey to IPO readiness easier:

  • Assess internal control readiness. Companies need to determine where they are on the continuum of internal control compliance, where they need to be and how to close the gaps.
  • Establish an approach and timeline for remediation. Once a company has completed its assessment and identified its deficiencies, it will need to develop a plan and timeline for closing the gaps long before going public.
  • Document walkthroughs of processes and controls. Companies will need to perform walkthroughs for each major class of transactions to understand and document the process flow of transactions and the controls management has put in place, the strength of their design, the completeness of the process, and any controls that prevent or detect fraud and errors.
  • Remediate processes and controls. Based on the readiness assessment and findings from the walkthroughs, and following the remediation plan, companies should fix any identified weaknesses within the timeline specified.
  • Test processes and controls. Once the remediation exercise is complete, companies will need to again test their processes and controls to determine the success of remediation efforts and assess their readiness for the new regulatory compliance and reporting requirements for internal controls.

If the resource requirements and level of effort required to achieve readiness exceed current capabilities, companies may want to consider a co-sourcing or outsourcing arrangement. This is very common for companies embarking on an IPO and offers a number of benefits, including:

  • Offering a scalable support function that is more cost effective than building in-house capacity
  • Providing leading-practice approach plans, documentation and testing, including a smart controls lens that does not over-engineer the control environment
  • Improving the company’s internal control environment through education and training

5. What’s the bottom line?

EY chart - Leading class internal control practices

Getting ready for an IPO can be a daunting exercise even under ideal circumstances. In an era of increased investor scrutiny and regulatory complexity, the effort can sometimes feel insurmountable.

But it does not have to be. The key is to be prepared.

With enough time, careful planning and a risk-based approach, companies can strengthen internal controls to meet regulatory requirements. If help is necessary, CFOs should not hesitate to leverage experienced third-party providers.

The initial investment will pay off over time by promoting greater accountability in the organization, reducing financial reporting risk, lowering compliance costs and avoiding unpleasant surprises after your company is public.