If a company is considering going public through a special purpose acquisition company, a traditional initial public offering, or a direct listing, having effective internal controls is a necessary step for a successful transition. This blog details some important considerations for achieving an appropriate internal control environment for this leap.
By Brian P. Sullivan, CPA, CFA
The proliferation of special purpose acquisition companies (SPACs) in 2020 and 2021 have resulted in many companies electing to access capital markets through an acquisition by a SPAC. But whether becoming public through a SPAC, a traditional initial public offering, or a direct listing, having effective internal controls is a necessary step in a successful transition to going public. The Sarbanes-Oxley Act of 2002 (SOX) requires publicly traded companies in the United States to maintain sufficient internal controls over financial reporting (ICFR) to ensure accuracy of financial statements and prevent corporate fraud. SOX requires management to perform an annual assessment of internal control effectiveness, and most large publicly traded companies are required to have an external auditor’s assessment of the effectiveness of the company’s ICFR.
The following are important considerations for achieving an appropriate internal control environment.
Having proper ICFR requires commitment from executive leadership and management, which in turn helps employees understand its importance. A common misconception about internal controls is that they interfere with operations, forcing companies to spend extra time on tasks such as conducting reviews, approving financial transactions, and performing reconciliations. However, when operating as a public entity, these controls are essential for presenting accurate and timely financial records to investors. Executives who instill a culture of compliance – including the establishment of necessary entity-level controls (e.g., board governance and related committees, employee code of conduct, written policies and procedures for key process) – generally have fewer challenges in dealing with ICFR requirements as a publicly traded company.
Executives looking to transition their company to a public entity should employ appropriate professionals to establish, maintain, and modernize internal controls. Whether through a chief financial officer, controller, director of internal audit, or other position, the collective resources should be able to manage the following important financial aspects during the process:
High-quality internal controls require the appropriate software and technology. Various systems may be needed, for instance, to support financial data for SEC filings, internal management reporting, operational metrics, and data analytics. The more automation that is incorporated into the various processes, the more confident the finance and accounting department can be in providing accurate reporting and disclosures with sufficient time to meet 10-K and 10-Q filing deadlines. Companies should look for opportunities to reduce manual controls with automated processes, including those that harness artificial intelligence. Automation can improve speed while reducing errors, helping companies provide accurate, reliable information in a timely manner. Given the ever-increasing threat of cyberattacks or the costly impact of a data breach, strong information technology controls can protect confidential information and safeguard company assets.
A culture of compliance, finance and accounting personnel with the necessary expertise, and high-quality technology systems combine for a stronger control environment and lay the groundwork for addressing challenges faced by a publicly traded company. But even if management elects to remain private, the company will benefit from improved internal controls. Timely, accurate, and reliable financial information are invaluable to management seeking informed strategic decisions.
Brian Sullivan, CPA, CFA, is an audit and assurance senior manager with Deloitte in Philadelphia, Pa. He can be reached at bpsullivan@deloitte.com.
This blog is not a substitute for professional advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action, consult a qualified professional adviser.
Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form.
Statements of fact and opinion are the authors’ responsibility alone and do not imply an opinion on the part of PICPA officers or members. The information contained in herein does not constitute accounting, legal, or professional advice. For professional advice, please engage or consult a qualified professional.