A company going public in the United States does not need to have passed a SOX 404 audit to list, but it needs far more than most private companies have. From its first quarterly report, its chief executive and chief financial officer certify under Sections 302 and 906 that the report is accurate and that they have evaluated the company’s disclosure controls. Its audit committee must start meeting independence rules at listing. Management’s first annual assessment of internal control over financial reporting comes with the second annual report, and the auditor’s attestation follows once the company is an accelerated or large accelerated filer and no longer an emerging growth company. Pre-IPO SOX readiness is the work of building, before listing, the controls, people and processes that let those certifications be signed honestly and that first assessment come out clean. Most companies need 12 to 18 months for it, and the ones that start late usually find out in the registration statement, where material weaknesses identified in the IPO audit are typically disclosed as risk factors.
This guide covers what applies when, why readiness has to start before the registration statement is filed, an 18-month plan in five phases, the readiness assessment and the gaps it usually finds, remediation priorities, the finance team a public company needs, IT general controls, the disclosure controls behind the certifications, the audit committee and internal audit, material weaknesses found before listing, what emerging growth company status does and does not defer, a readiness checklist, the common mistakes, and a worked example from a software company’s listing. The certifications themselves are compared in the site’s guide to SOX 302 vs 404 vs 906; the steady-state program is in the SOX 404 guide.
In this guide
- What applies when: from filing to the second annual report
- Why readiness starts before the registration statement
- The 18-month readiness plan
- Phase 1: the readiness assessment
- Phase 2: remediation priorities
- Accounting resources: the finance team a public company needs
- IT general controls: the usual long pole
- Disclosure controls and the certification machinery
- The audit committee and internal audit
- Material weaknesses found before listing
- Emerging growth company status: what it defers and what it does not
- A pre-IPO SOX readiness checklist
- Common mistakes
- Worked example: a software company’s listing
- Questions about pre-IPO SOX readiness
- Related guides
What applies when: from filing to the second annual report
The obligations arrive in stages, and the stages are what a readiness plan works back from.
| Milestone | What applies |
|---|---|
| Before the registration statement is filed | Financial statements audited under PCAOB standards by an auditor that meets SEC and PCAOB independence rules; personal loans to directors and executive officers unwound, because Section 402’s ban applies once the registration statement is filed |
| At listing | An audit committee with at least one member meeting the Rule 10A-3 independence requirements; the exchange’s governance rules, several with phase-ins; a compensation recovery (clawback) policy under the exchanges’ Rule 10D-1 listing standards; disclosure controls ready for the first periodic report |
| Within 90 days of listing | A majority of the audit committee independent |
| First periodic report | Section 302 and 906 certifications by the chief executive and chief financial officer; the officers’ conclusion on disclosure controls; current reporting on Form 8-K throughout |
| Within one year of listing | A fully independent audit committee of at least three members; on the NYSE, an internal audit function |
| Second annual report | Management’s 404(a) report on internal control over financial reporting; the full 302 certification language |
| Second annual report or later | The auditor’s 404(b) attestation, once the company is an accelerated or large accelerated filer and no longer an emerging growth company |
Two dates on that table deserve precision. The first 10-Q after listing is due within 45 days of the registration statement becoming effective, or by the normal deadline if that is later, so a company that lists in June typically certifies its first quarterly report in August. And the NYSE’s internal audit requirement comes with a one-year transition for companies listing through an initial public offering; in August 2026 the exchange filed a proposal to extend that transition to five years, which needs SEC approval, so check its status before planning around it. Nasdaq does not require an internal audit function, though most listed companies have one.
Why readiness starts before the registration statement
There are four reasons a company cannot leave SOX until after it lists.
The IPO audit finds the weaknesses first. The financial statements in the registration statement are audited under PCAOB standards, and AS 1305 requires the auditor to communicate in writing to management and the audit committee every significant deficiency and material weakness it identifies. A material weakness communicated during the IPO audit is usually disclosed as a risk factor in the registration statement, with a remediation plan, and investors read it.
The first certification comes within weeks. The officers’ 302 certification on the first 10-Q requires an evaluation of disclosure controls. A company that has never run a public-company quarter-end has nothing to evaluate.
Controls need time to operate. A control designed in the last month before listing has no operating history. Management’s first assessment is as of a year-end, but a control that has operated for a quarter or two before the IPO gives the finance team time to find out whether it works.
Public-company deadlines compress everything. A newly public company is usually a non-accelerated filer in its first year, with 45 days to file each 10-Q and 90 days for the 10-K. Once it becomes an accelerated or large accelerated filer, the 10-Q deadline tightens to 40 days and the 10-K to 75 or 60. A close that takes three weeks leaves little room for review, and review is the evidence behind every certification.
The 18-month readiness plan
| Phase | Timing | Main work | Output |
|---|---|---|---|
| 1. Assess | 18 to 12 months before listing | Materiality and scoping; walkthroughs of the significant processes; gap assessment against the COSO components; IT general controls review; accounting resources review | A gap register ranked by potential severity; a roadmap and budget |
| 2. Design and remediate | 12 to 6 months before | Fix the gaps that could be material weaknesses first; rebuild the close for a public timetable; fix IT general controls; build entity-level controls; write the risk and control matrix with key controls chosen, not listed | Designed controls; the matrix; policies; hires |
| 3. Operate and rehearse | 6 months to listing | Controls operate for at least one or two quarters; a dry-run quarter-end on the 10-Q timetable; a rehearsal of the disclosure committee and the certifications; design testing | Evidence of operation; issues fixed; the first disclosure committee minutes |
| 4. First year public | Listing to 12 months after | 302 and 906 certifications each quarter with sub-certifications; operating effectiveness testing; deficiency evaluation; internal audit function formed | Certifications with evidence behind them; a working deficiency log |
| 5. First assessment | 12 to 24 months after | Management’s 404(a) assessment with the second annual report; rationalize the key control set; prepare for the auditor’s attestation | Management’s report; readiness for 404(b) |
Companies that start with 12 months usually compress phases 1 and 2 and run phase 3 alongside the registration statement. What gets squeezed is operation: the controls are designed in time but have little history before the first certification. Starting at 18 months buys the quarters of operation that make the first year public routine rather than a scramble.
Phase 1: the readiness assessment
The readiness assessment is a scoped look at where the company is against where a public company needs to be. It starts with materiality and significant accounts, using the top-down approach in the site’s SOX scoping guide, then walks through each significant process to record what actually happens, and compares that with the controls a public company would need. The gaps it finds at private companies are remarkably consistent.
| Area | Typical gap at a private company | Why it matters at listing |
|---|---|---|
| Financial close | Three weeks or more; manual journals; review by the one person who knows the numbers | 10-Q deadlines of 40 to 45 days leave no room; the review is the evidence behind the certifications |
| Revenue | Complex contracts tracked in spreadsheets; manual allocation and timing calculations | Revenue is one of the most common areas for restatements and material weaknesses |
| Stock compensation | Calculated in a spreadsheet by one person; grant data outside any system | Heavy disclosure; the SEC staff scrutinizes pre-IPO grant valuations |
| IT general controls | Shared administrator accounts; developers with production access; no change approvals; no access reviews | A pervasive weakness undermines every automated control and every system report |
| Segregation of duties | A small team where one person can create and approve entries | Hard to fix without people; often needs compensating controls |
| Accounting resources | No technical accounting or SEC reporting expertise in-house | A shortage of qualified accounting staff is among the most frequently cited material weaknesses in IPO filings |
| Entity-level controls | No audit committee, hotline, fraud risk assessment or written policies | The audit committee must exist at listing; the COSO principles assume the rest |
| Disclosure | No disclosure committee; no process for spotting 8-K events | The 302 certification applies from the first periodic report; many 8-K items have a four-business-day clock |
| Service organizations | Payroll, hosting and payments outsourced with no review of SOC 1 reports | The company’s controls include the user controls the service organization assumes |
| System reports | Reports used in reviews never tested for completeness or accuracy | Controls that rely on untested reports are only as good as the reports |
The output is a gap register, each gap rated by how likely it is to become a material weakness if left alone, with an owner, a remediation approach and a date. The rating matters more than the count. A readiness assessment that lists 140 gaps without saying which five could appear in the registration statement has not done its job.
Phase 2: remediation priorities
Remediation follows the rating, in roughly this order:
- Anything that could be a material weakness. Typically the close, revenue, IT general controls over financially significant systems, and accounting resources. These need the longest lead time, because some of them are hires.
- The close. Rebuild it for the public timetable: a calendar with owners, account reconciliations with review, a journal entry review with thresholds, and a flux review precise enough to catch errors that matter. The site’s guide to auditing the financial close describes what good looks like.
- IT general controls. Access provisioning and removal, privileged access, change management and periodic access reviews over the systems that feed the financial statements. The SOX ITGC scoping guide covers which systems are in scope.
- Entity-level controls. The audit committee and its charter, the code of conduct, the hotline, the fraud risk assessment, delegation of authority and the policies the rest of the controls rest on. The site’s guide to entity-level controls covers which of these can reduce process-level testing and which cannot.
- Process controls and the matrix. The risk and control matrix is written last, from risks, with key controls chosen deliberately rather than every control in the process marked key.
The last point is where readiness programs most often create problems for later. Consultants paid to document controls tend to document everything, and a matrix with 400 key controls looks thorough in the readiness report and becomes a testing burden every year after listing.
Accounting resources: the finance team a public company needs
Many readiness gaps are people gaps. A private company’s finance team is built to close the books for lenders and a board; a public company’s has to produce quarterly reports on a deadline, handle technical accounting questions as they arise, and document its work so that someone else can check it.
| Capability | What it covers | Common approach before listing |
|---|---|---|
| Controller and close team | The close, reconciliations, journal entries, the review layer | Add reviewers so that no one reviews their own work |
| Technical accounting | Revenue, leases, stock compensation, business combinations, new standards | Hire a technical accounting lead; use advisors for one-off issues |
| SEC reporting | 10-Q, 10-K, 8-K, proxy disclosures, XBRL tagging | Hire an SEC reporting lead before the registration statement |
| Equity administration | Grants, vesting, exercises, the records behind stock compensation | Move grant data into an equity system with access controls |
| Tax | Provision, uncertain tax positions, the tax disclosures | Often co-sourced, with an internal owner of the review |
| SOX program lead | The matrix, testing coordination, deficiency log, sub-certifications | A dedicated hire or an experienced manager seconded from finance |
| IT compliance | ITGCs, access reviews, change management evidence | An owner inside IT, not in finance |
The pattern behind the frequent “insufficient accounting resources” material weakness is simple: controls exist on paper, but the people performing and reviewing them lack the time or the technical depth to do it properly. No amount of documentation fixes that, which is why hiring decisions belong in phase 1, not phase 3.
IT general controls: the usual long pole
At technology companies especially, IT general controls are the gap that takes longest to close. Engineering cultures give developers broad access to production for good operational reasons; changes to billing and revenue configuration go through the same fast deployment pipeline as everything else; and software-as-a-service applications multiply the number of systems that touch the financial statements.
The remediation sequence that works starts with the inventory: which systems feed financially significant accounts, what reports come out of them, which service organizations host them. It then fixes access first, because access problems are easiest to see and hardest to defend: remove shared administrator accounts, separate developer access from production, and start documented access reviews. The user access review guide covers what a review needs to show. Change management comes next, particularly for configuration that drives revenue or billing, as the site’s IT change management audit guide describes. For outsourced systems, the SOC 1 reports need to be obtained and reviewed, and the complementary user entity controls they assume need to exist, as the SOC 1 review guide explains.
The timing matters because IT general controls support everything else. An automated control over revenue is only reliable if the system it runs in is protected from unauthorized change, so a pervasive IT general controls weakness can undermine every automated control and every report the auditor planned to rely on.
Disclosure controls and the certification machinery
The 302 certification on the first 10-Q needs an evaluation of disclosure controls, which needs disclosure controls to exist. For most newly public companies that means five things built before listing:
- A disclosure committee with a charter, usually chaired by the chief financial officer, general counsel or controller, and including the heads of financial reporting, legal, investor relations and the SOX program, meeting before each 10-Q, 10-K and earnings release.
- Sub-certifications from the people who know: business unit finance leads, process owners, legal, tax, IT, with specific questions about controls, changes, errors, fraud and legal matters.
- A disclosure checklist and review process for each report, with the drafts, comments and sign-offs retained.
- An 8-K trigger process that identifies reportable events and meets the four-business-day deadline, including the cybersecurity incident item, which runs from the date the company determines an incident is material.
- An earnings release process with the same controls as the filings, since the numbers are published first in the release.
A rehearsal matters here more than anywhere. Running the disclosure committee and the sub-certification cycle once on a private-company quarter, before the first real one, finds the gaps in the questions, the attendance and the minutes while the stakes are low. The site’s guide to SOX 302 vs 404 vs 906 sets out what the certification says and what has to exist behind each paragraph.
The audit committee and internal audit
The audit committee is the governance body the whole program reports to, and it has to exist at listing. Rule 10A-3 and the exchanges allow a newly listed company to phase in independence: one independent member at listing, a majority within 90 days and a fully independent committee within a year. The exchanges also expect financial expertise: the NYSE requires every member to be financially literate and at least one to have accounting or related financial management expertise, and Nasdaq requires at least one financially sophisticated member. The committee should be formed early enough to oversee the readiness program, not just receive its results. The site’s guide to presenting to the audit committee covers what the committee should hear and how.
Internal audit’s role before listing depends on whether the function exists. Many pre-IPO companies have none, and build it in the year after listing, in-house or co-sourced; the site’s guides to establishing an internal audit function in a small company and sourcing options cover the choices. Where internal audit exists before listing, it can do valuable readiness work as an advisory engagement: assessing design, reviewing the gap register, testing whether remediated controls operate. The caution is about what comes next. A function that designs the SOX program, owns the matrix and runs the testing will later be asked to give the audit committee assurance over the same program, which is the self-review problem the site’s guide to independence and objectivity describes. The practical answer is to agree the role in writing, keep management as the owner of the controls and the program, and treat readiness work as advisory rather than assurance.
Material weaknesses found before listing
Material weaknesses found during the IPO audit are common, particularly the themes in the assessment table: accounting resources, the close, IT general controls and segregation of duties. What matters is how the company handles them.
| Step | What it involves |
|---|---|
| Evaluate properly | Classify each deficiency with the same framework the company will use after listing, as the control deficiency evaluation guide sets out, rather than negotiating the label |
| Disclose accurately | Describe the weakness, its effect and the remediation plan in the risk factors, in plain words |
| Remediate with evidence | Design the fix, operate it for long enough to show it works, and test it |
| Report progress | Update the audit committee each quarter and describe progress in the periodic reports until the weakness is remediated |
| Avoid overstating | Do not describe a weakness as remediated until the control has operated and been tested |
A disclosed and credibly remediated weakness is an ordinary part of many listings. An undisclosed one that appears in the first 10-K is a different conversation, with investors and with the SEC staff.
Emerging growth company status: what it defers and what it does not
Most companies that list in the United States qualify as emerging growth companies under the JOBS Act. The status brings real relief: two years of audited financial statements in the registration statement instead of three, scaled executive compensation disclosure, extended transition periods for new accounting standards, and exemption from the auditor’s 404(b) attestation. It lasts until the end of the fiscal year after the fifth anniversary of the IPO, unless the company earlier reaches annual revenues of 1.235 billion dollars, becomes a large accelerated filer, or issues more than 1 billion dollars of non-convertible debt in three years.
It defers less than it appears to. The 302 and 906 certifications apply from the first periodic report. Management’s 404(a) assessment applies from the second annual report. And the status often ends early: a company whose public float passes 700 million dollars becomes a large accelerated filer and loses emerging growth company status at the end of that fiscal year, which can bring the auditor’s attestation two years after listing rather than five. Readiness programs that plan on five years without attestation are betting on a valuation staying low.
A pre-IPO SOX readiness checklist
Scoping. Materiality set; significant accounts, disclosures and processes identified; in-scope systems and service organizations listed.
Close. A close calendar that meets a 40-day 10-Q; reconciliations for every significant account with review; journal entry review with thresholds; a precise flux review.
Revenue and stock compensation. Calculations moved out of unreviewed spreadsheets; technical accounting memos for significant judgments; grant data in an equity system.
IT general controls. No shared administrator accounts; developer access separated from production; change approvals for financially relevant changes; access reviews started; SOC 1 reports obtained and reviewed.
Entity-level controls. Audit committee formed with a charter; code of conduct and hotline in place; fraud risk assessment written; delegation of authority approved; policies current.
People. Technical accounting, SEC reporting and SOX program roles filled; no preparer reviewing their own work.
Disclosure controls. Disclosure committee chartered and rehearsed; sub-certifications designed; disclosure checklist in use; 8-K trigger process in place; earnings release controls.
Matrix. Risk and control matrix written from risks, with key controls chosen and justified; system reports behind key controls identified for testing.
Evidence. Controls operating for at least one quarter before listing, with evidence retained.
Governance. Section 402 loans unwound before filing; clawback and insider trading policies adopted; the internal audit plan and charter agreed with the audit committee.
Common mistakes
| Mistake | What happens | The fix |
|---|---|---|
| Starting after the registration statement is filed | Controls are designed in time but have no operating history for the first certification | Start 12 to 18 months before listing |
| A consultant-written matrix nobody owns | Controls describe what reviews are meant to do, not what they do; owners do not recognize their own controls | Owners walk through and sign their controls; precision is tested, not described |
| Marking every control key | Hundreds of key controls, an unsustainable testing load and weak ones hiding the strong | Choose key controls from risks, as the key controls guide sets out |
| Treating the fraud risk assessment as a listing document | It is written once and not refreshed when the business model changes | Refresh it annually and when pricing, products or incentives change |
| Leaving IT general controls to year two | Automated controls and system reports cannot be relied on | Fix access and change management in phase 2 |
| A disclosure committee that discusses rather than reviews | Minutes record conversations, not decisions on specific disclosures | Minutes record what was reviewed, what was decided and why |
| Planning on five years of emerging growth company status | The float passes 700 million dollars and attestation arrives early | Plan for 404(b) readiness by the second annual report |
| Internal audit designing the program it will assure | Self-review threatens the function’s objectivity | Management owns the program; internal audit’s readiness role is agreed in writing as advisory |
Worked example: a software company’s listing
The software company described in the site’s guides to entity-level controls and key controls, which had about 600 million dollars of revenue two years after it listed, started its readiness program 14 months before its IPO. Its experience shows what a readiness program can get right and what it can leave for later.
What the readiness program got right. An advisory firm’s assessment found the gaps the table above predicts. The close took 14 working days. Developers could change billing configuration in production without approval, and nobody reviewed access to the billing platform. Stock compensation was calculated in a spreadsheet by one person. There was no disclosure committee. The company hired a technical accounting lead, an SEC reporting lead and a SOX program lead; brought the close to eight working days; separated developer access from production and put billing configuration changes through approval; moved grants into an equity system and designed a quarterly review of stock compensation expense in which the controller recomputed every grant; and chartered a disclosure committee and ran it once before listing. The IPO audit’s communication under AS 1305 reported significant deficiencies but no material weakness, and the registration statement disclosed none.
What it left for later. The consultants documented nine processes and marked 412 controls as key. Many of the review controls were described as precise, with the reviews written up as they were meant to be performed. The fraud risk assessment was written for the listing. The disclosure committee’s minutes recorded discussions rather than reviews of specific disclosures. None of this caused a problem at listing, and all of it surfaced afterwards.
| After listing | What happened | Where it is told |
|---|---|---|
| The year before the first attestation | Internal audit and the SOX program lead rationalized the matrix from 412 key controls to 168, cutting estimated testing effort from about 9,900 hours to about 4,500 and adding seven controls for assertions the matrix had missed, two of which found stock compensation disclosure errors in their first quarter | Key vs non-key controls |
| The first attestation year | Internal audit’s entity-level assessment found that only one of four reviews documented as precise was precise in practice: the stock compensation review designed during readiness. The fraud risk assessment had not been refreshed for usage-based pricing | Entity-level controls |
| The outcome | A clean auditor attestation in the first year it applied, after the company’s float passed 700 million dollars and emerging growth company status ended | Both guides |
The lesson. The readiness program did what readiness programs are usually measured on: no material weakness at listing and certifications that could be signed from the first quarter. What it missed was the difference between documenting controls and knowing how they operate. The one review that survived scrutiny two years later was the one the company had designed itself, with a recomputation and a low threshold, rather than the ones consultants had written up from interviews. A readiness program that tests precision and chooses key controls deliberately saves the rework, and the company’s own team ends up understanding its controls rather than inheriting a description of them.
Questions about pre-IPO SOX readiness
When should a company start SOX readiness before an IPO?
Twelve to eighteen months before listing. Eighteen months allows an assessment, remediation and at least one or two quarters of controls operating before the first certification.
Is SOX compliance required before an IPO?
Not in full. The financial statements must be audited under PCAOB standards, Section 402’s loan ban applies once the registration statement is filed, and the audit committee must meet phased independence rules at listing. The 302 and 906 certifications start with the first periodic report, and management’s 404(a) assessment with the second annual report.
Do emerging growth companies need SOX 404?
They need the management assessment under 404(a) from their second annual report. They are exempt from the auditor’s 404(b) attestation while the status lasts, which can end early if the company becomes a large accelerated filer.
What are the most common pre-IPO material weaknesses?
Insufficient accounting and financial reporting resources, weaknesses in the financial close, IT general controls, and segregation of duties are the recurring themes.
Who should lead SOX readiness?
Management, usually the chief financial officer with a dedicated SOX program lead, supported by advisors. Internal audit can contribute as an advisor but should not own the program it will later give assurance over.
Can a company list with a material weakness?
Yes. Companies list with disclosed material weaknesses regularly. What matters is accurate disclosure in the registration statement, a credible remediation plan and evidence of progress in the periodic reports that follow.
Related guides
- SOX 302 vs 404 vs 906 — the certifications a newly public company signs.
- SOX 404 compliance — the program readiness builds toward.
- SOX scoping — materiality, significant accounts and key controls.
- Entity-level controls — the same software company, two years after listing.
- Key vs non-key controls — taking the matrix from 412 key controls to 168.
- SOX ITGC scoping — which systems are in scope.
- User access reviews — the access control readiness usually has to build.
- IT change management audits — change approvals over financially relevant systems.
- SOC 1 report review — service organizations inside the scope.
- Auditing the financial close — what a public-company close looks like.
- Control deficiency evaluation — classifying what the IPO audit finds.
- The fraud risk assessment — the document readiness programs write once and forget.
- How to establish an internal audit function in a small company — building the function after listing.
- Presenting to the audit committee — reporting readiness to the new committee.
- Internal Audit at Tech and SaaS Companies: Complete Guide — building the function fast at a software company.
- Standing Up Internal Audit After an IPO: The First 18 Months — the first 18 months: charter, plan, staffing, SOX and the committee.
Leave a Reply