What are internal control activities?

Internal control activities are primarily composed of a combination of process, people, and information technology systems. Deficiencies in any of these areas can lead to a disclosed material weakness, before or after you go public, even if that particular area isn’t subject to formal assessment by external auditors.

What are common internal control mistakes leading up to a public exit?

High growth companies tend to work with fewer resources as development and product teams outpace the infrastructure. As a result, they don’t always have: Clearly defined processes and controls Adequate headcount and segregation of duties A full implementation of a robust enterprise resource planning (ERP) system It’s not uncommon for companies to file an S-1 or S-4 registration statement with a disclosed material weakness. Data presented in Audit Analytics’ September 2020 report on Sarbanes-Oxley act (SOX) 404 disclosures reveals instances and pervasiveness of negative ICFR disclosure as the result of management’s 404(a) self-assessment.

What documentation should be part of the internal controls process?

As part of a well-defined process, management must consider: Segregation of duties Independent review Approval of journal entries Reconciliations New public companies often lack the level of diligence necessary to ensure all journal entries are independently reviewed and properly supported. Similarly, reconciliations must have established thresholds for following up on variances and resolving reconciling items. If this type of auditable documentation is lacking, it could result in a material weakness.

What accounting cutoff procedures should your company include in its internal controls process?

Your company should have a period-end mechanism where accounting discusses business activities with a broad swath of internal and external stakeholders to ensure activities have been properly recorded. These cutoff procedures include revenue, expenses, shipping, receipts, third-party services, and the number of hours worked.

What are the potential effects of an insufficient accounting headcount?

A typical reason for a material weakness at a newly public company would be insufficient accounting headcount. It’s not uncommon for a company to go public with only two to four people in the accounting department. This makes it exceedingly difficult to properly segregate sensitive accounting activities and ensure segregation of duties. Segregation of duties and staffing insufficiency are typical for many smaller companies subject to 404(a); at least 39% of smaller companies have self-reported ineffective ICFR since 2013. Regardless of the resources available to a company, the same set of ICFR standards for management exist for all public companies.

How could your company leverage consultants?

Fortunately, management can scale resources up or down by leveraging consultants or other third parties to provide additional bandwidth for: Resource constraints and technical guidance Complex judgments and conclusions Leveraging best practices Recent ongoing experience

What ERP system should a new public company choose?

One of the first major projects for a new public company with cash resources is to upgrade to a more robust ERP system. It’s not uncommon for a company to go public with a tier two or tier three ERP systems, or even QuickBooks, as opposed to a tier one system such as Oracle or SAP. Tier three systems lack the internal control functionality inherently built into higher-tier ERP systems — such as user role management — to enforce: Segregation of duties Park and post of journal entries Integration with various supporting modules or systems For companies using a tier three system, it’s easier for management to override controls or to adjust already-posted entries. Additionally, there are typically few logical controls to enforce segregation of duties.

Article

Three internal control considerations for your company’s IPO or SPAC journey

June 28, 2021 · Authored by Findley Gillespie

One of the biggest changes and focus areas for a company going public through a traditional initial public offering (IPO), or through a special purpose acquisition company (SPAC), is ensuring accurate financial reporting in compliance with U.S. Securities and Exchange Commission (SEC) regulations and laws that govern public filers.

As a company looking to go public, compliance with these standards must be managed through a strict process supported by internal control over financial reporting (ICFR) to prevent embarrassing corrections or disclosures.

Our article addresses the following:

What are internal control activities?
What are common internal control mistakes leading up to a public exit?
How do you define and maintain your internal controls process?
What documentation should be part of the internal controls process?
What accounting cutoff procedures should your company include in its internal controls process?
What are the potential effects of an insufficient accounting headcount?
How could your company leverage consultants?
What ERP system should a new public company choose?

Findley Gillespie

Principal

Three internal control considerations for your company’s IPO or SPAC journey

Findley Gillespie

What are internal control activities?

What are common internal control mistakes leading up to a public exit?

How do you define and maintain your internal controls process?

What documentation should be part of the internal controls process?

Stricter accruals accounting

What accounting cutoff procedures should your company include in its internal controls process?

Importance of knowledgeable people and headcount

What are the potential effects of an insufficient accounting headcount?

Documentation

Leadership involvement

How could your company leverage consultants?

What ERP system should a new public company choose?

Diligence for system-generated data and reports

Safety measures

Have questions? Baker Tilly can help.