After the IPO: The Public-Company Close, SOX Controls, and Finance Team You Need

The IPO is the start of public-company reporting, not the end of the accounting work. From the first quarter after listing, the company has to report on a fixed schedule, its CEO and CFO personally certify the numbers, and within about two years management has to report on its internal controls. Companies that build that machinery before the IPO have a far easier first year. Here is what changes and how to prepare.

Quarterly and annual reporting deadlines

A newly public company is usually a non-accelerated filer for its first annual report. For non-accelerated filers, the SEC deadlines are:

• Form 10-Q: 45 days after the end of each of the first three fiscal quarters
• Form 10-K: 90 days after the fiscal year-end

Larger companies move to shorter deadlines later, as little as 40 days for the 10-Q and 60 days for the 10-K for large accelerated filers. Inside those windows the company has to close the books, complete the auditor's quarterly review or annual audit, write MD&A, and get board and audit committee approval. That usually means the books need to be closed in a couple of weeks, not a couple of months.

SOX certifications start with the first report

Under Section 302 of the Sarbanes-Oxley Act, the CEO and CFO certify in each 10-Q and 10-K that the report is accurate and that they are responsible for disclosure controls. These certifications start with the first periodic report after the IPO, so the controls behind them need to exist from day one.

Internal control reporting under Section 404

• Section 404(a), management's assessment. A newly public company does not have to include management's report on internal control over financial reporting in its first annual report. It generally starts with the second 10-K.
• Section 404(b), the auditor's attestation. Emerging growth companies are exempt from the auditor's attestation for up to five years after the IPO, as long as they keep EGC status. Non-accelerated filers are also exempt. Other companies need it once they become accelerated filers.

The grace period is shorter than it looks. To report that controls are effective at the end of year two, they have to be designed, documented, and operating well before then. Most companies use the COSO 2013 framework and start the documentation during IPO preparation.

What a public-company close looks like

• A written close calendar with owners and deadlines for every task, from bank reconciliations on day two to the final flux review
• Account reconciliations for every balance sheet account, prepared and reviewed by different people
• Journal entry controls: support for every manual entry and approval by someone other than the preparer
• Flux analysis that explains significant changes against the prior period and budget before the auditor asks
• Revenue and equity sub-processes documented step by step, because they are the areas most often involved in material weaknesses
• Disclosure checklist and committee to make sure every required footnote and risk disclosure is reviewed each quarter
• System access controls in the accounting software, so the people who record transactions cannot also approve or change them

The finance team

A private company can often run with a bookkeeper, an outside CPA, and a part-time CFO. A public company typically needs, at a minimum, a CFO who can sign certifications and speak to investors, a controller who owns the close, and access to SEC reporting and technical accounting expertise. KPMG's IPO studies point to a lack of people with enough U.S. GAAP and SEC knowledge as the most common cause of material weaknesses. Many companies close that gap with a mix of hires and outsourced specialists, then decide which roles to bring in-house once the reporting rhythm is established.

Accounting quality and the market

Investors price predictability. A company that files on time, does not restate, and explains its results clearly in MD&A gives analysts fewer reasons to discount the stock. Missed deadlines, restatements, and new material weaknesses after an IPO are disclosed publicly and can damage credibility quickly. The work done on the close and controls before listing therefore pays off well after the IPO.

A 12-month preparation plan

• Months 12 to 9: readiness assessment, gap analysis against SOX and SEC reporting, close calendar design
• Months 9 to 6: document key processes and controls, implement journal entry and reconciliation controls, run a "dry run" quarterly close in public-company format
• Months 6 to 3: draft 10-Q-style financial statements and MD&A for a recent quarter, test controls, fill finance team gaps
• Months 3 to 0: finalize the disclosure checklist and committee, confirm the first 10-Q timeline with the auditor

OICPA's IPO Readiness Accounting service supports public-company reporting after listing. Our month-end close and management reporting services build the close process, and our outsourced accounting team can cover controller-level work while you hire. Related reading: how accounting problems delay an IPO and pre-IPO bookkeeping cleanup.

Frequently asked questions

How fast does a public company need to close its books?

Fast enough to meet the 45-day 10-Q deadline after the auditor's review, management review, and audit committee approval. In practice that usually means a close of about 10 business days or less.

Do we need SOX 404 compliance on the day we list?

Not the full 404 report. Section 302 certifications start with the first periodic report, while management's 404(a) report generally starts with the second annual report. Emerging growth companies are exempt from the auditor's 404(b) attestation while they keep EGC status, for up to five years.

Can we outsource public-company accounting?

Much of it, yes: close support, technical accounting, SEC reporting, and SOX documentation are commonly outsourced. Management still owns the financial statements and signs the certifications, and the outside auditor must remain independent of the work it audits.

What is a dry-run close?

A practice quarterly close performed before the IPO on public-company deadlines, producing 10-Q-style statements and MD&A. It shows where the process breaks before the first real deadline does.