Don’t Forget about SOX in your IPOs and M&A!
Have you thought about SOX compliance yet? It’s been around since 2002, but it’s still as relevant as ever!
It’s one of the most common blind spots for companies in growth mode. Too many wait until they’re already deep into IPO prep or M&A talks before realizing just how much work is required to meet public company standards.
Here’s why you should bring in SOX experts early—ideally before the bankers and auditors are at your door:
1. SOX isn’t just a finance issue – it’s a Company-Wide Mindset
When companies think about preparing for SOX compliance—whether for an IPO or as part of being acquired by a public company—the conversation almost always starts with finance. That makes sense. After all, SOX (Sarbanes-Oxley) was designed to improve the accuracy and reliability of financial reporting.
But here’s the catch: SOX isn’t just a finance issue.
To meet public company standards, you need a company-wide approach to governance, controls, and risk. That means finance, yes—but also IT, HR, operations, and often legal, security, and procurement.
Why is SOX Company-Wide?
SOX requires companies to prove that their financial reporting is reliable—not just in theory, but in actual execution. This includes everything from who has access to your accounting system, to how changes to your applications are tracked, to how approvals are handled for new hires, contractors, and vendors.
That’s not just the controller’s job. Here are just a few areas SOX spans:
- IT: System access provisioning, change management, backups, monitoring, logging
- HR: Onboarding/offboarding controls, payroll processing, role alignment
- Operations: Key process controls tied to revenue, procurement, inventory, or service delivery
- Finance: Of course—journal entries, reconciliations, revenue recognition, close processes
2. IPO readiness goes beyond hitting revenue targets.
For many fast-growing companies, crossing the $100M revenue mark—or even getting close—feels like the green light for an IPO. Growth is strong, demand is there, and the investor pitch is compelling.
But here’s the reality: A solid growth story isn’t enough.
If you can’t back that story with reliable financial reporting and a strong internal control environment, the SEC, your auditors, and potential investors will hit the brakes—fast.
What Slows Things Down?
Even companies with strong revenue often get stuck during IPO prep. Why? Because they don’t realize how much time it takes to get controls in place and operating effectively.
Here are just some of the more common delays:
- Undocumented key processes like revenue recognition or expense accruals
- No formal SOX controls around journal entries, reconciliations, or system access
- Inconsistent application of accounting policies across teams or regions
- Weak or missing audit trails in core systems
- IT systems that don’t support proper segregation of duties
3. M&A due diligence is unforgiving.
When a public company evaluates your business, it’s not just about growth potential or market share. It’s about whether your financials can be trusted to stand up to SEC-level scrutiny.
That includes:
- Are your revenue numbers backed by consistent, well-documented accounting practices?
- Do you have documented controls over who can access, change, or approve financial data?
- Can you show that your books are closed in a timely and repeatable way?
- Do you have clean audit trails for how key decisions (journal entries, estimates, accruals) are made?
If the answer to any of those is no—or even “sort of”—expect that to show up in the valuation. Or worse, as a deal breaker.
I’ve seen a potential $100M acquisition be at risk after the acquirer’s audit team found no documentation of key financial reporting and IT controls, raising serious concerns about data integrity and financial accuracy. The SOX experts were called too late in the process.
Now the buyer has two choices: build in risk by lowering the valuation, or pause the deal entirely until the target company cleans things up.
Either way, the deal timeline is extended, internal teams are pulled into chaos, and the company often ends up spending 2–3x more cleaning things up under pressure than they would have proactively.
Public Companies Have No Choice – The Have to Care About SOX
Public companies are held to Sarbanes-Oxley (SOX) standards—and that means they’re required to evaluate and certify the effectiveness of their internal controls over financial reporting.
If they acquire you and inherit your processes (or lack thereof), your problems become theirs. So, they’ll treat your books, systems, and controls like they’re already subject to SOX. Because post-acquisition—they are.
4. Fixing SOX issues early is always cheaper.
If your company is preparing for an IPO or engaging in M&A conversations with a public company, you’re likely hearing a lot about SOX compliance.
And here’s the honest truth: every company ends up paying for SOX readiness—one way or another.
The only question is when and how much.
You can either build it the right way early—or you can scramble to fix it later, at a much higher cost, with far more stress, and far less control over the outcome.
I’ve worked with companies who treated SOX readiness as a last-minute checklist—and others who started 12–18 months in advance. The difference in cost, stress, and outcome is night and day.
What You Should Do if You’re Considering a Sale
If M&A is even a remote possibility in the next 12–24 months, treat SOX readiness as a competitive advantage.
Here’s where to start:
- Identify key controls tied to revenue, expenses, access, and reporting
- Document processes and ownership for financial close, approvals, and system changes
- Conduct internal walkthroughs or mock audits to identify gaps
- Bring in outside SOX advisors to evaluate where you stand
By showing that you’ve already built a solid control environment, you reduce the buyer’s risk—and potentially increase your company’s value.
Have questions about what SOX readiness should look like for your business? Feel free to reach out—happy to share insights and lessons learned.
Disclosure: Some of the links in this article may be affiliate links, which can provide compensation to me at no cost to you. These are products I’ve personally used and stand behind.
Walkthroughs with Impact: Internal Audit’s Role in Modernizing Controls
Use SOX walkthroughs to challenge the status quo, automate controls, and build more agile, future-ready processes in today’s fast-changing world.
0 Comments