Pre-IPO Preparedness checklist

Many resources are available for companies preparing for an IPO. One area of the process that can be difficult to navigate is how to implement compliance properly. Building your compliance infrastructure before going public is critical, given the costs of compliance failures and reputational and financial harm.

SOX requires all qualifying SEC-registered organizations to document, evaluate, monitor, and report on internal control over financial reporting and disclosure controls and procedures, which include IT controls.

The first step in this process will be to assess the overall strength of your IT control in the organization by considering the following questions:

1. Does the SOX steering committee understand the risks inherent in IT systems and their impact on compliance with Section 404 - Management Assessment of Internal Controls?
2. Does IT management understand the financial reporting process, and its supporting systems?
3. Does the CIO fully understand the types of IT controls necessary to support reliable financial processing?
4. Are policies governing security, availability, and processing integrity established, documented, and communicated to all members of the IT organization?
5. Are the IT department's roles and responsibilities related to Section 404 documented and understood by all department members?
6. Do members of the IT department understand their roles, do they possess the requisite skills to perform their job responsibilities relating to internal control, and are they supported with appropriate skill development?
7. Is the IT department's risk assessment process integrated with the company's overall risk assessment process for financial reporting?
8. Does the IT department document, evaluate and remediate IT controls related to financial reporting annually?
9. Does the IT department have a formal process to identify and respond to IT control deficiencies?
10. Is the effectiveness of IT controls monitored and followed up regularly?

SOX compliance requirements 

SOX aims to enhance corporate governance through measures that will strengthen internal checks and balances and also strengthen corporate accountability. However, it is essential to emphasize that Section 404 does not merely require companies to establish and maintain an adequate internal control structure and assess its effectiveness on an annual basis. 

For those organizations that have begun the compliance process, it has quickly become apparent that information technology plays a vital role in internal control by supporting the systems, data, and infrastructure components critical to the financial reporting process. The public accounting oversight board, PCAOB  believes that IT controls are so important that it issued an auditing standard that discusses the importance of information technology in internal control. In particular, it states:

"The nature and characteristics of a company's use of information technology in its information system affect the company's internal control over financial reporting."

Public companies must comply with the following SOX requirements:

• Provide periodic financial statements for external audits
• Provide an annual assessment of internal controls, approved by independent auditors
• Report any financial material changes to the public promptly
• Have good internal controls in place (both financial and IT) to detect and prevent fraud and ensure the company's financial and data integrity

Demonstrating compliance

Public companies demonstrate compliance with SOX requirements by providing the SEC and investors with the following information:

1. Financial Reporting

Companies must provide routine financial reports approved by independent auditors. The SOX Act states that accounting companies that conduct audits can’t provide any other services to the businesses they audit, like consulting or tax guidance. 

All financial statements from public companies must comply with GAAP (Generally Accepted Accounting Principles). Financial statements must equitably represent the company's financial circumstances, and the CFO or CEO must certify that "to the best of their knowledge, there are no untrue or misleading statements or omissions in the reports."

2. Internal Controls

Section 404 of SOX requires organizations to implement internal controls to ensure accurate financial reporting. These controls, sometimes called 404 controls, are rules that prevent and detect errors in a company's financial reporting process. Internal controls avoid or detect concerns in organizational processes, ensuring the organization achieves its objectives.

SOX does not provide a list of specific controls. Instead, companies must define their controls to meet the regulator's goals. For example:

• Segregation of duties
• Access control 
• Cybersecurity 
• Data backup systems, and
• change management
• Internal control report

SOX requires organizations to file a report demonstrating that the company's management remains responsible for the internal control structure applied to financial records.

All material weaknesses must be reported immediately to senior management to ensure transparency. Sections 302 and 404 are relevant to this aspect of SOX:

• Section 302:  the CEO and CFO are responsible for reporting and internal controls
• Section 404: ensures accounting practices remain transparent by requiring quarterly reports and annual disclosures

3. Data security policies

SOX requires companies to create and uphold a data security policy that protects the storage and use of financial data. SOX requires organizations to enforce this policy consistently and to communicate it with employees.

4. Real-time issuer disclosures

"Issuers are required to disclose to the public, on an urgent basis, information on material changes in their financial condition or operations. These disclosures are to be presented in terms that are easy to understand and supported by trend and qualitative information of graphic presentations as appropriate." In summary, if an event leads to a significant change in financial conditions or operations, the company must tell shareholders and stakeholders immediately. 

5. Criminal penalties

SOX makes the signing executives, usually, the CEO or CFO, personally and individually responsible for their attestations. The penalty for filing a false or misleading report can be a fine of up to $5 million and 20 years of jail time. 

6. Internal audit priorities

Internal audit and controls testing is typically the largest, most complex, and most time-consuming part of compliance because internal controls include all of the company's IT assets. These assets include computers, hardware, software, and all other electronic devices where financial data resides.

An IT controls audit focuses on:

Access control

Assess how the company restricts access and provisions to ensure that only the right people can access sensitive financial data. 

Data backup

Assesses how the company backs up data and critical systems to minimize disruptions and data loss in a disaster. 

Change management

Assess how the company manages changes to the IT environment. These changes could be new employees, new software, new infrastructure, software updates, or configuration changes. These changes must be recorded in an audit trail and should be monitored. 

IT security

Assess how the company determines sensitive data, protects it, monitors its access and how security incidents are detected. In the event of an incident, the company must take corrective action promptly and effectively.

How SafePaaS can  help?

With SafePaaS, you can detect potential policy violations and sensitive access risks for all users and identities. Policy Manager provides fine-grained capabilities analyzing all users and identities across all your ERP environments and applications. With built-in remediation, the world's leading organizations use Policy Manager to identify and prevent risk in any application that meets audit requirements.

How can SafePaaS address your pre-IPO needs 

Audt, risk and compliance

SafePaaS allows pre-IPO companies to establish a unified platform to efficiently manage enterprise-wide Governance, Risk, and Compliance (GRC) processes. Executives, Business Process Owners, Internal Control Managers, and Auditors can improve their productivity by collaborating on key GRC tasks such as risk assessment, control activities, independent audit, remediation, and management certification. SafePaaS provides a role-based dashboard to ensure that management can make timely and accurate decisions based on complete insight to mitigate risk proactively.

Proactive Enterprise Risk Management (ERM)

Establish an ERM framework, and monitor enterprise risk and KRI's to reduce the frequency and severity of loss events. Take action in real-time to perform root-cause analysis with ad-hoc reports, reduce inconsistencies in procedures, and make better decisions by adding context to data from multiple sources. 

Audit Analytics and compliance monitoring with Interactive  dashboards and Reports 

Use interactive dashboards for real-time corrective action modeling and allow business managers to explore risk exposure ad hoc. You can easily access audit dashboards remotely over a smartphone or mobile device. 

SafePaaS monitors risk and controls in all major ERP systems including SAP, Oracle E-Business Suite, Oracle ERP Cloud, PeopleSoft, and J D Edwards to improve testing effectiveness and findings across the enterprise in a single integrated solution. Our DataProbe™ technology collects audit samples from ERP systems and stores control evidence.

Enterprise Risk Management

• Implement risk assessment processes to meet your organization's objectives. Maintain your Risk Library with Process, Risks, and Controls

• Manage enterprise risk ratings like impact and likelihood that best describe your approach to risk evaluation

• Manage Control Design based on the contextual framework to measure risk factors before controls (inherent), after controls (residual), or both
  

Audit Planning

• The Audit Planning module enables you to schedule projects and resources, so there is a clear view of fieldwork assignments and tracking of audit testing in an annual plan. 

• The easy-to-use web-based planning tool can be configured for small or large groups, allowing multiple plans to support enterprise audit objectives.

Compliance Management

Reduce regulatory compliance costs and penalties. You can transform compliance "silos" into a single enterprise platform that results in lower testing time with standardized self-assessment and management certification templates. Integration with ERP controls also enables you to streamline compliance with continuous controls monitoring. Management can easily update documentation and certify internal controls to comply with the most complex regulations, such as Sarbanes-Oxley (SOX). ARCPaaS™ can be configured to support various industry and regulatory frameworks such as AML, Basel II, COSO, COBIT, GDPR, FCPA, FISMA, FERC, HIPAA, NCR, OMB-123, OSHA, PCI DSS, and Solvency II. 

Audit Analytics

• Improve audit findings by replacing random sampling, spread-sheets, or generic business intelligence with audit analytics that are purposely built to detect anomalies or patterns in any data source to provide better assurance for business processes and controls

• Take a snapshot of any ERP system to map and translate your data into actionable insight. You can prevent operational losses such as duplicate supplier payments with advanced fuzzy matching.

Issue and remediation workflows

Workflow-enabled issue and remediation management tracks findings from all audit engagements and allows you to track the implementation status of recommendations made by your department and related management action plans. You can facilitate issue follow-up, trend analysis, prior audit review, and committee reporting. 

Management can easily access the findings and perform remediation actions in a timely manner to reduce overall risk exposure. Role-based access ensures that data and functions are only accessible and available based on each user's role and authorization.

Automated ERP controls monitoring

You can continuously monitor business activities within your enterprise applications with instant access to the most extensive catalog of automated application monitors covering 1,000+ business objects for major processes such as Procure-to-Pay, Order-to-Cash, Hire-to-Retire, Design-to-Ship, and Financial Record-to-Report. You can test ERP configuration controls by enforcing an application setup consistent with operating standards.

Segregation of duties (SoD) policy management

• Jumpstart your top-down risk-based SoD analysis with hundreds of SoD Rules based on thousands of application functions included in our rules repository
• Rapidly reduce SoD risks with workflow-enabled collaboration among process owners, application managers, IS security, and auditors

Self-service identity-based access provisioning

• Safeguard your most important business information against cybersecurity risks with policy-based centralized orchestration of user identity management and access control.
• Improve productivity and reduce costs by enforcing access policies, such as segregation of duty (SoD) rules, before violations get introduced into the ERP environment, controlling sensitive business information to potential threats and vulnerabilities.

Periodic user certification and review

• Automate periodic user access reviews to comply with access policies and maintain an audit trail to support IT General Controls.
• Enable managers to detect dormant users and unauthorized system access.

Having a solution like SafePaaS in place to prepare for SOX compliance removes the pain and pressure from pulling together your supporting audit documentation and evidence. SafePaaS provides the data and security needed for pre-IPO SOX compliance by securing risk across all your business applications, automating manual tasks, and enforcing internal controls.