Insights

The pre-IPO governance gap: IT controls before the audit

The pre-IPO governance gap is the distance between how a fast-growing or newly separated company actually runs its IT systems and what an auditor, a regulator or a new owner expects to see; it usually shows up as weak access control, informal change management and missing evidence.

A company can grow for years on trust and good people. Public markets, and many buyers, ask for something different: controls that are written down, followed every time, and provable after the fact. This article is general information, not legal or audit advice.

Where the gap usually shows

• Access. Too many people hold powerful access in SAP and other core systems, often because it was handed out quickly during growth and never reviewed.
• Segregation of duties. One person can both create a supplier and approve its payment, or change a system and release the change to production.
• Change management. Fixes reach production through side doors, with no record of who asked, who tested and who approved.
• Emergency access. Firefighter or break-glass accounts exist, but their use is not logged, reviewed or tied to a ticket.
• Evidence. The controls may work in practice, but nothing was kept that proves it to an auditor.

Why carve-outs make it worse

When a business unit is separated from its parent, it often loses the parent's IT controls on the day it leaves. A transition services agreement may keep the lights on for a time, but the controls the unit now needs, such as its own access reviews and change process, have to be built while the business is also changing owners.

What to do, in order

1. Map what matters. List the systems that produce financial figures and the processes that touch them. Do not start with every system.
2. Clean up access first. Remove access that nobody can justify, and review the people who hold the most powerful roles.
3. Fix segregation of duties on the highest-risk combinations, and put a compensating control in place where a conflict cannot be removed.
4. Make change management routine. One path to production, with a record of request, test and approval for every change.
5. Control emergency access. Log every use and have someone independent review it.
6. Keep evidence from the start. A control that ran but left no trace will not count in an audit.

How much time it takes

That depends on the size of the landscape and on how far the company is from the standard. As a general guide, it is far cheaper to start well before an audit window than inside one. Rules for newly public companies, including any transition period for reporting on internal control, differ by market, so check them with your auditors and advisers.

A small, well-governed team can carry much of this work, which is one reason a micro GCC is often set up around controls and support for the core systems. Terms such as ITGC, SoD and carve-out are explained in the glossary.