Most founders thinking about going public carry the same mental model. Hire a good CFO. Pick a Big Four auditor. Spend six months "getting audit-ready." Ring the bell. Celebrate. This mental model is wrong in ways that will cost you real money, real board credibility, and real sleep.
I lived it from the operator's seat. The part you won't find in any readiness guide is the texture — what being a reporting company actually does to your operating rhythm, your team, and the way you think about every single decision from invoicing to payroll to marketing spend. And PCAOB readiness is ground zero for that transformation.
Here's the core insight. PCAOB readiness is not about accounting. It's about evidence. And evidence is a completely different operating system than the one you've been running as a private company.
PCAOB auditors don't care if your numbers are right. They care if you can prove them.
Read that again. PCAOB auditors do not care whether your numbers are right. They care whether you can prove your numbers are right — with documentation that was created contemporaneously, reviewed by an independent party, and stored in a way that a third party can audit the audit trail itself.
In a private company, the CFO says, "trust me, this is right," and the board nods. In a PCAOB audit, the CFO says, "here is the document that was signed by Person A on Date X, reviewed by Person B on Date Y, approved under Policy Z which was board-adopted on Date W." Everything has to have a paper trail that was created before the fact, not reconstructed after. Reconstructed paper trails are how you end up in the newspaper.
In a private company, accounting is about answers. In a public company, accounting is about evidence. Those are two fundamentally different operating systems.
Internal controls are a behavioral problem, not a technical one
The Big Four IPO readiness guides — Deloitte's IPO services practice and EY's Global IPO Trends reports — all say the same thing in different words. Most companies underestimate SOX and internal controls readiness by 12–18 months. They're not being dramatic. They're being precise.
SOX 404 — the internal controls framework — is what eats companies alive in year one as a reporting entity. On paper it looks like a checklist. In practice it requires every single person in finance, ops, legal, and HR to change how they do their job. That is a behavioral transplant, not a software implementation.
Example. In a private company, your AP clerk pays a vendor invoice when the ops lead says "yes, this is legit." In a SOX-compliant environment, the AP clerk cannot pay that invoice until there is documented three-way matching (PO, receipt, invoice), an approver whose authority is codified in a board-approved delegation of authority matrix, and a segregation of duties proving the approver is not also the person who entered the invoice.
Every step is a behavioral change. Every change is resisted by the team that used to "just get things done." And every one of them is table stakes for an auditor signing your 10-K. This is where most pre-IPO companies underestimate the work — they think it's a system change, and it's actually a culture change.
The audit committee will test you in ways your board never did
Private company boards are largely your friends, your investors, and people who want the company to succeed. Public company audit committees have a legal duty to the shareholders that supersedes their relationship with you. A good audit committee chair will not cover for the CEO. They will ask the CFO hard questions with the CEO in the room and expect direct answers in complete sentences.
If you have never sat in a meeting where an audit committee chair politely asks "walk me through why this revenue was recognized in Q3 instead of Q4" and then sits in silence until you answer, you are not ready to be a public company CEO. That silence is the loudest sound in corporate life. I've sat in it. It teaches you more about your own controls than 90 pages of readiness decks.
The four things I wish I had done 12 months before the S-1
If I were advising a founder today who was seriously considering an IPO in the next 18-24 months, here is exactly what I'd have them start now:
- Run a parallel monthly close as if you were already public. Five-business-day close. Flux analysis on every material line. Management certification. Do this for at least four months before the auditor arrives. You will discover every broken process, and you will have time to fix them without someone watching.
- Hire a PCAOB-experienced controller before you hire a public-company CFO. The CFO is the face. The controller is the mechanism. You need the mechanism working before the face matters. Hire the mechanic first, the diplomat second.
- Adopt a delegation of authority matrix now. Board-approved. In writing. Dollar thresholds. Signature requirements. Cross-functional approvals. It will feel bureaucratic. It is a prerequisite to being auditable, and it will save you from one specific type of conversation with your audit committee that you do not want to have.
- Stand up an audit committee charter and start meeting as if it were real. Even if you don't technically have one yet. Practice the cadence, the materials, the tone, the questions. The first real audit committee meeting is not where you want to start learning.
The part nobody tells you about the cost
Being a public company at small-cap scale runs roughly $1.5M to $3M per year in audit fees, directors, D&O insurance, legal, filing, investor relations, and compliance. That's before you count the opportunity cost of your executive team spending 20-30% of their time on compliance instead of building the product.
If your company is not generating enough EBITDA to absorb that as a rounding error, going public is not an operating decision. It's a financing decision that is going to hollow out your P&L. I have watched several small-caps discover this the hard way in year two. I was one of them. The math is unforgiving.
The honest question nobody asks in the readiness meeting
Before you spend the money on readiness, ask yourself one question: do you actually want to be a public company CEO, or do you want the liquidity event? Those are two very different careers. The readiness process will reveal which one you actually signed up for — usually at exactly the moment it's too late to back out.
I'm not anti-IPO. I did it. I'd do parts of it again. But I would never do it again without spending 18 months building the operating rhythm of a public company before I was one, so that when the bell rings my team is already living in that world, not learning it on the job while the analysts are watching and the short sellers are circling.
Here's the challenge. If you're reading this and you're 18 months from filing an S-1, don't wait for your auditor to tell you what's broken. Go break it yourself. Run a closed-book dry-run audit next quarter. Find everything that would fail. Fix it before anyone is watching. The founders who survive year one as a reporting company are the ones who did the hard work before the world was watching — not the ones who tried to fake it under the lights.
If you ended up with a reporting company in distress rather than in readiness, my 72-hour turnaround playbook is the other side of that coin.