The science is ready before the operations are. What auditors and bankers actually look at, what has to be true before you file, and what can safely wait until after.
Maybe the board, maybe the new lead investor, maybe your own CEO after a good data readout. Nothing is filed and nothing is certain, but the conversation has changed tense — it is now when rather than if, and you are the person who will have to make the back office survive the scrutiny.
Revenue recognition still involves a spreadsheet somebody built. Your close takes longer than you would admit in a diligence call. Access rights were set up when there were forty people and nobody has looked since. None of it is wrong, exactly. It just was not built to be examined.
Eighteen months is a lot of time. Six is not.
Controls get treated as an audit problem rather than a systems problem. A firm is engaged, a controls matrix appears, and it describes a control environment your systems cannot actually enforce. Documented controls that depend on someone remembering to do something are the ones that fail testing, and they fail in the quarter you can least afford it.
The close gets faster by heroics instead of by design. Everyone works the weekend, the number lands, and the underlying process is unchanged. That works until the first quarter where you are reporting to a market.
Nobody separates what must be fixed before filing from what can be fixed after. This is the most expensive confusion available. Treat everything as pre-filing and you spend a year and a great deal of money on work that could have waited. Treat nothing as pre-filing and you are remediating in front of an auditor.
Operations. Can your order-to-cash, procure-to-pay, and inventory processes run without the three people who currently hold them together in their heads? Key-person dependency is a diligence finding, not just an operating risk.
Regulatory. Your GxP obligations do not pause for a filing, and the two control environments have to coexist without duplicating each other. Where a process carries both, it should be documented once and satisfy both.
Capital. Are the controls enforced by the system, evidenced automatically, and reviewable by someone who was not involved? Would your close survive being run twice as often? Does your revenue recognition survive someone reading the policy and then reading the transactions?
Global. If the EU expansion is on the roadmap — and it usually is by the time an S-1 is — consolidation, intercompany, and multi-currency belong in the design now. Adding a second entity after go-live is a rebuild, not a configuration change.
We read what exists: your close calendar, your current controls documentation, your system access model, your last audit management letter if you have one. Then we talk to the people who actually run the close and the people who would have to evidence a control if asked.
You get back a written picture of where you stand against what a first-year public company has to do, split into three lists: what must be true before you file, what must be true within four quarters after, and what is fine as it is.
Most of the value is in that third list. Knowing what not to spend on is usually worth more than another remediation plan.
A targeted analysis takes ten business days and a fixed fee. The most common version of the question here is what has to be true before we file, and what can wait.
If the answer is that the operating surface needs real work, that becomes a process assessment — four to six weeks, fixed fee, four lenses at once.
We are not your auditor and we do not want to be. We work the operations and systems side of the readiness question, which is the part that takes the longest and gets started the latest.
We can have an NDA signed the day you ask.