The standard advice to a CFO who has just been handed a material weakness before an S-1 is to fix it quietly and file on schedule. That advice assumes you have the runway. Roughly half the companies reaching the public market disclose one anyway, and the ones that get punished are rarely the ones who disclosed. They are the ones who showed up at the auditor's door carrying four weaknesses and no operating history behind the fix. What follows is what the disclosure actually costs, how much time remediation needs, and how the arithmetic changes on a SPAC clock.

Key takeaways

• Assume you will disclose. About 46% of companies going public between 2019 and 2024 reported at least one material weakness, and most of them reported only one or two.

• Count the weaknesses rather than the fact of one. Registration filers are the group most likely to carry four or more, and that count is what changes how an investor reads your risk section.

• Start 18 months out. Design takes six to nine months, and the operating history that makes it defensible takes six to 12 more.

• EGC status delays the auditor's opinion on internal control, never management's own assessment.

• Build the evidence into the close, not around the auditor.

Will a material weakness delay your IPO?

A disclosed material weakness rarely stops a listing on its own. It changes the conversation around it. Pricing gets harder to defend, diligence runs longer, and a weakness found late in the process is the one most likely to push a filing into the next window. Safebooks AI frames it as the single risk most likely to delay a listing and depress the valuation, which is the right instinct even if the mechanism is less dramatic than a blocked registration.

This piece is about what that disclosure does to a listing. It is not a general explainer on why controls fail. If you need the definition, the severity comparison and the remediation options in depth, those sit in the companion piece on why standard fixes fail to close control gaps.

How common are material weaknesses in IPO filings?

Common enough that underwriters and investors treat the disclosure as normal rather than disqualifying. PwC reviewed domestic and foreign issuer IPOs on the NYSE and NASDAQ from January 2019 to December 2024 and found that about 46% disclosed at least one material weakness before listing. More than 70% of those companies disclosed only one or two. Some disclosed as many as seven.

KPMG's separate study of traditional IPOs reaches the same neighbourhood from a different dataset. Across the 569 companies that closed traditional IPOs from 2021 to 2023, 253 of them disclosed a material weakness in their initial registration statement, or 46.4%. The annual figures inside that range from 40% to 58%.

Here is where the popular reading of those numbers goes wrong. The 2022 spike that gets quoted as evidence of deteriorating controls happened in the thinnest IPO year of the three. Only 107 traditional IPOs closed in 2022 against 340 in 2021, so the 58% describes a small and unusual cohort of companies that could still reach a closed market. By 2023 the rate was back to 44% on 122 IPOs. One year is a data point. Treat the mid-40s as the base rate and 2022 as the anomaly it was.

Table 1: how often material weaknesses appear in IPO registration statements, by issuer type and sector

The foreign private issuer gap deserves a note of its own. At 79% against 37% for domestic issuers, an F-1 filer is more than twice as likely to carry a disclosure. Local statutory reporting rarely builds the documentation trail that a US registration expects, and the gap shows up as a control finding rather than an accounting one.

What counts as a material weakness in an S-1 or F-1 filing?

A material weakness is a deficiency in internal control over financial reporting severe enough that a material misstatement could go undetected. In a registration it lives in the risk factors and in management's discussion of controls, and it travels through every amendment until it is remediated or the company stops filing.

KPMG sorts what actually gets disclosed into four working categories, and they are worth memorising because your auditor is sorting your environment the same way.

• Lack of accounting resources with the knowledge to handle complex transactions and US GAAP reporting.

• Segregation of duties gaps, usually a lean team where one person initiates and approves.

•  Inadequate control design, or no control at all over a significant process.

• Controls that were designed correctly and did not operate as intended.

Protiviti's work on what changes when a private company becomes a public filer is a useful cross-check on scope, because most first-time filers underestimate how much of the readiness effort sits outside the accounting team.

What SOX obligations begin the day you file?

Registration starts a clock that most private-company finance teams have never run against. Three provisions matter, and they arrive at different times.

Section 302 puts personal certifications on the CEO and CFO from the first periodic report. Section 404(a) requires management to assess internal control over financial reporting and to publish that assessment. Forvis Mazars puts the deadline plainly, noting that management must file its 404(a) assessment by the second annual report even where an emerging growth company has a five-year delay on the auditor's opinion. Section 404(b) is that auditor attestation, and it is the one with the heaviest documentation and testing demands attached.

The sequence catches people out. Management certifies first and the auditor opines later, so the company that waits for its auditor to define the control environment has inverted the order of the work.

Emerging growth company status moves your deadline, not your exposure

The JOBS Act created emerging growth company status to soften the compliance step-up, and it does real work. Eligibility turns on revenue below $1.235 billion in the most recently completed fiscal year and no more than $1 billion of non-convertible debt issued over a rolling three years. Connor Group's readiness guide sets out both the eligibility tests and the reporting relief, including the reduction to two years of audited financials rather than three.

What EGC status does not do is exempt you from having controls that work. The relief is from the auditor's opinion. Management's own assessment still lands early, investors still read the risk factors, and the day the exemption lapses you inherit an attestation standard you have had no practice operating under.

Table 2: what emerging growth company status changes about the SOX obligations

One caveat on the right-hand column. The sources here describe the EGC exemption and the general 404(b) requirement, not the filer-status thresholds that trigger attestation for everyone else, so confirm your own position against the SEC's current accelerated filer definitions rather than reading it off this table.

How does a material weakness affect IPO valuation and pricing?

Investors price the count, not the existence. Stout reviewed nearly 500 companies that disclosed a material weakness between January and March 2025 and found that about 16% reported four or more. Among S-1 and S-4 filers that share rises to 21%. Registration filers are meaningfully more likely to arrive with a cluster than their fully public peers.

That gap is the whole story. One weakness with a dated, specific, funded remediation plan reads as a company that found a problem and is fixing it. Four weaknesses read as a finance function that has not kept pace with the business, and the discount attaches to the second interpretation. Stout's framing of internal control as a value lever rather than a compliance cost is the correct way to think about the spend, and the erosion shows up in slower audits and weaker positioning long before it shows up in a printed number.

The public examples make the point better than any model. Safebooks AI documents Groupon's restatement, which followed shortly after the company went public and traced back to refunds that were never properly reserved for. The share price fell 17% by Safebooks' account, and the SEC required a revision of the company's internal controls. Nobody bid the stock down because a control existed on paper. They bid it down because the reported revenue turned out to be wrong.

None of the sources here quantify an average valuation discount for a material weakness disclosure. Any figure you see attached to that claim deserves a hard look at its methodology.

Which control gaps show up most often in pre-IPO filings?

The same handful, year after year, in roughly the same order. Audit Analytics examined first management reports on internal control filed after an IPO and found that nearly all of the ineffective ones carried a documentation, policy or procedure issue. About 75% carried an accounting personnel resourcing issue. More than 50% carried a segregation of duties issue. At the account level, revenue recognition led at 11.8% of filings, with liabilities, payables, reserves and accrual estimates next at 10.1%.

That analysis was published in 2020 and its series runs from 2010 to 2018, which makes it the oldest evidence in this article. Treat the proportions as a pattern rather than a current-year reading. No newer release of the same longitudinal study exists, and the categories have proved stable across the more recent PwC and KPMG work.

Baker Tilly's guidance on what breaks in the run-up to a public exit puts operational detail underneath those categories. Cutoff procedures that were adequate for a private close stop being adequate once a quarter has to be defended. Accruals get stricter. Headcount depth stops being a hiring preference and becomes a control question, because a team of two cannot segregate anything.

If you want to know whether your own environment is trending toward a finding, the events that reliably precede a material weakness are a better early-warning system than a quarterly self-assessment.

Why late remediation fails on an IPO timeline

Four reasons, and Stout names all of them. Private companies underestimate what internal control over financial reporting actually involves, because lean teams and undocumented processes work fine until a PCAOB-audited set of financials arrives. Market windows open fast, which compresses the time available to evaluate, remediate and then test. Companies lean on the external auditor to lead the effort, when the auditor's job is opinion-level assurance and not building your control environment. And remediation gets treated as a gap-plugging exercise, with borrowed documentation and temporary workarounds that do not survive a readiness review.

The fourth one is the expensive one. A control you designed in March and tested once in September has no operating history. Your auditor is not assessing whether the control exists. They are assessing whether it ran, consistently, over a period long enough to mean something. Forvis Mazars makes the related point that management certifies control adequacy well before the auditor issues any opinion, so the sequence people default to is backwards.

How much runway does remediation actually need before you file?

Plan for 18 months. PwC's guidance is six to nine months to design and implement a SOX-compliant framework, then operating under that framework for at least six to 12 months before it is defensible. Add those together and the control decision sits roughly a year and a half ahead of the listing, not inside the window where the S-1 is being drafted.

Companies do commit to the fix. PwC found that 98% of IPO registrants disclosing a material weakness also disclosed a remediation plan, most often establishing or revising formal policies and procedures or hiring additional personnel. Several disclosed more than one remedy. The disclosure itself is not the problem the market is pricing. An undated, unfunded, vaguely worded plan is.

On staffing, Baker Tilly's position is worth taking seriously. External consultants close a documentation gap quickly and they cannot own a control, which means the headcount question does not go away. Here is the honest concession. Complex, non-routine transactions such as convertible instruments, cheap stock and revenue with heavy variable consideration genuinely need a technical accounting specialist, and no amount of automation substitutes for that judgment. What automation can do is stop those specialists spending their quarter chasing balances and rebuilding support, which is the work that made the environment thin in the first place. Controls that produce their own evidence as the close runs are what turn a designed framework into an operating one.

What changes if you go public through a SPAC

The gaps are identical. The clock is not. EY's guidance for SPAC targets, written in 2022 at the height of the SPAC wave, notes that a merger moves much faster than a traditional IPO and that the pressure intensifies as the sponsor approaches the end of an 18 to 24 month lifecycle. A deadline set by someone else's fund structure is a different planning problem to a deadline you choose.

EY organises the response around people, process and policy, which holds up well as a sequence. Accounting staff who know US GAAP or IFRS and SEC reporting have to be onboarded early rather than recruited during diligence. Controls have to be built while the transaction is running. Accounting policies have to be documented before the auditor asks, because a policy written in response to a question reads exactly like a policy written in response to a question.

Table 3: control readiness on a traditional IPO compared with a SPAC merger

What investors and auditors watch after the listing

The S-1 is not the finish line, and the numbers say so. Audit Analytics tracked ineffective internal control in first management reports after an IPO rising from 12% of reports in 2010 to 21% in 2018, with a high of 24% in 2016. The same series is the 2010 to 2018 window flagged above, so read it as history rather than as this year's rate. The encouraging half is that most companies cleared the finding by their following management report.

KPMG's 2023 cohort shows both directions of travel. Of the 54 companies that disclosed a weakness in their initial registration, 14 had cleared it by their first 10-K. In the same cohort, 11 companies disclosed a weakness in a later 10-K or 10-Q that had never appeared in the S-1. Your registration statement is not the ceiling of your control problem. It is a snapshot taken before the reporting cadence got harder.

The consequence that should concentrate the mind is what Audit Analytics found downstream. Registrants disclosing ineffective controls in that first management report were more likely in subsequent years to file late, record an impairment, restate, or draw a going concern opinion. The correlation is not proof that the original weakness caused any of it, and a control environment weak enough to produce one finding rarely produces only one. If a correction does become unavoidable, the path through error corrections and restatement decisions is worth understanding before you are in it.

The pre-IPO control roadmap a CFO can start this quarter

None of this requires a consultant on site to begin. It requires sequencing.

1. Hire or promote accounting capability that has seen US GAAP or IFRS reporting and SEC filing requirements before. This is the constraint everything else waits on.

2. Train the finance people already in place. Most control failures at this stage are documentation failures by capable people who were never told what evidence looks like.

3. Build controls around financial reporting rather than around the audit. A control designed to satisfy a testing request will be redesigned the first time the business changes.

4. Document the policies before anyone asks for them. Cutoff, accruals, revenue, equity, consolidation.

5. Operate the framework long enough to have a testing population. Design without operating history is the gap that fails a readiness review.

The standard to aim at is control evidence produced as a by-product of the close rather than assembled afterwards. That is the difference between a SOX programme that is evidence rather than a badge and one that generates a fire drill every quarter.

Why choose Stacks for pre-IPO close controls

Finance teams running their close on Stacks close 50% faster, auto-match 96% of reconciliations, and complete audit cycles 45% quicker. Those outcomes belong to the teams, not to the software. What produces them is a close where the control and the evidence are the same artefact, so a 404(a) assessment is a query rather than a reconstruction project.

The controls a pre-IPO reader gets asked about are built into the workflow. Segregation of duties is enforced through maker-checker approvals rather than a policy document. Every action lands in an immutable audit trail. The platform runs SOX-ready controls with SOC 2 Type II, ISO 27001:2022 and GDPR behind it, which matters when your auditor starts asking who could have changed what and when.

For teams whose weakness sits in the reporting cycle itself, running the close on a single controlled timeline removes the handoffs where evidence usually goes missing. Where the finding is in balance sheet substantiation, matching that runs continuously rather than at quarter end turns the reconciliation from a monthly scramble into a standing position.

FAQs for material weakness and IPO readiness

Will a material weakness stop an IPO from going ahead?

Rarely on its own. About 46% of companies that went public between 2019 and 2024 disclosed at least one and still listed. What a weakness does is lengthen diligence, weaken your position on pricing, and raise the odds of a delay when it is identified late. A cluster of four or more is treated very differently from a single finding with a credible plan behind it.

How many companies disclose a material weakness in their IPO filing?

Roughly 46% on PwC's review of 2019 to 2024 listings. KPMG's independent study of traditional IPOs from 2021 to 2023 found 46.4% across 569 companies, with annual rates between 40% and 58%. The 58% year was 2022, which had unusually low IPO volume, so the mid-40s is the more reliable base rate.

Does an emerging growth company still have to assess internal control over financial reporting?

Yes. EGC status can exempt you from the auditor's attestation under SOX 404(b) while the status lasts, up to five years. Management's own assessment under 404(a) is still required by the second annual report. The relief is from the external opinion, not from the obligation to have controls that operate.

How long does it take to remediate a material weakness before filing?

Plan on about 18 months. PwC recommends six to nine months to design and implement a SOX-compliant framework, then a further six to 12 months operating under it so there is a testing population to assess. Shorter timelines are possible for narrow findings, but they leave no operating history behind the fix.

What is the difference between a material weakness and a significant deficiency?

Severity. A significant deficiency is important enough to warrant attention from those responsible for oversight. A material weakness carries a reasonable possibility that a material misstatement would not be prevented or detected in time. Only the material weakness triggers the disclosure that investors and underwriters read.

Do SPAC targets face the same internal control requirements as IPO candidates?

The requirements are the same and the timeline is not. A SPAC merger moves faster than a traditional IPO, and the sponsor's 18 to 24 month lifecycle sets a deadline the target does not control. That compression is why control gaps in a SPAC target usually surface as people and documentation problems rather than as design problems.