{{item.title}}
{{item.text}}
{{item.title}}
{{item.text}}
From 2019 to today, about half of all companies going public each year have reported one or more material weaknesses (MWs)1 in their internal controls before their IPO.
While management is not required to formally report on internal controls until the second annual report following an IPO (and auditor attestation potentially phases in later2) companies that fail to identify and disclose MWs during the IPO process may face significant consequences if those weaknesses come to the public light post-IPO. These include financial statement revisions and loss of trust and credibility with investors and the SEC. Newly public companies are particularly vulnerable given their short public market history.
More and more companies are disclosing MWs in their IPO filings to provide greater transparency to investors. Proactive disclosure, along with clear remediation plans, builds investor trust and positions the company to mitigate future operational, financial, and reputational risks. Demonstrating progress towards remediating MWs reflects positively on management, enhancing credibility and confidence in the company’s ability to operate effectively as a public entity. What may seem like an undesirable deficiency can ultimately highlight the company’s strengths in operating and enhancing its controls, thereby instilling greater confidence in the completeness and accuracy of its financial reporting.
A material weakness is defined as “a deficiency, or a combination of deficiencies, in internal control over financial reporting (ICFR), such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.”
Under the Sarbanes-Oxley Act (SOX), management—specifically the CEO and CFO— are required to establish, maintain, and evaluate the effectiveness of ICFR. It also requires external auditors of public companies to conduct an assessment and report on the effectiveness of ICFR. The requirements and timing of compliance vary based on the three separate certification requirements introduced by SOX, as described in more details below.
Section 3023 requires that the CEO and CFO certify in each annual and quarterly report that (i) they have reviewed the report and (ii) the report does not contain any untrue statement of a material fact or omits to state a material fact. They also certify that the financial statements fairly present, in all material respects, the company’s financial condition, results of operations, and cash flows, and that there are no material misstatements, omissions or instances of fraud that are required to be disclosed to the company’s audit committee.
Section 9063 requires that the CEO and CFO certify in each annual and quarterly report that they fully comply with federal securities laws and fairly present, in all material respects, the issuer’s financial condition and results of operations. Knowingly or willfully submitting false certifications can result in significant fines and imprisonment.
Under Section 4042, beginning with the second annual report, registrants must include a report stating that management is responsible for establishing and maintaining adequate ICFR and an assessment by management of the effectiveness of ICFR (Section 404(a)), including robust disclosures of material weaknesses that existed as of the date of the assessment.
In addition, for most registrants, the company’s external auditors are also required to attest to the effectiveness of ICFR (Section 404(b)).2
PwC analyzed MW disclosures by reviewing filings of domestic and foreign issuer IPOs1 listed on the NYSE and NASDAQ stock exchanges, from January 1, 2019 to December 31, 2024. The analysis revealed several noteworthy trends:
These noted trends in IPO MW disclosures suggest the market increasingly expects companies to have a strong understanding of their internal controls well before their IPO.
The most common MWs reported relate to insufficient accounting personnel, lack of financial reporting oversight, insufficient technology systems, review processes and lack of appropriate procedures. These types of MWs in pre-IPO companies are not unexpected, considering these companies typically have fewer resources and a leaner organization. In contrast, MWs identified in more mature public companies are typically tied to specific issues or complex transactions, given their more developed organizational structures supporting the organization. When pre-IPO companies disclosed MWs, they included a risk factor disclosure in the IPO registration statement and the majority also included additional disclosures in the Management’s Discussion and Analysis (MD&A).
Along with disclosing MWs, proactively disclosing remediation efforts demonstrates that management is committed to addressing deficiencies and improving internal controls, which can play a part in reassuring stakeholders that the company is taking the necessary steps to prevent any financial misstatements. Additionally, providing clear remediation plans allows companies to mitigate the negative impact of material weaknesses on public perception by showing progress and accountability. Disclosure of remediation strategies in registration filings can also help avoid further scrutiny from regulators like the SEC, which expects companies to be upfront about both their control deficiencies and corrective actions.
98% of companies disclosing MWs in their IPO registration statements included remediation plans, with many companies disclosing more than one solution to remedy their MWs. Most commonly, companies sought to remedy their MWs by establishing or revising formal policies and procedures or by hiring additional personnel. Other remediation plans include hiring a CFO, preparing training materials, and hiring third-party advisors.
Sector trends
Sector insights
i. Software
ii. Enterprise cloud
iii. Platform companies
i. Rapid growth and scaling, which can strain existing control resources and systems.
ii. Complex revenue recognition models including subscription, multi-element arrangements, freemium, licensing and royalty which can lead to additional complexity and need for controls.
iii. Higher cybersecurity risks and complex IT systems, given the software / cloud platforms, but lack of adequate IT general controls and mitigating internal controls.
iv. Regulatory environments with a heightened focus on data collection, privacy, employee and third-party access and telecommunications regulations.
Sector trends
Sector insights
i. Increased investment (and exits) - With an influx of venture capital funding and successful exits, a cycle of investment and growth has been established recently in the sector.
ii. Genomic medicine - Advances in genomic medicine (such as CRISPR) have revolutionized the biotech industry leading to the development of personalized medicine, targeted therapies, and novel treatments for previously intractable diseases.
iii. Platform companies - An increasing focus on developing platforms that can generate multiple products, rather than a single product, allows for diversification of risk, potential for multiple revenue streams, flexibility and scalability.
iv. Participation from industry experts - Participation, including investments and involvement from industry experts and former executives, has increased, indicating confidence in the company prospects and providing valuable industry insights and connections.
Sector trends
Sector insights
i. Financial instruments – The use of complex financial products such as derivatives, structured finance and hedging instruments increases accounting complexity and the risk of errors or misstatements.
ii. Global operations & FX - Many FS firms operate globally, making foreign currency transactions and hedging strategies essential, but these transactions can often increase the risk of financial misstatements.
iii. Legacy systems – FS companies at times rely on outdated or legacy systems for transaction processing and financial reporting, making it difficult to accurately manage non-routine transactions.
Sector trends
Sector insights
i. Frequent M&A - Consumer companies frequently engage in mergers, acquisitions, and business combinations, which complicates financial reporting as they incorporate subsidiaries with different ERPs and reporting systems which can lead to errors in consolidating financial statements.
ii. Complex Revenue Streams - CM companies often deal with diverse revenue streams (e.g., retail sales, online platforms, franchises), which can complicate the application of revenue recognition rules with complex accounting for variable consideration, discount and promotional models, loyalty programs, etc.
iii. High volume of transactions – Retail and consumer companies often deal with a high volume of small transactions, typically across multiple sales channels and with complex inventory management systems, which increases the complexity of tracking and reporting financial data accurately, leading to potential control weaknesses.
Sector trends
Sector insights
Sector trends
Sector insights
i. The capital intensive nature of the industry requiring large upfront investments.
ii. Regulatory hurdles requiring stringent compliance at a state, national and international level.
iii. Long-term investment horizons with some projects, especially mining and energy, requiring decades to break even.
iv. A mature industry structure means that the sector is often dominated by large, established players with significant market share, leaving little room for smaller companies to start, grow and go public.
Sector trends
Sector insights
Addressing internal controls after IPO registration begins can complicate an already intense process. Meeting SOX requirements often demands meaningful process and control changes—changes that can be disruptive if tackled too late. In our experience, starting six to nine months in advance to design and implement a SOX-compliant framework—and operating under it for at least six to twelve months—help reduce risk, smooth the IPO journey and build investor confidence.
Preparing to go public is a transformational step. We work closely with management teams to conduct comprehensive readiness assessments that uncover gaps in internal controls and processes—well before they become roadblocks. From early diagnostics to hands-on guidance through every stage of IPO readiness, our team is here to help you move forward with confidence. Reach out to find out how we can guide you through each step of the readiness assessment process and beyond.
For over 14 years, PwC has tracked and analyzed MW disclosures on a quarterly basis—by sector, in aggregate, and at the individual company level. Our robust dataset covers key dimensions, including:
This depth of insight helps companies benchmark against peers, spot trends, and anticipate investor and regulatory scrutiny.
We’re ready to dive into material weakness trends that matter to your company or industry. If you’re looking to access more detailed data, explore key insights, or have a strategic conversation with our experienced team, connect with us using the link below—we’d love to help you take the next step.
Special thanks to Semir Krpo, Jocelyn Leung, Noah Simon and Thomas Ko for contributing to this publication.