A potential IPO changes how a company has to keep its records long before it changes anything else. Investors will read the registration statement; regulators will comment on it; the underwriters will be legally exposed if it is wrong. Every one of those parties wants evidence, and evidence has to exist before it can be shared.
The ten recommendations below follow the order in which the work usually happens. They are written for a growth company in the United States filing with the Securities and Exchange Commission, but most apply to any market with a prospectus regime.
The 18 months before a listing, in six blocks
- Two or three years of audited statements
- Revenue recognition reviewed
- Auditor independence confirmed
- Independent directors recruited
- Audit committee chartered
- Policies drafted
- Control gaps mapped
- Close shortened
- Systems access cleaned up
- Cap table reconciled
- Contracts and IP confirmed
- Litigation summarized
- Underwriter and counsel requests
- Q&A tracked
- Drafting support for the filing
- Comment letters answered
- Final numbers refreshed
- Room archived
1. When should IPO preparation actually start?
Earlier than the board expects. Eighteen months before the target window is a sensible starting point for a company that has never been audited to public-company standards. Companies with a strong finance team and clean audits can sometimes compress this to nine or twelve months.
A useful internal test: if the auditors were asked today to sign off on the last two years, would they need to change anything? If the answer is “probably”, the clock has already started.
2. Are your financial statements audit-ready for a public filing?
Public filings require financial statements audited under the standards of the Public Company Accounting Oversight Board, by a firm registered with it. A private-company audit is a good start but not the same thing. Revenue recognition, stock compensation and segment reporting are the areas most often reworked.
| Area | What private companies often have | What a public filing needs |
|---|---|---|
| Audit standard | Private-company audit | PCAOB-standard audit by a registered firm |
| Years presented | Latest year only | Two years for an emerging growth company, usually three otherwise |
| Interim periods | Management accounts | Reviewed quarterly statements |
| Revenue policy | Applied informally | Documented and consistent across periods |
| Close speed | Several weeks | Fast enough to meet quarterly deadlines |
3. Does the board meet public-company expectations?
Exchanges require a majority of independent directors on the board and fully independent audit, compensation and nominating committees, with phase-in periods for newly listed companies. Recruiting experienced independent directors, particularly an audit committee chair with financial expertise, can take six months on its own.
Write the committee charters, the code of conduct and the insider trading policy at the same time. Underwriters will ask for drafts, and the board needs time to adopt them properly.
4. Are internal controls documented and working?
Public companies certify their internal control over financial reporting. Newly public companies get a transition period, and emerging growth companies are exempt from the auditor attestation for several years, but management still has to stand behind the controls from the start.
Start by mapping where numbers come from: which system, who enters them, who reviews them. Gaps usually sit in access management (too many people with admin rights in the finance system) and in the close process (manual spreadsheet steps nobody reviews).
Practical tip
Keep evidence of each control as you go: sign-offs, reconciliations, access reviews. A folder of dated evidence is far easier to share with auditors and underwriter’s counsel than a reconstruction done under deadline.
5. Is the cap table reconciled to the legal documents?
Every share, option, warrant, SAFE and convertible note has to tie back to a signed instrument and a board approval. Discrepancies between the cap table spreadsheet and the legal record are one of the most common causes of late-stage delays, because fixing them can require consents from former employees and early investors.
Reconcile now. Collect every grant letter, exercise notice and transfer document into one place, and have counsel confirm the totals.
6. Can you produce every material contract, signed?
Diligence teams want the executed version, with all amendments, of every contract that matters: top customers, key suppliers, debt facilities, leases, licenses, and anything with change-of-control or exclusivity terms. “We think it is in someone’s inbox” is not an answer that survives a diligence call.
Editorial guidance based on published listing requirements and typical timelines; individual cases vary.
7. Have IP ownership and open litigation been confirmed?
Investors need to know the company owns what it sells. Confirm invention assignment agreements for every founder, employee and contractor who touched core products, and register key trademarks in the markets you operate in. Summarize pending or threatened litigation with counsel’s assessment, because it will be disclosed.
8. How should you prepare for underwriter diligence?
Bankers and their counsel run two kinds of diligence. Business diligence covers the model, the market and management. Legal diligence works through corporate records, contracts, regulatory matters and anything that could make the filing misleading. Both arrive as long request lists, and both expect fast, complete answers.
This is where a data room earns its cost. A room indexed to the request list, with each party in its own permission group and a Q&A module that logs every question and answer, gives everyone one place to work and leaves a record of what was provided and when. That record matters later: it supports the underwriters’ due diligence defense.
| Room capability | Why it matters in an IPO | How to check it in a trial |
|---|---|---|
| Granular permission groups | Banks, auditors and several law firms see different scopes | Create three groups and test each as a guest |
| Structured Q&A | Questions from many parties stay organized and logged | Submit and route a test question |
| Audit trail export | Evidence of what was provided, and when | Export a log after a test session |
| Watermarking and view-only | Draft financials and forecasts are highly sensitive | Open a file as a guest and try to print |
| Strong certifications | Banks’ own security reviews ask for them | Request the SOC 2 report or ISO 27001 certificate |
Some platforms are built specifically around capital markets work. Our Venue by DFIN review and Datasite review cover two that bankers often know, and our ranking of the best data room software for an IPO compares the wider field on the criteria above.
9. What changes in the last three months?
The draft registration statement goes back and forth between the company, counsel, auditors and, once filed, the regulator’s reviewers. Numbers are refreshed each quarter, comment letters are answered, and the roadshow presentation is built. The data room stays open and active, usually with new folders for comment responses and bring-down diligence.
Plan for the archive. When the deal closes, export the full room with its audit log and keep it under your records policy. Check before signing how long the provider keeps the archive and what an export costs.
10. Should you keep the option of a different exit open?
Many companies that prepare for an IPO end up selling instead, sometimes in a dual-track process run alongside the filing. The good news is that readiness work is not wasted: an audited, well-governed company with clean records and an organized data room is exactly what a strategic buyer or private equity firm wants to see too. Our guide to the best data room software for M&A covers the sale side.
Comparing rooms for an IPO or dual-track process?
See how the leading providers score on security, workflow and pricing clarity.
Frequently asked questions
How long does it take to prepare for an IPO?
Usually 12 to 18 months for a company that has not yet been audited to public-company standards. Companies with strong finance teams and clean audits can sometimes prepare in nine to twelve months.
What is the hardest part of IPO readiness?
For most companies it is the financial side: audits to public-company standards, a faster close and documented controls. Cap table reconciliation and contract cleanup are the next most common sources of delay.
Do you need a virtual data room for an IPO?
In practice, yes. Underwriters, their counsel, company counsel and auditors all run diligence at the same time, and a data room keeps their access separate, logs every question and answer, and records what was provided.
What is an emerging growth company?
A US category for companies below a revenue threshold that can use scaled disclosure, including two years of audited financial statements instead of three and a temporary exemption from the auditor attestation of internal controls. Check the current thresholds with counsel.
What should a company do with its data room after listing?
Export the full room with its audit log and keep it under the company's records retention policy. The record of what was disclosed during diligence can matter long after the listing.