Material weakness disclosures in an IPO: PwC

Why does transparency matter in an IPO?

From 2019 to today, about half of all companies going public each year have reported one or more material weaknesses (MWs)¹ in their internal controls before their IPO.

While management is not required to formally report on internal controls until the second annual report following an IPO (and auditor attestation potentially phases in later²) companies that fail to identify and disclose MWs during the IPO process may face significant consequences if those weaknesses come to the public light post-IPO. These include financial statement revisions and loss of trust and credibility with investors and the SEC. Newly public companies are particularly vulnerable given their short public market history.

More and more companies are disclosing MWs in their IPO filings to provide greater transparency to investors. Proactive disclosure, along with clear remediation plans, builds investor trust and positions the company to mitigate future operational, financial, and reputational risks. Demonstrating progress towards remediating MWs reflects positively on management, enhancing credibility and confidence in the company’s ability to operate effectively as a public entity. What may seem like an undesirable deficiency can ultimately highlight the company’s strengths in operating and enhancing its controls, thereby instilling greater confidence in the completeness and accuracy of its financial reporting.

Identifying MWs post-IPO can impact share price as analysts and investors may perceive these weaknesses as a risk leading to lower ratings, reduced trust, and lower demand for the stock.
Negative press from delayed disclosures can highlight concerns around financial controls, governance, or public company readiness and damage a company’s reputation.
MW disclosures enforce management’s accountability and provide transparency, allowing for a more accurate and reliable evaluation during the due diligence process.
With increasing scrutiny from stakeholders (i.e., auditors, legal counsel, underwriters) on an entity’s control environment, companies should proactively identify and disclose MWs, if applicable, to minimize the risk of potential IPO timeline delays.
Early identification of MWs can support more accurate budgeting and earlier remediation planning which can be time-intensive and costly, often requiring companies to hire additional personnel, overhaul internal processes, and implement more robust financial controls.

Just what is a material weakness?

A material weakness is defined as “a deficiency, or a combination of deficiencies, in internal control over financial reporting (ICFR), such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.”

Under the Sarbanes-Oxley Act (SOX), management—specifically the CEO and CFO— are required to establish, maintain, and evaluate the effectiveness of ICFR. It also requires external auditors of public companies to conduct an assessment and report on the effectiveness of ICFR. The requirements and timing of compliance vary based on the three separate certification requirements introduced by SOX, as described in more details below.

SOX — Key provisions

Section 302

Section 302³ requires that the CEO and CFO certify in each annual and quarterly report that (i) they have reviewed the report and (ii) the report does not contain any untrue statement of a material fact or omits to state a material fact. They also certify that the financial statements fairly present, in all material respects, the company’s financial condition, results of operations, and cash flows, and that there are no material misstatements, omissions or instances of fraud that are required to be disclosed to the company’s audit committee.

Section 906

Section 906³ requires that the CEO and CFO certify in each annual and quarterly report that they fully comply with federal securities laws and fairly present, in all material respects, the issuer’s financial condition and results of operations. Knowingly or willfully submitting false certifications can result in significant fines and imprisonment.

Section 404

Under Section 404², beginning with the second annual report, registrants must include a report stating that management is responsible for establishing and maintaining adequate ICFR and an assessment by management of the effectiveness of ICFR (Section 404(a)), including robust disclosures of material weaknesses that existed as of the date of the assessment.

In addition, for most registrants, the company’s external auditors are also required to attest to the effectiveness of ICFR (Section 404(b)).²

The latest trends

PwC analyzed MW disclosures by reviewing filings of domestic and foreign issuer IPOs¹ listed on the NYSE and NASDAQ stock exchanges, from January 1, 2019 to December 31, 2024. The analysis revealed several noteworthy trends:

All IPOs
IPOs by issuer type

An average of 46% of companies have disclosed at least one MW while going public.
The average disclosure rate has consistently remained around the mid-40% range, with an exception in 2022 when MW disclosure rate reached 59%.

Over 70% of companies that filed for an IPO and disclosed MWs reported one to two MWs; however some disclosed up to seven MWs.
Foreign private issuers have a significantly higher rate of MW disclosures compared with domestic issuers. On average, 79% of foreign private issuers disclosed MWs in their IPOs compared with 37% of domestic issuers.

These noted trends in IPO MW disclosures suggest the market increasingly expects companies to have a strong understanding of their internal controls well before their IPO.

Common types of MWs and remediation

The most common MWs reported relate to insufficient accounting personnel, lack of financial reporting oversight, insufficient technology systems, review processes and lack of appropriate procedures. These types of MWs in pre-IPO companies are not unexpected, considering these companies typically have fewer resources and a leaner organization. In contrast, MWs identified in more mature public companies are typically tied to specific issues or complex transactions, given their more developed organizational structures supporting the organization. When pre-IPO companies disclosed MWs, they included a risk factor disclosure in the IPO registration statement and the majority also included additional disclosures in the Management’s Discussion and Analysis (MD&A).

Along with disclosing MWs, proactively disclosing remediation efforts demonstrates that management is committed to addressing deficiencies and improving internal controls, which can play a part in reassuring stakeholders that the company is taking the necessary steps to prevent any financial misstatements. Additionally, providing clear remediation plans allows companies to mitigate the negative impact of material weaknesses on public perception by showing progress and accountability. Disclosure of remediation strategies in registration filings can also help avoid further scrutiny from regulators like the SEC, which expects companies to be upfront about both their control deficiencies and corrective actions.

98% of companies disclosing MWs in their IPO registration statements included remediation plans, with many companies disclosing more than one solution to remedy their MWs. Most commonly, companies sought to remedy their MWs by establishing or revising formal policies and procedures or by hiring additional personnel. Other remediation plans include hiring a CFO, preparing training materials, and hiring third-party advisors.

Sector breakout

Technology, Media, and Telecommunications (TMT)

Sector trends

On average, 54% of TMT companies disclosed at least one MW, which is 8% higher than the average across all sectors at 46%.
Despite the unusually high IPO volume in 2021, MW disclosures for TMT companies stayed consistent with other years in the 50% range.

Sector insights

The TMT sector IPOs are primarily led by:

i. Software
ii. Enterprise cloud
iii. Platform companies

These companies tend to have the following elements, all of which can explain their increased disclosure of MWs:

i. Rapid growth and scaling, which can strain existing control resources and systems.
ii. Complex revenue recognition models including subscription, multi-element arrangements, freemium, licensing and royalty which can lead to additional complexity and need for controls.
iii. Higher cybersecurity risks and complex IT systems, given the software / cloud platforms, but lack of adequate IT general controls and mitigating internal controls.
iv. Regulatory environments with a heightened focus on data collection, privacy, employee and third-party access and telecommunications regulations.

Pharma and life sciences (PLS)

Sector trends

PLS companies tend to disclose fewer MWs than the wider market, with an average of 39% disclosing at least one, compared to 46% across all sectors.
Biotechs, typically with pre-commercial operations, tend to make up a majority of this sector and as such, 99% of all MWs disclosed were at companies with $500 million or less in revenue.

Sector insights

The PLS sector IPOs have recently been dominated by biotech companies due to:

i. Increased investment (and exits) - With an influx of venture capital funding and successful exits, a cycle of investment and growth has been established recently in the sector.
ii. Genomic medicine - Advances in genomic medicine (such as CRISPR) have revolutionized the biotech industry leading to the development of personalized medicine, targeted therapies, and novel treatments for previously intractable diseases.
iii. Platform companies - An increasing focus on developing platforms that can generate multiple products, rather than a single product, allows for diversification of risk, potential for multiple revenue streams, flexibility and scalability.
iv. Participation from industry experts - Participation, including investments and involvement from industry experts and former executives, has increased, indicating confidence in the company prospects and providing valuable industry insights and connections.

At the time of IPO, PLS companies typically benefit from a simpler pre-commercial business model - often pre-revenue, no inventory, and focused on R&D and meeting regulatory milestones. Compared to other sectors, this simplified business model can enable PLS companies to more easily establish a control environment that can reduce the risk of financial misstatements and identification of MWs.

Financial services (FS)

Sector trends

In the financial services sector, an average of 37% of the companies that went public disclosed at least one MW, lower than the 46% average of companies disclosing MWs overall.
FS companies had proportionally less MW disclosures due to lack of segregation of duties, but complex transactions were a significant driver of MW disclosures for FS companies, at 49% compared to 39% for all other sectors.

Sector insights

FS companies tend to have exposure from non-routine complex transactions due to the following:

i. Financial instruments – The use of complex financial products such as derivatives, structured finance and hedging instruments increases accounting complexity and the risk of errors or misstatements.
ii. Global operations & FX - Many FS firms operate globally, making foreign currency transactions and hedging strategies essential, but these transactions can often increase the risk of financial misstatements.
iii. Legacy systems – FS companies at times rely on outdated or legacy systems for transaction processing and financial reporting, making it difficult to accurately manage non-routine transactions.

Regulatory complexity: FS companies face multi-layered regulatory oversight, such as SEC, FASB, FINRA, and international regulators. This regulatory oversight can encourage FS companies to develop strong control environments, possibly contributing to the overall lower MW rate.
FS companies maintain strong segregation of duties controls due to stringent regulations, ensuring accountability and reducing risks of fraud, errors, and compliance breaches in routine transactions.

Consumer markets (CM)

Sector trends

The average number of consumer market sector companies disclosing an MW was higher, at 56%, than the overall market average of 46%.
Smaller CM companies with $500 million or less in revenue were more likely to disclose an MW than companies with over $1 billion in revenue.

Sector insights

CM companies face unique financial reporting challenges due to factors which can complicate accuracy and increase the risk of control weaknesses:

i. Frequent M&A - Consumer companies frequently engage in mergers, acquisitions, and business combinations, which complicates financial reporting as they incorporate subsidiaries with different ERPs and reporting systems which can lead to errors in consolidating financial statements.
ii. Complex Revenue Streams - CM companies often deal with diverse revenue streams (e.g., retail sales, online platforms, franchises), which can complicate the application of revenue recognition rules with complex accounting for variable consideration, discount and promotional models, loyalty programs, etc.
iii. High volume of transactions – Retail and consumer companies often deal with a high volume of small transactions, typically across multiple sales channels and with complex inventory management systems, which increases the complexity of tracking and reporting financial data accurately, leading to potential control weaknesses.

Industrial products (IP)

Sector trends

An average of 45% of the IP companies that went public disclosed at least one MW, which was only slightly lower than the overall average of 46%.
Despite a fluctuating volume of IP IPOs, the rate of MWs disclosed has declined from 75% in 2019 to 43% in 2024.

Sector insights

Due to a historically low IPO volume in 2022 through 2023, only one IP company went public each year and neither disclosed an MW.
The adoption of advanced technology, such as integrated accounting and ERP systems, along with robust risk management frameworks, is potentially contributing to the reduction in MW disclosures at IP companies by improving financial reporting and risk mitigation.

Energy, utilities and mining (EUM)

Sector trends

Over the past six years, IPO volumes ranged from one to five annually, with only the 2021 IPO boom resulting in more than one company disclosing an MW.

Sector insights

The lower IPO volume, and associated MW trends, in the sector can be attributed to several factors, including:

i. The capital intensive nature of the industry requiring large upfront investments.
ii. Regulatory hurdles requiring stringent compliance at a state, national and international level.
iii. Long-term investment horizons with some projects, especially mining and energy, requiring decades to break even.
iv. A mature industry structure means that the sector is often dominated by large, established players with significant market share, leaving little room for smaller companies to start, grow and go public.

Health Services (HS)

Sector trends

The volume of HS IPOs has been low, leading to wide variation in MW disclosures: in 2019, both IPOs disclosed MWs, while in 2021, only two of eight did.
Only 35% of HS companies disclosed more than one MW, while in the overall market 46% disclosed more than one.

Sector insights

Health services companies encounter certain industry specific accounting complications including the need for accurate billing and coding, regulatory compliance (patient data, billing, etc.) and the management of patient receivables and bad debt.
The noted complications can raise challenges in accurately recognizing revenue, lead to errors or delays in financial reporting and increase the risk of financial misstatements.

Act early, go confidently

Start early, stay ahead
Lean on experience
Looking for deeper insights?

Start early, stay ahead

Addressing internal controls after IPO registration begins can complicate an already intense process. Meeting SOX requirements often demands meaningful process and control changes—changes that can be disruptive if tackled too late. In our experience, starting six to nine months in advance to design and implement a SOX-compliant framework—and operating under it for at least six to twelve months—help reduce risk, smooth the IPO journey and build investor confidence.

Lean on experience

Preparing to go public is a transformational step. We work closely with management teams to conduct comprehensive readiness assessments that uncover gaps in internal controls and processes—well before they become roadblocks. From early diagnostics to hands-on guidance through every stage of IPO readiness, our team is here to help you move forward with confidence. Reach out to find out how we can guide you through each step of the readiness assessment process and beyond.

Looking for deeper insights?

For over 14 years, PwC has tracked and analyzed MW disclosures on a quarterly basis—by sector, in aggregate, and at the individual company level. Our robust dataset covers key dimensions, including:

Volume of MW disclosures
Foreign vs. domestic filers
Nature of the MWs disclosed
Where disclosures appear in filings
Language used to describe MWs and remediation plans
Revenue ranges
Deal values

This depth of insight helps companies benchmark against peers, spot trends, and anticipate investor and regulatory scrutiny.

We’re ready to dive into material weakness trends that matter to your company or industry. If you’re looking to access more detailed data, explore key insights, or have a strategic conversation with our experienced team, connect with us using the link below—we’d love to help you take the next step.

Special thanks to Semir Krpo, Jocelyn Leung, Noah Simon and Thomas Ko for contributing to this publication.

¹_{^{IPOs with proceeds that are less than $25 million, best efforts offerings, oil and gas royalty trusts, business development companies, pricing on OTC Bulletin Board and OTC Pink Sheets, and special purpose acquisition companies (SPACs) IPOs and de-SPAC transactions are not included in the population of IPO filings reviewed for this publication. SEC filing forms reviewed include S-1, 424B(3), F-1, S-4, S-4/A and Schedule 14A. Note that companies undergoing IPOs may have disclosed a material weakness outside the year of initial pricing; however, disclosures as of the pricing date were used for the purposes of calculating year-over-year percentages.}}

²_{^{For companies which do not qualify for emerging growth companies (EGCs) status, section 404(a) and 404(b) certifications are required with a company’s second annual report after going public. For EGC filers 404(b) compliance is deferred for as long as the company retains its EGC status (see below for disqualifying conditions, including the five-year limitation). Many smaller reporting companies (SRCs) also qualify as non-accelerated filers and, accordingly, are not required to comply with the requirements of 404(b). However, if an SRC has annual revenues in excess of $100 million and a public float between $75 million and $250 million, it would meet the definition of an accelerated filer (while simultaneously maintaining its SRC status) and, accordingly, would be required to comply with the requirements of 404(b).

EGCs are broadly defined as companies that meet the following criteria: (1) had less than $1.235 billion in gross revenue (indexed for inflation every five years) for the most recently completed fiscal year; and (2) has not issued more than $1 billion of non-convertible debt in a rolling three-year period. An issuer that is an EGC as of the first day of its fiscal year continues to be an EGC until the earliest of: (1) the last day of the fiscal year during which it had total annual gross revenues of $1.235 billion or more; (2) the last day of the fiscal year following the fifth anniversary of the first sale of the issuer’s common equity securities in an offering registered under the Securities Act of 1933 (Securities Act); (3) the date on which the issuer has issued more than $1 billion in non-convertible debt securities during the previous three-year period; or (4) the date on which the issuer becomes a large accelerated filer (generally, more than $700 million in worldwide public float).}}

³_{^{Section 302 and 906 certifications are effective for companies starting with their first quarterly or annual report as a public company regardless of EGC status.}}