Every IPO readiness conversation starts in the same place: the financial statements. Boards ask whether three years of audited numbers are clean, whether the accounting policies will survive scrutiny, and whether the auditor's opinion will be unqualified. These are the right questions — but they are rarely the ones that determine whether a listing process runs smoothly.

In our experience advising companies through listing preparation, the gap that causes the most delay, cost and reputational risk is not technical accounting. It is governance.

The accounting work is finite. The governance work is not.

A financial statement clean-up has a clear endpoint: restated numbers, resolved technical positions, an audit opinion. It is hard work, but it is bounded work. Governance readiness — board composition, related-party frameworks, internal control culture, disclosure discipline — is not a project with an endpoint. It is an operating standard the company has to sustain indefinitely, starting well before the listing and continuing long after.

Companies that treat governance as a checklist to complete before the DRHP is filed tend to discover, six months after listing, that the standard they built for the offer document was never embedded into how the business actually runs.

Three governance gaps that consistently surface late

1. Related-party frameworks built in isolation

Related-party transaction policies are often drafted by legal counsel without input from the people who actually structure deals — procurement, treasury, business development. The policy looks correct on paper and breaks down in practice within the first two quarters of being public.

2. Independent directors without independent information

Board independence is often satisfied on paper — the right number of independent directors, the right committee composition — but those directors are given the same management-curated information as everyone else. True independence requires structured access to internal audit findings, whistleblower reports and risk registers, not just attendance at quarterly board meetings.

3. Internal controls designed for the audit, not for the business

ICFR documentation built specifically to satisfy auditors during the listing process often does not reflect how the business actually operates day to day. The gap between the documented control and the operating reality is exactly where post-listing control failures tend to originate.

What this means for listing timelines

We advise clients to start governance readiness work at the same time as financial statement clean-up — not after it. In practice, this means:

• Mapping board and committee structure against listing requirements at least 18 months before a target listing date, not 6.
• Building related-party and conflict-of-interest policies with the operational teams who will actually apply them, not just legal counsel.
• Treating internal control documentation as a living operating manual, reviewed and tested on a cycle that continues well past the listing date.

The technical accounting clean-up will always get the most attention in the boardroom, because it is the most measurable and most familiar workstream. But the companies that sustain investor confidence after listing are the ones that recognised, early, that governance discipline is not a pre-listing milestone — it is the new baseline for how the company operates.

IT general controls — access management, change management, and IT operations — rarely make it onto a CFO's weekly agenda. They are unglamorous, technical, and easy to assume are "handled" by the IT team. That assumption is exactly why ITGC gaps are among the most common findings we encounter during diligence, audits, and post-incident reviews.

The problem is not that ITGC failures are rare. It is that they are invisible until something forces them into view — a financing round, an acquisition, a statutory audit, or a breach.

Why ITGC issues surface at the worst possible time

Access controls that were never tightly enforced, change management processes that exist on paper but not in practice, and segregation-of-duties conflicts that built up over years of headcount changes — none of these cause daily disruption. They sit quietly until a diligence team or an auditor starts testing them systematically, at which point every gap surfaces at once, often with a tight deadline attached.

The three most common gaps we see

1. Access reviews that exist in name only

Periodic user access reviews are a standard control — but in practice, many organisations run them as a formality, with managers rubber-stamping access lists without genuine review. The result is privileged access that has accumulated, unchecked, for years.

2. Change management without segregation of duties

Developers who can both write and deploy code to production, without independent review, are a common and easily overlooked control gap — particularly in fast-growing technology and finance teams.

3. ERP configuration drift

Automated controls configured correctly at go-live often drift over time as the business changes — new entities, new approval thresholds, new workflows — without a formal process to revalidate the underlying control logic.

The practical fix

Closing these gaps does not require an enterprise-wide overhaul. It requires:

• A genuine (not cosmetic) periodic access review, with management accountable for the outcome, not just the sign-off.
• Independent review built into every change management workflow, regardless of team size.
• A standing process to revalidate ERP and application controls whenever the underlying business process changes.

The organisations that handle this well treat ITGC review as a continuous discipline, not a once-a-year compliance exercise — because the cost of finding these gaps yourself is always lower than the cost of having someone else find them for you.

GST has now been in force long enough for a clear pattern to emerge: businesses that structured transactions reactively, addressing questions only as they came up, are the ones now facing the heaviest litigation load. Businesses that invested early in structuring discipline are spending a fraction of the time and cost on disputes.

The shift we are seeing across clients is a move from "we'll deal with it if it's questioned" to "we'll structure it so it's defensible from day one." That shift is not just good practice — it is increasingly a financial necessity.

Why disputes are taking longer and costing more

As GST jurisprudence matures, tax authorities are applying more sophisticated scrutiny to classification, valuation and input tax credit positions. Matters that might once have been resolved at the assessment stage are now routinely escalating to appeal — extending timelines and tying up working capital in disputed demands.

Where proactive structuring pays off

Supply chain and contract structuring

Many disputes originate in how contracts and supply chains were structured years before the dispute arose. Reviewing structure today — classification, place of supply, valuation methodology — closes the door on the most common categories of future dispute.

Input tax credit documentation discipline

ITC disputes are increasingly about documentation, not eligibility. Businesses that maintain rigorous, real-time documentation tend to resolve ITC queries quickly; those that try to reconstruct documentation after a notice is issued face a far harder path.

Sector-specific exposure

Financial services, real estate and e-commerce businesses each carry distinct GST treatment nuances that generic compliance approaches often miss — and that tax authorities are increasingly familiar with testing.

A practical starting point

• Conduct a GST health check focused on the transaction types most exposed to current audit trends in your sector.
• Review supply chain and contract structures for classification and valuation positions that haven't been revisited since GST implementation.
• Build a documentation discipline for ITC claims that holds up under real-time audit, not just retrospective reconstruction.

The businesses spending the least time on GST litigation today are, almost without exception, the ones that treated structuring as a continuous discipline rather than a one-time compliance exercise.

Most technical accounting positions never reach the boardroom. A revenue recognition judgment, a lease classification, a consolidation question — these are typically resolved between the finance team and the statutory auditor, documented in a technical memo, and closed out. But a small subset of positions escalate, and when they do, the difference between a smooth resolution and a prolonged board-level issue almost always comes down to timing of documentation.

What causes escalation

A technical position becomes a board issue when it meets one of three conditions: it is material to reported earnings, it involves significant judgment rather than a clear-cut application of a standard, or the auditor and management initially disagree on the conclusion. Any one of these is manageable on its own. Together, they tend to pull the audit committee into the conversation.

Why documentation timing is the real issue

Technical memos written contemporaneously — at the time the judgment was made, with the information available at that time — read very differently from memos reconstructed after the fact, once a position has come under scrutiny. Auditors and audit committees can tell the difference, and reconstructed documentation invites more questions, not fewer.

We consistently see two patterns:

• Teams that document significant judgments as they are made move through audit committee review quickly, because the reasoning trail is already complete.
• Teams that wait until a position is challenged to formalise their reasoning spend disproportionate time rebuilding a case that should have existed from day one.

What good contemporaneous documentation includes

• The specific accounting standard or guidance applied, with the relevant paragraphs identified.
• The facts and assumptions available at the time of the judgment — not facts known only in hindsight.
• Alternative positions considered, and why they were not adopted.
• Sign-off from the appropriate level of finance leadership, dated at the time of the original judgment.

Building this discipline into the close process — rather than treating it as an exercise reserved for contested positions — is the single highest-leverage step finance teams can take to keep technical accounting questions from becoming prolonged board issues.

Ask most management teams what internal audit is for, and the answer tends to default to compliance: ticking boxes, satisfying a regulatory requirement, producing a report the audit committee files away. Ask the same question of a board that has seen internal audit done well, and the answer is very different — internal audit is one of the few functions in the organisation with a mandate to see everything, and that visibility is a strategic asset if it's used properly.

The cost of treating internal audit as a checkbox

When internal audit is scoped narrowly — testing the same controls in the same order every year, with findings that rarely surprise anyone — it produces exactly what it is designed to produce: assurance that nothing obviously broke. It does not produce insight into where the business is exposed to risks that haven't yet materialised as control failures.

What a modern internal audit charter should include

Risk-based scoping, revisited annually

The audit plan should be built from a current risk assessment — not last year's plan with minor updates. Businesses change quickly; an audit plan that doesn't change with them quietly becomes less relevant every year.

Direct, unfiltered access to the audit committee

Internal audit's value depends on its independence. That independence is only real if findings reach the audit committee without being filtered or softened by the management functions being audited.

A mandate that includes emerging risk, not just historical control testing

The most valuable internal audit functions spend a portion of their time looking forward — assessing exposure to risks the organisation hasn't yet experienced, rather than exclusively testing controls against risks it has already identified.

What boards should expect

• An audit plan that can explain, in plain language, why each area was prioritised this year.
• Findings that are specific and actionable, not generic statements that could apply to any organisation.
• A head of internal audit with genuine standing to escalate uncomfortable findings without friction.

Internal audit done well is not an exercise in compliance theatre. It is one of the most direct lines of sight a board has into how the organisation actually operates — and treating it as anything less leaves real risk undetected.

When a listing timeline slips, the assumption is usually that the financials weren't ready — an unresolved technical accounting position, an audit that ran long, a restatement that took an extra quarter. In practice, we see a different pattern just as often: the financials are ready, but the governance structure isn't.

Two issues that recur more than any others

Related-party transaction frameworks built too late

Many businesses approaching a listing have related-party arrangements that built up organically over years — supplier relationships with founder-linked entities, intercompany arrangements, shared services agreements. These arrangements are often legitimate and commercially reasonable, but if the related-party framework and disclosure approach is only built in the final months before filing, untangling and documenting years of history becomes a significant source of delay.

Board independence that doesn't hold up to scrutiny

Listing requirements specify a minimum number of independent directors and committee composition rules. Satisfying the letter of these requirements is straightforward. What often isn't straightforward is demonstrating, under regulatory or investor scrutiny, that independent directors have had genuine access to information and genuine influence over decisions — not just a seat at the table.

Why these issues surface late

Both issues tend to be treated as legal or secretarial workstreams, run in parallel with — but disconnected from — the financial readiness workstream. By the time the two workstreams converge, often during the final review before filing, gaps that should have been caught 12 months earlier surface as last-minute blockers.

What works instead

• Mapping related-party arrangements and building the disclosure framework at the same time financial statement clean-up begins — not after.
• Giving independent directors structured, documented access to internal audit and risk information well before the listing, so the practice of independence is established, not just the appointment.
• Running governance readiness as a workstream with the same project discipline and timeline ownership as the financial statement clean-up — not as a background legal task.

The companies that move through the governance review fastest are the ones that started building the framework as early as the accounting clean-up — treating both as part of the same readiness exercise, not two separate tracks that happen to converge at filing.

Cyber risk used to be treated, in most boardrooms, as a technical matter delegated entirely to the CISO or IT function. That is changing quickly. Audit committees are now asking specific, informed questions about incident response readiness, third-party exposure and recovery time objectives — and they expect specific, informed answers, not reassurance.

What changed

High-profile breaches at well-governed organisations have made it clear that cyber resilience is not solely a function of technical control maturity — it is also a function of governance: how quickly an incident is detected, how clearly it is escalated, and how prepared the organisation is to respond under pressure. That makes it a board-level risk, not just an IT risk.

What boards are increasingly expected to know

Incident response readiness

Not just whether an incident response plan exists, but whether it has been tested — through tabletop exercises or simulations — within the last year, and whether roles and escalation paths are clear to the people who would actually execute them.

Third-party and vendor exposure

A growing share of incidents originate through vendors and service providers rather than direct attacks. Boards are increasingly expected to understand which critical vendors hold sensitive data or system access, and what assurance exists over their security posture.

Recovery objectives, not just prevention

Prevention will never be perfect. Boards are increasingly focused on recovery time objectives and recovery point objectives for critical systems — concrete, tested numbers, not aspirational targets.

How to be ready for the conversation

• Bring a recently tested incident response plan to the table, with a summary of what the test revealed — including what didn't work.
• Maintain a current inventory of critical third-party access and the assurance basis for each relationship.
• Translate technical cyber posture into business terms the board can act on: financial exposure, operational downtime, regulatory notification obligations.

The organisations that handle these board conversations well are not necessarily the ones with the most sophisticated security tooling. They are the ones that have translated cyber resilience into governance language the board can engage with directly.