5 ms·

Posting anonymously. Some quick factors not discussed. 1) Massive compliance overhead. Going public and maintaining public status can be a real nightmare. For

Posting anonymously. Some quick factors not discussed. 1) Massive compliance overhead. Going public and maintaining public status can be a real nightmare. For example staff generally "get" what a financial statement audit is about - are the numbers correct. And when they aren't everyone gets that a system should be improved. And the auditor makes some notes about areas to improve based on their work, and the difficulty and errors noted in checking the actual numbers. This is the audit most private companies go through - and it actually works pretty well. A public company under SOX - now you have an audit of the numbers (great) and you have a kind of meta audit of the system (internal control) that got to those numbers (ugh). The cost / benefit of this second part is not clear to most staff. It's huge checklists, everyone get's checklist fatigue, and no one dares change a system after the auditors have been through etc. You literally can ask, why in the world do we do crazy procedures X/Y/Z? Because the auditors accepted it and we are too scared to change it. All critical thinking goes out the window. And folks start driving workarounds to the systems to get stuff done (double ugh and big actual risks). Read some PCAOB reports for "audit failures". These aren't actual "audit failures" - no numbers were wrong. But it'll be things like - the auditor read over the calculations, checked underlying documents, recalculated numbers sat in on some meetings, but STILL didn't do enough to assess internal control over some calculation. OK - I'll save the rest for later, but the idea that the private markets are the new public markets rings true to me. These are folks who can weigh actual cost / benefit of compliance cost vs losing money on an investment. Most are going to stick to something like a regular audit. Multiply by 100x in every dimension?

tabtab 9y ago
Most such rules are in place because slimebags abused the system, and in some cases taking the world economy with it. I'm all for making more efficient auditing rules, but one has to be careful not the throw the baby out with the bathwater. Perhaps have compliance tiers such that smaller co's can optionally be in a riskier and less audited stock system or level. However, we probably don't want too much of the economy in that pool. As it is, private investors may be willing to take on riskier and even dodgier companies who don't want auditors snooping around. That's fine: if the rich want to gamble with dodgy companies via private investment, go for it.
- dcosson 9y ago
  But how long ago did these slimebags abuse the system, and are we sure it's still a problem in the modern era? It seems a lot like the Uber/taxi fight - I imagine at some point somebody painted a car like a taxi and kidnapped some riders, and we needed a way for riders to be able to trust that the driver is safe to ride with so licenses/medallions came about. Now with the internet and verified identity of drivers, turns out we don't need it anymore and Uber has built a safe way to get into a stranger's car.
  - kelnos 9y ago
    > Uber has built a safe way to get into a stranger's car The people who have been attacked by Uber drivers wouldn't agree with that statement. I think Uber/Lyft/etc. are largely safe, but their standards are pretty low, and for a long time they weren't even doing proper criminal background checks on prospective drivers. Agreed that the old taxi system was entirely broken and needed to get shaken up, but Uber was hardly a responsible darling in all this.
    - cobbzilla 9y ago
      While I also agree Uber is no darling, the proper comparison would be between driver-on-passenger assaults for ridesharing services versus traditional taxi. How do they stack up? It's not immediately obvious which one would be safer. In theory ridesharing yields a more extensive data/evidence trail (driver identity, passenger identity, GPS history, etc), making assault much harder to get away with; this would seem to be a better deterrent than relatively anonymous cab rides. I did a bit of googling and can't find any hard numbers that compare the two types of transport from a driver-on-passenger assault POV. I would welcome cited figures anyone else might have.
    - salvar 9y ago
      When you say "doing proper criminal background checks", do you mean "making sure no one who has re-entered society after serving their sentence is allowed to work for them"?
pfarnsworth 9y ago
My wife works in finance. This above explanation is completely untrue. Companies aren't scared of auditors. The auditors are scared of their clients. Only under extreme situations will an auditor turn around and fire a client. Usually they will find ways to work with them. So things like changing processes, especially for SOX, are non-issues. There are thousands of public companies in the US, and they all have to endure SOX. It's a pain in the ass but it's not something to be feared. There are plenty of regulations that many companies need to go through that are less onerous than SOX.
- deleted 9y ago
  [deleted]
- tomcam 9y ago
  >There are plenty of regulations that many companies need to go through that are less onerous than SOX. For example?
  - pfarnsworth 9y ago
    The simple act of complying with GAAP is much more onerous than SOX. Any finance person worth their salt can navigate SOX easily. Only inexperienced finance people have problems with SOX, but then again, similar things can be said about inexperience programmers as well.
    - privateSFacct 9y ago
      I'm afraid this illustrates how poorly informed you are - you clearly are not an accountant with significant experience (just saying). This goes doubly so of your wife - if this is her level of understanding that is very worrisome - the idea that she is licensed with this attitude is scary - it's what you don't know that can bite you. Some facts for those that may read the above and get the wrong idea. EVERY major big four firm and their clients and all other major players have had great difficulty in this area. It's super painful because the question is not - are the numbers right - which pretty much everyone in accounting would understand putting efforts towards, but a very meta (and wide) question on systems getting to the numbers (with turns out to be subjective). What's crazy is I can step back from this type of thing and without even going into a company spot lots of issues likely illustrating poor control or even worthy of enforcement action (actual enforcement) from the outside. Seriously, go to a consumer complaint website - if you see a ton of the same complaint it's worth a look. This is why CFPB was such a powerful idea. Yes - they overreached slightly but 90%+ great work - and very focused on bad actors which was wonderful to everyone trying to do right thing. Absolutely should have kept going with that idea. Just a flavor... pay close attention to words like all and every which open up each item to huge scope - the auditor here picked a random month to test a system and actually went in person to a meeting where reconciliations were performed. Now repeat this 100x for each client. Every firm out there doing audits has had issues like this (many). These are the MOST experienced people - so I laugh when I hear that "only inexperienced people" have problems. KPMG: A.1. Issuer A In this audit, the Firm failed to obtain sufficient appropriate audit evidence to support its opinions on the financial statements and on the effectiveness of ICFR. The Firm identified this manual control and certain other manual review and reconciliation controls as compensating controls, but failed to sufficiently test these controls. Specifically — o To test the review and approval of changes to the financially significant applications, the Firm tested a sample of changes to determine whether they had been appropriately approved. The Firm's testing was not sufficient as ... its sample was limited to changes made in only one month (the third month before year end) and the Firm failed to consider whether this month was representative of changes made throughout the year. o To test the manual review and reconciliation controls, the Firm obtained certain monthly operating review reports and reconciliations and attended certain monthly management meetings where the reports and reconciliations were discussed. The Firm's testing was not sufficient, as (a) it did not test controls over the completeness and accuracy of the data in the reports, and (b) it failed to test whether these controls identified all of the relevant issues for investigation and, if so, whether such issues were appropriately investigated and resolved.
bsder 9y ago
The issue is simply a result of earlier articles talking about how nobody wants to do Series A's anymore--VC's and companies. If one end of the pipeline shuts off, the other end eventually runs out too.
s2g 9y ago
Solution sounds like it’s increase the regulatory overhead on private companies.
billjings 9y ago
No doubt you have experience that I don't. But if I'm reading a comment about audit controls, and it can't keep track of how many numbered points it has, I'm going to be skeptical.

tabtab 9y ago

Most such rules are in place because slimebags abused the system, and in some cases taking the world economy with it. I'm all for making more efficient auditing rules, but one has to be careful not the throw the baby out with the bathwater. Perhaps have compliance tiers such that smaller co's can optionally be in a riskier and less audited stock system or level. However, we probably don't want too much of the economy in that pool. As it is, private investors may be willing to take on riskier and even dodgier companies who don't want auditors snooping around. That's fine: if the rich want to gamble with dodgy companies via private investment, go for it.

dcosson 9y ago
But how long ago did these slimebags abuse the system, and are we sure it's still a problem in the modern era? It seems a lot like the Uber/taxi fight - I imagine at some point somebody painted a car like a taxi and kidnapped some riders, and we needed a way for riders to be able to trust that the driver is safe to ride with so licenses/medallions came about. Now with the internet and verified identity of drivers, turns out we don't need it anymore and Uber has built a safe way to get into a stranger's car.
- kelnos 9y ago
  > Uber has built a safe way to get into a stranger's car The people who have been attacked by Uber drivers wouldn't agree with that statement. I think Uber/Lyft/etc. are largely safe, but their standards are pretty low, and for a long time they weren't even doing proper criminal background checks on prospective drivers. Agreed that the old taxi system was entirely broken and needed to get shaken up, but Uber was hardly a responsible darling in all this.
  - cobbzilla 9y ago
    While I also agree Uber is no darling, the proper comparison would be between driver-on-passenger assaults for ridesharing services versus traditional taxi. How do they stack up? It's not immediately obvious which one would be safer. In theory ridesharing yields a more extensive data/evidence trail (driver identity, passenger identity, GPS history, etc), making assault much harder to get away with; this would seem to be a better deterrent than relatively anonymous cab rides. I did a bit of googling and can't find any hard numbers that compare the two types of transport from a driver-on-passenger assault POV. I would welcome cited figures anyone else might have.
  - salvar 9y ago
    When you say "doing proper criminal background checks", do you mean "making sure no one who has re-entered society after serving their sentence is allowed to work for them"?

pfarnsworth 9y ago

My wife works in finance. This above explanation is completely untrue. Companies aren't scared of auditors. The auditors are scared of their clients. Only under extreme situations will an auditor turn around and fire a client. Usually they will find ways to work with them. So things like changing processes, especially for SOX, are non-issues. There are thousands of public companies in the US, and they all have to endure SOX. It's a pain in the ass but it's not something to be feared. There are plenty of regulations that many companies need to go through that are less onerous than SOX.

deleted 9y ago
[deleted]
tomcam 9y ago
>There are plenty of regulations that many companies need to go through that are less onerous than SOX. For example?
- pfarnsworth 9y ago
  The simple act of complying with GAAP is much more onerous than SOX. Any finance person worth their salt can navigate SOX easily. Only inexperienced finance people have problems with SOX, but then again, similar things can be said about inexperience programmers as well.
  - privateSFacct 9y ago
    I'm afraid this illustrates how poorly informed you are - you clearly are not an accountant with significant experience (just saying). This goes doubly so of your wife - if this is her level of understanding that is very worrisome - the idea that she is licensed with this attitude is scary - it's what you don't know that can bite you. Some facts for those that may read the above and get the wrong idea. EVERY major big four firm and their clients and all other major players have had great difficulty in this area. It's super painful because the question is not - are the numbers right - which pretty much everyone in accounting would understand putting efforts towards, but a very meta (and wide) question on systems getting to the numbers (with turns out to be subjective). What's crazy is I can step back from this type of thing and without even going into a company spot lots of issues likely illustrating poor control or even worthy of enforcement action (actual enforcement) from the outside. Seriously, go to a consumer complaint website - if you see a ton of the same complaint it's worth a look. This is why CFPB was such a powerful idea. Yes - they overreached slightly but 90%+ great work - and very focused on bad actors which was wonderful to everyone trying to do right thing. Absolutely should have kept going with that idea. Just a flavor... pay close attention to words like all and every which open up each item to huge scope - the auditor here picked a random month to test a system and actually went in person to a meeting where reconciliations were performed. Now repeat this 100x for each client. Every firm out there doing audits has had issues like this (many). These are the MOST experienced people - so I laugh when I hear that "only inexperienced people" have problems. KPMG: A.1. Issuer A In this audit, the Firm failed to obtain sufficient appropriate audit evidence to support its opinions on the financial statements and on the effectiveness of ICFR. The Firm identified this manual control and certain other manual review and reconciliation controls as compensating controls, but failed to sufficiently test these controls. Specifically — o To test the review and approval of changes to the financially significant applications, the Firm tested a sample of changes to determine whether they had been appropriately approved. The Firm's testing was not sufficient as ... its sample was limited to changes made in only one month (the third month before year end) and the Firm failed to consider whether this month was representative of changes made throughout the year. o To test the manual review and reconciliation controls, the Firm obtained certain monthly operating review reports and reconciliations and attended certain monthly management meetings where the reports and reconciliations were discussed. The Firm's testing was not sufficient, as (a) it did not test controls over the completeness and accuracy of the data in the reports, and (b) it failed to test whether these controls identified all of the relevant issues for investigation and, if so, whether such issues were appropriately investigated and resolved.

bsder 9y ago

The issue is simply a result of earlier articles talking about how nobody wants to do Series A's anymore--VC's and companies. If one end of the pipeline shuts off, the other end eventually runs out too.

s2g 9y ago

Solution sounds like it’s increase the regulatory overhead on private companies.

billjings 9y ago

No doubt you have experience that I don't. But if I'm reading a comment about audit controls, and it can't keep track of how many numbered points it has, I'm going to be skeptical.