The luxury of the five year gap

The New York Stock Exchange thinks newly listed companies should get a five year pass on having an internal audit function. For those of us who've spent ten years squinting at control matrices, this is a shock. It means a company can move from being a private secret to a public entity while basically flying blind on governance for half a decade.

The pro-argument is always the same: they want to cut the regulatory burden on growth companies; they reckon forcing a young firm to build a full audit shop right after an IPO is a costly distraction.

It isn't a distraction. It's the baseline. Thinking five years is a fair window for maturation ignores how fast a lack of oversight turns systemic. If you don't test and document internal controls from day one, you aren't saving money, and you're just pushing the bill to a later date when the cleanup will cost way more.

Who pays for this? The external auditors do. Once these companies hit that five year mark and panic-build an audit function, they'll hand their outside firms a graveyard of legacy errors and undocumented processes. This leads to two outcomes. Either audit fees spike to cover the forensic work (which is inevitable) or qualified opinions tank the share price, and the risk doesn't vanish; it just shifts downstream to whoever has to sign off on the books.

Why this sudden urge to prune the hedges? It shows up in other parts of the SEC's mood too, and there's a proposal to scrap the pay-to-play rule for investment advisers, specifically for private equity. They want to remove friction.

But there is a difference between removing friction and removing visibility.

The GAO recently noted that banks are already dodging SEC oversight when it comes to risk disclosures. If the regulator is also thinking about easing rules for private equity political contributions and letting new public companies skip internal audits, they're creating a specific kind of silence. It's the silence of a regulator who assumes things are being handled in spirit while the actual paperwork vanishes.

Compliance isn't about spirit; it's about evidence.

Look at other parts of the market to see what happens when you ignore evidence. The FTC just slapped Humboldt Merchant Services with a $12 million fine because they helped sham merchants take payments. This isn't about "spirit. It's a failure to follow PCI DSS and KYC rules; you aren't being efficient when you stop checking who's actually on the other end of a deal. You're just an accomplice.

The SEC spent time this week clarifying Schedule 13G engagement rules for passive investors, and it sounds dry and procedural, so most people will ignore it, but that's where the actual work is. It tells you exactly who files what and when; it's a far cry from the "trust us" vibe in the NYSE proposal.

Why accept a five year grace period for internal audits? Doing that basically means admitting the rules are too hard to follow. That's dangerous. Either the rules are bad or the companies can't handle them. You fix the rule or you penalize the firm, and you don't give them a five year holiday from being accountable.

One wonders how many banks mentioned in the GAO report would have been caught sooner if their risk disclosures hadn't been treated as optional suggestions.

I'll be watching whether the SEC actually rejects the NYSE proposal or if they decide that five years of darkness is a fair trade for a smoother IPO process.