MD&A Discipline for Private Companies: The IPO-Readiness Drafting Process That Starts Two Years Out

Updated for 2026, AI-related risk factors and the governance posture behind them now show up in nearly every S-1 we have read this year. Pair this guide with the one-page AI governance policy mid-market can defend so the disclosure controls have something to attach to before the registration window opens. MD&A is a discipline, not a deliverable, and it cannot be compressed into the registration window In the engagements we have run with IPO-bound private companies, the most consistent finding about MD&A preparation is that the work is treated as a registration-window deliverable, drafted in the eight-to-twelve weeks before the S-1 is filed, by company counsel with input from the underwriter's counsel, with management's review compressed into the same window. The result is an MD&A that satisfies the basic disclosure requirements, that does not reflect the depth of analysis the underwriter ultimately requires, and that is rewritten substantially during the SEC review process, sometimes more than once. The pattern is structural rather than personal. MD&A under SEC Reg S-K Item 303 requires a comparative discussion of the company's results of operations, liquidity, capital resources, critical accounting estimates, known trends and uncertainties, off-balance-sheet arrangements, and contractual obligations, with the comparison spanning the periods presented in the financial statements (typically two or three fiscal years plus interim periods). The comparison cannot be reconstructed from a registration-window analysis of historical financials; it requires a contemporaneous understanding of why each material change occurred, captured at the time the change occurred and refined through subsequent reporting cycles. The companies we have observed completing successful IPOs with minimal SEC comment-letter rework on MD&A are the companies that began drafting MD&A two fiscal years before the registration window, running quarterly drafts against then-private financials, refining the analysis with each cycle, and using the drafts to identify the analytical and disclosure gaps that would otherwise surface in the registration. The cost of the discipline is approximately one full-time-equivalent of finance and disclosure work over the two-year period; the cost of not running the discipline is the registration delay, the underwriter's incremental fees, and the disclosure-controls finding that follows the company into the public-reporting cadence. Reg S-K Item 303: the controlling rule and the recent amendments SEC Regulation S-K Item 303 is the rule that governs MD&A for SEC registrants, and it has been amended substantially in recent years with the SEC's 2020 modernization of the requirements (effective for fiscal years beginning on or after February 10, 2021, with early adoption permitted). The current rule has six primary components. The financial overview component requires a brief contextual discussion of the company's business, including material changes in the business that affect the period under review. This is not a re-statement of the company's business description from another part of the registration statement; it is a focused contextualization of the financial performance discussion that follows. The results of operations component is the heart of MD&A and the section the SEC most consistently comments on. The rule requires a discussion of material period-over-period changes in revenue, cost of revenue, gross profit, operating expenses, and net income (or loss), with the underlying drivers of each change explained, the impact of any one-time or non-recurring items quantified, and the comparison spanning each of the periods presented in the financial statements. The 2020 amendments emphasize that the discussion should identify "material changes" rather than reciting line-by-line changes regardless of materiality, which is the standard the company's drafting discipline should adopt. The liquidity and capital resources component requires a discussion of the company's material cash requirements and the sources and uses of cash. The 2020 amendments replaced the prior contractual-obligations table with a principles-based discussion of material cash requirements, including known commitments, contingencies, and the company's plans to meet them. The discussion must address both short-term (next twelve months) and long-term (beyond twelve months) cash requirements. The critical accounting estimates component requires a discussion of accounting estimates that involve significant uncertainty and that are material to the financial statements, including a description of why the estimate is uncertain, the methodology used, the assumptions involved, and the sensitivity of the estimate to changes in assumptions. The 2020 amendments codified critical accounting estimates as a required disclosure (previously a frequent SEC staff request rather than a formal requirement). The known trends and uncertainties component requires a discussion of known trends and uncertainties that are reasonably likely to have a material effect on the company's financial condition or results of operations. This is the forward-looking component of MD&A and the component most often under-developed in first drafts. The discussion must address both favorable and unfavorable trends, and the standard for disclosure is "reasonably likely" rather than "probable", a lower threshold than many drafters appreciate. The off-balance-sheet arrangements component, while reduced in scope by the 2020 amendments, still requires disclosure of off-balance-sheet arrangements that have or are reasonably likely to have a material effect on the company. With the implementation of ASC 842 lease accounting (which brought operating leases onto the balance sheet) and the post-financial-crisis reduction in synthetic structures, this section is often shorter for current registrants than it was a decade ago, but the disclosure obligation remains. The two-year drafting roadmap: from contemporaneous analysis to filed MD&A The drafting roadmap we run with IPO-bound clients begins twenty-four months before the target registration date and proceeds through six discrete cycles, each producing a draft of progressively higher fidelity to the eventual filed MD&A. The first cycle, at month minus-twenty-four, produces a structural template of the MD&A using the most recent two fiscal years of financials. The template establishes the section headings, the disclosure conventions, the metric definitions, and the period-comparison conventions the eventual MD&A will use. The first cycle is typically eight-to-twelve weeks of work, led by the controller with finance and (for IPO-bound companies) external counsel review, and produces a draft that is substantively incomplete but structurally complete. The second cycle, at month minus-eighteen, refines the results-of-operations discussion using the additional two quarters of financial data accumulated since the first cycle. The driver-level analysis is built out, what drove the revenue change, what drove the gross margin change, what drove the operating expense change, with the underlying support in the FP&A platform and the GL traceable to each statement in the draft. The second cycle is typically four-to-six weeks of work and produces a draft that is structurally complete and substantively partial. The third cycle, at month minus-twelve, completes the liquidity and capital resources section using the company's then-current debt structure, the company's then-current cash position, and the rolling twelve-month projection from the rolling forecast. The cycle also begins the critical accounting estimates section, working through the company's significant estimates with the external auditor's input. Cross-link to /blog/management-vs-financial-reporting-boundary for the disclosure-controls discipline that supports the critical accounting estimates section. The fourth cycle, at month minus-six, brings the draft to substantively-complete form using the most recent fiscal year's audited financials and the most recent interim period. The known-trends-and-uncertainties section is fully developed, the off-balance-sheet section is reviewed and concluded, and the entire draft is reviewed by external counsel and (in companies that have engaged the underwriter) the underwriter's counsel. The fifth cycle, at month minus-three, integrates the audited financials for the most recent fiscal year (now complete) and the interim period required by the registration statement. The draft is now substantively complete and is reviewed by the audit committee with the controller and external counsel attending. The audit committee's review is the formal governance step before the registration window. Cross-link to /blog/audit-committee-reporting-clean-meetings for the audit committee's role in MD&A review. The sixth cycle, the registration window itself, is the SEC-driven review-and-response cycle. SEC comment letters typically focus on the results-of-operations discussion (asking for additional driver-level analysis), the critical accounting estimates section (asking for additional sensitivity analysis), and the known-trends-and-uncertainties section (asking for additional forward-looking disclosure). A draft that has been refined through the prior five cycles produces a comment letter that is shorter and more substantively contained than a draft that has been compressed into the registration window. The components of the results of operations section: the analytical depth the SEC expects The results of operations section is the section the SEC most consistently comments on, and the analytical depth required is meaningfully greater than most first drafts provide. The SEC's expected analytical structure runs through three levels. The first level is the headline change: revenue increased by X% from the prior year, driven by Y. The first level is what most drafts provide and what the SEC consistently flags as insufficient. The second level decomposes the headline change into the underlying drivers: revenue increased by X%, of which A% was driven by volume growth in the X product line, B% was driven by price increases in the Y product line, and C% was offset by attrition in the Z customer segment. The second level requires that the company's reporting infrastructure track revenue at sufficient granularity to support the decomposition, which is a finance-systems question rather than a drafting question. The third level explains the underlying drivers: volume growth in the X product line was driven by expansion of the channel partner program initiated in Q2 of the prior year and reaching scale in the current year; price increases in the Y product line were driven by the renewal cohort returning to market pricing after the prior-year promotional discounting; attrition in the Z customer segment was driven by the loss of two large customers to a competitor's product launch in Q3. The third level connects the financial change to the underlying business reality and is the level most first drafts do not reach. The reporting infrastructure that supports level-three analysis is the FP&A platform with revenue tracking by product, by customer segment, and by acquisition cohort; the CRM with customer-level revenue and retention data; the GL with sufficient chart-of-accounts granularity to support the operating-expense discussion; and the documented variance-analysis discipline that captures the business reasoning behind material changes contemporaneously rather than retrospectively. Cross-link to /blog/finance-transformation-needs-systems-integrator for the systems-integration discipline that supports MD&A drafting. The critical accounting estimates section: the discipline the auditor will eventually require The critical accounting estimates section requires identification and discussion of the accounting estimates that involve significant uncertainty and that are material to the financial statements. For most mid-market companies preparing for IPO, the typical list runs through five-to-eight estimates: revenue recognition under ASC 606 (especially variable consideration, contract modifications, and material rights), allowance for credit losses (under ASC 326), stock-based compensation (especially for equity grants with performance conditions, and for grants in the periods leading up to IPO when the underlying valuation methodology becomes a critical-audit-matter), goodwill and intangible asset impairment (under ASC 350), income tax provisions (especially uncertain tax positions under ASC 740), and any company-specific estimates the external auditor has identified as critical. For each estimate, the disclosure should describe (a) the methodology, (b) the key assumptions, (c) the sources of the assumptions, (d) the sensitivity of the estimate to changes in assumptions (typically expressed as the impact of a 10% change or a one-standard-deviation change in a key assumption), and (e) any change in methodology or assumptions from prior periods. The sensitivity analysis is the most analytically demanding component and is the component most often underdeveloped in first drafts. The companion artifact is the audit committee's challenge of management's estimates. Cross-link to /blog/audit-committee-reporting-clean-meetings for the AC's role in reviewing complex accounting estimates. The AC's review serves two purposes in IPO readiness: it surfaces issues that need to be addressed before the registration window, and it builds the documented record of audit-committee oversight that the SEC and the underwriter will eventually look for as evidence of disclosure-controls operation. The disclosure controls and procedures buildout: SOX 302, 906, and 404 Disclosure controls and procedures (DCP) under SEC rules are the controls and procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports filed under the Exchange Act is recorded, processed, summarized, and reported within the time periods specified in the SEC's rules and forms. DCP is broader than internal control over financial reporting (ICFR); DCP includes the controls around all SEC-required disclosures, while ICFR is specifically the controls around the financial statements. Section 302 of Sarbanes-Oxley requires the CEO and CFO to certify, in each periodic report, that they have reviewed the report; that based on their knowledge the report does not contain untrue statements or omit material facts; that the financial statements fairly present the financial condition and results of operations; that they are responsible for establishing and maintaining DCP and have designed DCP to ensure material information is made known to them; that they have evaluated the effectiveness of DCP as of the end of the period; that they have disclosed to the audit committee and the auditors any significant deficiencies and material weaknesses in ICFR; and that they have identified any fraud involving management or other employees with a significant role in ICFR. Section 906 of SOX adds a criminal certification: the CEO and CFO certify that the periodic report fully complies with the requirements of the Exchange Act and that the information in the report fairly presents, in all material respects, the financial condition and results of operations. Section 404 of SOX requires (for public companies above the smaller-reporting-company threshold) the company's external auditor to attest to the effectiveness of the company's ICFR. The attestation requires that the company have a framework (typically COSO 2013) for evaluating ICFR, that the company have documented its controls and tested their operation during the year, and that the auditor has independently tested the controls and concluded on their effectiveness. The buildout for an IPO-bound private company is a two-year process running parallel to the MD&A drafting roadmap. The DCP buildout requires identifying the relevant disclosures, designing the controls around their preparation, implementing the controls, and operating the controls for at least one fiscal year prior to registration. The ICFR buildout requires the COSO-based framework, the documented control library, the management testing program, and the operating year prior to registration. The audit committee oversight of both DCP and ICFR is the governance dimension that provides the SEC and the underwriter the comfort that the controls are operated rather than nominal. The companies that complete this buildout cleanly are the companies that began the work approximately twenty-four months before the registration window, the same timeline as the MD&A drafting roadmap, and for the same reason. The work cannot be compressed into the registration window without producing material weaknesses or significant deficiencies that will appear in the company's first 10-K and that will require remediation in the first year of public-company life. Cross-link to /blog/management-vs-financial-reporting-boundary for the disclosure-controls discipline that supports DCP. The audit committee buildout: independence, financial expertise, and operating record The audit committee buildout is the third pillar of IPO readiness, alongside the MD&A drafting roadmap and the disclosure controls and procedures buildout. The SEC's audit committee requirements (under SEC Rule 10A-3 and the relevant exchange listing standards) require that the audit committee be composed entirely of independent directors, that at least one member be designated as a financial expert (or that the company disclose why no member qualifies), that the committee have direct responsibility for the appointment, compensation, and oversight of the external auditor, and that the committee have written procedures for receipt and treatment of complaints regarding accounting matters. The financial expert designation is the requirement most often unmet in mid-market private-company audit committees. The SEC's definition (under Item 407 of Reg S-K) requires either (a) experience as a public-company CFO, controller, principal accounting officer, or auditor; (b) experience supervising a person who held one of those positions; or (c) experience overseeing or assessing the performance of companies or public accountants with respect to the preparation, auditing, or evaluation of financial statements. The pool of qualified candidates is narrower than most boards anticipate, and the recruitment timeline is six-to-twelve months for a director-search engagement. The operating record requirement is the dimension most often missed entirely. The SEC and the underwriter will look at the audit committee's operating record over the periods covered by the registration statement, meeting minutes, attendance, executive sessions with the auditor, complex accounting estimate discussions, related-party transaction approvals, whistleblower hotline activity, ERM oversight, as evidence that the committee was operating substantively rather than ceremonially. A committee that has been formed two months before the registration filing has no operating record; a committee that has been operating for two years has the record the registration process expects. For PE-backed companies anticipating an IPO, we recommend forming the audit committee with the SOX-compliant composition and operating it under the SOX-compliant charter at least twenty-four months before the registration window. Cross-link to /blog/audit-committee-reporting-clean-meetings for the AC operating discipline. The interaction with the rolling forecast, the 13-week, and the management-vs-financial reporting boundary MD&A drafting interacts with the company's broader finance operating discipline in three ways that warrant explicit cross-reference. The forward-looking component of MD&A, known trends and uncertainties, liquidity and capital resources beyond twelve months, relies on the company's rolling forecast as the underlying analytical foundation. A company without a defensible rolling forecast cannot make the forward-looking disclosures MD&A requires, and the rolling forecast must be operating with sufficient quality and stability to support the disclosures by the time the registration draft is being prepared. Cross-link to /blog/rolling-forecasts-vs-static-budgets-cadence for the rolling forecast discipline. The liquidity and capital resources component relies on the 13-week cash flow as the operating evidence of the company's near-term liquidity discipline, and on the rolling forecast as the medium-term liquidity analysis. The going-concern memo that the audit committee reviews quarterly (referenced in our audit committee field guide) is the foundation of the MD&A liquidity discussion. Cross-link to /blog/13-week-cash-flow-operational-rhythm for the 13-week structure. The non-GAAP measures the company uses in MD&A, adjusted EBITDA, free cash flow, and any company-specific non-GAAP measures, are governed by the management-vs-financial reporting boundary policy. The reconciliations from each non-GAAP measure to its nearest GAAP analogue must be consistent with the reconciliations the company has been using in its private-company reporting, and changes in the definitions or calculations from prior periods must be disclosed and explained. Cross-link to /blog/management-vs-financial-reporting-boundary for the boundary policy. The SEC comment letter process: what to expect and how to prepare The SEC review of a registration statement typically produces a comment letter that addresses the financial statements, the MD&A, the description of the business, and the risk factors. The comment letter on MD&A typically requests additional analytical depth in the results-of-operations discussion, additional sensitivity analysis in the critical accounting estimates section, additional forward-looking disclosure in the known-trends-and-uncertainties section, and clarification on the non-GAAP measures and their reconciliation to GAAP. The response to the comment letter requires the company to either (a) revise the disclosure in the next amendment of the registration statement, (b) provide supplemental information to the SEC explaining the disclosure, or (c) decline to make the requested change with a substantive justification. The response cycle typically runs two-to-four weeks per round, with two-to-three rounds being typical for well-prepared registrations and four-to-six rounds being typical for less-prepared registrations. The companies whose comment letters are shortest are the companies whose drafts have already addressed the analytical depth, sensitivity analysis, and forward-looking disclosures the SEC consistently requests. The two-year drafting roadmap is, fundamentally, an exercise in pre-empting the comment letter, the questions the SEC will eventually ask are the questions the drafting cycles ask of the company throughout the two-year window. What we recommend Begin the MD&A drafting roadmap twenty-four months before the target registration date. The drafting cycles produce progressively higher-fidelity drafts using the company's then-private financials, refine the analytical depth required by the SEC, and surface the disclosure-controls gaps that need to be addressed before the registration window. The roadmap is approximately one full-time-equivalent of finance and disclosure work over the two-year period, and the cost of running it is substantially less than the cost of compressing it into the registration window. Build the disclosure controls and procedures alongside the MD&A drafting cycles. DCP under Section 302 and 906, and ICFR under Section 404, require an operating year of evidence prior to registration. The buildout is parallel to the MD&A roadmap and is most efficient when run together. Form the audit committee with SOX-compliant composition and operating discipline at least twenty-four months before the registration window. The financial expert designation under Item 407 of Reg S-K, the independent-director composition, the executive sessions with the external auditor, and the operating record across the registration-period years are the governance dimensions the SEC and the underwriter will look for. Use the existing finance operating disciplines, rolling forecast, 13-week cash flow, management-vs-financial reporting boundary, non-GAAP reconciliations, as the foundation for the MD&A drafting. The disciplines that produce defensible private-company reporting also produce defensible MD&A; the disciplines that are missing in private-company reporting will be missing in the MD&A as well. Cross-link to /blog/audit-committee-reporting-clean-meetings for the audit committee operating discipline, /blog/management-vs-financial-reporting-boundary for the disclosure-controls discipline, /blog/13-week-cash-flow-operational-rhythm for the liquidity disclosure foundation, /blog/kpi-dashboards-investor-review for the metric-discipline foundation, and /blog/finance-transformation-needs-systems-integrator for the reporting-infrastructure foundation.