Whether it’s a Real Estate Investment Trust (REIT) or real estate fund you hope to take public via an initial public offering (IPO), you undoubtedly will want to enter the public marketplace for the first time successfully. There are myriad considerations to accomplish this, so we’ve created a three-part thought leadership series to help, highlighting distinct phases of the going public journey:
- Creating a strategy for effective internal controls (appealing to sophisticated investors)
- Developing the public company’s accounting and financial reporting processes (meeting investor and regulatory needs)
- Creating the initial tax and organizational frameworks (focusing on the importance of tax structuring and REIT compliance related to the impact of ASC 740).
Together, strength in these areas can help offer REIT executives, and accounting and compliance officers a comprehensive framework for navigating the complexities of going public, mitigating risks, and positioning organizations for long-term credibility and public trust.
Below, we take a deep dive into best practices for internal controls and governance, covering:
- Infrastructure,
- Risk management progression,
- Technology shifts,
- Cultural change,
- Challenges and
- Best practices every executive and accounting and compliance officer should know for a successful journey.
Internal Controls: Ensuring Confidence and Compliance
The transition from a private company to a public filer is a pivotal step for real estate companies, unlocking access to institutional capital, improving liquidity and increasing market visibility. However, it also introduces heightened reporting requirements and investor expectations.
At the core of this shift is the implementation of strong internal controls. These controls are essential for maintaining investor trust, ensuring regulatory compliance and supporting operational discipline. More than a regulatory obligation, they create a foundation of transparency, accuracy and accountability stakeholders rely on.
For companies accustomed to lean or less formal administrative structures, going public requires a meaningful cultural and operational shift. Establishing robust internal controls helps align the organization with public market standards and positions it to meet the demands of institutional investors.
Consider the importance of internal controls in your move to public filing through four key areas:
- Investor Confidence: Investors move money to various new investments based on not only the promise that management can generate a certain rate of return, but also that the money is protected with reliable controls. Weak controls work against that belief, while strong controls attract more and varied money and signal you, as a new public filer, have taken the necessary steps to reach the next level in sophistication.
- Regulatory Compliance: Public REITs must comply with Sarbanes-Oxley Act (SOX), particularly Section 404, SEC regulations and Public Company Accounting Oversight Board (PCAOB) audit standards. An opinion on internal controls is another method through which you can realize and demonstrate compliance to the investing public.
- Expansion Readiness: As a public company invests in new real estate deals and expands its size, manual processes become time consuming and prone to errors in financial reporting. Internal controls provide the structure needed to grow operations without sacrificing accuracy or transparency. Automating certain controls allows for efficiency and scalability as growth is executed.
- Risk Mitigation: Effective controls protect against financial misstatements, fraud, cybersecurity breaches and human error, reducing a REIT’s exposure to public scrutiny and financial mistakes.
The journey from private to public demands a companywide approach to internal controls, integrating governance, risk management, technology, and culture to meet the expectations of shareholders and regulatory authorities.
Governance Infrastructure: Establishing a Credible Foundation
A private real estate company typically operates with a small management team and very informal oversight. Public markets, however, demand a formal governance structure investors recognize as credible. This change entails several critical components:
- Board Composition: Independence and Expertise
An effective board is a necessity of effective governance. Your new public entity must find independent directors that comprise a majority of the board and have varied expertise in finance, real estate, compliance and risk management. Your company must establish clear criteria for board selection and the implementation of regular evaluations of director performance. For example, a REIT preparing for an IPO might recruit directors with experience in public company accounting and auditing, real estate acquisitions and SEC compliance, ensuring a well-rounded board of directors.
- Audit Committee: Oversight and Accountability
The audit committee oversees financial reporting, internal audits and external auditor relationships. It must operate independently, with at least one member meeting SEC financial expertise standards. Key responsibilities include reviewing financial statements, monitoring internal control compliance, and maintaining communication between management and auditors. Best practices involve developing a clear charter, regular committee self-assessments, and ongoing education on evolving accounting and SEC requirements.
- Whistleblower Protections: Safeguarding Integrity
SEC rules require procedures be in place for employees and even nonemployees, such as contractors or vendors, to report concerns about anything happening at the company anonymously, fostering a culture of accountability and ethical behavior. Private REITs transitioning to public filers should implement confidential reporting channels, such as hotlines or secure online portals, and ensure whistleblower protections are widely trained, communicated and enforced.
- Tone at the Top: Leadership Commitment to Compliance
Leadership must take the lead and set a clear and consistent tone regarding the importance of compliance and integrity by including ethical standards into decision-making, rewarding behaviors that support integrity and holding management accountable for ethical behavior. Management and the board should consistently communicate the importance of internal controls by conducting annual ethics training, providing regular updates on compliance initiatives, and integrating ethics and integrity goals into performance evaluations.
Risk Management and Compliance: From Reactive to Proactive Discipline
Risk management in private REITs is often reactive, responding to issues as they arise. The transition to public filing requires a shift to an organizational, proactive approach, integrating risk assessment and mitigation across all the entire operations of a REIT. Consider the following four areas:
- Enterprise Risk Management (ERM): Integrated Frameworks
Frameworks such as the Committee of Sponsoring Organizations of the Treadway Committee (COSO) enable REITs to assess, monitor and manage risks across financial, operational and strategic areas. Implementing COSO involves identifying key risks upfront, assigning ownership of those risks, and establishing regular reporting mechanisms for both compliance and errors.
- Compliance Programs: Ensuring Regulatory Adherence
Public REITs must monitor compliance with SEC filings, REIT qualification rules and state-level regulations. This includes implementing policies, tools, and procedures for timely and accurate reporting and maintaining documentation for REIT status.
- Cybersecurity Controls: Protecting Electronic Assets
With the rise of digital reporting, shareholder portals and electronic communications, cybersecurity has become an entity-wide priority. REITs must deploy firewalls, warning systems against hacking, encryption protocols, and conduct regular penetration testing to safeguard sensitive investor and tenant data. A comprehensive cybersecurity strategy includes employee training on phishing and social engineering risks, incident response plans and annual third-party audits of security infrastructure.
- ESG Reporting: Responding to Institutional Demands
While the SEC’s climate disclosure rule is stalled, environmental, social and governance (ESG) disclosures remain critical as investors, regulators and global reporting demand transparency. REITs must consider implementing strong controls for ESG data collection, validation and reporting by integrating metrics into organizational systems, assigning accountability and aligning with standards. Strong ESG practices strengthen a REIT’s reputation and may attract capital from impact-focused investors.
Technology Enablement: Modernizing Internal Controls
Technology is the heart of effective internal controls, allowing automation of manual processes, real-time monitoring of transactions and more accurate decision-making. As such, the transition to public filing may require a significant investment in technology infrastructure to support compliance, scalability and risk management. Consider these areas:
- ERP Systems: Centralizing Financial Data and Workflows
Enterprise resource planning (ERP) platforms, such as Yardi, centralize financial data, impose segregation of duties and automate important workflows by mapping business processes, migrating legacy data from antiquated systems, and configuring controls to support both SOX and SEC compliance. By implementing a new ERP system, or optimizing one already in place, a private REIT preparing for an IPO might replace spreadsheet-based output, automate revenue recognition and expense management, and increase efficiency and controls of recording transactions.
- Internal Control Monitoring Tools: Detecting Variances in Real Time
Continuous monitoring solutions provide real-time detection of variances, exceptions and control failures. These tools integrate with ERP systems, flagging issues for immediate resolution and reducing reliance on manual audits.
- Data Analytics: Proactive Risk Identification
Still in the early stages for real estate companies but growing consistently every year, advanced data analytics enables projecting risk identification, such as forecasting tenant defaults, market downturns or operational inefficiencies.
- Cybersecurity Infrastructure: Safeguarding Sensitive Information
A strong cybersecurity infrastructure is essential for protecting investor and tenant data, ensuring compliance with data privacy regulations and maintaining business continuity.
Cultural Transformation: Fostering a Compliance-Driven Organization
Internal controls require not only technical implementation but also adoption throughout your entire entity. Encouraging a culture of compliance is essential to the long-term success of public REITs and entails focusing on:
- Training Programs: Building Awareness and Capability
Training should start when new employees are onboarded. However, it’s important to provide annual comprehensive training programs as a refresher, as well as specialized workshops for specific groups, such as IT, accounting or sales. This will help ensure employees across all levels understand compliance obligations, reporting procedures, and, most importantly, the rationale behind the use of internal controls.
- Accountability Structures: Integrating Controls into Performance Evaluations
Performance evaluations should include adherence to internal controls, rewarding employees who demonstrate commitment to compliance. For example, employee reviews might incorporate control effectiveness, participation in training and timely completion of compliance tasks.
- Change Management: Achieving Team Support
Transitioning from private to public status requires buy-in across the organization, from executives to property managers. Change management strategies include regular communication about the benefits of controls, visible support from senior leadership and plenty of opportunities for employee feedback.
Challenges and Pitfalls: Navigating the Complexities of Internal Controls
The journey to institutional-ready internal controls is not without challenges. Common pitfalls include:
- Making things too difficult: Excessive controls can slow growth and burden staff with unnecessary complexity. Controls should be risk-based and scalable.
- Resistance to Change: Employees accustomed to informal processes may resist structured change. Addressing concerns through training and communication is essential.
- Cost: Implementing controls requires investment in technology, personnel and external advisers. Budgeting for these costs and demonstrating a return is critical.
- Lack of documentation: Controls may be in place, but it is critical to have documentation that serves as evidence of the implemented controls.
- Integration Challenges: Merging old systems with new software can create issues. Careful planning, phased implementation and thorough testing can help reduce these risks.
Modification approaches include pilot or test programs, stakeholder engagement and constant improvement, ensuring controls evolve with the organization’s needs.
Best Practices for Internal Controls
To build an effective internal control framework, private REITs looking to go public should consider the following best practices:
- Start Early: Begin building controls well before filing with the SEC, allowing time for testing and refinement.
- Engage External Advisers: Consultants and auditors provide expertise and credibility in the eyes of investors and regulators.
- Understanding Peers: Study public REITs of similar size and complexity to identify best practices and avoid common pitfalls.
- Ongoing Improvement: Review and Update controls regularly to reflect changes in business operations, regulatory requirements and emerging risks.
- Integrate Technology: Use automation, analytics and monitoring tools to enhance control effectiveness and efficiency.
- Create a Compliance Culture: Insert compliance into organizational values, performance evaluations and leadership communications.
Recommendations include conducting annual control self-assessments, establishing cross-functional control committees, and maintaining open channels for employee feedback and issue reporting.
Positioning for Institutional Trust and Public Market Success
Internal controls are the foundation of IPO-ready development for private REITs transitioning to public filers. The journey demands a comprehensive approach that integrates governance, active risk management, advanced technology and cultural transformation. By investing in these areas and adhering to best practices, REITs can build platforms that institutional investors trust, regulators respect and employees embrace.
Ultimately, the success of a public REIT hinges on its ability to demonstrate transparency, accountability and flexibility. Strong internal controls are not just a regulatory requirement but a strategic asset, enabling organizations to access institutional capital, scale operations and succeed in the competitive landscape of public markets.
The guidance outlined in this article can help REIT executives begin to navigate the complexities of public transition, mitigate risks and position their organizations for long-term success and credibility.
Contact Nick Antonopoulos, Angela Bacarella-Wood or a member of your service team to discuss this topic further.
In this blog Cohen & Co is not rendering legal, accounting, investment, tax or other professional advice. Rather, the information contained in this blog is for general informational purposes only. Any decisions or actions based on the general information contained in this blog should be made or taken only after a detailed review of the specific facts, circumstances and current law with your professional advisers.