Clean numbers from close to exit

Ledger-tested controls and fraud analytics for portfolio companies, from the 100-day plan to the buyer's data room.

Engraving of a chessboard of ledger grids with miniature factories as pieces, a hand moving a magenta one.
Every move is diligenced twice.

Sponsor reporting assumes working controls

A sponsor's view of a portfolio company arrives as a monthly reporting pack: EBITDA, cash, working capital, covenant headroom. The pack is only as good as the controls under it, and in a lower-middle-market company those controls were often built by founders who never expected outside owners. After the deal, the finance team is asked to close faster, report more and absorb add-on acquisitions, usually without many more people.

Incentives add pressure. Management equity and bonus plans keyed to EBITDA reward results, and they can also reward timing: a cost pushed into next month, a rebate accrued early, a reserve released at quarter end. Most of this is not fraud. It still distorts the numbers that the sponsor, the lender and an eventual buyer rely on.

At exit, the buyer's diligence team will test the same ledger. Issues found at that stage cost price, time or both. Found in the first year of ownership, the same issues are a fix list.

Where portfolio numbers go soft

  • The 100-day plan outruns the controls

    New reporting, new systems and new leadership arrive together, and approval rights are reassigned in a hurry and rarely revisited.

  • Add-ons arrive on different ledgers

    Each acquisition brings its own chart of accounts, vendor master and access rights, along with its own compliance history.

  • EBITDA targets invite smoothing

    Accrual timing, reserve releases and period-end reclasses deserve closer attention when bonuses and equity value depend on the result.

  • Lenders and buyers test transactions

    Covenant certificates, field exams and exit diligence all look at the ledger itself, not at the policy manual.

Rules reach into the portfolio

Status as of November 2026. Rules change; we date every statement we make about them.

Rule or standardWhat it asksStatus
DOJ Corporate Enforcement and Voluntary Self-Disclosure PolicyA Department-wide policy, issued 10 March 2026, that rewards companies for self-disclosing misconduct, cooperating and remediating.In effect. Presumption of declination for qualifying self-disclosure; a 50 to 75% penalty reduction for near-miss disclosures.
DOJ Evaluation of Corporate Compliance ProgramsProsecutors' questions for judging a compliance program, including pre-acquisition due diligence, post-acquisition integration, data analytics and AI risk.The September 2024 version is the latest located as of November 2026.
UK failure to prevent fraud offence (ECCTA 2023)A corporate offence for large organizations, measured group-wide, when an associated person commits fraud intending to benefit them. Reasonable fraud-prevention procedures are the defense.In force since 1 September 2025. It can reach US groups where the underlying fraud has a UK connection.
Credit agreement reportingFinancial covenants, officer-signed compliance certificates, borrowing-base reports and field exams set by the portfolio company's lenders.Contractual. Inaccurate certificates and covenant breaches can trigger default provisions.
Sarbanes-Oxley 302 and 404, if the exit is an IPOOfficer certifications from the first periodic report, and management's assessment of internal control from the second annual report.In effect for listed companies. An SEC proposal of May 2026 would narrow who needs 404(b) auditor attestation; it is not final.

Work that repeats across companies

  • Controls Health Check

    A fixed-scope diagnostic for each new platform or add-on, with results in the same format across the portfolio.

  • Full-Ledger Analytics

    Every journal entry and payment tested for timing, authorship and period-end patterns that a sample would miss.

  • Fraud Risk Assessment

    A fraud risk assessment on the COSO and ACFE model that also documents reasonable procedures for any UK exposure.

  • Continuous Controls Monitoring

    Weekly automated tests and a monthly exception report short enough for an operating partner to read.

  • Counterparty & Vendor Due Diligence

    Ownership, sanctions and adverse-media research on an add-on's key vendors, customers and agents.

  • Compliance Program Evaluation

    An evaluation against DOJ's questions, scaled to a mid-size company, before integration or exit.

Test the add-on before integrating it

An add-on acquisition brings a ledger you did not build, a vendor master you have not cleaned and users whose access nobody has reviewed. Integrating it first and testing it later means its problems move into the platform's books. We run a short, fixed set of tests on the add-on's data in the first weeks after closing, before the systems are merged.

DOJ's compliance program guidance asks specifically how a company handles due diligence and integration after an acquisition, and its 2026 enforcement policy rewards companies that find and disclose problems early. Our summary of DOJ's 2026 Corporate Enforcement Policy explains the incentives.

First-month tests for a new add-on

  1. Manual journal entries by time, author, approver and proximity to period end.
  2. Vendors that share a bank account, address or tax ID with an employee or with another vendor.
  3. Vendor bank-detail changes in the last twelve months, and the payments that followed them.
  4. Payments to agents, consultants and intermediaries in higher-risk jurisdictions.
  5. User access in the accounting system, the bank portals and payroll, compared with job roles.

Full-Ledger Analytics runs these tests over every transaction, and every flag is reviewed by a person before it reaches a report.

One format for every company

Operating partners read many reporting packs. We deliver findings in the same structure for each company, ranked by consequence, each with an owner and a date, so the sponsor can compare companies and track progress between board meetings. The same register, kept current, becomes part of the evidence a buyer's diligence team will ask for at exit: what was found, when, and what changed. Once the fixes are in, continuous controls monitoring keeps the same tests running weekly. Our list of ten automated tests shows what that looks like in practice.

What people ask before hiring us

Do you work for the sponsor or for the portfolio company?

Either, and we agree which in writing before work starts. The engagement letter names who receives the report and who can see the findings. Where both the sponsor and management want the results, we deliver the same report to both.

Do you prepare quality-of-earnings reports?

No. We prepare companies for them. Ledger analytics, documented controls and a findings register that shows known issues being fixed give a buyer's diligence team fewer open questions. We do not value businesses or advise on transactions.

What happens if the analytics point to misconduct?

We stop, tell the accountable executive and, where the engagement letter provides for it, the sponsor. Decisions about investigation and disclosure belong to the company and its counsel. Because DOJ policy rewards timely self-disclosure, we report quickly and in plain terms.

Can the same monitoring run across several portfolio companies?

Yes. The test library is the same; we map it to each company's ledger, whether NetSuite, Sage Intacct, Microsoft Dynamics 365 Business Central, QuickBooks Online or Xero, so results are comparable.

Related work and reading

  • Full-Ledger Analytics

    A two-to-four-week diagnostic that runs a library of explainable tests and outlier models over every transaction in the period, then reports only the flags an analyst has reviewed.

  • Continuous Controls Monitoring

    Automated tests on your ledger, bank and access data every week or month, each exception reviewed by a person and routed to a named owner, run as a subscription after a six-week setup.

Tell us what you are seeing

A first conversation is a scoping call: what worries you, what you need to show, and to whom. You leave it with a view on where to start, whether or not you hire us.

Writehello@financeethics.com
Call(307) 365-5252
Office7124 Commons Dr, Cheyenne, WY 82009
HoursMonday to Friday, 9:00 to 17:00 Mountain Time