- Zero Material Weakness
- Posts
- Welcome to Zero Material Weakness!
Welcome to Zero Material Weakness!
Stay ahead of audit red flags with practical insights and real-world tips to fix internal control weaknesses before they’re found.

Welcome to this edition (week ending August 1, 2025) of Zero Material Weakness (ZMW) — a newsletter built for CFOs and controllers who want to stay ahead of material weaknesses before they become audit red flags. Whether you're preparing for SOX compliance, managing IPO-readiness, or just tightening up your internal control environment, this newsletter brings practical insights, industry trends, and real-world examples straight to your inbox. Our goal? Help you fix what’s weak, before the auditors find it.
News this week
The SEC has designated George R. Botic to serve as Acting Chair of the PCAOB after Erica Y. Williams resigned effective July 22, 2025, with Botic’s appointment taking effect July 23. This leadership change matters because the PCAOB sets and enforces audit standards, conducts inspections of public company and broker-dealer audits, and brings enforcement actions. A new chair can reset policy priorities, influence inspection focus, and affect the pace and substance of standard-setting, which in turn shapes workloads and risk assessments for issuers, audit firms, and investors. Watch for early signals from Botic on inspections and the rulemaking calendar as we head into fall.
On Tuesday, July 22, 2025, a federal court entered the stipulated final judgment and order in the CFPB’s 2021 lawsuit against FirstCash, Inc. for alleged violations of the Military Lending Act, and the CFPB on the same day terminated its 2013 consent order against Cash America, FirstCash’s predecessor, after finding the obligations had been met. This combination closes a multi-year enforcement matter involving protections for servicemembers and clarifies FirstCash’s ongoing MLA compliance obligations, providing a clear signal to all lenders that serve active-duty borrowers to validate MLA screening, disclosures, and rate-cap controls and to ensure any legacy remediation is fully embedded in current operations.
On July 22, 2025, FINRA alerted firms to a critical Microsoft SharePoint vulnerability that allows remote code execution, warned of active exploitation, and urged immediate patching and mitigations. This matters because many broker-dealers rely on SharePoint for records and collaboration, so a breach could jeopardize books and records compliance, trigger Reg SCI and Reg SP issues, and expose customer data. CISOs and IT teams should coordinate with supervisory principals to validate controls and remediation, and vendors that host firm portals should confirm they have applied Microsoft’s fixes and documented compensating safeguards.
On Wednesday, July 23, the OCC appointed Kate Tyrrell as Chief of Staff and Senior Deputy Comptroller, placing her on the agency’s Executive Committee and giving her oversight of the Comptroller’s support staff and public affairs, with a portfolio that includes interagency policy coordination. This move matters because senior leadership can influence supervisory priorities and the timing of the OCC’s near-term agenda, including Community Reinvestment Act modernization, digital-asset guidance, and operational and cybersecurity expectations. Stakeholders should anticipate a stronger push for alignment across the Treasury Department and fellow regulators, which could accelerate policy clarity and tighten execution timelines for banks and their service providers.
The White House Office of Information and Regulatory Affairs (OIRA) held a series of Executive Order 12866 review meetings on July 21, 22, and 24, 2025 about the Environmental Protection Agency’s proposal titled “Greenhouse Gas Endangerment Finding and Motor-Vehicle Reconsideration” with Regulatory Identification Number 2060-AW71. The Office of Management and Budget (OMB) docket shows meetings with the Alliance for Automotive Innovation on July 21, the Union of Concerned Scientists on July 22, and Consumer Reports and the BlueGreen Alliance on the morning of July 24. This matters because reopening the endangerment finding and related motor-vehicle standards could reset federal climate policy and compliance obligations for the auto industry, including greenhouse gas targets and Corporate Average Fuel Economy (CAFE) trajectories, technology choices, and litigation exposure. The tight cluster of meetings signals an active and high-priority OMB review.
A thought from our Author Norm Osumi
With the recent IPO of Circle, crypto exchanges are now systemically relevant, which means valuation hype comes with real expectations for innovation and compliance. Treat custody and counterparty exposure as you would any other financial risk, and expect auditors to push for proof-of-reserves style evidence. For finance leaders where your companies hold digital assets, five close items matter most: adopt FASB ASU 2023-08 so eligible crypto is measured at fair value, and validate price feeds and hierarchy levels; apply SAB 122 by using ASC 450 to record a contingent safeguarding liability only when loss is probable and estimable, with an updated risk memo and roll-forwards; classify income correctly, using ASC 606 for staking or lending fees and ASC 815 for derivatives, and keep non-GAAP adjustments disciplined; reconcile tax lots to Form 8949 and recognize staking rewards as ordinary income when you have control; perform a thorough subsequent-events review through filing since hacks or a 10 percent price swing can trigger ASC 855 disclosure. These items should help you avoid unwanted adjusting JE's as well as comment letters.
Ask the PCAOB Whisperer
Changes are happening at the PCAOB after the SEC requested Chair Erica Williams’s resignation on July 22 and installed longtime insider George Botic as acting chair the next day. The Commission also opened applications for all five board seats, signaling a top to bottom reset that could temper the watchdog’s aggressive posture. Over the next six to twelve months we should expect a holding pattern: no new audit standards, a pause on headline grabbing enforcement, and budget friction as the SEC questions salaries and staffing growth. Quality control reforms already adopted will still march toward implementation, yet projects on firm governance, cybersecurity and AI may slip into 2026. Once a new board is seated, observers foresee a more measured agenda that balances investor protection with audit cost. Auditors should monitor budget hearings, shortlist leaks, and any slowdown in China work paper inspections to carefully gauge the incoming board’s true appetite for oversight.
Weekly Podcasts
We want to keep you engaged with meaningful topics, so we create weekly podcasts and host periodic webinars.
Curious about how the pros really build bulletproof budgets and align teams for high-growth success? In our latest episode of ReportingNorms.ai, finance leader Sarah S. shares hard-won lessons on stress-testing assumptions, navigating tricky system integrations, and designing comp plans that actually motivate teams. Plus, she reveals the advice that guides her approach to leaving every organization better than she found it.
Catch these insights and more - tune in to the full episode now!
Tune in to hear more.
Here’s the audio version of the same:
To watch more podcasts, visit and follow us on ReportingNorms.ai.
Like what you see? Subscribe now and join a growing network of finance leaders building stronger, audit-ready companies.
Reply