- Zero Material Weakness
- Posts
- Welcome to Zero Material Weakness!
Welcome to Zero Material Weakness!
Stay ahead of audit red flags with practical insights and real-world tips to fix internal control weaknesses before they’re found.

Welcome to this edition (week ending August 8, 2025) of Zero Material Weakness (ZMW) — a newsletter built for CFOs and controllers who want to stay ahead of material weaknesses before they become audit red flags. Whether you're preparing for SOX compliance, managing IPO-readiness, or just tightening up your internal control environment, this newsletter brings practical insights, industry trends, and real-world examples straight to your inbox. Our goal? Help you fix what’s weak, before the auditors find it.
News this week
On July 29, 2025, the U.S. Securities and Exchange Commission (SEC) said that “authorized participants”, the large financial firms that can create or redeem shares directly with a fund may now create and redeem shares of bitcoin and ether exchange-traded products (ETPs), which are exchange-traded investments, by delivering the actual cryptocurrency instead of cash. This “in-kind” process is how many commodity ETPs already work, so the crypto products are being brought in line with common practice.
On August 1, 2025, the U.S. Securities and Exchange Commission (SEC) created an Artificial Intelligence (AI) Task Force to use AI in its everyday work, including exams of firms, market monitoring, and data analysis. The SEC also named Valerie Szczepanik as its first Chief AI Officer. She will coordinate AI projects across the agency, set rules for responsible use, and speed up adoption. Why this matters: the SEC wants to help its staff find problems sooner, work more accurately, and work more efficiently so investors are better protected and markets are better monitored.
On August 1, 2025, U.S. Securities and Exchange Commission (SEC) Commissioner Hester Peirce said her Crypto Task Force will hold roundtable meetings in cities across the United States. The meetings will focus on very small, early-stage crypto projects so the SEC can hear directly from startups, not only large firms. Why this matters: the goal is to get input from outside Washington, District of Columbia, to be more transparent by posting a planned list of participants, and to gather practical, real-world feedback. What the SEC learns could influence future crypto rules and how new projects register and follow the law.
The Consumer Financial Protection Bureau (CFPB) has published the 2025 Filing Instructions Guide (FIG) for Section 1071 of the Dodd-Frank Act. Section 1071 requires lenders to collect and report data on small-business lending. The first reporting window runs from July 18, 2025 to December 31, 2025. The FIG tells lenders exactly which data fields they must capture and the validation checks their submissions must pass when they file in 2026. The timeline reflects an interim rule issued on June 18, 2025 that extended the compliance dates. What this means for lenders: start collecting the required data now, update your systems to match the FIG’s field and validation rules, and prepare for your 2026 submission.
Investor alert (July 29, 2025): Be careful with websites or apps that say they offer “auto-trading.” Many aren’t registered with regulators. They often promise sky-high returns and claim to use “AI,” but don’t explain how it really works. That’s a red flag. Why it’s risky: You could be dealing with a scam, your personal and financial info could be exposed, and if the firm isn’t registered you won’t get the usual investor protections. What to do: a) Don’t trust words like “guaranteed” or “risk-free.” Check that the company is properly registered before you give them money or information. For firms: Review and supervise employee and social-media claims to make sure they’re accurate and compliant.
Adam Cohen named Chief Counsel (July 30, 2025)
OCC appointed Adam Cohen Senior Deputy Comptroller & Chief Counsel, effective Aug 11. He’ll oversee the Law Department; advise on supervision, enforcement, licensing, and policy; and sit on the Executive Committee. His background includes Fed/CFTC roles, in-house GC, and digital-asset matters—likely shaping OCC’s legal posture.On July 30, 2025, the Office of Information and Regulatory Affairs (OIRA) finished reviewing a joint proposal from the Federal Aviation Administration (FAA) and the Transportation Security Administration (TSA) called “Normalizing Unmanned Aircraft Systems (UAS) Beyond Visual Line of Sight (BVLOS) Operations.” OIRA marked it “Consistent with Change,” which means the rule can move forward to publication, but with some edits. Why this matters: it is a major step toward a single, coordinated set of rules from FAA and TSA that would allow drones to fly beyond the pilot’s visual line of sight at scale. This is important for aviation services, package delivery, utilities, and companies that inspect or maintain infrastructure. What to expect next: FAA and TSA will publish the proposal. Businesses planning BVLOS operations should read it carefully, prepare comments if needed, and start mapping out how they will meet the upcoming safety and security requirements.
A thought from our Author Norm Osumi
Crypto exchanges have sprinted from curiosities to systemic platforms before many risk managers even finished updating their internal policy manuals. The valuations of firms like Circle, Robinhood and Kraken underscore investor faith, but also embed sky‑high expectations for innovation and compliance. Auditors will likely need to provide proof‑of‑reserves attestations; if you’re a corporate treasurer, rethink counter‑party risk; and if you’re a retail investor, remember that regulation always lags innovation, sometimes just long enough for new kinds of mistakes. Finally, for CFO’s, CAO’s and Controller’s, First: make sure you’ve early‑adopted FASB ASU 2023‑08—all eligible crypto now goes at fair value, so verify price feeds and hierarchy levels before you lock the ledger. Second: SAB 122 supersedes SAB 121; it no longer forces a blanket safeguarding liability. Instead, apply ASC 450 and book a contingent liability only if loss is probable and estimable update of that risk memo and any roll‑forwards. Third: classify income correctly, staking or lending fees fall under ASC 606, crypto derivatives under ASC 815 because the SEC is already flagging ‘adjusted EBITDA’ numbers. Fourth: tie tax lots to Form 8949 and record staking rewards as ordinary income the moment you have control; the IRS’s latest guidance is crystal clear. Finally: run a subsequent‑events sweep right up to filing an after‑close hack or a 10 % price swing can trigger ASC 855 disclosure. Be mindful of these five points and you’ll likely keep the audit adjustments and the comment letters at bay.
Ask the PCAOB Whisperer
Q: The SEC just launched an AI Task Force. What should I expect in my next audit?
A: More questions, not more checklists. Auditors will want a plain-English map of where AI touches reporting, how data flows, and who’s accountable. Expect sharper skepticism on “AI-enhanced” disclosures, heavier use of IT specialists, and evidence requests around data lineage and third-party tools. Keep it explainable.
Weekly Podcasts
We want to keep you engaged with meaningful topics, so we create weekly podcasts and host periodic webinars.
On this week’s ReportingNorms.ai, Crypto isn’t just for speculators anymore, it’s fast becoming the backbone of mainstream finance.
In this clip we dive into how new tech, sky-high valuations, and regulatory power-plays are reshaping the game for everyone from major banks to retailers.
Want the full breakdown on how the $4 trillion banking system and DeFi are shaking hands?
Tune in to the full episode now and subscribe to us for many more such interesting conversation.
Here’s the audio version of the same:
To watch more podcasts, visit and follow us on ReportingNorms.ai.
Like what you see? Subscribe now and join a growing network of finance leaders building stronger, audit-ready companies.
Reply