IPO READINESS · SET / mai

Build the controls and evidence
for your next stage of growth.

ALPHASEC helps businesses preparing to list on Thailand’s SET or mai strengthen IT controls, cybersecurity, privacy and business continuity, with evidence that supports assurance work and management decisions.

Discuss your IPO readiness

BUILT FOR YOUR IPO JOURNEY

For businesses preparing to enter the capital market

For founders, CEOs, CFOs, CIOs, audit committees and IPO teams seeking a clear view of gaps, remediation priorities and operating evidence across the agreed group-company scope.

Eight areas of readiness

IT audit & application controls

Review ITGC and application controls across critical ERP, finance and sales systems: access, segregation of duties, change management and operating evidence.

IT governance & cyber risk

Define policies, accountability, risk registers, supplier controls and reporting for management and the board.

Vulnerability assessment & penetration testing

Assess authorized web, API, network and cloud scope; prioritize findings, support remediation and retest agreed fixes.

PDPA & data protection

Map processing, prepare ROPA and privacy notices, review processors and rights procedures, and plan breach response. Assess whether a DPO is required.

Business continuity & disaster recovery

Assess business impacts, define recovery objectives, prepare plans, test restoration and rehearse scenarios with management.

Security monitoring & incident response

Plan CSOC/MDR coverage, security logging, escalation and incident response around the business risk and agreed service scope.

Data governance

Define data ownership, classification, quality, access and retention so critical information can be traced and governed.

AI governance

Inventory AI uses, assess data and model risks, and define approvals and human oversight where the organization uses AI.

Assess. Improve. Sustain readiness.

Assess and prioritize
Review systems, applicable requirements and the IPO timetable with relevant stakeholders. Agree gaps, owners and a practical work plan.
Improve and gather evidence
Develop policies and controls, address findings, train teams and test operations to build evidence of how controls work in practice.
Review and sustain
Review remediation and residual risk, prepare management reporting and define ongoing support before and after listing.

What you receive

A readiness assessment and risk-ranked gap report
An action plan with owners, dates and evidence requirements
Policies, procedures and test results within the agreed scope
Management and board reporting with an ongoing review plan

Questions before you begin

Does every IPO company need every service?

Scope depends on critical systems, risks, sector rules and the needs of the financial adviser, external auditor and internal auditor. Inclusion in this programme does not make every activity a universal IPO requirement.

Are ISO certificates and a DPO always required?

ISO 27001, ISO 22301 and ISO 42001 certification are not universal IPO conditions. PDPA obligations and the requirement to appoint a DPO must be assessed for the organization’s circumstances.

How does ALPHASEC work with IPO advisers?

We agree the IT, cyber, privacy and data scope with the company and its advisers, align evidence and reports with the intended purpose, and assess auditor independence before engagement.

Does the service guarantee IPO approval?

The service supports readiness within the agreed scope. Offering approval and listing acceptance remain with the relevant authorities and depend on the company’s full qualifications. It does not replace the financial adviser, statutory auditor or all internal audit functions.

Related guidance: SEC Corporate Governance Code · SET Listing

LET’S PLAN YOUR NEXT STEP

Start with your IPO plan

Share your planned filing period, group-company scope and critical systems so our team can propose a suitable programme.

Read our privacy notice