The First 90 Days: A Legal Audit for a Growing Company
Updated: 3 hours ago
By Trenton Roberts and Andrew Brown
Circular 230 / general information notice. This article is general information only. It is not tax, legal, or accounting advice. Reading it does not create an attorney-client relationship. Tax results depend on your facts and on law that can change. Consult your own attorney and CPA before taking any action. This article was not written to be used, and cannot be used, to avoid tax penalties.
When a growing company brings in outside general counsel for the first time, the natural instinct is to start with whatever is on fire. A customer contract needs comments by Friday, a contractor is asking about equity, a landlord wants a renewal signed. That work matters, but if it is all that happens, the company is still exposed to the problems nobody has noticed yet. A structured legal audit in the first 90 days finds those problems while they are still cheap to fix.
We have written about what a fractional general counsel does and how that model compares with hiring in-house. This piece is the work plan we use for the audit itself. We also look at these questions from the owner's chair, where every hour spent on paperwork is an hour not spent on the business.
Days 1 to 30: collect the records and fix the foundation
The first month is about finding out what exists. Most growing companies have more paper than they think, scattered across email, shared drives, and the founders' laptops.
Entity and governance records
Start with the company itself. We want the certificate of formation, every amendment, the company agreement or bylaws, all written consents and minutes, and the current ownership ledger or cap table. Then we compare them.
The questions that come up most often:
Does the ownership ledger match the signed documents? Equity promised in an email or an offer letter but never documented is a common problem, and an expensive one to fix during a financing or sale.
Do the governance documents match how the company actually operates? A company agreement that requires unanimous member consent for any contract over $50,000 is a problem if the company has been signing those contracts for two years without consents.
Are the right people authorized to sign? Officer appointments and bank resolutions should match who is actually signing contracts and moving money.
Is the company in good standing? In Texas, the annual franchise tax report is due May 15. For report years 2026 and 2027, the Comptroller's no tax due threshold is $2,650,000 in annualized total revenue. An entity at or below the threshold owes no franchise tax but still generally has to file a Public Information Report or an Ownership Information Report. Missing those filings can lead to forfeiture of the right to transact business in Texas, which is a problem that tends to surface at the worst possible moment, such as a closing.
Is the registered agent current, and are foreign qualifications in place in each state where the company is doing business?
If the company was formed in a hurry, it is also worth asking whether the entity choice still fits. Our post on choosing a business entity in Texas walks through those questions.
Contract inventory
Next, build a list of every material contract: customer agreements, vendor and supplier agreements, leases, loan documents, licenses, and partnership or reseller agreements. For each one we record the counterparty, term and renewal date, termination rights, assignment and change of control provisions, exclusivity, most favored customer clauses, and any liability cap.
This list becomes the foundation for everything else. It tells the company when renewals are coming, which contracts would need consent in a sale, and which commitments limit what the company can do next.
Days 31 to 60: people, intellectual property, and data
Employees and contractors
Employment issues are where small companies most often accumulate risk without knowing it. The audit should cover:
Classification. Are people treated as independent contractors when the facts look like employment? A contractor who works set hours, uses only company equipment, and has no other clients is a common warning sign.
Form I-9 compliance. Employers must keep each Form I-9 for three years after the hire date or one year after employment ends, whichever is later, and make them available for inspection.
Pay practices. Under the Texas Payday Law, Section 61.011 of the Labor Code, employees exempt from overtime under the Fair Labor Standards Act must be paid at least once a month, and other employees at least twice a month.
Restrictive covenants. Texas non-competes have to meet the requirements in Sections 15.50 through 15.52 of the Business and Commerce Code. A form copied from another state may not work here. Our post on Texas non-compete agreements explains the rules.
Information returns. For payments made after December 31, 2025, the reporting threshold for Forms 1099-NEC and most 1099-MISC payments rose to $2,000 per payee for the calendar year. Some categories, such as royalties, keep lower thresholds. The company's accounts payable process should reflect the current rules.
Intellectual property
The question here is simple: does the company own what it thinks it owns? Copyright in code, designs, and content generally belongs to the individual who created it unless it is a work made for hire or there is a written assignment. That applies to founders who started building before the company existed and to contractors who were never asked to sign anything. Our post on IP assignment for founders and contractors covers how to close those gaps.
We also check whether the company's name and key product names have been cleared and registered as trademarks, and whether domain names and social media accounts are held by the company rather than by an individual. Our post on trademark clearance and registration covers the first step.
Data and privacy
For a company that collects personal information, the audit should identify what data it holds, where it is stored, and who can access it. Texas law requires notice to affected individuals within 60 days after a breach involving sensitive personal information is determined, and notice to the Texas Attorney General within 30 days if the breach involves at least 250 Texas residents. A company that does not know what data it has cannot meet those deadlines. We also review the privacy policy against what the company actually does, because a privacy policy that overpromises is its own source of liability.
Days 61 to 90: risk, process, and the plan
Insurance and disputes
Review the insurance program with the company's broker: general liability, professional or errors and omissions coverage, cyber coverage, employment practices liability, and directors and officers coverage. Then compare the coverage against the indemnities and insurance requirements in the company's major contracts. A customer contract that requires $5 million in cyber coverage does the company no good if the policy carries $1 million.
Identify any pending or threatened claims, demand letters, or regulatory inquiries. Some of them may already need to be reported to an insurer under the policy's notice provisions.
Contract process
By this point the audit usually shows a pattern. The company signs too many contracts on the other side's paper, or it negotiates the same issues from scratch each time, or nobody knows where the signed copies are. The fix is a light process:
A standard customer agreement and a standard vendor agreement, each with a short list of fallback positions.
An approval matrix that says who can sign what, by dollar amount and risk level.
A single repository for signed agreements, with renewal dates tracked.
A simple intake method so legal requests arrive with the document, the deadline, and the business goal.
Our contract review checklist for MSAs is a good starting point for the standard terms.
The written plan
The audit ends with a short memo for leadership. It should rank issues by risk and cost to fix, assign an owner and a date to each item, and separate what needs to happen now from what can wait until the next financing or the next renewal cycle. Most companies cannot fix everything at once, and a ranked list keeps the work tied to the business's priorities.
What a legal audit tends to find
Every company is different, but the items that cause the most trouble in a later financing or sale are consistent: equity that was promised but not documented, IP that was never assigned, contracts with change of control provisions nobody noticed, and missed state filings. If the first 90 days fix those four, the audit has done its job.
How we can help
We conduct legal audits as the first phase of fractional general counsel engagements, and we stay on afterward to handle the contracts, governance, and employment questions that follow. We coordinate with the company's CPA on tax filings and with its insurance broker on coverage.
If your company has never had a legal audit, email info@robertsandwillie.com or call (469) 910-4017. Sending a message does not create an attorney-client relationship.
Disclaimer. This article is for general information only and is not tax, legal, or accounting advice. It does not create an attorney-client relationship. Tax law changes and depends on your specific facts. Do not act on this article without consulting your own attorney and CPA. This article is not intended or written to be used, and cannot be used, by any taxpayer for the purpose of avoiding penalties that may be imposed under the Internal Revenue Code or other applicable law. Attorney Advertising. Roberts & Willie, PLLC, Dallas, Texas; Trenton Roberts, responsible attorney.
Comments