AuditBoard and the case for boring software

AuditBoard and the case for boring software

In May 2024 the private equity firm Hg agreed to acquire AuditBoard in a transaction valued at more than $3 billion (Hg, 2024-05-23). Crunchbase ranked it as the largest acquisition of a US venture-backed private company that year (Crunchbase News, 2024-05-23).

It was not a model lab, a chip designer or a consumer app. It was software for internal audit, risk and compliance teams, built in Cerritos, California. CrossWork's first fund, Midas I, held a position in AuditBoard, which was exited through the Hg transaction.

We think the story is worth studying precisely because it is unglamorous. The most durable returns in software have often come from categories no one writes breathless articles about.

What AuditBoard actually was

By the time of the acquisition, AuditBoard served more than 2,000 enterprises, including close to half of the Fortune 500, and reported more than $200 million in annual revenue while being profitable (Crunchbase News, 2024-05-23). Crunchbase also noted that the company had raised only about $43.6 million in venture funding over roughly a decade, with its last priced round led by Battery Ventures in 2018 (Crunchbase News, 2024-05-23).

Read those two facts together. A company reached enterprise scale, profitability and a multi-billion-dollar outcome while consuming a small fraction of the capital that headline startups routinely raise. The efficiency is the story.

Why compliance is a durable category

Compliance software has properties that generalist investors often underrate.

Demand is mandated, not discretionary. Public companies must maintain internal controls over financial reporting under Sarbanes-Oxley. Regulators keep adding obligations in cybersecurity disclosure, operational resilience and data protection. Budgets for these functions do not disappear in downturns because the obligations do not.

Switching costs are structural. Once an audit team's controls, evidence and workflows live in a system, moving them is a multi-quarter project with regulatory exposure. Customers do not switch lightly.

The buyer is under-served. For years many internal audit and risk teams ran on spreadsheets and email. A product that respects their workflow earns loyalty that a generic platform cannot easily dislodge.

Expansion is natural. A company that starts in SOX compliance can extend into operational risk, IT risk, ESG reporting and third-party risk, each a new budget line inside the same customer.

Hg understood this. The firm describes itself as a long-time investor in compliance, risk and accounting software (Hg, 2024-05-23). Specialist acquirers pay for durability because they have seen it compound.

Why it was under-noticed

If the category is this good, why was it not crowded? A few reasons recur.

The product is invisible to consumers and to most technology journalists. The buyer, an internal auditor or chief audit executive, is not the person most venture investors meet at conferences. Capital-efficient companies raise infrequently, so they generate fewer headlines and fewer chances for outside investors to see them. And the growth is steady rather than explosive, which reads as "boring" to investors screening for the steepest curves.

Each of those is an information gap. Information gaps are where private-market returns are made.

The pattern for spotting the next one

AuditBoard was not a one-off. We use a short checklist, drawn largely from how former operators on our advisory board describe the companies their own teams relied on.

1. Ask what the finance, legal and risk teams cannot live without. Operators know which tools survived every budget review. Those tools rarely appear on trend lists.
2. Look for capital efficiency as a signal of product pull. A company that grows to scale on little outside capital is usually being pulled by customers rather than pushed by sales spend.
3. Prefer regulatory tailwinds that ratchet in one direction. Obligations that are added and rarely removed create compounding demand.
4. Check for a credible specialist acquirer universe. A category with multiple informed buyers, private equity firms and strategic acquirers that know the space, gives an investment more than one path to an exit.
5. Be willing to be early to something unfashionable. The discount on boring companies is real, and it tends to close at exit, when a buyer with category expertise prices the durability.

None of this is a formula for returns. Plenty of vertical software companies stall, and a regulatory tailwind is not a moat by itself. But the combination of mandated demand, structural switching costs and capital efficiency is a pattern worth recognising early.

Why this matters now

The AI cycle has pulled attention and capital towards the most visible layers of the stack. That is rational in part; we hold positions in several of those companies ourselves. But the shift also creates a new set of boring, essential problems: model risk management, AI governance and audit, data lineage and regulatory reporting on automated decisions. The buyers are again compliance, risk and audit teams. The budgets again follow mandates. Some of the companies that will serve them are small, capital-efficient and largely unnoticed today.

CrossWork Midas II is built to look in both places: the defining platform companies of this decade and the quieter software businesses that the market tends to find only at exit. Access to both runs through the same advisory network of former operators, and it is invitation-only.

---

Sources

• Hg, "AuditBoard agrees to be acquired by Hg for over $3 billion" (2024-05-23).
• Crunchbase News, "An auditing startup produced 2024's biggest VC-backed M&A exit" (2024-05-23).
• Cooley, "AuditBoard to be acquired by Hg for more than $3 billion" (2024-05-23).

Past performance is not indicative of future results. This is not an offer; offering documents govern. Detailed performance is available to verified investors in the CrossWork portal. This is not investment advice.