IT Growing Pains Post-Series A: The Blind Spots Between Rounds

A Bay Area founder called us three weeks into her company's Series B diligence, and she did not sound like someone celebrating a term sheet. The diligence team had just finished a routine access review and found six accounts still live for people who had not worked at the company in over a year. Two belonged to engineers with standing access to the production database. One belonged to a sales rep who had left on bad terms and still had a working login to the CRM, the same system holding every customer's contract terms.

Nobody had acted maliciously. The company grew from twelve to forty employees in the sixteen months following its Series A. Because the team was hiring as fast as it could find candidates, offboarding quietly devolved into whatever the closest available person remembered to handle that week. The round closed, but it took an uncomfortable few days of access audits and password resets to get there. I think about that call often, because what nearly stalled the round down had nothing to do with the product, the market, or the team's execution. It was simply the accumulation of small, reasonable shortcuts taken during a growth sprint, left unexamined for over a year, discovered all at once by an auditor.

What IT Growing Pains Look Like Post-Series A

IT growing pains after Series A funding are not one failure. They are a pattern of operational gaps in access control, tool usage, offboarding, and compliance posture that build up quietly while a company is focused on hiring, shipping, and closing customers. None of those operational gaps look urgent in isolation. A departed contractor's account stays active a few extra weeks. A growth team signs up for a new analytics tool without looping in IT. A SOC 2 control that worked fine at twenty people gets missed once at forty-people. Each one is a rounding error. However, together, over twelve to eighteen months, they become the list a diligence team flags during the next raise.

The companies most exposed to this are often those that did everything right in the last round. They passed the audit, closed the money, and went straight into execution mode without building a habit of revisiting the systems they set up under pressure. Growth does not wait for IT hygiene to catch up on its own. It has to be checked on a schedule, the same way you'd check burn rate or hiring pipeline, or it quietly falls behind while everyone's attention sits somewhere else. This is not a story about negligence. It is a story about where attention naturally goes during a growth phase, and where it doesn't. A team hiring six people a month, closing a wave of new customers, and shipping a roadmap under pressure is, by definition, not spending much attention on an access list from four departments from months ago. That is a reasonable allocation of attention in the moment. It just leaves a bill that comes due later, usually at the worst possible time.

Access Control Drift: When Headcount Outpaces Permissions

Access control drift happens when the number of people with access to a system grows faster than anyone reviews who actually needs it. At twelve people, everyone knows what everyone else can see, and granting broad access to move fast feels harmless because the team is small enough to self-correct. At forty people across four departments, that same habit becomes a real liability. 

An engineer who switched teams still has production access from the old role. A contractor brought on for a three-month project still has a live account eight months after the project ended. Nobody assigned ownership of pruning any of it, so nobody did. In practice, this shows up in specific ways, like a marketing hire who briefly covered a data question retains admin rights to the analytics platform months later, or an early employee promoted three times still carries permissions from a role they left behind two promotions ago. None of it looks like a security incident from the inside. It only reads as one to someone auditing the account list cold.

Role-based access control only fixes this if someone reviews it on a schedule. We've covered setting up identity and access management for a growing team in more depth, and the tool matters less than the habit. A quarterly access review, even a simple one where each manager confirms who on their team still needs what, catches most of this before it turns into sixteen months of drift. Skip it for a quarter or two, and the list gets long enough that nobody wants to be the one to sort through it.

Tool Sprawl You Stopped Tracking After the Raise

Tool sprawl happens when individual teams start solving their own problems with SaaS subscriptions faster than IT can track them. A growth team picks up a new analytics platform to test attribution models. Sales adds a call-recording tool nobody vetted for data retention policy. An engineer spins up a monitoring service on a company card because procurement would have taken two weeks and the outage would not wait.

Recent industry benchmarking (CIO Dive, 2026) found that the average large company now runs thousands of applications, and more than sixty percent of the ones IT discovers were never formally approved or overseen by anyone. Startups run leaner, but the ratio tends to get worse, not better, in the months right after a raise, when budget loosens, and headcount grows across departments that have never had to ask IT for anything before.

The risk is not only cost, though a stack of forgotten subscriptions adds up fast. Nobody has a full picture of where company data actually lives. If a former employee's personal login was the one connecting a tool to customer data, that connection often survives their exit. We've written about building a proper shadow IT inventory before, but the short version at this stage of growth comes down to one exercise: pick a quarter, sit down with finance's expense report, and match every recurring SaaS charge to an owner and a purpose. What's left over is your actual shadow IT problem, and it is usually bigger than anyone imagined.

Offboarding Gaps From Hiring Faster Than You Onboard

Fast-growing companies tend to build a solid onboarding process early, because a new hire's first week is visible and painful to get wrong. Offboarding, on the other hand, rarely gets the same attention, because a departure is quieter and the person leaving is no longer around to notice what got missed. The result is a company that can provision a new engineer's laptop and accounts in an afternoon but takes weeks, or never gets around to, fully deprovisioning someone who left.

This gap widens specifically between funding rounds because turnover picks up alongside hiring. Growth-stage companies lose people too, whether through a bad fit, a departure to a competitor, or a role restructured after the raise. Every one of those departures is a moment where standing access should get revoked completely: email, Slack, the CRM, cloud infrastructure, any tool with a company login attached. When offboarding is handled informally, by whoever happens to be around that week, some of it always gets missed. We put together a fuller employee IT lifecycle framework covering onboarding, role changes, and offboarding as one connected process. That connected version is the one that actually holds up as headcount grows.

Compliance Posture That Quietly Slips Between Audits

A SOC 2 Type II report covers months of sustained operation, not a single snapshot. That means a company's compliance posture has to hold steady on every ordinary day between audits, long before an auditor ever shows up to look. That is harder than it sounds during a growth sprint. Multi-factor authentication gets enforced at launch and then quietly skipped for a new hire because IT was slammed that week. A new data store gets spun up for a product launch without the same encryption standard the rest of the infrastructure uses. Security awareness training gets assigned to new hires and never followed up on for the ones who never finished it.

None of these would fail an audit on their own. Collected across a year of growth, they are exactly the kind of gaps that turn a routine control test into a finding. We laid out what a SOC 2 compliance timeline looks like month by month for a company building this from scratch, but the same discipline applies after certification. Compliance is not a project you finish and file away. It is a posture you maintain, and it drifts the moment nobody owns maintaining it.

How These Blind Spots Surface at the Next Raise

None of these gaps are secret. They are just invisible day to day, until an outside party runs a structured review looking specifically for them. We've written about what investors actually audit during technical due diligence, and the pattern holds across both posts for a reason: the audit does not create these problems; it only reveals ones that already existed. A diligence team pulling an access log, a security reviewer checking MFA enforcement, or an acquirer's technical team mapping your SaaS footprint will all find the same accumulation, because they are looking at the same twelve to eighteen months everyone else was too busy to check.

The founders who move through this quickly are not the ones with zero gaps. Almost nobody has zero gaps after a year and a half of rapid growth. They are the ones who found the gaps themselves first, on their own schedule, instead of letting a diligence team find them.

A Quarterly IT Health Check Between Rounds

To catch operational gaps before they become issues during a diligence audit, implement these habits:

How often should we run access reviews?

Run an access review every quarter. Confirm who has access to what, and revoke any permissions that cannot be justified in under a minute.

How do we manage SaaS subscriptions to prevent sprawl?

Reconcile SaaS subscriptions against finance's expense reports twice a year. Match every recurring charge to an owner and a business reason to identify unused or unapproved tools.

What is the best practice for employee offboarding?

Treat offboarding as a formal checklist, not a memory exercise. Every departure should trigger the same standardized steps: revoking access, transferring file ownership, and verifying device returns.

How can we maintain compliance between audits?

Spot-check compliance controls quarterly, rather than waiting for an audit. Verify MFA enforcement, encryption settings, and security training completion regularly.

Who should be responsible for the IT health checks?

Assign a dedicated owner for these processes. When IT health checks are "everyone’s job," they often fail; assign a clear lead to ensure consistency.

Preparation Beats Discovery

The founder who called us mid-diligence closed her round, and her company is stronger for having scrambled through that process. But an audit is an expensive, stressful way to discover where you’re behind. The window between funding rounds is your best chance to close these gaps on your own terms. A scramble during diligence rarely kills a round, but it consumes time, which is the one resource no founder wants to waste on cleanups. The least expensive version of this is the one handled quietly, on a schedule, months before anyone comes looking.

If you aren't sure where your gaps are, you are in a very normal place for a company sixteen months into a growth sprint. It is a far better problem to solve today than during your next diligence call.

Most concerned about audits? See how our Compliance Kickstarter Program helps you get audit-ready quickly.

Looking for a broader IT partner? Let’s talk about Fully Managed IT.

If you're not sure where your gaps are right now, we’ll be happy to help you find out.

---

About The Author

Evan Jones
Founder and CEO of Jones IT

With over two decades of IT experience in San Francisco, Evan guides Jones IT's long-term strategy, finances, and culture, with a vision of building the city's highest-rated IT services firm. Outside of work, you'll find him on the golf course or running Bay Area Warriors, his non-profit connecting Bay Area kids to college through basketball.