Norman Marks on Governance, Risk Management, and Internal Audit

Last week, I shared a post about the firm of Audit Analytics’ report on 2021 financial restatements.

Today, I am going to cover their report, SOX 404 Disclosures: A Seventeen-Year Review. Admittedly, it analyzes 2020 filings, but I would expect that the results would be similar now.

Their report has some interesting news, notably that the number of adverse assessments of internal control over financial reporting (ICFR) decreased in 2020 despite the pandemic.

The percentage of adverse ICFR management reports and auditor attestations decreased in 2020, despite the impact of the COVID-19 pandemic throughout 2020 that necessitated changes to internal controls. The COVID19 pandemic occurring throughout 2020 had particular effects on public companies and their internal control structure and environment.

Some companies with existing control deficiencies disclosed difficulty remediating those weaknesses due to pandemic circumstances. Furthermore, rapid changes to the control environment were required in order for many companies to continue operating, including the need to reduce personnel to comply with pandemic restrictions or conserve cash. A reduced workforce can result in issues in the control environment related to segregation of duties and maintaining appropriate accounting personnel. Additionally, many companies increased reliance on information technology to accommodate a remote workforce, an area of controls ripe for deficiencies.

They also said that there was no significant change in the areas where material weaknesses were found.

Despite the unprecedented nature of the pandemic, little effect was noted in terms of the most common issues disclosed in adverse SOX 404 assessments. For example, the top two internal control issues cited in adverse ICFR management reports in 2020 – issues related to accounting personnel and segregation of duties – have been the top two issues for the previous five years. This illustrates that issues related to personnel are always common for smaller companies, regardless of circumstances arising from an event, such as the pandemic, that could significantly exacerbate existing deficiencies.

One ‘finding’ in the report astonished me.

The report says that the external auditors cited different material weaknesses than management.

• In adverse ICFR auditor attestations for the fiscal year 2020, the most common internal control issue that led to the conclusion that ICFR was ineffective was the need to make year-end adjustments (51%). The second most common reason expressed by auditors was a need for more highly trained accounting personnel (42%). These internal control issues are common, appearing as the top two issues in each of the last five years.
• In adverse ICFR management reports for the fiscal year 2020, the most common internal control issue that led to the conclusion that ICFR was ineffective was a need for more highly trained accounting personnel (75%). The second most common reason was related to segregation of duty issues associated with the design and use of personnel within an organization (63%). These internal control issues are commonly cited in management reports, appearing as the top two issues in each of the last five years.

This makes no sense to me for several reasons.

First and foremost, I find it hard to believe that they couldn’t agree on material weaknesses. If the audit firm said something was a material weakness, it would be next to impossible for management (and the audit committee) to refuse to identify it as such in their report. Similarly, I can’t see the audit firm passing up the opportunity to report something management said was a material weakness.

I am also surprised that the auditors thought having a lot of year-end adjustments reflecting an ineffective system of ICFR. The only explanation I have is that they related to errors during the year that were material to one or more quarters and corrected at year-end – and that should have been the disclosure. The problem with that is that the system of ICFR at the end of the year would probably have been effective! (Management also identified this area in 21% of their adverse assessments.)

The report lists other areas where material weaknesses were identified, either by the audit firm or by management.

• The audit firms identified issues related to IT in 36% of their adverse opinions.
• Both the audit firms and management identified inadequate disclosure controls (21% of the adverse audit attestations, and 25% of management’s). But disclosure controls (the subject of s302 of the Act) are not subject to s404 opinions. This makes no sense to me.
• Management identified an insufficient audit committee as a material weakness in 21% of their reports. It is hard to see how this can be correct. While it is one of the Principles in the COSO Internal Control Framework, defects in the audit committee are highly unlikely to result in a material error or omission in the financial statements.

The report has some more useful information. Again, they contrasted the reports of the audit firms to those of management.

• In adverse ICFR auditor attestations for the fiscal year 2020, the most common accounting issue that led to the conclusion that ICFR was not effective concerned revenue recognition. The second most common reason expressed by auditors was related to taxes. Taxes were the number one issue in 2016 but were less common between 2017-2019. Accounting issues related to PPE, intangible or fixed assets jumped in rank from eighth in 2019 to 2020. In a bigger jump, accounting issues related to the recording of debt and warrants identified in adverse ICFR auditor attestations went from being far outside the top five issues in the last five years to being the sixth most common issue in 2020.
• In adverse ICFR management reports for the fiscal year 2020, the most common accounting issue that led to the conclusion that ICFR was ineffective concerned the recording of debt/warrants/securities. This issue ranked fourth in 2015, but historically, the recording of debt and warrants was not a prevalent accounting issue cited in management reports with adverse ICFR.

I am drawn to conclude that people are having difficulties in this area. I strongly suspect that some auditors and some management teams are not testing their identification of material weaknesses against the definition of “a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.”

I also suspect that the audit committees of these companies are not challenging management and the audit firms to report the same and not different material weaknesses.

Finally, too many seem to be failing to assess and report on the state of ICFR at the end of the year, which is the requirement.

Reports like these are useful information to all involved in SOX. We should pay attention and makes sure we have the right top-down and risk-based scope, and test any deficiencies against the definition of a material weakness.

I welcome your thoughts.