|EXECUTIVE SUMMARY |
| This article examines the first two years of section 404 reporting data to determine whether section 404 has accomplished its intended purpose and what small companies can learn from the experience of large companies that have implemented section 404 requirements.
The number of companies reporting material weaknesses in their internal controls over financial reporting (ICFR) went from 15.7% the first year to 10.3% the second year. The nature of material weaknesses, the most common of which was GAAP misapplication or failure, remained the same.
Smaller companies reported disproportionately higher numbers of ICFR deficiencies in both years, which were also reflected in a disproportionately higher number of ICFR deficiencies among clients of audit firms that primarily audited smaller companies.
Issuers in the retail and service sectors were most likely to have ineffective ICFR while construction and finance, insurance and real estate were the least likely to report material weaknesses in ICFR.
Research shows that companies that have implemented section 404 are less likely to restate results. Restatements among companies that implemented section 404 declined 14% in 2006 while restatements by companies not yet required to comply with section 404 (non-accelerated filers) rose 40%.
Large companies can use findings in this article to further improve their ICFR and small companies can use the findings to target their ICFR efforts toward areas, such as GAAP misapplication and failure in tax expense and revenue recognition, that are at highest risk for material weaknesses.
Kathryn E. Scarborough, CPA, is a general business specialist in the Office of the Chief Accountant of the SEC. Mark H. Taylor, CPA, Ph.D., is the John P. Begley Endowed Chair in Accounting at Creighton University, Omaha, Neb. Their e-mail addresses are email@example.com and firstname.lastname@example.org, respectively.
The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by any of its employees. The views expressed herein are those of the authors and do not necessarily reflect the views of the commission or of the author’s colleagues on the staff of the commission.
Just two paragraphs out of a 66-page law, section 404 of the Sarbanes-Oxley Act created one of the most controversial regulatory requirements since the wave of securities regulations following the stock market crash of 1929. The first-year implementation of new requirements for public companies’ internal control over financial reporting (ICFR) proved more burdensome and costly than expected, resulting in an outcry from corporate America.
With two full years of ICFR reporting data now available, we ask the question, has section 404 improved the quality of ICFR? What can small public companies (non-accelerated filers) that are preparing to comply with section 404 for the first time gain from the experience of large companies? Our review is a first step toward answering such questions.
||ICFR Prevents Restatements
For those skeptical about the value of ICFR, consider this: Data reported early in 2007 by market research firm Glass Lewis & Co. show that between 2005 and 2006, restatements by companies required to comply with section 404 (accelerated filers) declined 14% while restatements by companies not yet required to comply with section 404 (non-accelerated filers) rose 40%. In other words, companies with strong ICFR are far less likely to restate their financial statements, thus avoiding painful declines in market valuation.
Second-year results show that companies have learned from their first year’s experience, marking clear overall improvement in the number of companies reporting material weaknesses. In year one, 3,801 issuers filed form 10-Ks containing management’s report on ICFR. Of the 3,801 that filed, 598 issuers, or 15.7%, reported that one or more material weaknesses existed in their ICFR as of the reporting date. In year two, of the 3,907 issuers that filed management’s report on ICFR, 402 issuers, or 10.3%, reported ineffective ICFR (see Exhibit 1). Comparing year one to year two, 154 (38%) of the issuers who reported ineffective ICFR in year two had also reported ineffective ICFR in year one.
|| Issuer Population |
All data (throughout article) is based on SEC filings compiled by Audit Analytics as of March 5, 2007.
NATURE OF MATERIAL WEAKNESSES
The most common material weakness in both year one and year two was GAAP misapplication or failure. In fact, the five most common internal control issues leading to material weaknesses reported in year two and year one were identical (see Table 1).
|| Nature of Material Weaknesses |
|Specific Material Weaknesses Identified by Issuers With Ineffective ICFR
# of Issuers
|Year 1 |
# of Issuers
|Accounting rule (GAAP / FASB) application failures
||583 (97.5) |
|Accounting documentation, policy and/or procedures
||555 (92.8) |
|Material and/or numerous auditor / YE adjustments
||297 (49.7) |
|Accounting personnel resources, competency / training
||292 (48.8) |
|Restatement or nonreliance of company filings
||261 (43.6) |
|Information technology, software, security and access issues
||98 (16.4) |
|Restatement of previous 404 disclosures
||75 (12.5) |
|Segregation of duties / design of controls (personnel)
||94 (15.7) |
|Ethical compliance issues with personnel
||16 (2.7) |
|Senior management resources, competency, reliability issues
||17 (2.8) |
|Untimely or inadequate account reconciliations
||83 (13.9) |
|Insufficient or non-existent internal audit function
||5 (0.8) |
|Scope (disclaimer of opinion) or other limitations
||10 (1.7) |
|Management / Board / Audit Committee investigation(s)
||5 (0.8) |
|Ineffective or understaffed audit committee
||7 (1.2) |
|SEC or other regulatory investigations and/or inquiries
||2 (0.3) |
|Remediation of MW identified
||0 (0.0) |
|Inadequate disclosure controls (timely, accurate, complete)
||2 (0.3) |
|Ineffective regulatory compliance issues
||5 (0.8) |
* Among issuers with ineffective ICFR
Table 2 reports in order of decreasing frequency the top five GAAP misapplications or failures. Problems with internal controls associated with tax expense and revenue recognition were the most common GAAP application failures for companies in both year one and year two.
|| GAAP Application Failures in Material Weakness Disclosures |
|Specific GAAP Application Failures Identified by Issuers With Ineffective ICFR
# of Issuers
|Year 1 |
# of Issuers (%)*
|Tax expense / benefit / deferral / other (FAS 109) issues
||170 (29.2) |
|Revenue recognition issues
||168 (28.8) |
|Liabilities, payables, reserves & accrual estimate failures
||123 (21.1) |
|Inventory, vendor & cost of sales issues
||144 (24.7) |
|Accounts / loans receivable, investments & cash issues
||146 (25.0) |
|PPE / Fixed / Intangible assets (FAS 142) value / diminution issues
||96 (16.5) |
|Foreign / related / affiliated / reliance / subsidiary party issues
||58 (9.9) |
|Deferred, stock-based or executive compensation issues
||41 (7.0) |
|Acquisition, merger, disposal or reorganization issues
||53 (9.1) |
|Lease, FAS 5, legal, contingency & commitment issues
||87 (14.9) |
|Financial derivatives / hedging (FAS 133) issues
||44 (7.5) |
|Financial statement / footnote / disclosure issues
||63 (10.8) |
|Consolidation (Fin 46R / Off BS) & foreign currency translation issues
||44 (7.5) |
|Cash flow statement (FAS 95) classification errors
||36 (6.2) |
|Intercompany / Investment with subsidiary / affiliate issues
||24 (4.1) |
|Expense recording issues
||14 (2.4) |
|Capitalization of expenditure issues
||57 (9.8) |
|Lease, leasehold & other FAS 13 (98) issues
||0 (0.0) |
|Depreciation, depletion or amortization issues
||66 (11.3) |
|Debt, quasi-debt, warranties & equity (BCF) securities issues
||32 (5.5) |
|Unspecified / incomplete FASB / GAAP issue identification
||7 (1.2) |
|Balance sheet classification of asset issues
||8 (1.4) |
|Income statement classification, margin & EPS issues
||15 (2.6) |
|Debt &/or equity classification issues
||6 (1.0) |
|Gain or loss recognition issues
||17 (2.9) |
|Defective or unreliable accounting / reporting records
||2 (0.3) |
* Among issuers with ineffective ICFR related to GAAP application failures
CHARACTERISTICS OF COMPANIES WITH INEFFECTIVE ICFR
Our review reveals a number of trends among the material weakness issuers. Companies with lower market capitalizations made up the majority of issuers with ineffective ICFR (see Table 3 ).
|| Market Capitalization Demographics |
||# of Issuers
|Percentage of |
||Year 1 |
|Less than $75 million
|$75 million to less than $700 million
|$700 million to less than $1 billion
|$1 billion to less than $5 billion
|More than $5 billion
Companies with market capitalizations of less than $700 million accounted for 64.4% and 63.4%, respectively, of the 598 year one and 402 year two issuers who had material weaknesses in ICFR. When compared to the total issuer population, a disproportionate number of companies of this size reported ineffective ICFR (see Exhibit 2).
|| Material Weakness Issuers vs. Total Issuers by Market Capitalization |
We next sorted issuers that reported material weakness by their Standard Industrial Classification (SIC) code. The incidence of material weaknesses was concentrated in issuers from a few industries. In both year one and year two, manufacturing companies; service companies; and finance, insurance and real estate companies accounted for more than 70% of the total population of issuers reporting ineffective ICFR (see Exhibit 3). Year one reporting results indicated that more than 15% of the issuers in the retail trade; services; mining; and transportation, communications, electric, gas, and sanitary services industries reported material weaknesses in ICFR.
|| Industry Demographics |
In year two, the incidence of material weaknesses was dispersed across a larger number of industries. The wholesale trade, services, manufacturing, mining, and agriculture, forestry and fishing industries were the only industries where more than 10% of the industry issuers reported material weaknesses. A comparison of the distribution of internal control reports among industries to the rate of material weakness disclosures by industry reveals that in years one and two, the frequency of transportation, communications, electric, gas and sanitary services companies reporting ineffective ICFR was consistent with the percentage of filed reports for that industry.
Companies in the finance, insurance, and real estate industry filed 24.1% and 25.4% of the total 404 reports filed in year one and year two, respectively, but only 16.4% and 14.4% of the reports indicating ineffective ICFR during year one and year two. The data suggest that on average, finance, insurance and real estate companies had more effective ICFR and a lower material weakness reporting rate.
AUDIT FIRM CHARACTERISTICS
If the year one and year two populations of issuers with ineffective ICFR are sorted by audit firm, the data reveal that the Big Four generally provided services to larger issuers that had a lower rate of ineffective ICFR (see Exhibit 4). In year one, the percentage of Big Four clients with ineffective ICFR ranged from 12.6% to 15.5%, while more than 34% of BDO Seidman’s clients and nearly 29% of Grant Thornton’s clients reported ineffective ICFR. These percentages were driven by the underlying distribution of issuers audited by the larger and smaller auditing firms; that is, the non-Big Four firms audited a larger proportion of the smaller issuers, which typically had a higher incidence of material weakness.
| Audit Firm Clients |
Year two showed some shifts in the distribution. The percentage of clients with material weaknesses fell across all audit firms. BDO Seidman’s client base had the highest percentage of ineffective ICFR at 25.0%, with all other firms, including the “Other” group, at 14.9% or less.
USING THE RESULTS
The second year’s section 404 reporting results were promising and indicated that many companies had made significant improvements in ICFR. Although the average number of material weaknesses per issuer that reported ineffective ICFR declined only slightly (from 2.41% to 2.32%), the percentage of issuers reporting material weaknesses decreased by 34.4%, from 15.7% of issuers in year one to 10.3% in year two.
As the compliance deadline for non-accelerated filers approaches, the management teams of those companies can look to year one and year two reporting results to anticipate where in their ICFR systems they will find the most common problems and begin addressing them now. In addition, non-accelerated filers can benefit a great deal from the additional guidance that is available, much of which is based on the experience of accelerated filers. Such guidance includes the Committee of Sponsoring Organization’s Internal Control Over Financial Reporting—Guidance for Smaller Public Companies (see “ Internal Control Guidance: Not Just a Small Matter,” JofA , March 07, page 46), the Institute of Internal Auditors’ Sarbanes-Oxley Section 404: A Guide for Management by Internal Control Practitioners, and the SEC’s proposed guidance Management’s Report on Internal Control Over Financial Reporting.
As the data bear out in our analysis, the incidence of ineffective ICFR is inversely related to issuer size. We anticipate that the incidence of ineffective ICFR could be much higher in the smallest public companies or non-accelerated filers that have yet to report on ICFR. However, non-accelerated filers’ management teams can access the data provided here, along with the voluminous guidance that is now available, to tune their assessments of ICFR and remediate material weaknesses.
Non-accelerated filers should pay particular attention to the most common internal control issues and GAAP application failures reported by accelerated filers and target their ICFR with those and other common weaknesses noted above. This is borne out in the data presented here as the average number of material weaknesses reported per issuer and the total number of material weakness issuers have decreased, but the nature of the material weaknesses and the population of material weakness issuers have remained the same.