But Better Controls May Not Be the Reason
Audit Analytics (AA) has published SOX 404 Disclosures: A Seventeen-Year Review, its annual report on auditor opinions and management assessments of the effectiveness of internal control over financial reporting (ICFR). AA found that the percentage of companies with management assessments that report ineffective ICFR declined across all company sizes for fiscal year 2020. Accelerated filers had the most significant decline, with nearly 100 fewer adverse control assessments. In addition, fewer ICFR auditor opinions on control effectiveness (which only accelerated filers are required to obtain) were adverse. There were 146 adverse auditor opinions in 2020, 4.6 percent of the ICFR attestations filed, down from 6.9 percent in 2019.
These drops in adverse ICFR assessments do not, however, necessarily signal a sudden improvement in the effectiveness controls. During 2020, the SEC changed its accelerated filer definition to exclude companies with revenue less than $100 million. AA found that 337 companies switched out of accelerated filer status between 2019 and 2020. AA states that “[t]hese companies accounted for a huge portion of the positive trend in control assessments for accelerated filers.”
SOX 404
Section 404 of the Sarbanes-Oxley Act (SOX) requires public company managements to perform and disclose an annual assessment of the effectiveness of the company’s ICFR. Section 404 also requires companies to obtain a report from their external auditor expressing the auditor’s opinion on the effectiveness of the company’s ICFR. For either a management assessment or an auditor’s report, the existence of one or more ICFR material weaknesses means that controls are ineffective and requires the issuance of an adverse assessment or opinion.
In 2010, the Dodd-Frank Act modified the original Section 404 scheme by excluding companies that qualified as non-accelerated filers under the SEC’s rules from the auditor attestation requirement. The JOBS Act of 2012 added an exclusion for emerging growth companies, as defined in that legislation.
The SEC’s accelerated filer definition has changed over time. For many years, any company with a public float of $75 million or more was an accelerated filer for SOX Section 404 purposes; any company with a public float less than $75 million was non-accelerated filer. However, in 2020, the SEC added a revenue test. As a result, companies with between $75 million and $700 million in public float are now accelerated filers only if they also have $100 million or more in revenue. This rule change increased the number of smaller public companies that are exempt from the external audit requirement and are only required to disclose management’s assessment of control effectiveness.
2020 SOX 404 ICFR Effectiveness Disclosures
In 2020, 6,205 management ICFR assessments were filed, down from 6,240 in 2020. There were 3,142 auditor’s reports on ICFR, down from 3,550 the prior year. In 2020, 3,064 companies filed only a management assessment of ICFR, up from 2,691 management assessment-only filers in 2019. With respect to the reporting of ineffective controls in these filings, AA found:
Auditor attestations. “The number of adverse ICFR auditor attestations dropped to 146 in 2020. Since the inception of SOX requirements in 2004, 2020 had the second-lowest number of adverse auditor attestations, after the 139 adverse attestations in 2010. After 2010, there was a six-year upward trend in the number of ineffective ICFR auditor attestations, partially related to oversight activities of the PCAOB and other regulators. The number of adverse auditor attestations represents 4.6% of all auditor attestations filed for the fiscal year 2020, a decrease from the 6.9% seen in 2019. This is the lowest percentage of total reports containing an adverse auditor attestation since 2012.”
Management reports. “The number of adverse ICFR management reports dropped to 1,329 in 2020. This represents 21.4% of all management reports filed for the year, down from 22.4% in 2019. The number of adverse management reports has been steadily declining since a high point of 23.9% in 2014. Between 2013 and 2020, the percentage of adverse management reports has minimally fluctuated between 21.4% and 23.9%.”
Management only reports (i.e., reports filed by companies not required to obtain an auditor’s opinion on ICFR effectiveness). “In 2020, the number of adverse ICFR management-only reports increased to 1,183. This represents 38.6% of all management-only reports filed for the year, down from 42.7% in 2019. The number of companies eligible to file a management-only report under SOX 404(a) increased in 2020, corresponding with amendments to the SEC’s accelerated filer definition that became effective in April 2020.”
In AA’s view, the percentage decline in adverse ICFR management reports from non-accelerated filers reports resulted from the relatively high quality of controls at companies that switched from accelerated to non-accelerated filer status: “[T]he accelerated filers that transitioned to a non-accelerated filer status under the amended definition had already expended resources to establish an effective control system, and they additionally benefited from having an independent auditor review their control systems for deficiencies. Therefore, those companies are more likely to operate with effective controls after their transition * * *.”
Nature of Control Weaknesses and Related Accounting Issues
Adverse auditor’s reports and management assessments are required to describe the reasons controls were ineffective. AA found:
Management reports. In the case of management assessments, the top five 2020 control weaknesses were accounting personnel resources; segregation of duties (personnel); insufficient audit committee; inadequacy disclosure controls; and material/numerous year-end adjustments. The top five accounting issues were debt and warrants; revenue recognition; accounts receivable, investments and cash; subsidiary/affiliate issues; and liabilities. The recording of debt and warrants presumably topped management’s accounting issues list because of the SEC’s April 2021 staff statement addressing whether warrants issued by a SPAC should be classified as equity or a liability.
AA observes that the pandemic had little effect on the issues in adverse ICFR assessments. “The top two internal control issues cited in adverse ICFR management reports in 2020 – issues related to accounting personnel and segregation of duties – have been the top two issues for the previous five years. This illustrates that issues related to personnel are always common for smaller companies, regardless of circumstances arising from an event, such as the pandemic, that could significantly exacerbate existing deficiencies.”
Auditor attestations. In 2020 auditor’s reports, the five most common control weaknesses were material/numerous year-end adjustments; accounting personnel resources; information technology; inadequacy disclosure controls; and segregation of duties (personnel). The top five accounting issues cited in adverse auditor ICFR assessments were revenue recognition; tax expense; liabilities; property, plant, and equipment, intangible or fixed assets; and inventory. Issues related to debt and warrants were sixth.
Comment: Because of the change in the SEC’s definition of accelerated filer, it is difficult to draw any year-over-year conclusions from AA’s 2020 findings. In general, the rate of adverse ICFR audit opinions has declined for companies subject to that requirement since the SOX 404 reporting requirements took effect in 2004. The rate of management adverse opinions has also declined for accelerate filers but, until 2020, has risen for non-accelerated companies. As the Update has noted in the past, the relatively higher, and more constant, level of adverse management assessments at smaller companies may reflect the fact that, without the discipline of an independent ICFR audit, there is less incentive for these companies to correct their control deficiencies. Higher deficiency levels at smaller companies are probably also a structural phenomenon, since smaller companies have fewer resources to devote to controls. See Fifteen Years of SOX 404 Reporting: Adverse ICFR Audit Opinions Rose Last Year, But Remain Below 2005 High, September-October 2019 Update.
Audit committees should bear in mind that, separate from the disclosure and audit requirements of SOX Section 404, the federal securities laws require all public companies to establish and maintain a system of internal accounting control to provide reasonable assurance that (among other things) transactions are recorded as necessary to permit preparation of GAAP financial statements. The SEC frequently charges violations of this requirement in cases involving financial reporting matters. Oversight of the adequacy of internal control is one of the most fundamental responsibilities of a public company audit committee.