Audit Analytics (AA) has released its annual report on Sarbanes-Oxley Act (SOX) Section 404 reporting, SOX 404 Disclosures: An Eighteen-Year Review. AA found that the percentage of companies filing a management assessment that reported ineffective internal control over financial reporting (ICFR) has increased across all company sizes. For fiscal year 2021, 23.7 percent of all management reports were adverse (i.e., reported ineffective controls), up from 21.7 percent in 2020. This is the highest percentage of adverse management assessments since SOX 404 reporting began in 2004. Adverse auditor opinions on control effectiveness also rose in 2021 – from 4.8 percent of all ICFR opinions in 2020 to 5.8 percent in 2021. (Auditor ICFR reporting is only required for larger companies -- accelerated filers -- while all public companies must file a management report.) Despite the increase in 2021, the percentage of adverse auditor reports remained far below its all-time peak of 15.8 percent in 2004.
Lack of qualified accounting personnel was the most frequently cited control issue in adverse ICFR assessments -- 71.5 percent of adverse management assessments and 48.7 percent of adverse auditor assessments identified lack of qualified staff as a cause of ineffective controls. (For a discussion of the last year’s AA report on Section 404 reporting, see Adverse Management Assessments and Auditor Opinions on ICFR Effectiveness are Down, But Better Controls May Not Be the Reason, November-December 2021 Update. Note that statistics for 2020 and earlier years in the current AA report appear to have been adjusted from those appearing in the prior report.)
Background – SOX 404
Section 404 of SOX requires public company managements to perform and disclose an annual assessment of the effectiveness of the company’s ICFR. Section 404 also requires companies to obtain a report from their external auditor expressing the auditor’s opinion on the effectiveness of the company’s ICFR. For either a management assessment or an auditor’s report, the existence of one or more ICFR material weaknesses means that controls are ineffective and requires the issuance of an adverse assessment or opinion.
In 2010, the Dodd-Frank Act modified the original Section 404 scheme by excluding companies that qualified as non-accelerated filers under the SEC’s rules from the auditor ICFR attestation requirement. The JOBS Act of 2012 added an exclusion for emerging growth companies, as defined in that legislation.
The SEC’s accelerated filer definition has changed over time. For many years, any company with a public float of $75 million or more was an accelerated filer; any company with a public float less than $75 million was non-accelerated filer. In 2020, the SEC added a revenue test. As a result, companies with between $75 million and $700 million in public float are now accelerated filers only if they also have $100 million or more in revenue. This rule change increased the number of smaller public companies that are exempt from the ICFR external audit requirement.
2021 SOX 404 ICFR Effectiveness Disclosures
In 2021, 6,731 management ICFR assessments were filed, up from 6,465 in 2020. There were 3,406 auditor’s reports on ICFR, an increase from 3,213 the prior year. In 2021, 3,328 companies filed only a management assessment of ICFR, up from 3,251 management assessment-only filers in 2022. With respect to the reporting of ineffective controls in these filings, AA found:
Management reports. The number of adverse ICFR management reports increased to 1,595 in 2021, up from 1,401 in 2020. As noted above, 23.7 percent of all 2021 management reports were adverse, up from 21.7 percent in 2020. This is the highest percentage of adverse management reports filed since the inception of SOX 404 reporting.
Auditor attestations. The number of adverse ICFR auditor attestations increased to 197 in 2021, up from 153 in 2020. As noted above, 5.8 percent of all attestations were adverse, compared to 4.8 percent in 2020. Since the SOX ICFR reporting requirements took effect in 2004, 2010 had the lowest percentage of adverse auditor attestations (3.5 percent) and 2004 had the highest (15.8 percent).
Management only reports (i.e., reports filed by companies not required to obtain an auditor’s opinion on ICFR effectiveness). In 2021, the number of adverse ICFR management-only reports increased to 1,398. This represents 38.4 percent of all management-only reports filed for the year, down from 41 percent in 2020. The number of companies eligible to file a management-only report under SOX 404(a) increased in 2020, as a result of the rule change (described above) that excluded additional smaller companies from the SEC’s accelerated filer definition.
First-time filers. For companies filing their first management ICFR assessment in 2021, 55.2 percent reported that their controls were ineffective, an all-time high and an increase from 44.4 percent in 2020. AA observes that these companies “are often small with fewer resources to devote to internal controls, contributing to overall higher percentages of ineffective ICFR in the first management assessment.” Similarly, a significant percentage -- 28.4 percent – of first-time auditor ICFR attestations (i.e., opinions filed by companies that had newly become accelerated filers) reported ineffective controls. This was also an all-time high and an significant increase over the 20.9 percent of adverse first-time auditor reports in 2020.
Nature of Control Weaknesses and Related Accounting Issues
Adverse auditor’s reports and management assessments are required to describe the reasons controls were ineffective. AA found:
Management reports. For all reporting companies, the top five 2021 control weaknesses were accounting personnel resources (71.5 percent); segregation of duties (personnel) (58.4 percent); inadequate disclosure controls (25.8 percent); non-routine transaction controls (20.0 percent); and information technology (18.2 percent). For companies filing only a management assessment, the top four weaknesses were the same, except that inadequate audit committee replaced information technology as the fifth most common weakness. The top five accounting issues in adverse management reports were debt and warrants (12.7 percent); revenue recognition (6.5 percent); accounts receivable, investments and cash (6.1 percent); tax expenses (3.9 percent); and expense reporting (2.7 percent). The recording of debt and warrants presumably topped the accounting issues list because of restatements stemming from the SEC’s April 2021 staff statement addressing accounting for debt and warrants issued by special purpose acquisition companies (SPACs). For companies filing only a management assessment, the top five accounting issues were the same.
Auditor attestations. In 2021 auditor’s reports, the five most common control weaknesses were accounting personnel resources (48.7 percent); information technology (44.2 percent); segregation of duties (personnel) (34.5 percent); inadequate disclosure controls (23.9 percent); and material year-end adjustments (14.7 percent). The top five accounting issues cited in adverse auditor ICFR assessments were revenue recognition (20.8 percent); tax expense (13.2 percent); accounts receivable, investments & cash (10.7 percent); acquisitions and mergers (10.2 percent); and property, plant, and equipment, intangibles (9.1 percent).
Comment: In general, the rate of adverse management assessments and ICFR audit opinions has been relatively steady or declining in recent years. The significant increases in 2021 seem to have two primary causes. First, difficulty in hiring qualified accounting personnel and the related challenge of maintaining segregation of duties in the face of staffing shortages had a negative impact on control effectiveness. (Recruiting and retention challenges are of course economy-wide phenomena and are not unique to personnel involving in accounting and controls.) Second, there has been an increase in the number of new reporting companies, likely driven by companies going public through SPAC mergers. As AA points out, these companies typically have fewer resources to devote to controls. Also, as the Update has noted in the past, the relatively higher, and more constant, level of adverse management assessments at smaller companies may reflect the fact that, without the discipline of an independent ICFR audit, there is less incentive for these companies to correct control deficiencies.
Oversight of the adequacy of internal control is one of the most fundamental responsibilities of a public company audit committee. Audit committees may want to reflect on whether frequently cited control weaknesses described in the AA report are affecting their company’s controls and whether any steps should be taken to address these issues. Separate from the disclosure and audit requirements of SOX Section 404, the federal securities laws require all public companies to establish and maintain a system of internal accounting control to provide reasonable assurance that (among other things) transactions are recorded as necessary to permit preparation of GAAP financial statements. The SEC typically charges violations of this requirement in cases involving financial reporting matters.