Ineffective ICFR Ticked Up for the Second Straight Year in 2022
Ideagen Audit Analytics has released SOX 404 Disclosures: A 19-Year Review, its annual analysis of disclosures under Section 404 of the Sarbanes-Oxley Act. AA found that, in FY 2022 the number of companies filing a management assessment that reported ineffective internal control over financial reporting (ICFR) increased for the second straight year – rising from 1,678 in 2021 to 1,740 in 2022, a 4 percent increase. Nearly one quarter (24.4 percent) of public companies reported that their controls were not effective. Since the reporting universe grew, the percentage of companies that filed an adverse ICFR disclosure during FY2022 was however slightly lower than in the prior year. The number of ICFR disclosures filed by special purpose acquisition companies (SPACs) seems to be a large factor in the increasing number of adverse ICFR disclosures. AA notes that SPACs comprised nearly 40 percent of all first-time adverse ICFR disclosures in FY2022.
AA also found that the total number of adverse ICFR auditor attestations rose to 257 in FY2022, a 21 percent increase over 2021. (Auditor ICFR reporting is only required for larger companies -- accelerated filers -- while all public companies must file a management report on ICFR effectiveness.) The percentage of companies subject to the audit requirement that received an adverse ICFR auditor attestation during FY2022 rose from 6.2 percent in 2021 to 7.6 percent, the highest rate since 2007. Despite the increase in 2022, both the number and percentage of adverse auditor reports remained far below their all-time peaks of 489 adverse auditor reports in 2005 and 15.8 percent of all auditor reports issued in 2004.
For a discussion of last year’s AA report on Section 404 reporting, see Ineffective ICFR is More Common; Staff Shortages May be the Cause, August 2022 Update. That item also contains a background description of the Section 404 reporting requirement. In comparing the 2022 report to prior AA reports, it should be noted that AA appears to have adjusted the statistics for 2021 and earlier years in the current report from those that originally appeared in those reports.
2022 SOX 404 ICFR Effectiveness Disclosures
In 2022, 7,139 management ICFR assessments were filed, up from 6,826 in 2021. There were 3,375 auditor’s reports on ICFR, a decrease from 3,409 the prior year. In 2022, 3,701 companies filed only a management assessment of ICFR, up from 3,419 management assessment-only filers in 2021. With respect to the reporting of ineffective controls in these filings, AA found:
Management reports. The number of adverse ICFR management reports increased to 1,740 in 2022, up from 1,678 in 2021. As noted above, 24.4 percent of all 2022 management reports were adverse, down slightly from 24.6 percent in 2021.
Auditor attestations. The number of adverse ICFR auditor attestations increased to 257 in 2022, up from 213 in 2021. 7.6 percent of all attestations were adverse, compared to 6.2 percent in 2021. Since the SOX ICFR reporting requirements took effect, 2010 had the lowest percentage of adverse auditor attestations (3.5 percent) and 2004 had the highest (15.8 percent).
Management only reports (i.e., reports filed by companies not required to obtain an auditor’s opinion on ICFR effectiveness). In 2022, the number of adverse ICFR management-only reports increased to 1,477. This represents 39.9 percent of all management-only reports filed for the year, down from 42.7 percent in 2021. The number of companies that filed a management-only in 2022 was 3,701 and increase from 3,419 in 2021.
First-time filers. For companies filing their first management ICFR assessment in 2022, 41.8 percent reported that their controls were ineffective, a decrease from 61.9 percent in 2020. AA observes that on average, “an ICFR disclosure is three times more likely to be classified as an adverse disclosure during a first-time assessment.” Similarly, 28 percent of first-time auditor ICFR attestations (i.e., opinions filed by companies that had newly become accelerated filers) reported ineffective controls. This was a decrease from the all-time high of 29.6 percent of adverse first-time auditor reports in 2021.
Nature of Control Weaknesses and Related Accounting Issues
Adverse auditor’s reports and management assessments are required to describe the reasons controls were ineffective. In FY2022, the most common internal control issue cited as contributing to ineffective ICFR in management reports was the need for more highly trained accounting personnel. The most common issue cited in adverse auditor reports was information technology, software, and/or security issues. Other findings of interest include:
Management reports. In management reports, the top five contributors to ineffective controls in 2022 were inadequate accounting personnel resources (cited in 67.6 percent of adverse reports); insufficient segregation of duties/personnel (cited in 57.8 percent of adverse reports); inadequate disclosure controls (cited in 35.8 percent of reports); information technology (cited in 22.4 percent of reports), and non-routine transaction controls (cited in 16.7 percent of reports). For companies filing only a management assessment, the top three issues were the same, but an inadequate audit committee replaced information technology as the fourth most referenced weakness.
The top five accounting issues in adverse management reports were deficiencies in approach, understanding, or calculation associated with revenue recognition (cited in 9 percent of adverse disclosures); debt and equity (cited in 8.3 percent of disclosures); accounts receivable, investments and cash (cited in 6.8 percent of disclosures); subsidiary/affiliate issues (cited in 5.5 percent of disclosures); and liabilities (cited in 5.4 percent of disclosures). For companies filing only a management assessment, the top five accounting issues were the same, although debt and equity issues came in first while revenue recognition was second. The frequency of ICFR challenges related to debt v. equity accounting presumably stems from the substantial number of SPACs that restated their financials to correct the accounting for debt and warrants.
Auditor attestations. In 2022 adverse auditor’s reports, the five most frequently referenced sources of control weaknesses were information technology (cited in 54.5 percent of disclosures); accounting personnel resources (cited in 53.7 percent of disclosures); inadequate disclosure controls (cited in 39.7 percent of disclosures); segregation of duties) (cited in 39.3 percent of disclosures); and non-routine transactions (cited in 14.4 percent of disclosures ). The top five accounting issues cited in adverse auditor ICFR assessments were revenue recognition (23.3 percent); accounts receivable, investments and cash (12.1 percent); inventory, vendor, cost of sales (11.7 percent); long-term assets (11.7 percent); and liabilities (10.1 percent).
Comment: The increases in the number of adverse management and auditor ICFR reports seem to have two primary causes. First, difficulty in hiring qualified accounting personnel and the related challenge of maintaining segregation of duties in the face of staffing shortages had a negative impact on control effectiveness. See, e.g., Material Weaknesses are Increasing and an Accountant Shortage May Be to Blame, August-September 2023 Update. Second, there has been an increase in the number of new reporting companies, driven by the popularity of SPACs. These companies typically have fewer resources to devote to controls.
Oversight of the adequacy of internal control is one of the most fundamental responsibilities of a public company audit committee. Audit committees may want to probe whether frequently cited control weaknesses described in the AA report are affecting their company’s controls. Separate from the disclosure and audit requirements of SOX Section 404, the federal securities laws require all public companies to establish and maintain a system of internal accounting control to provide reasonable assurance that (among other things) transactions are recorded as necessary to permit preparation of GAAP financial statements. The SEC typically charges violations of this requirement in cases involving financial reporting matters. See SEC Accounting Enforcement Continues Apace, July 2023 Update.