While compliance experts—and regulators—are often heard advising companies to disclose early and often, when it comes to their Section 302 quarterly reports, it appears that many companies have ignored that advice.
However, a surge in the number of companies filing ineffective Section 302 reports may suggest that such disclosure is improving, according to at least one expert.
While Section 302 is best known for requiring the principal executive and financial officers to certify in the annual and quarterly reports that the company’s filings are truthful and reliable, among other things, it also requires the company to self-report quarterly whether its disclosure controls are effective or not.
An analysis by research firm Audit Analytics of reports filed by public registrants with current revenue in excess of $10 million shows much higher incidence of ineffective disclosure-control reporting under Section 302 of Sarbanes-Oxley during the last two years, even though the requirement has been in effect since the fourth quarter of 2002.
Cheffers
An ineffective disclosure control means that a company has identified some deficiency in its ability to report its financials properly, explains Audit Analytics chief executive Mark Cheffers, who says such problems “can be small or can be significant.”
Early on, Cheffers says, most companies didn’t disclose such deficiencies in their disclosure controls and instead took a “band aid” approach. “They made a quick fix and didn’t address the real underlying control issue,” he says.
Others downplayed the significance of any issues they did bother to report. For example, Cheffers says, “A report might say, ‘By the way, we have an issue with consolidating our results from our foreign subsidiaries and we’re fixing it.’ Later, we’d find out that the issue was that the foreign subsidiary management was stealing from the company and they have to restate.”
In the last quarter of 2002, only 27 of the 4,853 companies in Audit Analytics‘ research group—that is, less than 1 percent—reported ineffective disclosure controls. That number remained well below 100 until the third quarter of 2004, when it hit 112, and then soared past 400 in the following quarter. [See the Related Resources box, above right, for details.]
In 2003, just 99, or less than 2 percent, of the 5,333 total Section 302 filings among the sample studied included ineffective 302 reports. In 2004, the number of ineffective 302 reports grew to 474 out of 5,627 filings. For 2005, 860 of 5,830 reports filed cited ineffective disclosure controls.
Cheffers says the increase implies that “this disclosure requirement [is] getting to where it should be.”
“There was almost no real understanding of what ineffective section 302 disclosure controls meant when the requirement first came about,” he says. “More companies [are] starting to understand what the requirements are with respect to reporting ineffective 302s. It’s an education process.”
Remediation-Disclosure Rules Confusing
Cheffers and others say at least part of the problem has been a lack of guidance about what having ineffective disclosure controls means.
“The rules around disclosing the remediation of significant deficiencies and material weaknesses not yet reported under Section 404 are confusing,” says Tim Leech, principal consultant and chief methodology officer at Paisley Consulting. “Not even a well-intended person could know what they’re supposed to disclose.”
For example, he says, “Companies are supposes to disclose whenever a significant change in control occurs, but there’s no guidance as to what that means.”
302 WEAKNESSES
The percentage of companies disclosing ineffective Section 302 controls in recent years.
Year
No. of Ineffective Disclosures
Material Weaknesses Cited In Explanation
Total Section 302 Filings
Percentage Of Ineffective Controls
2003
99
100
5,333
1.8 percent
2004
474
480
5,627
8.4 percent
2005
860
872
5,830
14.7 percent
Audit Analytics Research Update (October 2006; Provided Exclusively To Compliance Week)
Not surprisingly, the jump in reports of ineffective Section 302 reports coincides with the time period when accelerated filers started filing reports on their internal controls over financial reporting under Section 404.
“Once they disclose a material weakness in their 404 report, at a minimum, the company has to talk about remediation in their 302 reports,” says Leech, who expects another spike in ineffective disclosure control reports when non-accelerated filers eventually become subject to Section 404.
Prior to the first Section 404 deadline, Cheffers says, companies weren’t treating a material weakness or a significant deficiency in their internal controls as an ineffective control disclosure under 302.
“We should’ve seen far more ineffective 302 reports prior to the first round of adverse 404 reports,” he says. In most cases, an adverse report on their internal controls over financial reporting means a company also had an ineffective disclosure control, says Cheffers. While it’s possible to have ineffective disclosure controls and not have an adverse report under 404 and vice versa, he says such scenarios don’t happen often.
Leech says parts of Section 302 have been “widely ignored, since there’s no policeman per se,” adding that companies didn’t pay attention “because nobody felt that there were a lot of consequences for not following Section 302 before their first 404 anniversary date.”
Leech
Leech says there is still “rampant confusion” about the distinction between internal controls over financial reporting and disclosure controls. “People have a hell of a time breaking the two apart,” he says.
Many companies have ignored advice that, “when in doubt, disclose early and let the market deal with it,” Leech says. As evidence, he points to a 2005 report by Glass, Lewis & Co., which found that nearly every company that reported a deficiency under 404 had previously signed off on the 302 certification that their internal controls were operating effectively.
Shift In Philosophy
Cheffers says the increasing number of ineffective 302 disclosures signifies a shift in the philosophy among many major corporations. “They’re saying, ‘If we identify something, we’re better off putting it out there and cleaning it up before it becomes a big problem,’” he says.
Still, he says the number of ineffective 302s will climb higher before it eventually levels off. “Companies are still coming to grips with the philosophy that they’re better off disclosing than not,” says Cheffers. “It’s a hard sell.”
So far this year, he says about 930 registrants have reported an ineffective disclosure control under Section 302. That number is likely to reach 1,000 by the end of the year, up from 860 last year.
“There’s a real distribution in what constitutes an ineffective 302 report, but revenue recognition is at the top of the list,” says Cheffers, who notes that the reasons cited for ineffective 302 reports are similar to those cited in companies’ 404 reports.
So far this year, 233 registrants, about 25 percent, have cited revenue-recognition issues. In terms of magnitude, he says revenue-recognition matters tend to attract the most attention from investors.
Almost the same number (224) cited accounts payable accrual failures, while 181 companies cited tax issues, and 175 registrants reported inventory cost issues. A whopping 729 registrants indicated personnel inadequacies as part of their 302 reporting, while 161 (about 17 percent) cited issues related to deferred stock-based compensation, and 16 percent had deficiencies in their controls related to the reporting of fixed and intangible assets. Other issues include beneficial conversion features, cash flow statement errors, and financial derivatives.
Cheffers says more companies are reporting issues or actions related to IT systems or software. So far, 266 have reported some sort of issue or action related to IT software-security issues.
No comments yet