Corporate America has cut the number of internal control weaknesses it reports under Section 404 of the Sarbanes-Oxley Act by nearly 45 percent in the three years since SOX went into effect, a dramatic demonstration that companies are learning to tighten their financial reporting processes.
Likewise, the number of adverse Section 404 opinions from external auditors is marching downward too, even as more companies comply with the law.
Exclusive Compliance Week research shows a total of 624 “unique adverse disclosures”—that is, either companies or their auditors reporting weaknesses under Section 404—were made in the first year of Section 404 compliance. That number fell to 390 in the second year, and only 348 through most of the third year—a drop of 44.2 percent.
The data comes from Audit Analytics, which tracks data on corporate filings from more than 9,700 public registrants. Each Section 404 “compliance year” starts on Nov. 15, so the first year runs from Nov. 15, 2004, to Nov. 14, 2005. Statistics for the third year of compliance only run from Nov. 15, 2006, to Oct. 11, 2007.
Companies are citing the same primary problems—poor accounting documentation, inadequate personnel, and year-end or auditor adjustments—year after year in their Section 404 disclosures. For example, 93.3 percent of disclosures in the first year of compliance mentioned accounting documentation, as did 99.4 percent of disclosures made this year. But the total number of disclosures that cited accounting documentation fell from 501 to 172. (For disclosures by specific type of weakness, Year 3 data is only available from Nov. 15, 2006 to May 31, 2007, but most companies file their annual statements by then.)
A spreadsheet tracking the number and types of Section 404 disclosures made in the last three years can be downloaded from the box at right. Compliance Week also has more detailed information available for nine specific industries, as part of its Financial Reporting & Internal Control Benchmarking Report project.
Cheffers
Mark Cheffers, chief executive of Audit Analytics, says adverse auditor opinions of internal controls are clearly heading down. In Year Two, for example, auditors filed a total of 3,791 opinions on Section 404 controls, and 390 of them were adverse. This year, auditors filed 4,051 opinions, but only 348 were adverse.
The adverse opinions cited documentation, personnel, and year-end adjustments as the top problems for Year Three. But that is a marked change from two years ago, when restatements were cited in more than half of all adverse opinions. This year, that number has fallen to 19.7 percent.
Cheffers says that is another strong indicator of improved financial reporting processes.
“Implementing Section 404 has resulted in a lot of companies identifying financial reporting errors long before year-end and correcting them, so they don’t have to get adverse opinion,” he says. “Identifying and correcting errors has become much more of a year-round process.”
That has led to a decline in the types and number of issues mentioned in adverse auditor opinions across the board, Cheffers says.
“In almost all categories from Year Two to Year Three, we’re looking at declines in the types and number of issues,” he adds. For example, in Year Two, 30.5 percent of all adverse opinions identified a revenue recognition problem; this year, that number has fallen to 21.2 percent. Problems with inventory and vendors fell from 26.2 percent last year to 17.2 percent this year.
Now, Cheffers says, the primary driver of adverse auditor opinions seems to be material year-end adjustments, either by the company or the auditor. That problem was cited in 60 percent of adverse opinions filed through Oct. 11 of this year. It also surfaced in 71.7 percent of all management disclosures—up from 53.4 percent in Year One, and the only large problem that is becoming more frequent over time.
Enter the Non-Accelerated Filers
The numbers released so far paint a healthy picture for Corporate America. But observers say things could look decidedly different one year from now, as non-accelerated filers—those companies will less than $75 million in market capitalization—start complying with Section 404 for the first time. They are scheduled to begin filing management statements about internal controls for fiscal years ending on or after Dec. 15, 2007. Their external auditor attestations will start one year later.
“I expect the number of adverse 404 reports to increase dramatically once smaller public companies enter the picture,” says Bob Benoit, a partner at Lord & Benoit, an accounting firm that does SOX work for small and mid-sized companies.
Indeed, at a conference on SOX compliance in September, Josh Jones, professional practice fellow at the Securities and Exchange Commission, noted that while large filers have made “significant improvement” in internal controls, 60 percent of companies reporting material weaknesses this year had less than $500 million in revenue. That trend has held steady for all three years.
Benoit attributes that to small companies’ wishful thinking that after several years of delay, Section 404 compliance would somehow just never come to pass. “Almost none of the smaller public companies have done any SOX work,” he says. “With all of the delays, the perception was that ‘delay’ meant maybe they wouldn’t have to do it,” he says.
404 DISCLOSURES
Below is a summary of unique adverse disclosures under Section 404 in the first three years of compliance for large accelerated filers.
Disclosures
Year 1
624
Year 2
390
Year 3
348*
* Year 3 data through Oct. 11, 2007 only.
Source: Compliance Week Research Dept.
Benoit estimates that only about 20 percent of non-accelerated filers have begun work on Section 404 compliance, and most of that has only been creating policies and procedures, not working on their controls. Even if non-accelerated filers identify and fix a control weakness now, he says, it’s so late in the year that most likely, the control won’t be operating effectively long enough to be reliable. That means it will need to be reported as a material weakness.
Earlier this year, Lord & Benoit published a study of the causes of material weaknesses at small companies (under $100 million in revenue). The main problem was weak accounting and disclosure controls stemming from misapplication of Generally Accepted Accounting Principles.
Benoit says one common misconception among smaller companies is that they will automatically get an adverse opinion if they don’t have proper segregation of duties. Not necessarily, he says.
“Segregation of duties is a preventive control, but it’s just one form of control,” Benoit says. “Even if they have poor segregation of duties, companies can have compensating controls and detective controls that can show whether controls are operating effectively without the segregation of duties.”
But, he says, that process should be done early—as in, long before now. “I can’t even imagine how much of a mess it’s going to be,” he says.
Zecca
Anthony Zecca, a partner at auditing firm Cohn Consulting, agrees that the number of weakness disclosures “is likely to go up substantially” when non-accelerated filers start filing Section 404 reports. Like Benoit, Zecca says a lot of non-accelerated filers “are just continuing to bury their heads in the sand and doing the absolute minimum.”
“They're missing a golden opportunity the SEC has given them,” Zecca says. That opportunity is the coming year of Section 404 compliance when companies must report on internal controls but do not have external auditors double-checking their work. “They essentially have a year to get their act together where there’s no foul if things aren’t so good.”
No comments yet