At the request of subscribers, Compliance Week has launched a Remediation Center, in which readers can submit questions—anonymously—to securities and accounting experts. Compliance Week's editors will review all questions and then submit them—confidentially, of course—to specialists who can address the issues. The questions and responses will then be reprinted in a future edition of Compliance Week. Below is one of the Q&As; ask your own questions by clicking here.
THE QUESTION
Anonymous —
A December 13 article referenced that significant deficiency remediation status needs to be reported to the SEC in accordance with Section 302 of SOX; however, that assumes a "significant deficiency" meets your disclosure materiality threshold. Am I mistaken, or is there language in Section 302 that requires a significant deficiency to be reported to the SEC?
FIRST ANSWER
Tim Leech, Paisley Consulting —
Yes, there is language in the Act that would appear to indicate that this is required.
Section 302(a)(6) states "the signing officers have indicated in the report whether or not there were significant changes in internal controls or other factors that could significantly affect internal controls subsequent to the date of their evaluation, including any corrective actions with regard to significant deficiencies and material weaknesses".
It isn't clear whether this requirement only applies to events that happen after the evaluation date, or apply to all remediation steps that occur related to any significant deficiencies or material weaknesses that have been identified. It wouldn't appear to make sense to publicly disclose remediation efforts on significant deficiencies if the public has never been told what they are, regardless of whether the event occurred after the evaluation date.
Because of the confusion it is critical that you check with your legal advisors on this issue. Legal advice is particularly appropriate because the guidance issued by the SEC related to Section 404 does not require that you disclose the existence of significant deficiencies. Only material weaknesses must be disclosed under section 404.
The Financial Executive Research Foundation study I conducted with Professor Parveen Gupta on control deficiency filing trends for FERF in 2004 revealed that many companies are, in fact, reporting remediation efforts on significant deficiencies, perhaps in accordance with the section quoted above.
One school of thought holds that when confused by a law and/or regulation, disclose on the side of caution. There are no penalties I am aware of for over disclosing control issues or remediation efforts (again: check with your legal advisors since they may not subscribe to this school of thought).
From a very pragmatic perspective, since no one actually audits for compliance with Section 302, the chances of negative consequences because of noncompliance with Section 302 in the absence of a major corporate governance problem emerging appears remote. We know for example that only a small percentage of companies have identified which employees in the company meet the definition of playing a "significant role" in their controls.
Without knowing who these people are it is difficult to see how their can be high assurance that any fraud they are suspected of committing, "regardless of materiality" will be reported to the Audit Committee and External Auditor as required by section 302(a)(5)(B). External Auditors are not required to report known violations of section 302 as far as I know (again: check with your legal advisors)
SECOND ANSWER
Lehigh Univ. Professor Parveen Gupta —
I totally agree with Tim's interpretation [above].
There is nowhere in the [Sarbanes-Oxley] Act or the SEC Final Rules anything that says that to disclose a remediation action pertaining to a significant deficiency, it must meet some disclosure materiality threshold.
Morover, as per the definitions of "more than inconsequential" and "more than remote" the threshold for disclosing the significant deficiencies (if it were the rule) would be extremely low. Thus it would be very difficult to justify non-disclosure of any significant deficiencies and consequently the related remediation actions.
Note: Compliance Week's Remediation Center is an information service only. Answers to questions should not be construed to be legal guidance. Consult with your auditors, internal counsel, and external counsel on all critical compliance and governance matters.
Click here to submit an anonymous question in Compliance Week's Remediation Center.
No comments yet