Disclosure requirements of Section 404 of the Sarbanes-Oxley Act (SOX 404) haven’t been the smoothest of regulatory sailings over the past 12 years, and a new report by research firm Audit Analytics makes that clear.
Indeed, SOX 404 Disclosures: A 12-Year Review refers to a comment by Public Company Accounting Oversight Board (PCAOB) member Jeanette Franzel last year that “we continue to see significant challenges with internal controls over financial reporting (ICFR) across the system.”
SOX 404, after all, is all about those internal controls, thanks to the debacles of Enron and WorldCom. Since late 2004, SOX 404 has been a disclosure requirement first for accelerated filers that must have independent auditors attest to management’s assessment of ICFRs. Three years later, nonaccelerated filers were required to file. They, however, only file management assessments of ICFRs. The Dodd-Frank Act removed the auditor-attestation requirement for nonaccelerated filers.
A number of oversight and regulatory bodies play key roles in ICFR issues. In 2013, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) published a new standard, Internal Control – Integrated Framework, intended to help organizations better handle internal controls in the face of changing business environments and to clarify what effective ICFRs actually are.
The US Securities and Exchange Commission (SEC) and the PCAOB also keep watch, and this year, SEC Chief Accountant James Schnurr publicly stated that both agencies “encourage regular discussions between management, auditors, and audit committees on existing and emerging issues in assessments of ICFR.”
So, all that said, how’s everyone doing? Here’s a snapshot from the report.
- In the first auditor attestations filed by accelerated filers for fiscal year 2004, 15.7 percent disclosed ineffective ICFRs. That decreased in each year that followed to a low of 3.4 percent for FY 2010. But in 2010 and 2011, the PCAOB stepped into the picture to see if audits were getting sufficient evidence to substantiate auditor attestations of management’s assessment of the ICFRs.
- The PCAOB’s action apparently changed things. Disclosure of ineffective ICFRs increased after 2010, reaching a most-recent high of 5.8 percent for FY 2014. In FY 2015, that dropped to 5.3 percent – still higher than in earlier years.
- The top two reasons why auditors attest to inadequate ICFRs: numerous and/or material year-end adjustments and the need for more highly trained accountants.
- For FY 2015, revenue recognition issues were the most common accounting reason for ineffective ICFRs.
- Historically, more than 30 percent of small companies have ineffective ICFRs. That’s much higher than the 5.8 percent disclosed by large companies.
- The first improvement came in FY 2015, when the percentage of disclosures of ineffective ICFRs dropped from 40.48 percent to 36.07 percent – still higher than all prior years and higher than rates disclosed by large companies.
- Persistent percentages of more than 30 percent indicate the difficulties that small companies face in having adequate financial systems and processes.
- FY 2015 indicated that the most common ICFR problems for small companies involved the competency and training of accountants.
- The most common accounting reason for ineffective ICFRs in FY 2015 involved accounts/loan receivable problems.