In mid-2013, the SEC established the Financial Reporting and Audit Task Force, which in part was formed to spearhead the Division of Enforcement’s efforts to identify securities law violations relating to the preparation of financial statements, issuer reporting and disclosure, and audit failures. The Task Force, working closely with the Division of Corporation Finance and the Office of the Chief Accountant, has since begun to concentrate on matters involving internal control over financial reporting (ICFR), particularly in the absence of disclosure of material weaknesses when a company has not restated its financial statements.
The SEC’s approach, as described by Chair Mary Jo White in remarks at the Securities Enforcement Forum in October 2013 (http://1.usa.gov/1YjCNVF), is fashioned after the “broken windows” policy adopted in New York in the 1990s by then-Mayor Rudolph Giuliani, under which no violation of the law, including breaking a window, was deemed too small to be punished. This policy was based on the notion that enforcement against trivial violations creates a culture of compliance that deters more serious abuses. Chair White has explained that the same theory can be applied to the securities markets (i.e., overlooked or ignored minor violations can lead to bigger ones). In her keynote address to the AICPA National Conference in December 2015, Chair White made it very clear that, in her view, nothing is more important than ICFR in providing high-quality financial information that investors can rely on and that ICFR must remain the strong bulwark of reliable financial reporting that it has become (http://1.usa.gov/1XlOGKz).
The SEC’s Division of Enforcement has followed through on its promise to focus on minor ICFR violations. The SEC recently sanctioned Magnum Hunter Resources Corporation (MHR), two of its officers, and the engagement partner of its auditing firm for the improper assessment of ICFR and for failure to maintain effective ICFR. The SEC alleged that MHR and two of its senior financial officers failed to apply applicable ICFR standards and thus incorrectly concluded that MHR had no material weaknesses. The SEC also charged a former consultant engaged to assist the company’s management with documenting, testing, and evaluating ICFR under the Sarbanes-Oxley Act of 2002 (SOX) and the former MHR audit engagement partner with improperly evaluating the severity of MHR’s internal control deficiencies and misapplying relevant standards for assessing significant deficiencies and material weaknesses and distinguishing between them (http://1.usa.gov/1Ve4CRi).
Specifics of the MHR Enforcement Action
The SOX consultant issued a report that identified a control deficiency concerning inadequate staffing within MHR’s accounting function; the report 1) stated that the deficiency presented “substantial risk,” but 2) concluded, without further explanation, that the deficiency represented a significant deficiency rather than a material weakness. MHR’s CFO and chief accounting officer (CAO) accepted the consultant’s assessment that MHR’s insufficient accounting staffing represented only a significant deficiency. Both the CFO and the CAO also relied on the absence of an actual identified material error in MHR’s financial statements as evidence that a material weakness did not exist, and neither the CFO nor the CAO prepared any documentary evidence to supplement the documentation created by the SOX consultant. Because management concluded that the control deficiency rose only to the level of a significant deficiency, rather than a material weakness, MHR did not publicly disclose the deficiency but instead stated in its Form 10-K that its ICFR was effective as of December 31, 2011.
The audit engagement partner issued a report to MHR’s audit committee that stated: 1) ICFR was not adequate as a result of inadequate and inappropriately aligned staffing in the accounting department; and 2) this factor increased the possibility of a material error occurring and going undetected. Notwithstanding this assessment, the engagement partner also concluded that the control deficiency rose only to the level of a significant deficiency rather than a material weakness.
Moreover, the audit working papers failed to document the engagement partner’s conclusion, nor did they include an explanation of how inadequate ICFR that increased the possibility of a material error occurring and going undetected was not indicative of a material weakness. The engagement partner also relied on the fact that the audit did not reveal any material errors in the financial statements as evidence that the control deficiency did not constitute a material weakness.
The SEC’s Allegations
The SEC alleged that the audit engagement partner did not audit the company’s ICFR in accordance with PCAOB Auditing Standard (AS) 3, Audit Documentation, and AS 5, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements, and improperly approved the issuance of the auditor’s report expressing an unqualified opinion on the company’s ICFR as of December 31, 2011. Specifically, according to the SEC, the engagement partner misapplied the definitions of “significant difference” and “material weakness” in AS 5. The SEC emphasized that the engagement partner’s reliance on the fact that the audit did not uncover any errors in the financial statements was misplaced because, pursuant to AS 5, the severity of a control deficiency does not depend upon whether a misstatement actually occurred, but rather on whether there is a “reasonable possibility” that the company’s controls will fail to prevent or detect a misstatement. The SEC also noted that the audit working papers lacked the proper documentation for the engagement partner’s conclusion that the control deficiency did not rise to the level of a material weakness, citing the requirements in AS 3 that documentation 1) should be prepared in sufficient detail to provide a clear understanding of its purpose, source, and the conclusions reached and 2) must clearly demonstrate that the work was actually performed.
Regarding MHR and its CFO and CAO, the SEC alleged that, while retaining ultimate responsibility for assessing the company’s ICFR and the severity of control deficiencies, the company and its senior management merely accepted the SOX consultant and audit partner’s conclusions that the control deficiency did not constitute a material weakness. In addition, the SEC noted that the company did not prepare any of its own documentation to support such an assessment, as required by Item 308 of Regulation S-K, “Internal Control over Financial Reporting.”
The Significance of the MHR Case
The MHR case is the latest in a series of enforcement cases involving ICFR. It is particularly noteworthy because it centers on a “pure” ICFR violation—it stands on its own without allegations of accounting violations. Moreover, the settlement, which included a $250,000 penalty payable by the company and a one-year suspension of the audit engagement partner from practicing before the SEC, seems to be of the “broken windows” variety. Nevertheless, the MHR case does send a signal that the SEC may be shifting its enforcement emphasis to include ICFR—and ICFR audits—on a standalone basis (i.e., even when other accounting improprieties are not alleged and financial statements are not restated). Moreover, the MHR case is as much about documentation—or, rather, the absence of it—as it is about an improper conclusion concerning whether a control deficiency constitutes a material weakness. Management and auditors alike must be painstaking in documenting their conclusions, as required by AS 3 and Instruction 2 to Item 308 of Regulation S-K.
The MHR case does send a signal that the SEC may be shifting its enforcement emphasis to include ICFR on a stand-alone basis.
In the MHR case, it seems apparent that inadequate staffing in the accounting department was, in fact, a material weakness. In other cases, however, the difference between a significant difference and a material weakness may be less obvious. Hence, whichever conclusion is reached, at the very least proper documentation supporting that conclusion could go a long way in preventing the SEC from second-guessing a company’s reliance on the auditor’s report, particularly when the situation is more nuanced.
The MHR case also drives home the point that issuers are ultimately responsible for maintaining ICFR and evaluating its effectiveness. Simply accepting the conclusions of consultants and auditors will not be sufficient. The final message is that the absence of an error resulting from a control deficiency should not be a factor in concluding that a material weakness does not exist.
