Two Years and Counting

A review of Sarbanes-Oxley section 404 reporting

by Kathryn E. Scarborough and Mark H. Taylor

EXECUTIVE SUMMARY

This article examines the first two years of section 404 reporting data to determine whether section 404 has accomplished its intended purpose and what small companies can learn from the experience of large companies that have implemented section 404 requirements. The number of companies reporting material weaknesses in their internal controls over financial reporting (ICFR) went from 15.7% the first year to 10.3% the second year. The nature of material weaknesses, the most common of which was GAAP misapplication or failure, remained the same. Smaller companies reported disproportionately higher numbers of ICFR deficiencies in both years, which were also reflected in a disproportionately higher number of ICFR deficiencies among clients of audit firms that primarily audited smaller companies. Issuers in the retail and service sectors were most likely to have ineffective ICFR while construction and finance, insurance and real estate were the least likely to report material weaknesses in ICFR. Research shows that companies that have implemented section 404 are less likely to restate results. Restatements among companies that implemented section 404 declined 14% in 2006 while restatements by companies not yet required to comply with section 404 (non-accelerated filers) rose 40%. Large companies can use findings in this article to further improve their ICFR and small companies can use the findings to target their ICFR efforts toward areas, such as GAAP misapplication and failure in tax expense and revenue recognition, that are at highest risk for material weaknesses. Kathryn E. Scarborough, CPA, is a general business specialist in the Office of the Chief Accountant of the SEC. Mark H. Taylor, CPA, Ph.D., is the John P. Begley Endowed Chair in Accounting at Creighton University, Omaha, Neb. Their e-mail addresses are katie.scarborough@gmail.com and mhtaylor@creighton.edu, respectively. The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by any of its employees. The views expressed herein are those of the authors and do not necessarily reflect the views of the commission or of the author’s colleagues on the staff of the commission.

ust two paragraphs out of a 66-page law, section 404 of the Sarbanes-Oxley Act created one of the most controversial regulatory requirements since the wave of securities regulations following the stock market crash of 1929. The first-year implementation of new requirements for public companies’ internal control over financial reporting (ICFR) proved more burdensome and costly than expected, resulting in an outcry from corporate America.

With two full years of ICFR reporting data now available, we ask the question, has section 404 improved the quality of ICFR? What can small public companies (non-accelerated filers) that are preparing to comply with section 404 for the first time gain from the experience of large companies? Our review is a first step toward answering such questions.

OVERALL IMPROVEMENT
Second-year results show that companies have learned from their first year’s experience, marking clear overall improvement in the number of companies reporting material weaknesses. In year one, 3,801 issuers filed form 10-Ks containing management’s report on ICFR. Of the 3,801 that filed, 598 issuers, or 15.7%, reported that one or more material weaknesses existed in their ICFR as of the reporting date. In year two, of the 3,907 issuers that filed management’s report on ICFR, 402 issuers, or 10.3%, reported ineffective ICFR (see Exhibit 1). Comparing year one to year two, 154 (38%) of the issuers who reported ineffective ICFR in year two had also reported ineffective ICFR in year one.

Issuer Population All data (throughout article) is based on SEC filings compiled by Audit Analytics as of March 5, 2007.

NATURE OF MATERIAL WEAKNESSES
The most common material weakness in both year one and year two was GAAP misapplication or failure. In fact, the five most common internal control issues leading to material weaknesses reported in year two and year one were identical (see Table 1).

Nature of Material Weaknesses Specific Material Weaknesses Identified by Issuers With Ineffective ICFR Year 2  # of Issuers  (%)* Year 1  # of Issuers  (%)* Accounting rule (GAAP / FASB) application failures 397 (98.8) 583 (97.5) Accounting documentation, policy and/or procedures 396 (98.5) 555 (92.8) Material and/or numerous auditor / YE adjustments 355 (88.3) 297 (49.7) Accounting personnel resources, competency / training 234 (58.2) 292 (48.8) Restatement or nonreliance of company filings 185 (46.0) 261 (43.6) Information technology, software, security and access issues 86 (21.4) 98 (16.4) Restatement of previous 404 disclosures 63 (15.7) 75 (12.5) Segregation of duties / design of controls (personnel) 60 (14.9) 94 (15.7) Ethical compliance issues with personnel 24 (6.0) 16 (2.7) Senior management resources, competency, reliability issues 19 (4.7) 17 (2.8) Untimely or inadequate account reconciliations 18 (4.5) 83 (13.9) Insufficient or non-existent internal audit function 7 (1.7) 5 (0.8) Scope (disclaimer of opinion) or other limitations 7 (1.7) 10 (1.7) Management / Board / Audit Committee investigation(s) 6 (1.5) 5 (0.8) Ineffective or understaffed audit committee 5 (1.2) 7 (1.2) SEC or other regulatory investigations and/or inquiries 2 (0.5) 2 (0.3) Remediation of MW identified 2 (0.5) 0 (0.0) Inadequate disclosure controls (timely, accurate, complete) 1 (0.2) 2 (0.3) Ineffective regulatory compliance issues 1 (0.2) 5 (0.8) * Among issuers with ineffective ICFR

Table 2 reports in order of decreasing frequency the top five GAAP misapplications or failures. Problems with internal controls associated with tax expense and revenue recognition were the most common GAAP application failures for companies in both year one and year two.

GAAP Application Failures in Material Weakness Disclosures Specific GAAP Application Failures Identified by Issuers With Ineffective ICFR Year 2  # of Issuers  (%)* Year 1  # of Issuers  (%)* Tax expense / benefit / deferral / other (FAS 109) issues 140 (35.3) 170 (29.2) Revenue recognition issues 128 (32.3) 168 (28.8) Liabilities, payables, reserves & accrual estimate failures 113 (28.5) 123 (21.1) Inventory, vendor & cost of sales issues 105 (26.4) 144 (24.7) Accounts / loans receivable, investments & cash issues 100 (25.2) 146 (25.0) PPE / Fixed / Intangible assets (FAS 142) value / diminution issues 71 (17.9) 96 (16.5) Foreign / related / affiliated / reliance / subsidiary party issues 62 (15.6) 58 (9.9) Deferred, stock-based or executive compensation issues 57 (14.4) 41 (7.0) Acquisition, merger, disposal or reorganization issues 49 (12.3) 53 (9.1) Lease, FAS 5, legal, contingency & commitment issues 45 (11.3) 87 (14.9) Financial derivatives / hedging (FAS 133) issues 46 (11.6) 44 (7.5) Financial statement / footnote / disclosure issues 41 (10.3) 63 (10.8) Consolidation (Fin 46R / Off BS) & foreign currency translation issues 38 (9.6) 44 (7.5) Cash flow statement (FAS 95) classification errors 31 (7.8) 36 (6.2) Intercompany / Investment with subsidiary / affiliate issues 31 (7.8) 24 (4.1) Expense recording issues 28 (7.1) 14 (2.4) Capitalization of expenditure issues 26 (6.5) 57 (9.8) Lease, leasehold & other FAS 13 (98) issues 26 (6.5) 0 (0.0) Depreciation, depletion or amortization issues 24 (6.0) 66 (11.3) Debt, quasi-debt, warranties & equity (BCF) securities issues 23 (5.8) 32 (5.5) Unspecified / incomplete FASB / GAAP issue identification 15 (3.8) 7 (1.2) Balance sheet classification of asset issues 7 (1.8) 8 (1.4) Income statement classification, margin & EPS issues 6 (1.5) 15 (2.6) Debt &/or equity classification issues 5 (1.3) 6 (1.0) Gain or loss recognition issues 4 (1.0) 17 (2.9) Defective or unreliable accounting / reporting records 0 (0.0) 2 (0.3) * Among issuers with ineffective ICFR related to GAAP application failures

CHARACTERISTICS OF COMPANIES WITH INEFFECTIVE ICFR
Our review reveals a number of trends among the material weakness issuers. Companies with lower market capitalizations made up the majority of issuers with ineffective ICFR (see Table 3).

Market Capitalization Demographics   # of Issuers With Ineffective ICFR Percentage of Issuers With Ineffective ICFR Market Capitalization Year 2 Year 1 Year 2 Year 1 Less than $75 million 37 101 9.2 16.9 $75 million to less than $700 million 218 284 54.2 47.5 $700 million to less than $1 billion 26 40 6.5 6.7 $1 billion to less than $5 billion 71 112 17.7 18.7 More than $5 billion 26 30 6.5 5.0 Not provided 24 31 6.0 5.2 Total 402 598 100.0 100.0

Companies with market capitalizations of less than $700 million accounted for 64.4% and 63.4%, respectively, of the 598 year one and 402 year two issuers who had material weaknesses in ICFR. When compared to the total issuer population, a disproportionate number of companies of this size reported ineffective ICFR (see Exhibit 2).

Material Weakness Issuers vs. Total Issuers by Market Capitalization

We next sorted issuers that reported material weakness by their Standard Industrial Classification (SIC) code. The incidence of material weaknesses was concentrated in issuers from a few industries. In both year one and year two, manufacturing companies; service companies; and finance, insurance and real estate companies accounted for more than 70% of the total population of issuers reporting ineffective ICFR (see Exhibit 3). Year one reporting results indicated that more than 15% of the issuers in the retail trade; services; mining; and transportation, communications, electric, gas, and sanitary services industries reported material weaknesses in ICFR.

Industry Demographics

In year two, the incidence of material weaknesses was dispersed across a larger number of industries. The wholesale trade, services, manufacturing, mining, and agriculture, forestry and fishing industries were the only industries where more than 10% of the industry issuers reported material weaknesses. A comparison of the distribution of internal control reports among industries to the rate of material weakness disclosures by industry reveals that in years one and two, the frequency of transportation, communications, electric, gas and sanitary services companies reporting ineffective ICFR was consistent with the percentage of filed reports for that industry.

Companies in the finance, insurance, and real estate industry filed 24.1% and 25.4% of the total 404 reports filed in year one and year two, respectively, but only 16.4% and 14.4% of the reports indicating ineffective ICFR during year one and year two. The data suggest that on average, finance, insurance and real estate companies had more effective ICFR and a lower material weakness reporting rate.

AUDIT FIRM CHARACTERISTICS
If the year one and year two populations of issuers with ineffective ICFR are sorted by audit firm, the data reveal that the Big Four generally provided services to larger issuers that had a lower rate of ineffective ICFR (see Exhibit 4). In year one, the percentage of Big Four clients with ineffective ICFR ranged from 12.6% to 15.5%, while more than 34% of BDO Seidman’s clients and nearly 29% of Grant Thornton’s clients reported ineffective ICFR. These percentages were driven by the underlying distribution of issuers audited by the larger and smaller auditing firms; that is, the non-Big Four firms audited a larger proportion of the smaller issuers, which typically had a higher incidence of material weakness.

Audit Firm Clients

Year two showed some shifts in the distribution. The percentage of clients with material weaknesses fell across all audit firms. BDO Seidman’s client base had the highest percentage of ineffective ICFR at 25.0%, with all other firms, including the “Other” group, at 14.9% or less.

USING THE RESULTS
The second year’s section 404 reporting results were promising and indicated that many companies had made significant improvements in ICFR. Although the average number of material weaknesses per issuer that reported ineffective ICFR declined only slightly (from 2.41% to 2.32%), the percentage of issuers reporting material weaknesses decreased by 34.4%, from 15.7% of issuers in year one to 10.3% in year two.

As the compliance deadline for non-accelerated filers approaches, the management teams of those companies can look to year one and year two reporting results to anticipate where in their ICFR systems they will find the most common problems and begin addressing them now. In addition, non-accelerated filers can benefit a great deal from the additional guidance that is available, much of which is based on the experience of accelerated filers. Such guidance includes the Committee of Sponsoring Organization’s Internal Control Over Financial Reporting—Guidance for Smaller Public Companies (see “Internal Control Guidance: Not Just a Small Matter,” JofA, March 07, page 46), the Institute of Internal Auditors’ Sarbanes-Oxley Section 404: A Guide for Management by Internal Control Practitioners, and the SEC’s proposed guidance Management’s Report on Internal Control Over Financial Reporting.

As the data bear out in our analysis, the incidence of ineffective ICFR is inversely related to issuer size. We anticipate that the incidence of ineffective ICFR could be much higher in the smallest public companies or non-accelerated filers that have yet to report on ICFR. However, non-accelerated filers’ management teams can access the data provided here, along with the voluminous guidance that is now available, to tune their assessments of ICFR and remediate material weaknesses.

Non-accelerated filers should pay particular attention to the most common internal control issues and GAAP application failures reported by accelerated filers and target their ICFR with those and other common weaknesses noted above. This is borne out in the data presented here as the average number of material weaknesses reported per issuer and the total number of material weakness issuers have decreased, but the nature of the material weaknesses and the population of material weakness issuers have remained the same.