It's getting much harder for public companies to keep skeletons in their closets. As they ready internal controls for the harsh light of Section 404-compliance testing, the pressure to disclose problems uncovered in the process has become palpable.
In the first six months of the year, more than 100 companies raised red flags about the current state of their internal controls in their Securities and Exchange Commission filings, largely at the behest of their auditors, according to a CFO magazine analysis of a database compiled by Compliance Week newsletter. While there is no comparable data for previous years, the month-over-month growth — from 10 in January to 32 in June and 30 in July — has convinced many experts that such public confessions are on the rise.
"Even though Section 404 certifications won't start to be due until later this year, you're seeing a lot of companies trying to get ahead of the curve," says Stephen Poss, senior partner and chair of the securities litigation, SEC enforcement, and corporate-governance practice area at law firm Goodwin Procter LLP. He expects those numbers to increase until the completion of the first round of Section 404 testing, "as more companies get word from their auditors that they may have problems."
"Problems" can mean poor procedures or IT weaknesses, but in many cases they are more basic: unqualified or inadequate finance staffs. "A company needs to have a certain amount of [in-house] knowledge to determine the appropriate accounting issues, now that it cannot rely so heavily on its auditor," says Richard Steinberg, who led Pricewaterhouse-Coopers's governance practice before starting his eponymous consulting firm. The deficiencies that BDO Seidman noted at $14.5 million Advanced Materials Group Inc., which included operating without a full-time CFO and a lack of staff expertise, were typical of what one-third of companies making disclosures heard. And while smaller companies are most susceptible to such criticisms, large companies are not immune. PwC told international insurance giant AXA that the company had "insufficient personnel in the corporate accounting department with sufficient knowledge...of U.S. GAAP," the company reported in June.
With the threat of Section 404 failures looming, many firms are scrambling to fix their problems by hiring additional personnel and reorganizing. Thanks to quarterly Section 302 certification requirements, though, many are finding that agreeing to remedy weaknesses also entails reporting them. That means even the companies that end up passing Section 404 may be exposed to unwelcome investor scrutiny. The big question, says Wayne Avellanet, director of internal control at SST Truck Co., is: "Will I suffer the consequences of having a material weakness because I have a problem I can't fix fast enough?"
What Is Reportable?
Companies have long been required to disclose control weaknesses, but before Sarbanes-Oxley, they were rarely held accountable for knowing about them. The annual testing that Section 404 demands now leaves executives with little opportunity to plead ignorance. "With all the documentation and monitoring required, companies are much more likely to detect problems now," says Steve Wagner, a partner with Deloitte & Touche LLP and co-chair of its Sarbanes-Oxley steering committee. Although the controls covered by 302 are not exactly congruent to those described by 404, there is enough overlap so that "CFOs should be vigilant about any disconnects," says Poss.
Experts say many of the issues being revealed might once have stayed behind closed doors until fixed. But an arguably broader definition of what constitutes a "reportable condition" is making that strategy harder to pull off. Auditing Standard 2, recently issued by the Public Company Accounting Oversight Board (PCAOB), parses the historically used phrase into three categories — control deficiencies, significant deficiencies, and material weaknesses — in order of severity. The old standard allowed for a "low" probability of error before the dreaded material-weakness label was applied. But now a material weakness is one that creates "a more than remote" chance that "a material misstatement will not be prevented or detected" in a company's financial statements. And to further complicate matters, now multiple significant deficiencies can combine to equal a material weakness.
While auditors and companies (which must conduct their own independent assessments) must vet all types of deficiencies, only material weaknesses must be disclosed. But delineating between what does and does not have to be disclosed "requires a lot of judgment," says Wagner, who expects there to be "a fair amount of discussion and dialogue" between companies and auditors.
Such semantic issues are already leading to serious arguments between CFOs and auditors, as filings show. A number of companies, such as PhotoMedex Inc., Sports Club Co., and Alloy Inc., dismissed their auditors shortly after they identified the problems. At other firms, such as Western United Holding Co., auditors resigned because they were unwilling to rely on the data provided by management. AirGate PCS Inc., meanwhile, simply disagreed with KPMG in its second-quarter 10-Q. "The company believed that no reportable condition existed by the end of fiscal year September 30, 2003" related to a previously disclosed problem with the accounts-receivable information provided by Sprint Corp., "but our independent auditors have not made that finding."
When auditors and management disagree, however, auditors usually prevail. For example, a dismissal triggers a requirement to disclose any differences the two have had, including those regarding controls. And companies that maintain their relationships with the audit firm are usually bound to make the suggested changes. AirGate, for instance, has promised to disclose "all changes in internal controls with respect to financial information provided by Sprint that involves an item in excess of $1 million, and on a select basis, those changes with respect to financial information below this threshold." Roanoke Electric Steel Corp. CFO Mark G. Meikle had to hire a new staff member to placate his auditors. "We have always run a lean shop, and so we had some middle managers who were multitasking," he says, a situation that Deloitte & Touche considered a significant deficiency. Compensatory measures, such as having higher-ups approve the managers' decisions, did not solve the problem, he says, so "we realigned and readjusted so we wouldn't have that problem again."
The fear, of course, is that disclosing a control weakness will cause investors to doubt the financials. That's what happened to New York Stock Exchange-traded Adecco SA, which announced in January that Ernst & Young was refusing to sign off on its financial statements based on weak internal controls. The company's stock price dropped about 35 percent from the previous day and was still trading at more than 20 percent below preannouncement levels at press time — even after Adecco had spent more than $121 million to confirm the accuracy of the financial statements and replaced its CFO.
More often, it's hard to separate the effect of the disclosure from the rest of the news that accompanies it. Nortel Networks, Bristol-Myers Squibb, and Goodyear Tire & Rubber Co., for example, ended up restating earnings in part due to errors created by their lack of internal controls, which clearly had an impact on investors. At other companies, such as Mirant and WorldCom, the discovery came during well-publicized cleanup efforts after financial disasters, and had little effect on the stock.
The market does seem to have some sympathy for what companies are enduring, however. When Alloy Inc. revealed that KPMG had deemed its accounting staff's inability to properly account for goodwill as a material weakness in its May 27 10-K, its stock actually went up. Says Poss: "Everyone knows a lot of companies are struggling with the 404 issues." In fact, he predicts that in the first year, "so many companies will get a negative opinion [on their internal controls] that it will be little more than background noise."
While William J. McDonough, chairman of the PCAOB, won't speculate on the number of negative opinions, he recently told CFO (see "The Enforcer," August) that he believes "markets will distinguish [between] cases in which a company just isn't very well managed [and cases in which] a company has work to do, but will probably get a clean opinion next year."
All in the Details
The level of detail many firms are providing about their remediation may be helping to assuage investors' fears. "Companies want to illustrate the minutiae of the improvements they're trying to make," says Compliance Week editor Scott Cohen. Sola International Inc.'s June 10-K, for example, described the plan that new CFO Ron Dutt had presented to the board last October to correct deficiencies related to staffing, as well as a list of steps taken, including a reorganization of the international finance staff and the addition of three CPAs to its corporate accounting staff.
Some companies, such as Roanoke Electric Steel, are disclosing their hiring plans even when the underlying problem was not deemed to be material. "We wanted our shareholders to know that we were addressing it," says CFO Meikle, "so we went ahead and said we had the problem but we were going to solve it."
How well such efforts will insure companies against failing Section 404 is unclear, since passing depends largely on which problems still exist and their effects on financial statements. However, Wagner says that identifying finance-staff turnover as a risk and establishing plans to mitigate it, like "making sure they're adequately compensated, sufficiently trained, and given enough time to allow them to get on top of increasingly complex issues," is key to making auditors comfortable.
To that end, experts say that even damaging revelations about internal controls may be better than staying silent. Levi Strauss & Co. and Sonus Networks Inc., for example, have already been cited for allegedly failing to disclose control weaknesses as part of broader class action lawsuits. "You can pretty much count on the fact that any cases concerning GAAP violations brought after the 404 deadline are going to point to SEC reports that discuss internal controls," says Bruce Carton, executive director of Institutional Shareholder Services's Securities and Class Action Services.
More seriously, the SEC interest in such disclosures will surely carry consequences. "The SEC enforcement staff will increasingly try to make examples of outside directors in cases where companies have inadequate control over financial reporting," says Poss. The internal control environment was also included among the factors judges should use in deciding sentences for corporate defendants, he notes, in the U.S. Sentencing Commission's new guidelines.
At least until the first 404 audits, then, experts advise companies to disclose early and often. "This time next year," says Poss, "I have a feeling the market's going to be a lot less tolerant."
Alix Nyberg is a CFO contributing editor.
Loss of Control
A sampling of how companies are reporting internal-control weaknesses.
Company: Adecco. Problems: 01/12/04. "The reasons for the delay in completion of the audit include: the identification of material weaknesses in internal controls in the company's North American operations of Adecco Staffing...".
Impact on Stock Price: 01/09 — open: 16.47; close: 16.93
01/12 — open: 10.10; close: 11.70
01/13 — open: 11.78; close: 11.76
Company: AXA. Problems: 06/25/04. "In June 2004, PwC reported to AXA's Audit Committee and management that it had identified...two reportable conditions: ...instances of inadequate procedures for appropriately assessing and applying certain SEC disclosures and requirements, and...in PwC's view, the Company and certain of its subsidiaries have insufficient personnel in the corporate accounting department with sufficient knowledge and experience of U.S. GAAP accounting principles and SEC requirements."
Impact on Stock Price:: 06/24 — open: 21.59; close: 21.66
06/25 — open: 21.65; close: 21.52
06/28 — open: 22.17; close: 22.05
Company: BMC Software. Problems: 06/14/04. Management and Ernst & Young "identified during the course of the year-end audit a significant internal control deficiency involving inadequate staffing of qualified accounting personnel. We believe this deficiency is temporary and is due to a unique combination of factors, including larger than normal turnover of accounting personnel. Management is actively working to strengthen our accounting and finance team to correct the internal control deficiency identified and such efforts include: the recent hiring of additional senior financial management, including a new chief financial officer...."
Impact on Stock Price: 06/10 — open: 17.33; close: 17.50
06/14 — open: 17.29; close: 17.15
06/15 — open: 17.15; close: 16.99
Company: Bristol-Myers Squibb. Problems: 06/28/04. "In 2003...the Company has devoted substantial resources towards remedying the reportable condition in relation to taxes.... The Company expects to complete remediation of the reportable condition by the end of 2004."
Impact on Stock Price:: 06/25 — open: 24.78; close: 24.55
06/28 — open: 24.70; close: 24.74
06/29 — open: 24.74; close: 24.65
Company: EDS. Problems: 05/10/04. In April 2004, management learned of errors in contract accounting models and processes that "resulted in the untimely recognition of the purchase of certain hardware and assets under construction.... Other instances of breakdowns in our internal controls and procedures could occur or be identified in the future. Any such breakdowns may have an adverse effect on us and the market price of our securities...."
Impact on Stock Price:: 05/07 — open: 18.05; close: 17.79
05/10 — open: 17.79; close: 17.51
05/11 — open: 16.91; close: 16.48
Company: Mirant. Problems: 12/22/03. "Our internal-control deficiencies relate to the account reconciliation process and procedures, proper supporting transaction detail relating to journal entries and the controls over certain complex areas of accounting for derivatives and income taxation.... The current internal-control solution is not an optimal correction...."
Impact on Stock Price: 12/19 — open: 0.42; close: 0.42
12/22 — open: 0.40; close: 0.40
12/23 — open: 0.40; close: 0.40
Company: Nortel Networks. Problems: 11/19/03. In the 2003 audit, D&T informed the audit committee of material weaknesses in internal control: "...lack of compliance with established...procedures for monitoring and adjusting balances relating to certain accruals and provisions, including restructuring charges; and lack of compliance with established...procedures for appropriately applying generally accepted accounting principles to the initial recording of certain liabilities...."
Impact on Stock Price: 11/18 — open: 4.08; close: 4.04
11/19 — open: 4.07; close: 4.10
11/20 — open: 4.10; close: 4.07
Sources: Company filings; Compliance Week