Tag Archives: ICFR

Going Concern Reporting – The Gap in GAAP Versus GAAS – Part One

By: George M. Wilson & Carol A. Stacey

 

This is the first of three posts about an interesting conundrum in reporting that arose last year. The FASB, with ASU 2014-15, now requires disclosures by companies about going concern issues. However, there can be gaps between what companies are required to disclose and impact of going concern issues on the auditor’s report.

ASU 2014-15 added subtopic 205-40 “Disclosure of Uncertainties about an Entity’s Ability to Continue as a Going Concern” to the Accounting Standards Codification. This update became effective for periods ending after December 15, 2016. Previously there was no specific requirement for management to make these disclosures. (This is of course Generally Accepted Accounting Principles, or GAAP).

Auditors have had guidance in this area for many years courtesy of the PCAOB’s standard in AU section 341, which is now section AS 2415 in the PCAOB’s reorganized auditing standards. (This is Generally Accepted Auditing Standards, or GAAS).

 

To explore the gap between GAAP for companies and GAAS for auditors when reporting going concern issues we are going to present a series of three posts:

 

This first post will present an example of a going concern disclosure by a company and whether or not the auditor’s report was modified. (Spoiler – there was no mention in the auditor’s report!)

 

The second post will explore company disclosure requirements.

 

The third and last post will review auditor’s reporting requirements and detail the gaps between company and auditor reporting.

 

Sears Holdings, the retailer that owns Kmart and Sears, provided an example of this gap in their Form 10-K for the year ended January 28, 2017. In their financial statements Sears Holdings included this language:

We acknowledge that we continue to face a challenging competitive environment and while we continue to focus on our overall profitability, including managing expenses, we reported a loss in 2016 and were required to fund cash used in operating activities with cash from investing and financing activities. We expect that the actions taken in 2016 and early 2017 will enhance our liquidity and financial flexibility. In addition, as previously discussed, we expect to generate additional liquidity through the monetization of our real estate and additional debt financing actions. We expect that these actions will be executed in alignment with the anticipated timing of our liquidity needs. We also continue to explore ways to unlock value across a range of assets, including exploring ways to maximize the value of our Home Services and Sears Auto Centers businesses, as well as our Kenmore and DieHard brands through partnerships or other means of externalization that could expand distribution of our brands and service offerings to realize significant growth. We expect to continue to right-size, redeploy and highlight the value of our assets, including our real estate portfolio, in our transition from an asset intensive, historically “store-only” based retailer to a more asset light, integrated membership-focused company.

 

Our historical operating results indicate substantial doubt exists related to the Company’s ability to continue as a going concern. We believe that the actions discussed above are probable of occurring and mitigating the substantial doubt raised by our historical operating results and satisfying our estimated liquidity needs 12 months from the issuance of the financial statements. However, we cannot predict, with certainty, the outcome of our actions to generate liquidity, including the availability of additional debt financing, or whether such actions would generate the expected liquidity as currently planned. In addition, the PPPFA contains certain limitations on our ability to sell assets, which could impact our ability to complete asset sale transactions or our ability to use proceeds from those transactions to fund our operations. Therefore, the planned actions take into account the applicable restrictions under the PPPFA.

 

If we continue to experience operating losses, and we are not able to generate additional liquidity through the mechanisms described above or through some combination of other actions, while not expected, we may not be able to access additional funds under our amended Domestic Credit Agreement and we might need to secure additional sources of funds, which may or may not be available to us. Additionally, a failure to generate additional liquidity could negatively impact our access to inventory or services that are important to the operation of our business. Moreover, if the borrowing base (as calculated pursuant to the indenture) falls below the principal amount of the notes plus the principal amount of any other indebtedness for borrowed money that is secured by liens on the collateral for the notes on the last day of any two consecutive quarters, it could trigger an obligation to repurchase notes in an amount equal to such deficiency.

 

Sears Holdings used the term “substantial doubt”, but indicated that they believed their plans mitigated this “substantial doubt”.

 

This was the report of Sear’s Auditors:

 

In our opinion, the consolidated financial statements referred to above present fairly, in all material respects, the financial position of Sears Holdings Corporation and subsidiaries as of January 28, 2017 and January 30, 2016, and the results of their operations and their cash flows for each of the three fiscal years in the period ended January 28, 2017, in conformity with accounting principles generally accepted in the United States of America. Also, in our opinion, such financial statement schedule, when considered in relation to the basic consolidated financial statements taken as a whole, present fairly, in all material respects, the information set forth therein. Also, in our opinion, the Company maintained, in all material respects, effective internal control over financial reporting as of January 28, 2017, based on the criteria established in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission.

 

No mention of a going concern issue at all in the auditor’s report! What is an investor to think? Historically, when the only concrete guidance was in GAAS, it was very rare to see this issue not discussed in both the financial statements and the auditor’s report.

 

This is, of course, part of the gap between GAAP and GAAS. In our next post we will begin to explore the space in this gap!

 

 

As always, your thoughts and comments are welcome!

Fake SEC Filings and Enforcement in the Electronic Age

By: George M. Wilson & Carol A. Stacey

 

Over the many decades that equity securities have traded in the U.S., and over the centuries that equities have traded around the world, unscrupulous people have always tried to find ways to cheat others. From pump and dump schemes to fake analyst reports new ways are constantly evolving as less than ethical people look for a quick buck. One of the more recently developed sneaky tricks is to create a fictitious user ID in the SEC’s EDGAR system and try to manipulate a company’s stock with fake SEC filings such as tender offer documents. In a way this is kind of a “pump and dump” strategy, and it is all about fake news.

 

In February of this year an artist in Chicago used this trick to try and manipulate Alphabet’s stock. In May 2015, Avon stock was used in a similar scheme. In September 2015, a person used an SEC filing in the name of “LMZ & Berkshire Hathaway Co.” to try and manipulate Phillips 66 and Kraft Heinz. The report was signed with a false name.

 

That same false name was used on a filing to announce a fake tender offer for Fitbit in November 2017.

 

When there are new kinds of crimes, the SEC sets out to develop the right tools and techniques to find the perpetrators and protect investors and the markets from bad actors. They are making progress with this new kind of electronic and internet based crime. On May 19, 2017, fairly soon after the Fitbit false filing, the SEC announced an enforcement action against Robert W. Murray, the alleged perpetrator of this fraud, with a parallel criminal action by the U.S. Attorney’s Office for the Southern District of New York. Mr. Murry is a mechanical engineer based in Virginia.

 

According to the SEC Murray wove a tangled technical trail:

 

The SEC alleges that Murray created an email account under the name of someone he found on the internet, and the email account was used to gain access to the EDGAR system.  Murray then allegedly listed that person as the CFO of ABM Capital and used a business address associated with that person in the fake filing.  The SEC also alleges that Murray attempted to conceal his identity and actual location at the time of the filing after conducting research into prior SEC cases that highlighted the IP addresses the false filers used to submit forms on EDGAR.  According to the SEC’s complaint, it appeared as though the system was being accessed from a different state by using an IP address registered to a company located in Napa, California.

 

In the words of enforcement, this attempt to hide his actions did not work:

 

“As alleged in our complaint, Murray used deceptive techniques in a concerted effort to evade detection, but we were able to connect the dots quickly and hold him accountable,” said Stephanie Avakian, Acting Director of the SEC Enforcement Division.

 

For all his effort, and for the potential consequences, Murray’s ill-gotten gains in this scheme were only about $3,100!

 

Always fun to see how new ways to try and cheat don’t evade the consequences!

 

As always, your thoughts and comments are welcome!

 

SEC Reporting and FASB Updates Specific to Small and Mid-Sized Companies Take Center Stage

The Financial Reporting Regulatory landscape is chock full of recent updates and new regulations, chief among them is the new FASB Revenue Recognition Standard and revised Lease Accounting. Most surveys agree that filers are well behind schedule in implementing the changes needed to comply. Practitioners at small and mid-sized companies will receive the essential information and advice needed to get up to speed by attending SEC Reporting & FASB Forum live program September 14-15 in Las Vegas.

http://www.pli.edu/Content/13th_Annual_SEC_Reporting_FASB_Forum_for/_/N-1z10lptZ4k?ID=298604

 

Challenging Accounting Judgments, Principles Based Standards and ICFR

By: George M. Wilson & Carol A. Stacey

As you have undoubtedly heard from a variety of sources (including this post we made last December), the new revenue recognition, financial instruments impairment and lease standards all involve many new and sometimes complex accounting judgments and estimates.

 

Issues ranging from how to estimate current expected credit losses to what is stand-alone selling price confront us with new, difficult, and subjective judgment calls.

 

Even the Chief Accountant has discussed this issue in a recent speech, which we discussed in our blog. In his remarks, the Chief Accountant focused on ICFR, specifically mentioning:

 

“Having the requisite skills in the accounting and financial reporting area to make the many new, complex judgements required by these standards, and

 

Setting an appropriate tone at the top to assure these judgments are made in a reasonable, consistent and appropriate manner.”

 

To help us all deal with these challenges the Anti-Fraud Collaboration, a group made up of the Center For Audit Quality, FEI, NACD and IIA, has issued a report titled “Addressing Challenges for Highly Subjective and Complex Accounting Areas”.

 

This report is built on a foundation of detailed analysis of several SEC and PCAOB enforcement cases, a webcast and two workshops. The report has a robust discussion of several of the issues underlying these enforcement cases. One important conclusion drawn from this work is that a lack of controls surrounding subjective and complex accounting judgments is frequently a root cause underlying reporting problems. Based on this conclusion, the report includes a discussion of ways to help establish appropriate controls for such estimates and judgments. In fact, one of the enumerated objectives of the report is to:

 

“Facilitate a robust discussion about accounting policy, centering on highly subjective and complex accounting areas, and the design and operating effectiveness of ICFR”

In the report, there are several insights into ICFR issues surrounding complex judgments. For example:

 

Difficult Accounting Issues

 

Three accounting issues were problematic for companies under investigation: revenue recognition, loan impairment, and valuation. Both highly subjective and complex, these three areas were under stress during the financial crisis and therefore more prone to manipulation or error. The analysis of the AAERs also highlighted issues with the accounting policies pertaining to these areas. In the enforcement actions studied, the SEC cited that the companies either did not have an adequate accounting policy or procedure for the issue being investigated; the company was non-compliant with their existing policy or procedure; or that management acted to override the company’s accounting policy.

 

 

The report goes on to state:

 

For all members of the financial reporting supply chain, the importance of tone at the top cannot be overstated. In most cases of alleged financial fraud, the SEC names the CEO and/or the CFO in the complaint. Commission staff noted that the driver of earnings management—the catalyst for most fraud cases—is often top management, such that the focus on the CEO and CFO is not surprising. In cases the PCAOB has brought against individual auditors, it is usually the lead audit engagement partner or other senior members of an audit engagement team who are disciplined.

 

 

Hopefully, as you think about the design of ICFR over the new estimates and judgments required to implement the revenue recognition, lease and financial instrument impairment standards, you will find some helpful ideas in this report.

 

As always, your thoughts and comments are welcome!

 

 

Are There Consequences for Reporting ICFR Problems? – The Chief Accountant Speaks!

By: George M. Wilson & Carol A. Stacey

In a recent speech SEC Chief Accountant Wesley Bricker, towards the end of his remarks, made some interesting overall comments about the evaluation of ICFR. These comments are an interesting step in the ongoing conversation about whether the SOX 404 evaluation of ICFR makes any difference in investor behavior. There has been a lot of anecdotal evidence and much discussion about this question. Mr. Bricker’s comments are not based on supposition, inference or piecemeal observation. His comments have their roots in articles from various academic journals, including the Accounting Review and The Journal of Accounting Research. Research in these peer-reviewed journals is based on statistical analysis of quantitative data. (If you have never heard of these journals, they are very prestigious academic journals, so if you decide to read any of the articles grab a cup of coffee and a calculator!)

Here are some excerpts from his remarks. The footnote numbers are references to the academic papers which support his points. We left them in so you could follow-up if you would like to review the quantitative research underlying his comments.

 

Recent experience with disclosures 

Another point related to ICFR is consideration of disclosures.  Investors tend to incorporate disclosure of ICFR deficiencies in the price they are willing to pay for a stock.  For example, companies disclosing material weaknesses are more likely to experience increased cost of capital, and to face more frequent auditor resignations and restatements.[11]

 

Recent academic research suggests:

 

Companies disclosing internal control deficiencies have credit spreads on loans about 28 basis points higher than that for companies without internal control deficiencies; [12] and

 

After disclosing an internal control deficiency for the first time, companies experience a significant increase in cost of equity, averaging about 93 basis points. [13]

 

Remediation of ineffective ICFR tends to be followed by improved financial reporting quality, reduced cost of capital, and improved operating performance.[14]   For example,

 

Companies that have remediated their prior disclosed internal control deficiencies exhibit an average decrease in market-adjusted cost of equity of 151 basis points; [15]  and

 

Remediating companies also experience increases in investment efficiency and in operating performance, suggesting that accounting information generated by effective ICFR is more useful for managerial decision-making. [16]

 

A disclosure of material weaknesses, combined with demonstrating progress toward remediation, can provide investors with information about the company’s ability to function as a public company.  Some companies, for example, voluntarily disclose material weaknesses in their registration statements along with their plans for remediating those weaknesses. [17]

 

You can find citations in to the relevant articles in the text of the speech.

As always, your thoughts and comments are welcome!

ICFR Changes and the New Revenue Recognition, Leases, and Financial Instrument Impairment Transitions

By: George M. Wilson & Carol A. Stacey

 

In his recent, much publicized speech, Chief Accountant Wesley Bricker discussed the transition to the new revenue recognition standard. A bit later in the speech he addressed a not so frequently discussed issue, the requirement to disclose material changes in ICFR as it relates to implementation of the new revenue recognition, leases, credit losses and other standards. Here is an excerpt:

 

Over the next several years, updating and maintaining internal controls will be particularly important as companies work through the implementation of the significant new accounting standards. Companies’ implementation activities will require careful planning and execution, as well as sound judgment from management, as I have mentioned earlier in illustrating areas of judgment in the new GAAP standards.

 

In his remarks, well worth the read, he also comments on two crucial ICFR concerns in these new standards:

Having the requisite skills in the accounting and financial reporting area to make the many new, complex judgements required by these standards, and

Setting an appropriate tone at the top to assure these judgments are made in a reasonable, consistent and appropriate manner.

 

We did a post about reporting changes in ICFR in November 2016. To refresh your memory, or if you are not familiar with this area, here is a summary of the disclosures required for material changes in ICFR. This applies to material changes made to implement new accounting standards as well as any other material changes.

 

These requirements begin with Item 9A in Form 10-K and Part I Item 4 in Form 10-Q. They both refer to S-K Item 308(c):

 

(c) Changes in internal control over financial reporting. Disclose any change in the registrant’s internal control over financial reporting identified in connection with the evaluation required by paragraph (d) of §240.13a-15 or 240.15d-15 of this chapter that occurred during the registrant’s last fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting.

 

With changes to ICFR for revenue recognition for information about contracts and estimates, like stand-alone selling price and when control transfers, and changes to ICFR for capitalization of all leases, these new standards could require material changes to ICFR. Are these the types of changes included in the S-K 308(c) disclosure requirement?

 

This is an excerpt from the ICFR C&DI’s, number 7, about SOX reporting which you can find here:

 

After the registrant’s first management report on internal control over financial reporting, pursuant to Item 308 of Regulations S-K or S-B, the registrant is required to identify and disclose any material changes in the registrant’s internal control over financial reporting in each quarterly and annual report. This would encompass disclosing a change (including an improvement) to internal control over financial reporting that was not necessarily in response to an identified material weakness (i.e. the implementation of a new information system) if it materially affected the registrant’s internal control over financial reporting. Materiality, as with all materiality judgments in this area, would be determined upon the basis of the impact on internal control over financial reporting and the materiality standard articulated in TSC Industries, Inc. v. Northway, Inc. 426 U.S. 438 (1976) and Basic Inc. v. Levinson, 485 U.S. 224 (1988). This would also include disclosing a change to internal control over financial reporting related to a business combination for which the acquired entity that has been or will be excluded from an annual management report on internal control over financial reporting as contemplated in Question 3 above. As an alternative to ongoing disclosure for such changes in internal control over financial reporting, a registrant may choose to disclose all such changes to internal control over financial reporting in the annual report in which its assessment that encompasses the acquired business is included.

 

 

The SEC Regulations Committee of the CAQ has also discussed a particularly intricate issue in this transition. What if you change your ICFR this year, but the change is for future reporting when you begin to report under the new standard next year? This issue is still in play, as this excerpt from the minutes discusses:

 

Changes in ICFR in preparation for the adoption of a new accounting standard

Item 308(c) of Regulation S-K requires disclosure of changes in internal control over financial reporting (“ICFR”) during the most recent quarter that have materially affected or are reasonably likely to materially affect the registrant’s ICFR. The Committee and the staff discussed how this requirement applies to changes in ICFR that are made in preparation for the adoption of a new accounting standard when those changes are in periods that precede the date of adoption and do not impact the preparation of the financial statements until the new standard is adopted.

 

The staff indicated that they are evaluating whether additional guidance is necessary for applying the requirements of Item 308(c) in connection with the transition to the new revenue standard.

 

So, as you begin implementing systems and processes for these new standards, don’t forget this part of the reporting!

 

As always, your thoughts and comments are welcome!

The Move to The New Revenue Recognition Standard – Is the Pressure On?

By: George M. Wilson & Carol A. Stacey

 

Now that year-end is over for most calendar-year companies the transition to the new revenue recognition standard is a major focus area. In recent weeks there have been two interesting sources of comment and information about this transition.

 

First, on March 21, 2017 Chief Accountant Wesley Bricker spoke before the Annual Life Sciences Accounting & Reporting Congress in Philadelphia. (If you are thinking “that sounds familiar”, it was at this same conference a year ago that former Chief Accountant Jim Schnurr made some serious comments about the use of non-GAAP measures that previewed the May C&DI’s!).

 

In his remarks, Mr. Bricker focused on the transition to the new revenue recognition standard, saying:

 

“Let me now turn to implementation of the new revenue standard.  This area deserves close attention, both to make sure that the standard is implemented appropriately and timely and to ask whether the appropriate transition disclosures are being made so that investors and other market participants have sufficient time to absorb the anticipated effects of the new standard.

 

…………………………..

 

In the worrisome column, however, some companies need to make significant progress this year in their implementations.  In a survey of public companies released in October 2016, eight percent of respondents at that time had not started an initial assessment of the new revenue recognition standard, while an overwhelming majority of the others were still assessing the impact.

Particularly for companies where implementation is lagging, preparers, their audit committees and auditors should discuss the reasons why and provide informative disclosures to investors about the status so that investors can assess the implications of the information. Successful implementation requires companies to allocate sufficient resources and develop or engage appropriate financial reporting competencies.”

 

The second recent development is the release by Deloitte in a “Heads Up” newsletter in April 2017 of their most recent updated survey “Adopting the New Revenue Standard — Where Do Companies Stand?”

 

In the survey, Deloitte found that many companies that had originally contemplated using a full retrospective have moved more towards the modified retrospective method. And, along with the worries of the Chief Accountant above, they also found:

 

“Slightly more than half of respondents had started to implement the new standard, but most were in the very early phases of adoption.”

 

As always, your thoughts and comments are welcome!

 

When Disclosure Obligations Reach Beyond Financial Reporting

By: George M. Wilson & Carol A. Stacey

Good accounting requires good communication. Many times information that is well-removed from the financial reporting and accounting functions has impacts on the financial statements or other parts of the SEC reporting process, especially MD&A. The Sarbanes Oxley Act built on the internal accounting controls guidance in section 13(b) of the FCPA Act in expanding the evaluation, audit and reporting requirements for internal control over financial reporting, or ICFR, and creating the concept of disclosure controls and procedures, or DCP.

A recent enforcement action brings home, at this important year-end time, the importance of effective disclosure controls throughout the company, with perhaps redundant controls that search beyond traditional financial reporting functions for issues that may impact the financial statements or require disclosure in other parts of a periodic report. It reinforces the idea that responsibility for disclosure is a company-wide obligation, and that companies need to build reliable infrastructures to ensure that investors receive all of the information they are supposed to receive.

ICFR and its related requirements have been part of the reporting process for decades. ICFR is formally defined in Exchange Act Rule 13(a)-15 as:

a process designed by, or under the supervision of, the issuer’s principal executive and principal financial officers, or persons performing similar functions, and effected by the issuer’s board of directors, management and other personnel, to provide reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles and includes those policies and procedures that:

(1) Pertain to the maintenance of records that in reasonable detail accurately and fairly reflect the transactions and dispositions of the assets of the issuer;

(2) Provide reasonable assurance that transactions are recorded as necessary to permit preparation of financial statements in accordance with generally accepted accounting principles, and that receipts and expenditures of the issuer are being made only in accordance with authorizations of management and directors of the issuer; and

(3) Provide reasonable assurance regarding prevention or timely detection of unauthorized acquisition, use or disposition of the issuer’s assets that could have a material effect on the financial statements.

ICFR is all about the financial statements and that of course includes all of the relevant disclosures in the footnotes to the financial statements.

Here is how SOX expanded this process and formally defined disclosure controls in Exchange Act Rule 13(a)-15:

For purposes of this section, the term disclosure controls and procedures means controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Act (15 U.S.C. 78a et seq.) is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Act is accumulated and communicated to the issuer’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.

What is clear in this definition is that DCP relates to the entire report, not just the financial statements. And, both ICFR and DCP are relevant to the financial statements.

The terms “accumulate and communicate” are particularly relevant for this case. DCP clearly applies to the concept of a known trend in MD&A, which may not be relevant to the financial statements. It also applies to information that may be relevant to accounting for contingencies, even when that information is in an operational area.

In the enforcement case mentioned above the company paid “a $1 million penalty to settle charges that deficient internal accounting controls prevented the company from properly assessing the potential impact on its financial statements of a defective ignition switch found in some vehicles.” Further,

“[t]he SEC’s order finds that the company’s internal investigation involving the defective ignition switch wasn’t brought to the attention of its accountants until November 2013 even though other (company) personnel understood in the spring of 2012 that there was a safety issue at hand. Therefore, during at least an 18-month period, accountants at the (company) did not properly evaluate the likelihood of a recall occurring or the potential losses resulting from a recall of cars with the defective ignition switch.

This case clearly addressed accounting for contingencies and the related GAAP disclosures. In other situations there may not be a contingency disclosure, but there could be a known trend in MD&A. Both are relevant issues as we work through year-end. What this all builds to is that the disclosure process, including both ICFR and DCP, has to reach beyond the information required for financial statement reporting.

It is all about communication! And this might be a good time to communicate this issue to your disclosure committee and all the parts of your organization.

As always, your thoughts and comments are welcome!

A Control Environment and History Follow-Up

By: George M. Wilson & Carol A. Stacey

 

This famous quote has been in our thoughts over the last several months:
“Those who cannot remember the past are condemned to repeat it.”

George Santayana, the poet and essayist, wrote these famous words in his book The Life of Reason. Many other people including Winston Churchill have thoughtfully incorporated this fundamental principle of life in speeches and remarks.

Another favorite variation of the idea comes from Mark Twain:
“History doesn’t repeat itself, but it does rhyme.”

The lesson here is that if we learn history we can hopefully avoid making the same or similar mistakes in the future. As we discussed a couple of posts back, recent public company news shows that many organizations have not been learning from the past.

 

One person who can help us learn about history we do not want to repeat is Cynthia Cooper. She was the WorldCom head of internal audit who built and lead the team that worked almost “under cover” to find the largest fraud ever discovered. This was a tone at the top fraud, involving the CEO, CFO and CAO. Her book is a sometimes-chilling story of how bad tone at the top results in fraud.

 

Sharron Watkins is another person who can help us learn how to not repeat history. She was the Enron Vice President, a direct report to Andy Fastow, who blew the whistle about Enron’s accounting irregularities. And we all know perhaps too much about that fraud which was even the subject of a book and related movie “Enron: The Smartest Guys in the Room”.

 

Corporate ethics will never be easy, but as history and current events show, it does matter. If leadership of an organization sends the message that making money is the most important thing an organization does, if it sends the message that if you don’t make money you will be fired, if it sends the message that other values can be sacrificed if you make money, the ultimate result is inevitable. In countless frauds over centuries, from Ivar Kreuger, the match king in the early 1900s, to Equity Funding in the 1970s, to Madoff, to Enron, to the companies we are talking about today, this lesson has been proven time and time again.

 

These stories can help us learn and avoid the mistakes others have made. They can be the focus of training and learning. They can be the foundation for building awareness and support for these issues in organizations large and small.

 

As always, your thoughts and comments are welcome.

Tone at the Top, History and COSO

By: George M. Wilson & Carol A. Stacey

 

First, a quick warning before you read this post. One of the authors of this post spent nine years teaching at a university which had one of the few undergraduate business programs in the country with a required course in business ethics. This post is perhaps a bit preachy!

We have seen some distressing examples in the news lately of organizations acting unethically. If you were around during the early 2000s these events evoke a strong feeling of déjà vu. The similarities in the “tone at the top” of the organizations in the news today compared to the tone at the top in the companies involved in the pre-SOX waves of fraud (such as WorldCom and Enron) is eerie!

In all of these frauds, the roots of unethical conduct which harmed shareholders were at the top of the organizations.

History, as it always seems to do, is repeating itself. Eventually defective tone at the top will always result in trouble and distress for the organization and investors. (Yes, that was one of the preachy parts!)

All this makes it seem like a great time to review a key element in the foundations of internal control, the control environment. Here is an excerpt from the Executive Summary of the 2013 COSO Framework:

 

“Control Environment

The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The board of directors and senior management establish the tone at the top regarding the importance of internal control including expected standards of conduct. Management reinforces expectations at the various levels of the organization. The control environment comprises the integrity and ethical values of the organization; the parameters enabling the board of directors to carry out its governance oversight responsibilities; the organizational structure and assignment of authority and responsibility; the process for attracting, developing, and retaining competent individuals; and the rigor around performance measures, incentives, and rewards to drive accountability for performance. The resulting control environment has a pervasive impact on the overall system of internal control. “

Building an effective control environment starts at the top of an organization with the executive leadership, board and Audit Committee. If the people in these roles place financial performance before integrity, if their attitude is about accomplishing objectives at whatever the cost, that is poison in the control environment.

Understanding, assessing and evaluating tone at the top and the other elements of the control environment is not easy.

In a telecom company where the message from the CEO is to make the numbers at any cost is there any surprise that the end result is one of the largest financial reporting frauds ever? Or that the fraud was carefully crafted to avoid detection by the auditors? And, when the perpetrators of the fraud are the leaders of the organization, who have the power to punish anyone who might call out the tone at the top issues, is it any wonder that it is easy for them to conceal the corruption in the control environment? Is it any surprise that the courageous internal auditors who eventually called out the fraud actually had to conduct their investigation in secret and at times wondered if they should be afraid for their lives?

 

In an energy trading company where the CFO was behind hidden issues involving off-balance sheet arrangements that were not on the up-and-up, is it any wonder that the first person to really escalate the issue did so in an anonymous letter?

 

In a bank where not making sales goals resulted in your termination, is there any surprise when rules are bent? Is there any surprise when people are fired when they attempt to raise the issue to their managers?

 

As another example, check out this 10-K for Hertz which includes a major restatement. In the “Explanatory Note” at the beginning of the document you will find this language:

 

As of December 31, 2014, we did not maintain an effective control environment primarily attributable to the following identified material weaknesses:

Our investigation found that an inconsistent and sometimes inappropriate tone at the top was present under the then existing senior management that did not in certain instances result in adherence to accounting principles generally accepted in the United States of America (“GAAP”) and Company accounting policies and procedures. In particular, our former Chief Executive Officer’s management style and temperament created a pressurized operating environment at the Company, where challenging targets were set and achieving those targets was a key performance expectation. There was in certain instances an inappropriate emphasis on meeting internal budgets, business plans, and current estimates. Our former Chief Executive Officer further encouraged employees to focus on potential business risks and opportunities, and on potential financial or operating performance gaps, as well as ways of ameliorating potential risks or gaps, including through accounting reviews. This resulted in an environment which in some instances may have led to inappropriate accounting decisions and the failure to disclose information critical to an effective review of transactions and accounting entries, such as certain changes in accounting methodologies, to the appropriate finance and accounting personnel or our Board, Audit Committee, or independent registered public accounting firm.

 

This is another example of a fraud with its roots in tone at the top.

When frauds escalate to a material level there is a reasonable likelihood that it started with a problem with tone at the top, with the control environment.

So, where does all this lead? Assessing tone at the top is not easy. And a poisoned control environment will do everything it can to protect itself. The leaders of an organization with a defective control environment will use the power they wield to keep others from exposing the problem. Perhaps more protections for whistleblowers are a good thing in this regard. Tools to measure ethical behavior in an organization are difficult to find, subjective and imprecise. Enron in fact had a model code of ethics, but having something on paper does not mean that people will live by the code of ethics. The one thing that is clear is that this continues to be a complex area and continues to be at the root of many financial reporting frauds. We all need to focus on this area and work to develop a better understanding and better tools to assess the control environment.

We all need to focus on tone at the top and ethical behavior. Yes, it is not easy to measure, it is not easy for an outsider to observe, but it is clearly crucial to effective ICFR!

 

As always, your thoughts and comments are welcome!