The reporting requirements for material changes in ICFR apply to both Forms 10-K and 10-Q and are contained in Regulation S-K Item 308(c):

(c) Changes in internal control over financial reporting. Disclose any change in the registrant’s internal control over financial reporting identified in connection with the evaluation required by paragraph (d) of § 240.13a-15 or 240.15d-15 of this chapter that occurred during the registrant’s last fiscal quarter (the registrant’s fourth fiscal quarter in the case of an annual report) that has materially affected, or is reasonably likely to materially affect, the registrant’s internal control over financial reporting.

The materiality of some changes in ICFR is fairly easy to determine, such as when a material weakness arises and ICFR goes from effective to ineffective.  But this is not always the case.  For example, determining whether installation of a new or upgraded system creates a material change in ICFR can be a complex and subjective judgment.  This type of change in ICFR is addressed in Question 7 of these Sarbanes-Oxley C&DIs:

After the registrant’s first management report on internal control over financial reporting, pursuant to Item 308 of Regulations S-K or S-B, the registrant is required to identify and disclose any material changes in the registrant’s internal control over financial reporting in each quarterly and annual report. This would encompass disclosing a change (including an improvement) to internal control over financial reporting that was not necessarily in response to an identified material weakness (i.e. the implementation of a new information system) if it materially affected the registrant’s internal control over financial reporting. Materiality, as with all materiality judgments in this area, would be determined upon the basis of the impact on internal control over financial reporting and the materiality standard articulated in TSC Industries, Inc. v. Northway, Inc. 426 U.S. 438 (1976) and Basic Inc. v. Levinson, 485 U.S. 224 (1988).

Lamb Weston Holdings, Inc. provided an example of the issues surrounding this disclosure.  The company is a global producer, distributor, and marketer of frozen potato products. According to the company’s Form 10-K, french fries represent most of their “value-added frozen potato product portfolio.”  On April 3, 2024, Lamb Weston’s stock closed at $101.12.  The next day, on April 4, 2024, the stock closed at $81.53.  Behind this sudden stock drop was this Form 8-K for the company’s third quarter earnings release.  (The company’s third quarter ended on February 25, 2024.)  In the release the company disclosed:

ERP Transition

At the beginning of the fiscal third quarter, the Company transitioned certain central systems and functions, including order to cash, produce to deliver, source to pay, and inventory management, among others in North America to a new ERP system. After the transition, the Company experienced reduced visibility into finished goods inventories at its distribution centers, resulting in a higher-than-expected effect on customer order fulfillment rates. The transition had a greater impact on shipments of higher-margin mixed-product loads than shipments of single-product orders, resulting in unfavorable mix. The Company partnered closely with its customers to minimize the impact and estimates the lower order fulfillment rates reduced sales volume growth by approximately 8 percentage points and net sales by approximately $135 million during the fiscal third quarter, with $123 million and $12 million in the Company’s North America and International segments, respectively.

In total, the Company estimates the ERP transition negatively impacted fiscal third quarter net income by approximately $72 million, and Adjusted EBITDA by approximately $95 million.

Lamb Weston had identified the risks associated with their ERP system transition and included this risk factor in their Form 10-K for their fiscal year ended May 28, 2023:

Problems with the transition, design, or implementation of our new ERP system could interfere with our business and operations and adversely affect our financial condition.

We are in the process of building a new ERP system to replace our existing operating and financial systems. The ERP system is designed to accurately maintain our financial records, enhance operational functionality, and provide timely information to our management team related to the operation of the business. The ERP system implementation process has required, and will continue to require, the investment of significant personnel and financial resources. Due to the uncertainty caused by COVID-19, we paused ERP work in fiscal 2021, after completing the first phase of implementation. We have resumed designing the next phase of our ERP implementation of central functions in North America and are in the test stage. We expect to begin implementing this next phase in fiscal 2024. We have experienced, and may continue to experience, difficulties as we transition to new upgraded systems and business processes. These difficulties have or may include loss of data; difficulty in making payments to third-parties; difficulty in completing financial reporting and filing reports with the SEC in a timely manner; or challenges in otherwise running our business. We may also experience decreases in productivity as our personnel implement and become familiar with new systems and processes. Any disruptions, delays, or deficiencies in the transition, design, and implementation of a new ERP system, particularly any disruptions, delays, or deficiencies that impact our operations, could have a material adverse effect on our business, financial condition, and results of operations. Even if we do not encounter adverse effects, the transition, design, and implementation of a new ERP system, may be much more costly than we anticipated.

As discussed above, whether or not a computer system change is “material” can be a complex judgment.  That said, if a change could be “reasonably likely” to materially affect ICFR, it should be disclosed.  Obviously, we are looking at Lamb Weston’s situation with hindsight, but many times it is better to be conservative in deciding whether to make this kind of disclosure.  Lamb Weston included this disclosure in their third quarter Form 10-Q:

Changes in Internal Control over Financial Reporting

Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, evaluated any change in our internal control over financial reporting (as defined in Rule 13a-15(f) under the Exchange Act) that occurred during the quarter ended February 25, 2024. During the quarter ended February 25, 2024, we transitioned certain central systems and functions, including order to cash, produce to deliver, source to pay, and inventory management, among others, in North America to a new enterprise resource planning (“ERP”) system, as part of our multi-year effort to upgrade our information systems and ERP infrastructure across the Company. This implementation included changes to certain financial processes impacting key controls related to our internal controls over financial reporting. We have updated our internal controls as appropriate in light of the system implementation and will continue to monitor the impact of the implementation on our processes, procedures, and internal control over financial reporting.

As always, your thoughts and comments are welcome!

On April 12, 2025, Davita, Inc. reported a cybersecurity attack on Form 8-K.  Interestingly, and appropriately, the company did not report the event on Item 1.05.  The instructions for Item 1.05 begin with:

Item 1.05 Material Cybersecurity Incidents.

(a) If the registrant experiences a cybersecurity incident that is determined by the registrant to be material, describe the material aspects of the nature, scope, and timing of the incident, and the material impact or reasonably likely material impact on the registrant, including its financial condition and results of operations.

As this instruction clearly states, this Form 8-K Item is for material cybersecurity incidents.  That said, many times a company will want to alert investors and others when a cybersecurity incident has occurred, but the company is still in the process of assessing the materiality of the event.  On May 21, 2024, CorpFin issued this Statement addressing how to report a cybersecurity event before a materiality assessment is complete.  In the Statement, CorpFin “encourages” companies to use a different Form 8-K Item, perhaps Item 8.01 or 7.01.

Davita’s Form 8-K was filed under Item 8.01 and includes this language:

Item 8.01. Other Events. 

On April 12, 2025, DaVita Inc. (the “Company” or “we”) became aware of a ransomware incident that has encrypted certain elements of our network. Upon discovery, we activated our response protocols and implemented containment measures, including proactively isolating impacted systems. We are actively working to assess and remediate the incident with the assistance of third-party cybersecurity professionals and have notified law enforcement of the matter.

We have implemented our contingency plans, and we continue to provide patient care. However, the incident is impacting some of our operations, and while we have implemented interim measures to allow for the restoration of certain functions, we cannot estimate the duration or extent of the disruption at this time.

Given the recency of the incident, our investigation and response are ongoing, and the full scope, nature, and potential ultimate impact on the Company are not yet known.

As a final note, remember that Form 8-K Item 8.01 is filed information and Item 7.01 is only furnished.  Careful consideration should be given as to whether a company wants this information to be furnished or filed.

As always, your thoughts and comments are welcome!

In the year a company completes an acquisition, ICFR reporting for the combined business can be problematic.  If the acquired company has been private, or has not built an ICFR evaluation process, it may not be practicable to include the acquired business in the acquiror’s assessment of ICFR, and, if applicable, in the auditor’s attestation report over ICFR.  This is particularly true when an acquisition happens near year end.

Interestingly, this situation is addressed not in Regulation S-X, but in a Sarbanes-Oxley C&DI:

Question 3 

Q: If a registrant consummates a material purchase business combination during its fiscal year, must the internal control over financial reporting of the acquired business be included in management’s report on internal control over financial reporting for that fiscal year?

A: As discussed above, we would typically expect management’s report on internal control over financial reporting to include controls at all consolidated entities. However, we acknowledge that it might not always be possible to conduct an assessment of an acquired business’s internal control over financial reporting in the period between the consummation date and the date of management’s assessment. In such instances, we would not object to management referring in the report to a discussion in the registrant’s Form 10-K or 10-KSB regarding the scope of the assessment and to such disclosure noting that management excluded the acquired business from management’s report on internal control over financial reporting. If such a reference is made, however, management must identify the acquired business excluded and indicate the significance of the acquired business to the registrant’s consolidated financial statements. Notwithstanding management’s exclusion of an acquired business’s internal controls from its annual assessment, a registrant must disclose any material change to its internal control over financial reporting due to the acquisition pursuant to Exchange Act Rule 13a-15(d) or 15d-15(d), whichever applies (also refer to the last two sentences in the answer to question 7). In addition, the period in which management may omit an assessment of an acquired business’s internal control over financial reporting from its assessment of the registrant’s internal control may not extend beyond one year from the date of acquisition, nor may such assessment be omitted from more than one annual management report on internal control over financial reporting.

On February 28, 2023, Lamb Weston Holdings, Inc., a global producer, distributor, and marketer of frozen potato products, acquired LW EMEA, an entity previously accounted for using the equity method.  Item 9A in the company’s Form 10-K for their fiscal year ended May 28, 2023, included this disclosure about the exclusion of the acquired company from the ICFR evaluation:

Our management, under the supervision and with the participation of our Chief Executive Officer and Chief Financial Officer and oversight of the Board of Directors, assessed the effectiveness of our internal control over financial reporting as of May 28, 2023. Management based this assessment on criteria for effective internal control over financial reporting described in Internal Control – Integrated Framework (2013) issued by the Committee of Sponsoring Organizations of the Treadway Commission. Management’s assessment included evaluation of elements such as the design and operating effectiveness of key financial reporting controls, process documentation, accounting policies, and our overall control environment. Management’s assessment of internal control over financial reporting as of May 28, 2023 excludes internal control over financial reporting related to LW EMEA (acquired February 28, 2023), which accounted for 7% of consolidated net sales and 30% of consolidated total assets as of and for the year ended May 28, 2023. Based on this assessment, management concluded that, as of May 28, 2023, our internal control over financial reporting was effective to provide reasonable assurance regarding the reliability of financial reporting and the preparation of consolidated financial statements for external reporting purposes in accordance with GAAP. We reviewed the results of management’s assessment with the Audit and Finance Committee of our Board of Directors.

As always, your thoughts and comments are welcome!