Category Archives: Reporting

Cybersecurity, Disclosure Controls and Enforcement (Oh My!)

Hot Topic, Reporting

The dramatic increase in ransomware and other cyber-attacks has made cybersecurity a top-of-mind topic. Disclosure controls and procedures (DCP), on the other hand, is likely not a top-of-mind issue for most companies.  In a June 14, 2021 Enforcement Release, the SEC reminded us that cybersecurity and DCP should both be towards the top of our risk management agendas.

This relationship between cybersecurity risk and DCP is not a new, out-of-the-blue development.  In its February 26, 2018 Release, Commission Statement and Guidance on Public Company Cybersecurity Disclosures, the SEC specifically reminded companies of their obligation to assure cybersecurity risks were appropriately addressed within DCP:

“Crucial to a public company’s ability to make any required disclosure of cybersecurity risks and incidents in the appropriate timeframe are disclosure controls and procedures that provide an appropriate method of discerning the impact that such matters may have on the company and its business, financial condition, and results of operations, as well as a protocol to determine the potential materiality of such risks and incidents.

Building on this foundational requirement, the Release provides this suggestion about DCP and communication of cybersecurity risks and incidents within a company:

In addition, the Commission believes that the development of effective disclosure controls and procedures is best achieved when a company’s directors, officers, and other persons responsible for developing and overseeing such controls and procedures are informed about the cybersecurity risks and incidents that the company has faced or is likely to face. …..Companies should assess whether they have sufficient disclosure controls and procedures in place to ensure that relevant information about cybersecurity risks and incidents is processed and reported to the appropriate personnel, including up the corporate ladder, to enable senior management to make disclosure decisions and certifications and to facilitate policies and procedures designed to prohibit directors, officers, and other corporate insiders from trading on the basis of material nonpublic information about cybersecurity risks and incidents.”

Highlighting the importance of DCP over cybersecurity risk, on June 15, 2021, the SEC announced a settled enforcement case where a company did not have appropriate cybersecurity-related DCP.  As you can read in the Press Release and related SEC Order, the SEC found that senior executives responsible for public statements related to a cybersecurity incident “were not apprised of certain information that was relevant to their assessment of the company’s disclosure response to the vulnerability and the magnitude of the resulting risk.”

According to the SEC Order, the company’s information security personnel detected a cybersecurity vulnerability in a key application that contained substantial amounts of customer data.  Senior management was not informed about the vulnerability or that it was not remediated in accordance with company policy.  Several months after the company discovered the vulnerability, a cybersecurity journalist notified the company that they had discovered the problem and that document images with sensitive customer information could be easily viewed on the internet.  Management responsible for communications with investors about this problem did not have information that should have been included in determining how to communicate to investors about this situation.

The Press Release includes this quote from Kristina Littman, Chief of the SEC Enforcement Division’s Cyber Unit:

“As a result of First American’s deficient disclosure controls, senior management was completely unaware of this vulnerability and the company’s failure to remediate it.  Issuers must ensure that information important to investors is reported up the corporate ladder to those responsible for disclosures.”

As always, your thoughts and comments are welcome!

A Lighthearted Glossary of Securities Law Terms

Education, Reporting

Have you ever been working through an SEC reporting or securities law issue and encountered a term or acronym you had never seen before?  To help when this happens, Mayer Brown has built “Writing on the Wall,” an entertaining and lighthearted glossary addressing over 800 securities, capital markets and related terms.  Thanks to Anna Pinedo of Mayer Brown for letting us know about this useful tool.

As always, your thoughts and comments are welcome!

The New MD&A Rule: Part Three – Critical Accounting Estimate Disclosure

Hot Topic, Reporting

In this post, we overviewed the changes to MD&A in the SEC’s Management’s Discussion and Analysis, Selected Financial Data, and Supplementary Financial Information Final Rule. This rule was published in the Federal Register on January 11, 2021, and is effective for filings on or after February 10, 2021.

The rule’s transition provisions provide a mandatory transition date but also allow voluntary early compliance.  The mandatory transition date is each company’s first fiscal year that ends after August 9, 2021, which is 210 days after the effective date.  Companies may voluntarily apply the new rule, on an S-K item-by-item basis, in any filing made on or after the effective date of February 10, 2021.

If a company did not implement the rule early, it is not too soon to start planning for these required changes.

In the second post in this series, we reviewed the first of the changes to the MD&A requirements, the addition of an objective to S-K Item 303.

This third post in the series addresses disclosure of critical accounting estimates.  The history of this disclosure has created more than a bit of confusion about its goal.  As a result, disclosure about critical accounting estimates is too often vague and uninformative.

The first mention of anything “critical” about accounting principles or estimates was a “Cautionary Advice” issued on December 2, 2001, in the wake of Enron’s downward spiral.  It is very short.  It builds on the belief that:

“Investors may lose confidence in a company’s management and financial statements if sudden changes in its financial condition and results occur, but were not preceded by disclosures about the susceptibility of reported amounts to change, including rapid changes.”

Without defining “critical accounting policy,” the Release suggested several disclosure steps, including:

“Each company’s management and auditor should bring particular focus to the evaluation of the critical accounting policies used in the financial statements.”; and

“Prior to finalizing and filing annual reports, audit committees should review the selection, application and disclosure of critical accounting policies.”

This was the first step in addressing accounting policies involving subjective and challenging estimates which could potentially create material financial statement volatility.  The SEC issued a proposed rule in 2002 that would have required “critical accounting estimate” disclosure.  (Note the change in terminology from “policy” to “estimate.”)

This rule was never finalized.

One of the reasons the SEC never finalized this rule was their conclusion that existing MD&A guidance provides for “critical accounting estimate” disclosure.  The 2003 MD&A release, FR 72,  formally changed the terminology to “critical accounting estimates” and provided disclosure guidance:

V. Critical Accounting Estimates

Many estimates and assumptions involved in the application of GAAP have a material impact on reported financial condition and operating performance and on the comparability of such reported information over different reporting periods. Our December 2001 Release reminded companies that, under the existing MD&A disclosure requirements, a company should address material implications of uncertainties associated with the methods, assumptions and estimates underlying the company’s critical accounting measurements. In May 2002 we proposed rules, which remain under consideration, that would broaden the scope of disclosures beyond those currently required.

When preparing disclosure under the current requirements, companies should consider whether they have made accounting estimates or assumptions where:

  • the nature of the estimates or assumptions is material due to the levels of subjectivity and judgment necessary to account for highly uncertain matters or the susceptibility of such matters to change; and
  • the impact of the estimates and assumptions on financial condition or operating performance is material.

FR 72, the 2003 MD&A release, goes on to say:

Such disclosure should supplement, not duplicate, the description of accounting policies that are already disclosed in the notes to the financial statements. The disclosure should provide greater insight into the quality and variability of information regarding financial condition and operating performance. While accounting policy notes in the financial statements generally describe the method used to apply an accounting principle, the discussion in MD&A should present a company’s analysis of the uncertainties involved in applying a principle at a given time or the variability that is reasonably likely to result from its application over time.

This disclosure guidance is consistent with the overall objective of MD&A to help investors understand how well historical financial performance is predictive of future financial performance.  (We discussed this objective in the previous post in this series.)  If a company makes an estimate which could materially change in future periods, investors should be aware of this risk.

With all of this as preamble, it is still clear that many companies do not disclose information consistent with this guidance.  All too frequently this disclosure is simply a repetition of information in the financial statement’s summary of significant accounting policies.

This leads us to the Final Rule which adds a critical accounting estimate disclosure requirement to S-K Item 303.  This clarifies and codifies existing Commission guidance.  S-K Item 303 now includes this paragraph:

(3) Critical accounting estimates. Critical accounting estimates are those estimates made in accordance with generally accepted accounting principles that involve a significant level of estimation uncertainty and have had or are reasonably likely to have a material impact on the financial condition or results of operations of the registrant. Provide qualitative and quantitative information necessary to understand the estimation uncertainty and the impact the critical accounting estimate has had or is reasonably likely to have on financial condition or results of operations to the extent the information is material and reasonably available. This information should include why each critical accounting estimate is subject to uncertainty and, to the extent the information is material and reasonably available, how much each estimate and/or assumption has changed over a relevant period, and the sensitivity of the reported amount to the methods, assumptions and estimates underlying its calculation.

The rule also adds this language in new Instruction 3, using the same wording as the 2003 MD&A release:

For critical accounting estimates, this disclosure must supplement, but not duplicate, the description of accounting policies or other disclosures in the notes to the financial statements.

The SEC explained their rationale for adding this requirement to S-K Item 303 in this comment from the Final Rule:

The Commission proposed amending Item 303 to add new Item 303(b)(4), which would explicitly require disclosure of critical accounting estimates in order to clarify the required disclosures of critical accounting estimates, facilitate compliance, and improve the resulting disclosure. Because registrants often repeat the information in the financial statement footnotes about significant accounting policies, the proposals were also intended to eliminate disclosure that duplicates the financial statement discussion of significant accounting policies and, instead, promote enhanced analysis of measurement uncertainties.

The Final Rule also articulates the overall goal of critical accounting estimate disclosure and its forward-looking focus:

Further, unlike existing requirements in U.S. GAAP, our amendments emphasize forward-looking information as they are intended to provide investors with greater insight into estimation uncertainty that is reasonably likely to have a material impact on financial condition and operating performance. We remind registrants that the principle that MD&A should not be a recitation of financial statements in narrative form extends to disclosure of critical accounting estimates.

This new requirement will create an opportunity for many companies to review their current disclosure and eliminate information that does not help assess potential variability or that simply duplicates information in the financial statements.  There is also an opportunity to consider whether critical accounting estimate disclosure should be similar to the auditor’s discussion of critical audit matters.

As always, your thoughts and comments are welcome!

SASB and IIRC Complete Merger to Become The Value Reporting Foundation

Hot Topic, Reporting

As investors, companies and regulators focus on developing frameworks and standards for ESG and related disclosures, two important organizations in this space have combined.

The SASB, a non-profit organization founded in 2011, has been actively working to develop sustainability standards.  The SASB Standards are currently available for 77 industries and primarily address ESG issues related to financial performance.

The IIRC, starting with its 2013 International Integrated Reporting Framework, has built a set of concepts and related approaches to build reports that focus on “value creation over time and related communications regarding aspects of value creation.”

Hopefully this combination will provide clarity in this rapidly evolving reporting area.  As you can read here, with the combination of the two organizations, they now provide resources including Integrated Thinking Principles, the Integrated Reporting Framework, and SASB Standards.  Companies can tailor their approach to ESG reporting using these tools.

As always, your thoughts and comments are welcome.

The New MD&A Rule: Part Two – Objective

Hot Topic, Reporting

In this post, we overviewed the SEC’s Management’s Discussion and Analysis, Selected Financial Data, and Supplementary Financial Information Final Rule. This rule was published in the Federal Register on January 11, 2021, and is effective for filings on or after February 10, 2021.

The rule’s transition provisions provide a mandatory transition date but also allow voluntary early compliance.  The mandatory transition date is each company’s first fiscal year that ends after August 9, 2021, which is 210 days after the effective date.  Companies may voluntarily apply the new rule, on an S-K item-by-item basis, in any filing made on or after the effective date of February 10, 2021.

This means a company that files a Form 10-K on or after February 10, 2021, has the option to early implement this new MD&A (S-K Item 303) guidance.  If a company has not implemented the rule early, as we suggested in the earlier post, this is a good project to put on our to-do list for the summer.  Additionally, implementation of the new rule provides an opportunity to look for other opportunities to improve our MD&A disclosure.

This post explores the first of the changes to the MD&A requirements, the addition of an objective to S-K Item 303.

A clear writing objective is crucial to effective business writing such as MD&A.  Before this new rule, the most recent statement of the MD&A objective was in FR 72, the 2003 MD&A release which states:

The purpose of MD&A is not complicated. It is to provide readers information “necessary to an understanding of [a company’s] financial condition, changes in financial condition and results of operations.”  The MD&A requirements are intended to satisfy three principal objectives:

  • to provide a narrative explanation of a company’s financial statements that enables investors to see the company through the eyes of management;
  • to enhance the overall financial disclosure and provide the context within which financial information should be analyzed; and
  • to provide information about the quality of, and potential variability of, a company’s earnings and cash flow, so that investors can ascertain the likelihood that past performance is indicative of future performance.

This articulation of MD&A’s objective is over 17 years old, but it has never been part of the core guidance for MD&A in S-K Item 303.  In the new rule, the SEC included a writing objective as part of S-K Item 303 and modernized the language:

229.303 (Item 303) Management’s discussion and analysis of financial condition and results of operations.

(a) Objective. The objective of the discussion and analysis is to provide material information relevant to an assessment of the financial condition and results of operations of the registrant including an evaluation of the amounts and certainty of cash flows from operations and from outside sources. The discussion and analysis must focus specifically on material events and uncertainties known to management that are reasonably likely to cause reported financial information not to be necessarily indicative of future operating results or of future financial condition. This includes descriptions and amounts of matters that have had a material impact on reported operations, as well as matters that are reasonably likely based on management’s assessment to have a material impact on future operations. The discussion and analysis must be of the financial statements and other statistical data that the registrant believes will enhance a reader’s understanding of the registrant’s financial condition, cash flows and other changes in financial condition and results of operations. A discussion and analysis that meets these requirements is expected to better allow investors to view the registrant from management’s perspective.

In the Final Rule the SEC included these statements about the new objective:

By emphasizing the purpose of MD&A at the outset of Item 303, the proposal was intended to provide clarity and focus to registrants as they consider what information to discuss and analyze. The proposal was also intended to facilitate a thoughtful discussion and analysis, and encourage management to disclose factors specific to the registrant’s business, which management is in the best position to know, and underscore materiality as the overarching principle of MD&A.

Registrants should regularly revisit these objectives in Item 303(a) as they prepare their MD&A and consider ways to enhance the quality of the analysis provided. These objectives provide the overarching requirements of MD&A and apply throughout amended Item 303. As such, they emphasize a registrant’s future prospects and highlight the importance of materiality and trend disclosures to a thoughtful MD&A.

The Final Rule also focused on the principles-based requirements for MD&A:

Rather, we continue to believe that MD&A’s materiality-focused and principles-based approach facilitates disclosure of complex and often rapidly evolving areas, without the need to continuously amend the text of the rule to update or impose additional prescriptive requirements. These amendments are intended to further emphasize these goals.

This objective will help companies improve MD&A.  Based on this new objective, here are three key issues to remember in drafting and reviewing MD&A:

  1. Don’t write from a theoretical or academic perspective. Write about what management regards as important and regularly reviews in the financial statements.
  1. Focus on the future as much as the past. Any known issues that indicate historical financial performance is not predictive of future financial performance must be considered for disclosure. (As a reminder of this disclosure requirement check out this enforcement action which involved a $5,000,000 fine when a company failed to disclose an issue that meant that revenues were likely to decline in future periods.)
  1. MD&A must focus on the financial statements but cannot stop there.It should include “other statistical data that the registrant believes will enhance a reader’s understanding of the registrant’s financial condition, cash flows and other changes in financial condition and results of operations.” (This is very consistent with the SEC’s new metrics release which you can read about in this post and hear more about in our March 6, 2020 One-Hour Briefing.)

The updated objective of MD&A and these three framing concepts help us understand what we must communicate to investors and are the foundation for effective MD&A disclosure.

In our next post we will begin applying this foundation.

As always, your thoughts and comments are welcome!

New Item 9C in Form 10-K – Holding Foreign Companies Accountable Act Disclosures

10-K Tips, Hot Topic, Reporting

On March 18, 2021, the SEC Adopted Interim Final Rules implementing disclosure requirements in the “The Holding Foreign Companies Accountable Act” (HFCA Act).  The Act became law on December 18, 2020.  The SEC’s Interim Final Rules became effective on May 5, 2021.  These rules added new Item 9C to Form 10-K and made similar changes to Forms 20-F and 40-F.

The HFCA Act requires disclosures by companies that have retained a PCAOB registered public accounting firm to issue an audit report where “that registered public accounting firm has a branch or office that:

  • Is located in a foreign jurisdiction; and
  • The PCAOB has determined that it is unable to inspect or investigate completely because of a position taken by an authority in the foreign jurisdiction.”

These companies are referred to as “Commission-Identified Issuers.”  New Item 9C(a) in Form 10-K requires that these companies “must electronically submit to the Commission on a supplemental basis documentation that establishes that the registrant is not owned or controlled by a governmental entity in the foreign jurisdiction.”  They must submit this documentation before the due date of the form.  This requirement does not apply if the company is owned or controlled by a foreign governmental entity.

If the SEC determines that a company is a Commission-Identified Issuer for three consecutive years, Section 2 of the HFCA Act requires that the Commission prohibit trading of the company’s securities.

A Commission-Identified Issuer that is a foreign issuer must make additional disclosures.  The term foreign issuer is defined in Exchange Act Rule 3b-4:

 “The term foreign issuer means any issuer which is a foreign government, a national of any foreign country or a corporation or other organization incorporated or organized under the laws of any foreign country.”

The required disclosures are specified in Section 3 of the HFCA Act and are included in Item 9C(b) below.

The updated instructions to Form 10-K now include new Item 9C:

Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections.

(a) A registrant identified by the Commission pursuant to Section 104(i)(2)(A) of the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7214(i)(2)(A)) as having retained, for the preparation of the audit report on its financial statements included in the Form 10-K, a registered public accounting firm that has a branch or office that is located in a foreign jurisdiction and that the Public Company Accounting Oversight Board has determined it is unable to inspect or investigate completely because of a position taken by an authority in the foreign jurisdiction must electronically submit to the Commission on a supplemental basis documentation that establishes that the registrant is not owned or controlled by a governmental entity in the foreign jurisdiction. The registrant must submit this documentation on or before the due date for this form. A registrant that is owned or controlled by a foreign governmental entity is not required to submit such documentation.

(b) A registrant that is a foreign issuer, as defined in 17 CFR 240.3b-4, identified by the Commission pursuant to Section 104(i) (2)(A) of the Sarbanes-Oxley Act of 2002 (15 U.S.C. 7214(i)(2)(A)) as having retained, for the preparation of the audit report on its financial statements included in the Form 10-K, a registered public accounting firm that has a branch or office that is located in a foreign jurisdiction and that the Public Company Accounting Oversight Board has determined it is unable to inspect or investigate completely because of a position taken by an authority in the foreign jurisdiction, for each year in which the registrant is so identified, must disclose:

(1) That, for the immediately preceding annual financial statement period, a registered public accounting firm that the PCAOB was unable to inspect or investigate completely, because of a position taken by an authority in the foreign jurisdiction, issued an audit report for the registrant;

(2) The percentage of shares of the registrant owned by governmental entities in the foreign jurisdiction in which the registrant is incorporated or otherwise organized;

(3) Whether governmental entities in the applicable foreign jurisdiction with respect to that registered public accounting firm have a controlling financial interest with respect to the registrant;

(4) The name of each official of the Chinese Communist Party who is a member of the board of directors of the registrant or the operating entity with respect to the registrant; and

(5) Whether the articles of incorporation of the registrant (or equivalent organizing document) contains any charter of the Chinese Communist Party, including the text of any such charter.

Rule 12b-13 requires that all item numbers be included in Form 10-K.  That said, for most companies the response to this new item will likely be “Not applicable.”

As always, your thoughts and comments are welcome.

Let’s Add MD&A Modernization to Our Summer To-do Lists

Reporting

Now that most of us are through the crunch of year-end and first-quarter reporting, it is time to give some thoughtful consideration to how we will implement the SEC’s November 19, 2020 MD&A changes.

As a reminder, this is the rule that modernized and updated several areas in S-K Item 303, including:

  • Modernizing and moving  the principal objectives of MD&A to new Item 303(a);
  • Adding Item 303(b)(1) to modernize, enhance and clarify disclosure requirements for liquidity and capital resources;
  • Adding Item 303(b)(2) to clarify, modernize and streamline disclosure requirements for results of operations;
  • Moving critical accounting estimate disclosures to new Item 303(b)(3) and modernizing these disclosure requirements;
  • Replacing current Item 303(a)(4), Off-balance sheet arrangements, with a more principles-based instruction to discuss such obligations in the broader context of MD&A;
  • Eliminating current Item 303(a)(5), Tabular disclosure of contractual obligations, as this information is required in a more principles-based, narrative form in the revised liquidity and capital resources disclosure requirements;
  • Adding an option to the interim period MD&A requirements to include sequential-quarter analysis rather than year-over-year analysis; and
  • Removing the paragraph addressing the impact of inflation, as such discussion would be required by the overall objective of MD&A.

The transition for the new rules provides that companies can voluntarily adopt the changes on an S-K item-by-item basis after the effective date of February 10, 2021.  If a company does not early implement the new rule, the mandatory transition date is the company’s fiscal year that ends on or after August 9, 2021.  For calendar year-end companies the new rules must be implemented for the year ended December 31, 2021.

A Reminder – Selected Financial Data and Quarterly Information

This is the Final Rule that also changed the requirement for the five-year summary and quarterly information disclosures.  We explored these changes in this post from January 14, 2021.  Removing the five-year summary and only including quarterly information if it has been materially, retrospectively adjusted are changes that are fairly straightforward and easy to implement.  An issue to note, if a company decides it wants to keep the five-year summary, there is no longer a Form 10-K Item 6, as it is now “reserved.”  This means that a company that wants to keep the five-year summary would have to include it somewhere else, likely MD&A.

Transition Planning – MD&A

Implementing the new MD&A rules will require more planning and thought.  There are many considerations, ranging from the new liquidity and capital resources requirements to clearer critical accounting estimate disclosures.  Additionally, in most organizations, there are several stakeholders in MD&A disclosure who will need to be involved in the implementation.  To hopefully help in this process, we are starting a series of blog posts that will explore each MD&A change and discuss the practical issues and challenges in implementation.  Each post is designed to help companies who have not implemented these new requirements plan the process and build the team to make these changes.

Perhaps more importantly, the new principles-based MD&A requirements are designed to help companies build a clearer and more informative MD&A.  This transition provides an opportunity to make MD&A more informative and helpful for investors.  Companies can combine the objective of improving their MD&A with the process of implementing the new S-K Item 303 guidance.

Our next post will explore the changes to the objective of MD&A and discuss how to use this objective as we draft MD&A to make it simpler and easier to follow.

In the meantime, to provide an example of a company that went all in and implemented the new rules for their year-ended December 31, 2020, check out Lumen Technologies 2020 Form 10-K.

To help readers understand why their 2020 Form 10-K looks different, Lumen provided this helpful disclosure at the very beginning of Item 1 about the changes in their 10-K related to new rules.

Changes from Prior Periodic Reports

In this report we have complied with the disclosures required by the Securities and Exchange Commission (“SEC”) release No. 33-10825 “Modernization of Regulation S-K Items 101, 103, and 105”, and we have early adopted the changes in disclosure standards included in SEC release No. 33-10890 “Management’s Discussion and Analysis, Selected Financial Data, Supplementary Financial Information.”

Modernization of Regulation S-K Items 101, 103 and 105

Effective as of November 9, 2020, the SEC issued Release No. 33-10825, “Modernization of Regulation S-K Items 101, 103, and 105.” This release was adopted to modernize the description of business, legal proceedings, and risk factor disclosures that registrants are required to make pursuant to Regulation S-K. Specifically, this release requires registrants to provide disclosures relating to their human capital resources and to restructure their risk factor disclosures. Additionally, the release increases the threshold for disclosure of environmental proceedings to which the government is a party.

These changes are required for any annual period subsequent to the effective date of November 9, 2020. As such, we have adopted these changes in this report.

Management’s Discussion and Analysis, Selected Financial Data, and Supplementary Financial Information

In November 2020, the SEC issued Release No. 33-10890, “Management’s Discussion and Analysis, Selected Financial Data, and Supplementary Financial Information” which will become fully effective on August 9, 2021, with voluntary compliance permitted on or after February 10, 2021. This release was adopted to modernize, simplify, and enhance certain financial disclosure requirements in Regulation S-K. Specifically, the SEC eliminated the requirement for selected financial data, only requiring quarterly disclosure when there are retrospective changes affecting comprehensive income, and amending the matters required to be presented under Management’s Discussion and Analysis (“MD&A”) to, among other things, eliminate the requirement of the contractual obligations table.

With our early adoption of this release, we have eliminated from this document the items discussed above that are no longer required. Information on our contractual obligations is still disclosed in a narrative within the “Management’s Discussion and Analysis of Financial Condition and Results of Operations” in Item 7 of Part II of this report.

You will find Lumen’s MD&A on page 34 of their Form 10-K.

As always, your thoughts and comments are welcome!

PCAOB Provides Insights Into the 2021 Inspection Process

Hot Topic, Reporting

On April 6, 2021, the PCAOB published two documents addressing 2021 inspections:

Audit Committee Resource – 2021 Inspections Outlook, and

Spotlight – Staff Outlook for 2021 Inspections.

While these documents are directed primarily to auditors, they provide insights to help company management avoid audit surprises and problems.

The Audit Committee Resource reinforces the PCAOB’s commitment to “seeking views and feedback from audit committees” through its outreach process.  In 2019 and 2020 the PCAOB visited with over 700 audit committee chairs.  It also provides audit committee perspectives for areas including:

  • Auditor’s Risk Assessments
  • Firms’ Quality Control Systems
  • How Firms Comply with Auditor Independence Requirements
  • Fraud Procedures
  • Critical Audit Matters
  • How Firms Implement New Auditing Standards
  • Supervision of Audits Involving Other Auditors

The Spotlight report outlines several inspection process changes and focus areas for 2021.  Changes to the inspection process will include reviewing financial reporting and audit risks posed by COVID-19 and reducing the predictability of the inspection process.  The PCAOB will select more engagements randomly and inspect more “non-traditional” audit areas.

The report outlines areas where inspections continue to find deficiencies, such as revenue and accounting estimates.  The list of other areas where the staff plans to concentrate inspection resources includes firm quality control systems, how firms comply with independence requirements, fraud procedures, critical audit matters, implementation of new auditing standards, responding to cyber threats, auditing digital assets and supervision of audits involving other auditors.  These areas are consistent with those in the Audit Committee Resource.

As always, your thoughts and comments are welcome

A Risk Factor Rewrite Example

10-K Tips, Hot Topic, Reporting

The SEC’s May 2020 risk factor disclosure modernization created a great opportunity to rethink risk factor disclosures and focus on communicating material risks.

The prior S-K disclosure requirements for risk factors included this language:

229.105 (Item 105) Risk factors.

Where appropriate, provide under the caption “Risk Factors” a discussion of the most significant factors that make an investment in the registrant or offering speculative or risky. This discussion must be concise and organized logically. Do not present risks that could apply generically to any registrant or any offering. Explain how the risk affects the registrant or the securities being offered. Set forth each risk factor under a subcaption that adequately describes the risk.

The May 2020 Final Rule revised the requirements with this language:

229.105   (Item 105) Risk factors.

(a) Where appropriate, provide under the caption “Risk Factors” a discussion of the material factors that make an investment in the registrant or offering speculative or risky. This discussion must be organized logically with relevant headings and each risk factor should be set forth under a subcaption that adequately describes the risk. The presentation of risks that could apply generically to any registrant or any offering is discouraged, but to the extent generic risk factors are presented, disclose them at the end of the risk factor section under the caption “General Risk Factors.”

(b) Concisely explain how each risk affects the registrant or the securities being offered. If the discussion is longer than 15 pages, include in the forepart of the prospectus or annual report, as applicable, a series of concise, bulleted or numbered statements that is no more than two pagessummarizing the principal factors that make an investment in the registrant or offering speculative or risky.

(Note: the entire new text of S-K Item 105 can be found here.)

Three aspects of this rule change create opportunities to rethink this disclosure:

The change in language from “significant factors” to “material factors,”

The requirement to put “generic” risk factors at the end of the discussion and use the heading “General Risk Factors,” and

The requirement to include a summary if risk factors are longer than 15 pages.

Lumen Technologies took advantage of this opportunity in a meaningful way.   In Lumen Technologies’ Form 10-K for the year-ended December 31, 2019, risk factors are on pages 20 to 48, 28 pages long.  Risks described range from “Risks Affecting Our Business” to “Other Risks.”  It would be fair to say that some of the risk factors, such as “We may not be able to compete successfully against current and future competitors” might be “risks that could apply generically to any registrant or any offering.”

After implementing the new disclosure requirements, and a major amount of work, in Lumen Technologies’ Form 10-K for the year ended December 31, 2020, risk factors are on pages 21 to 32.  This is a reduction from 28 to 11 pages!  The revised disclosures start with “Business Risks,” a simpler and more direct heading, and finish with “General Risks” as required by the new rule.  Interestingly, the General Risks are less than one page.  Competitive issues are addressed in a more tailored risk factor titled “We operate in an intensely competitive industry and existing and future competitive pressures could harm our performance.”

“We took the SEC’s changes to S-K Item 105 as an opportunity to take a fresh look at our risk factors,” said David Hamm, Associate General Counsel at Lumen Technologies. “After a robust cross-functional effort, we believe we enhanced and streamlined our risk factors while maintaining existing protections.”

Lumen Technologies’ revised presentation is more direct and clearly more investor friendly.

As always, your thoughts and comments are welcome!

A Timely Form 12b-25 Reminder from SEC Enforcement!

Reporting

On April 29, 2021, with deadlines for first-quarter reports rapidly approaching, the SEC Enforcement Division sent an important message about using Form 12b-25 to request due date extensions.  Form 12b-25 is short and simple.  And while the extensions of 15 calendar days for an annual report and 5 calendar days for a quarterly report are not particularly long, they can be helpful to avoid becoming a non-timely filer and losing Form S-3 for twelve months. Yet, like all other SEC reports, if a 12b-25 is not complete there are consequences.

The likely source of problems with 12b-25 lies in “Part III – Narrative.”  Part III provides this instruction:

State below in reasonable detail why Forms 10-K, 20-F, 11-K, 10-Q, 10-D, N-CEN, N-CSR, or the transition report or portion thereof, could not be filed within the prescribed time period.

(Attach extra Sheets if Needed)

As we discuss in our Workshops, it is important to make complete disclosures of all the reasons for any delay. One example we cite is a February 2005 enforcement case – FFP Marketing Company, Inc., Warner Williams, and Craig Scott, CPA.  In February 2002, FFP Marketing Company discovered its financial statements were materially misstated.  In a Form 12b-25 to extend the due date of its December 31, 2001 Form 10-K, the CFO/CLO failed to disclose this fact.  When the restatement came to light, the SEC enforced, sanctioned the company, and barred the CFO/CLO from SEC practice for three years.

While the FFP Marketing case was many years ago, on April 29, 2021, just before the due dates for first-quarter reports, the SEC  announced Form 12b-25 enforcement cases against eight companies.  Using data analytics, the SEC found that these companies filed Form 12b-25s that failed to disclose that “anticipated restatements” caused the delays.  Each of the companies entered into cease and desist orders and paid fines ranging from $25,000 to $50,000.

The loss of Form S-3 for twelve months, while not stated in the enforcement release, is also another likely consequence in this type of case.

As always, your thoughts and comments are welcome!