In our Workshops, participants almost always have a reasonable understanding of Internal Control Over Financial Reporting (or ICFR). And this makes sense; the concept of internal control in the financial reporting process has existed for decades. When SOX required all companies to evaluate their ICFR, the way banks had been evaluating ICFR since the FDICIA Act of 1991, it was not a brand new idea.
But what about controls over the preparation of information which is outside of the financial statements? Prior to SOX there was no “control” process for non-financial information. Recognizing that the non-financial information in a filing can be as important if not more important than the financial statements, SOX created a new category of controls, disclosure controls and procedures (DCP for short).
This post reviews some background about DCP and then we dive more deeply into four common DCP problem areas and include some example SEC comments. (If you are comfortable with the concept of DCP, you can skip to the comments at the end.)
The technical definition of DCP is in Exchange Act Rule 13a-15:
(e) For purposes of this section, the term disclosure controls and procedures means controls and other procedures of an issuer that are designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the Act (15 U.S.C. 78a et seq.) is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the Act is accumulated and communicated to the issuer’s management, including its principal executive and principal financial officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.
From this definition it is clear that DCP applies to the entire report. So, for example, in a Form 10-K, while ICFR applies to the financial statements in Item 8, DCP applies to the whole report, Items 1 through 15, including MD&A, includes a substantive portion of ICFR in the financial statements.
When SOX created a requirement to evaluate ICFR, it also created a requirement to evaluate DCP. Again, from Rule 13a-15:
(b) Each such issuer’s management must evaluate, with the participation of the issuer’s principal executive and principal financial officers, or persons performing similar functions, the effectiveness of the issuer’s disclosure controls and procedures, as of the end of each fiscal quarter, except that management must perform this evaluation:
(1) In the case of a foreign private issuer (as defined in §240.3b-4) as of the end of each fiscal year….
Both Form 10-K in Item 9A and Form 10-Q in Part I Item 4 refer to S-K Item 307:
- 229.307 (Item 307) Disclosure controls and procedures.
Disclose the conclusions of the registrant’s principal executive and principal financial officers, or persons performing similar functions, regarding the effectiveness of the registrant’s disclosure controls and procedures (as defined in §240.13a-15(e) or §240.15d-15(e) of this chapter) as of the end of the period covered by the report, based on the evaluation of these controls and procedures required by paragraph (b) of §240.13a-15 or §240.15d-15 of this chapter.
[68 FR 36663, June 18, 2003]
One important difference between ICFR and DCP is that a newly public company does not have to report on the effectiveness of its ICFR in its first 10-K and in fact an Emerging Growth Company does not have to report on the effectiveness of its ICFR while it is an emerging growth company. But DCP must be evaluated immediately in the company’s first 10-Q or 10-K. And this evaluation must be performed each quarter.
DCP Problem Areas
Here are four common issues with some example comments about the DCP reporting process:
Have you documented your evaluation of DCP?
Have you said DCP are or are not effective?
Have you considered the impact of ICFR issues on DCP?
When you remediate, remember to disclose what you did.
Have you documented your evaluation of DCP?
One challenging issue in the evaluation of DCP is how much documentation is required? As a brand new concept with SOX, DCP does not have the history that ICFR has. Companies may have a Disclosure Committee, use sub-certifications, or have CEO and CFO meetings with operations managers, all of which would be part of DCP. But there is no formal “framework” for DCP and much more judgment is required. The same is true of the evaluation process. That said, it is clear it is required:
Controls and Procedures, page 105
- We note the disclosures under subsections (a) and (b) under this heading refer to management’s evaluations and conclusions of the effectiveness of disclosure controls and procedures and internal control over financial reporting as of and for the year December 31, 2013. In your response please confirm, if true, that company’s management performed the annual assessments as of the end of the period covered by this report, December 31, 2014. Please also provide us with the revised disclosures, with the applicable period, that includes the following:
- the evaluations and conclusions of the principal executive and principal financial officers, regarding the effectiveness of the company’s disclosure controls and procedures as of the end of the period covered by the report, as prescribed by Item 307 of Regulation S-K; and
- a report from management on the company’s internal control over financial reporting with the elements prescribed in Item 308(a) of Regulation S-K.
Have you said DCP are or are not effective?
Just as with ICFR a conclusion that DCP are or are not effective is required when they are evaluated. Note that in both the following comments the SEC is requiring the company to amend their filing:
Item 4. Controls and Procedures, page 35
- Based on the evaluation of disclosure controls and procedures as of June 30, 2014, your chief executive officer and chief financial officer concluded that your disclosure controls and procedures were effective as of June 30, 2014, except for the impact of material weaknesses in your internal control over financial reporting. We believe that Item 307 of Regulation S-K requires your officers to conclude if your disclosure controls and procedures are “effective.” We do not believe it is appropriate for your officers to conclude that your disclosure controls and procedures are effective “except for” certain identified problems. Your officers must definitively conclude whether your disclosure controls and procedures are effective or ineffective. Your officers should consider the identified problems in determining if your disclosure controls and procedures are effective. If your officers conclude your disclosure controls and procedures are effective, please disclose the basis for their conclusion in light of these material weaknesses. If you determine that your disclosure controls and procedures were ineffective as of June 30, 2014 when considering these identified problems, please amend your Form 10-Q for the period ended June 30, 2014 to include your revised assessment of your disclosure controls and procedures.
- In the first paragraph of this section, you disclose that your disclosure controls and procedures were adequate. Meanwhile, in the second paragraph of this section, you disclose that your disclosure controls and procedures were not effective. In an amendment to your Form 10-K, please revise to disclose your conclusion that your disclosure controls and procedures are effective or ineffective, whichever the case may be. Refer to Item 307 of Regulation S-K.
Have you considered the impact of ICFR issues on DCP?
As described above DCP includes ICFR as a subset of DCP. This means that if a company has a material weakness in ICFR it likely also impacts on DCP.
Item 4. Controls and Procedures, page 21
- As reported in your Form 10-K for the year ended July 31, 2015, management identified material weaknesses in internal controls over financial reporting, and you disclose that your remediation of the material weaknesses in your internal control over financial reporting is ongoing. Given this, please tell us the factors that management considered in concluding that disclosure controls and procedures were effective for the period.
When you remediate, remember to disclose what you did.
Lastly, just as with ICFR, when you remediate a problem area, be sure to appropriately disclose what you did to fix a control problem
Evaluation of Disclosure Controls and Procedures, page 7
- We note that you conclude that your disclosure controls and procedures were not effective on June 30, 2015. Please expand your disclosures to clearly discuss the material weakness identified, when it was discovered and your plans to remediate it.
- We note your conclusion indicating that your disclosure controls and procedures were not effective as of your June 30, 2015 fiscal year end due. Further, we note your management concluded that disclosure controls and procedures in your Form 10-Q filed on November 16, 2015 were effective and there were no changes in your internal control over financial reporting during the quarter ended September 30, 2015. Please revise to expand your disclosures to explain how management determined that its disclosure controls and procedures were effective at September 30, 2015 given that the company concluded that they were ineffective at year end. In this regard, tell us and disclose how you remediated the material weakness that caused you to conclude that your disclosure controls and procedures were not effective at June 30, 2015. Also, please revise your disclosures to comply with Item 308(c) of Regulation S-K to include details of any changes that may have materially affected or are reasonably likely to materially affect the company ́s internal control over financial reporting.
As always, your thoughts and comments are welcome!