SEC plans focus on internal controls at year-end

Given big changes companies are undertaking in their accounting processes, staff at the Securities and Exchange Commission plan to pay special attention to internal controls.

At a year-end conference of the American Institute of Certified Public Accountants, SEC staff members said they have seen some progress among public companies in assessing and reporting on the effectiveness of their internal control over financial reporting. However, massive accounting changes in revenue recognition and leases have upended control structures, and those control structures are critical to robust, compliant accounting.

“The assessment of ICFR is especially important this year-end, given the impact on companies’ internal controls related to the adoption of new accounting standards, such as revenue recognition,” said Emily Fitts, a professional accounting fellow at the SEC. Evaluating the operating effectiveness of controls will be critical, and design of the controls is the starting point, she said.

“The foundation of the evaluation is to determine if the control is operating as designed,” said Fitts. “The nature, timing, and extent of the evaluation procedures should be linked to the assessed risk of control failure and the risk of material misstatement.”

Controls should address the risks that have been identified to reliable reporting, said Fitts, including any changes to those risks. “A vital step in management’s evaluation of whether the operation of the control is effective is the consideration of whether the control has operated as it was designed,” she said.

Fitts linked the evaluation of operating effectiveness to the risk of control failure and material misstatement. “As these risks increase, generally more persuasive evidence is needed in order to sufficiently evaluate whether the control operated effectively,” she said.

Tom Collens, another professional accounting fellow at the SEC, said staff members look at control deficiencies through the eyes of a “prudent official,” as specified in the SEC’s guidance to management on internal controls. “Consistently applying this mindset will help management perform a more holistic and effective evaluation of the severity of control deficiencies compared to some of the more narrow evaluations we have seen in some instances through our consultations at OCA,” he said.

Reminding preparers that they are required to consider not just actual misstatements, but potential misstatements, Collens urged a holistic approach to evaluating controls. “We have seen instances where management believes that the effect of a control deficiency is relegated to the specific area in which a misstatement occurred without considering whether it is reasonably possible that other financial statement areas could be impacted based upon the root cause of the control deficiency,” he said.

If compensating controls are the planned backstop, preparers need to keep in mind the level of precision at which those controls operate, Collens said. “To be a compensating control, the control should be designed to achieve the same objective as the control identified as deficient,” he said. “To illustrate, we have objected to instances where management believed that the existence of compensating controls reduced the severity of a control deficiency below the level of a material weakness despite the fact that a material misstatement did exist.”

Where a robust evaluation reveals material weaknesses in controls, the SEC will also be looking for good disclosure, said Fitts. While the staff has seen some improvements, “more could be done to make these disclosures more informative to investors,” she said. Disclosures should make clear to investors what went wrong, what effect it had on reporting, and what management plans to do to remediate the problem, she said.