While an intense focus on internal controls in recent years is leading to improvement in financial reporting, regulators are growing more convinced that an underbelly of weaknesses still lurks in corporate accounts that isn’t being disclosed to investors.

In a recent speech to accounting academics, Jeanette Franzel, a member of the Public Company Accounting Oversight Board, presented a bevy of statistics that raise deep questions about the true state of internal controls over financial reporting among public companies. Why do so many companies with restatements issue clean reports on internal controls before restating financials? Does that mean material weaknesses in internal controls are not being identified? Or worse, are they being identified, but not reported?

Franzel said this “noise” in the data on internal control merits closer attention to determine what’s really happening on the control front. She’s curious, she said, why the data show an overall increase in the percentage of adverse opinions on internal control (from 3.4 percent in 2010 to 5.2 percent in 2014) while also showing an overall increase in the percentage of clean internal control opinions preceding financial statement restatements: from 74.2 percent in 2010 to 80.4 percent in 2014.

The sheer volume of restatements that follow clean audit opinions is puzzling in itself, Franzel said. “The data show that often a material weakness is not identified even when a known misstatement occurs and suggest that there may be undisclosed material weaknesses in ICFR,” she said. “Why do the vast majority of issuers with financial restatements receive a clean audit opinion on ICFR? Is this simply a timing issue or are there other underlying causes? Have there been undisclosed material weaknesses in this group of issuers?”

The Securities and Exchange Commission has been pondering these same questions publicly since at least 2013. In speeches at professional conferences, SEC staff members have said they suspect companies are not disclosing material weaknesses in internal control. Franzel is the first to dissect the suspicion in such statistical detail.

“There are a lot of analytics there to suggest that companies are not discussing or acknowledging weaknesses, but instead are relying on the fact that there are no material misstatements, so therefore controls are fine,” says Pat Voll, vice president at financial reporting consulting firm RoseRyan. “That’s not an appropriate conclusion.”

“There are a lot of analytics there to suggest that companies are not discussing or acknowledging weaknesses but instead are relying on the fact that there are no material misstatements, so therefore controls are fine. That’s not an appropriate conclusion.”
Pat Voll, Vice President, RoseRyan

It could be that companies or their auditors see control problems during the year, but address them to a point where they don’t get flagged as material weaknesses as of the financial statement date, says Sri Ramamoorti, a director of the Corporate Governance Center at Kennesaw University. “We know clients are very unhappy about getting material weaknesses,” he says. “So they will suddenly present compensating controls, like pulling a rabbit out of a hat, just in time. This is not good for the auditing profession or the client concerned.”

Ron Kral, managing partner at governance firm Candela Solutions and a member of Financial Executives International, says the tension over close calls is definitely a dynamic in the examination of undisclosed weaknesses. “There’s strong-arming involved,” he says. “Auditors are always conscious of the long-term relationship. It’s often easier to take the path of downgrading to a significant deficiency.”


Below is an excerpt from PCAOB member Jeanette Franzel’s speech on ICFR.
In my view, the increase in adverse opinions between 2010 and 2014 is notable, going from 138 to 200, as seen in table 2, and representing an increase of 45 percent. It is also notable that the PCAOB began putting significant focus and emphasis on audits of ICFR in its 2010 inspections—a focus that has continued since then.

Despite this trend of increasing numbers of adverse ICFR opinions, there is other data that also suggest there may be room for improvement in identifying and disclosing material weaknesses.
For example, a restatement of prior period financial statements to correct a material misstatement is an indicator of a material weakness in ICFR, and the rate of restatements continues to exceed the rate of opinions with material weaknesses.
In 2014, approximately 326 (or 8.4 percent) of the 3,863 companies with audit opinions on ICFR restated their financial statements from prior years. The rate of financial restatements among companies with ICFR opinions has increased in recent years, from 5.6 percent in 2010 to 8.4 percent in 2014, as shown in figure 2 below.

On an overall basis, the rate of restatements (figure 2) exceeds the rates of adverse ICFR opinions (figure 1) for those companies that receive ICFR opinions.
Source: PCAOB.

Franzel wonders about the dynamics at play as well. “I’ve heard anecdotally that it is difficult for auditors to convince an audit client that a material weakness exists in the absence of a material misstatement,” she said. “To what extent does this pressure exist and potentially cause under-reporting of material weaknesses?”

We’re Not There Yet

To see evidence that material weaknesses are going undisclosed to investors suggests the entire objective of internal control reporting under the Sarbanes-Oxley Act has not yet been achieved, more than a decade after its enactment. “The whole point was to provide information in advance of any financial restatement,” says Joe Carcello, executive director of the corporate governance center at the University of Tennessee. “If investors never get information in advance, it’s not exactly clear what the point of it is.”

Jim DeLoach, managing director at consulting firm Protiviti, says he was most fascinated by an additional data point Franzel provided showing that the number of clean internal control audit opinions that are restated, while small, is growing. It was 25 in 2010 and grew to 33 in 2013. Those are cases where a company received a clean opinion on controls, but the audit firm later provided an adverse opinion on the same reporting period. Franzel said PCAOB inspections prompted a number of those restated opinions.

“That says these numbers could be just the tip of the iceberg,” says DeLoach. “If the fact comes to light that you have a material weakness in the current year and there’s clear evidence that the condition also existed in prior years, why shouldn’t that fact be disclosed? That would give more insight into the failings of the system, but that insight is not addressed.”

The growing discussion of undisclosed control weaknesses at the PCAOB and SEC could lead to changes in guidance or standards, DeLoach says. “Both regulators are raising legitimate questions about these data points,” he says. “They are asking themselves: Is the system delivering to Sarbanes-Oxley’s objective of providing investors an early warning that there are potential financial statement restatement risks? I think potentially it could lead to some rulemaking down the road.”

Tom Ray, former chief auditor at the PCAOB now a guest lecturer at Baruch College and an audit consultant, says regulators’ discussion of undisclosed weaknesses suggests while companies and auditors may have made progress on internal controls, the system is not yet sound. “I don’t see the PCAOB backing off on the way they’re looking at internal control audits,” he says. “We’ve been suffering through this for three years, and we’ve made some improvements but we are continuing to suffer through it. One has to have confidence that maybe after a little more time passes, companies will get it, auditors will get it, and the PCAOB will start being satisfied with the work that is being done.”

Ramamoorti said he believes the PCAOB’s consideration of possible changes in the audit report—moving away from a pure pass-fail report one that provides more insight into close calls—would help draw out more undisclosed weaknesses. “There are so many shades of gray in the middle, but auditors are unable to express opinions on any of those things,” he says. “Not all who got a pass are created equal. We need for the public to be better informed.”

Elizabeth Ryan, director at consulting firm MorganFranklin, says the discussion around undisclosed material weaknesses in internal controls is yet another reason for management to assure its focus on controls is based on risk. “What are the risks to material misstatement?” she asks. “Identify those risks, and look at the controls that would mitigate those risks. We are getting smarter, but we have a long way to go.”