Public companies can expect no relief in the regulatory and audit pressure on internal control over financial reporting, based on the latest remarks out of the Securities and Exchange Commission.

Instead, Chief Accountant Jim Schnurr is encouraging preparers to communicate more with their auditors and open up to the idea that perhaps the tension arises because their controls are not up to snuff. “The ICFR issues identified by the PCAOB may not be just a problem of audit execution,” he said at an annual national accounting conference on accounting and auditing issues. “Rather, they may, at least in part, be indicative of deficiencies in management’s controls and assessments.”

Schnurr says auditors, management, and audit committees need to focus on the ongoing maintenance and assessment of internal controls with “robust dialogue” within the context of existing guidance from both the SEC and the Public Company Accounting Oversight Board. He urged preparers, in addition to pursuing more communication and dialogue with auditors, to “push back” on demands for evidence or documentation that aren’t justified through the risk assessment or the audit plan. “If someone tells you to do something, you absolutely need to push back and get an explanation.”

Brian Croteau, deputy chief accountant at the SEC, said at the conference that SEC staff continue to consult on filing reviews and enforcement investigations that involve internal control issues. “Based on discussions with public company management teams during our consultations, there are encouraging signs that some ICFR reminders provided by SEC staff in recent years at this and similar conferences are being heard,” he said.

And there’s more encouraging evidence, he said, that management is waking up to control problems. For two consecutive years, the staff is finding an “uptick,” he said, in the reporting of material weaknesses in internal control that arise outside of the context of a material misstatement. That’s an area where the SEC has raised concerns in the past as an indicator that companies were not timely identifying control problems.

Given the continued persistence of PCAOB findings on internal control, Croteau said management and auditors need to remember the importance of identifying and describing the nature of a control deficiency, especially understanding the “complete population of transactions” that the control is intended to address. In assessing the severity of a deficiency, both likelihood and magnitude of misstatement must be considered. The final conclusion on the severity of deficiency needs to consider that “could factor,” he said, yet too often it “appears to be an afterthought in a company’s analysis.”

Reliability of the information used to evaluate the severity of control deficiencies also counts, he said, including using reasonable assumptions about the risks of misstatements resulting from the deficiency. “If the evaluation leads to an effort to obscure the severity of a control deficiency, investors are less likely to receive the disclosures they expect,” he said.

SEC Chair Mary Jo White said at the conference that preparers need to recognize their ability to fulfill financial reporting responsibilities depends significantly on the design and effectiveness of controls. While some initially questioned the value of such controls, she says, the SEC hears more support and sees the benefits in improved financial reporting.

“It is hard to think of an area more important than ICFR to our shared mission of providing high-quality financial information that investors can rely on,” said White. “We need to be frank about any challenges in the operation and assessment of ICFR and address them to the extent appropriate.”

Topics