At first glance, it was a seemingly incongruous filing that Centerpoint Energy made in January. The company confessed to ineffective disclosure controls and procedures surrounding some natural gas transactions, which overstated its 2004 revenues and expenses by $511 million—and then, two paragraphs later, asserted that its internal control over financial reporting was fine.
In fact, as a spate of corporate filings show, corporations actually can report strong controls for financial reporting and weak controls over disclosures, or vice-versa. The reason rests in the heart of the differences between Section 302 of Sarbanes-Oxley and Section 404.
The Securities and Exchange Commission says that under Section 302, a company’s chief executive and chief financial officers must evaluate the effectiveness of its disclosure controls and procedures on a quarterly and annual basis. Disclosure controls and procedures generally refer to the process that companies go through to prepare for the release of information to the public, such as through press releases or regulatory filings. They are the overall management systems that result in a quarterly report being prepared, completed and filed on time.
Section 404, on the other hand, requires annual attestations by management on the company’s internal control over financial reporting, which involves its accounting and auditing procedures. While financial controls are related to disclosure controls, and can affect a business’s ability to disclose information, the process of compiling and releasing financial information differs from the process involved in periodic reporting to the SEC.
Richards
“A company can say under 302 that they have proper disclosure controls, when in fact their internal controls over financial reporting contain a [material weakness] which does not surface until such time as the annual 404 work is done, since it is much more detailed in its review,” says David Richards, president of the Institute of Internal Auditors. “I liken it to the fact that disclosure controls are focused on those actions within the organization that are taken to ensure the accuracy of the preparation of the [financial statements]—not the accuracy of the data going into the financial statements, which is the focus of the 404 review.”
Under the current 302 interpretation, a company is required to update its annual 404 statement by disclosing any major changes in internal controls that may have occurred, plus continue to state that nothing has come to the management’s attention that would change its overall opinion on the effectiveness of the company’s internal control over financial reporting, Richards says.
A quarterly report filed by Toys R Us in June 2005 provides an example of where a material weakness in internal control over financial reporting affected the company’s ability to certify its disclosure controls.
EXAMPLE
Below is an excerpt from a June 8, 2005 filing from Toys R Us outlining its ineffective disclosure controls.
As described in Note 2 entitled "Restatement of Financial Statements for Accounting for Leases and Leasehold Improvements" and as more fully described in Item 9A of the Company's Annual Report on Form 10-K for the fiscal year ended January 29, 2005, management reviewed the Company's accounting practices for leases and leasehold improvements as a result of views expressed by the office of the Chief Accountant of the Securities and Exchange Commission in a February 7, 2005 letter to the American Institute of Certified Public Accountants, regarding certain operating lease accounting issues and their applicability under generally accepted accounting principles, and concluded that our previously established accounting practices for leases and leasehold improvements were incorrect, and accordingly, we determined to restate certain of our previously issued financial statements to reflect the correction in the Company's accounting practices for leases and leasehold improvements. As a result, the Company concluded that it had a material weakness in controls over the selection and monitoring of its accounting practices used in its accounting for leases and leasehold improvements as of January 29, 2005. As a result, the Company's Chief Executive Officer and Chief Financial Officer concluded that solely as a result of the foregoing lease accounting matter, the Company's disclosure controls and procedures were not effective as of the end of the fiscal period covered by our Annual Report on Form 10-K for the year ended January 29, 2005.
Subsequent to January 29, 2005, to remediate the above referenced material weakness in the Company's internal control over financial reporting and the ineffectiveness of its disclosure controls and procedures, the Company corrected its method of accounting for leases and leasehold improvements. During the quarter ended April 30, 2005, the Company has implemented additional review procedures over the selection and monitoring of appropriate assumptions and factors affecting lease accounting practices.
In connection with the preparation of this Quarterly Report on Form 10-Q, as of the end of the fiscal period covered by this Quarterly Report on Form 10-Q (April 30, 2005), the Company performed an evaluation, under the supervision and with the participation of the Company's management, including the Company's Chief Executive Officer and Chief Financial Officer, of the effectiveness of the design and operation of the Company's disclosure controls and procedures pursuant to Rules 13a-15(e) and 15d-15(e) under the Exchange Act. Based on this evaluation, the Company's Chief Executive Officer and Chief Financial Officer concluded that, as a result of the remediation of the material weakness described below, the Company's disclosure controls and procedures were effective as of the end of the fiscal period covered by this Quarterly Report on Form 10-Q (April 30, 2005).
Other than as discussed above, during our first quarter of 2005, there have not been any changes in our internal control over financial reporting (as such term is defined in Rules 13a-15(f) and 15d-15(f) under the Exchange Act) during the fiscal quarter to which this report relates that have materially affected, or are reasonably likely to materially affect, our internal controls over financial reporting.
Source
Toys R Us 10-Q (June 8, 2005)
A review by management into Toys R Us’ accounting practices for leases and leasehold improvements found that the retailer’s previous practices for those items were incorrect, and the company had to issue a restatement. As a result, Toys R Us determined it had a material weakness in controls over the selection and monitoring of accounting practices used for leases and leasehold improvements as of Jan. 29, 2005, and its disclosure controls and procedures were deemed ineffective for that fiscal year, according to the filing.
Toys R Us wasn’t the only company that had to adjust its accounting practices for leases and leasehold improvements, spokeswoman Kathleen Waugh said in an interview. Regulators “were asking for everybody to account for leases in a certain way. We were one of many companies that had to make that change.” The company has since been bought by three private equity groups.
Martin
Confusion over the difference between the disclosure and internal controls derives in part from the language of the Sarbanes-Oxley Act itself, says David Martin, head of the securities practice at the law firm Covington & Burling and a former director of corporation finance at the Securities and Exchange Commission.
Section 302, as drafted by Congress, says that once a quarter and every year, the chief executive and chief financial officers must attest to the effectiveness of their company’s internal controls. Section 404 says that each public company’s annual report will include an assessment by management of internal control structure and procedures for financial reporting. The law doesn’t distinguish or define the types of controls for each of the sections.
Since execution of SOX was placed under the SEC, the commission was able to rationalize the two sections’ requirements, Martin explains. To ease the administrative burden on companies, the SEC proposed rules that split the internal control requirements into two categories: disclosure and financial reporting, with the latter being required only once a year.
Thompson
Generally to comply with Section 302, companies have a disclosure committee that reviews the data compiled by various business units. Membership on the committee varies by firm; top executives such as the chief executive or chief financial officers may participate, as well as the general counsel and a representative from investor relations, says Louis Thompson, chief executive of the National Investor Relations Institute.
Requiring the managements of companies to attest to both sets of controls won’t necessarily stop fraud from occurring, he adds. While companies are requiring certification from the bottom of the organizational chart to the top, if someone along that chain is lying when he certifies his results, it will be tough for the top executives to discover that right away.
“Investors will be deceived if they believe that all of these controls will avoid fraud,” he says. “If someone is still intent on doing fraud, they will do it.”
A downloadable spreadsheet of internal control attestations at nearly 300 public companies—including management’s assessment of disclosure controls and procedures, as well as management’s and auditor's assessment of internal control over financial reporting—can be found in the box above, right. Also available are related columns and Compliance Week coverage.
No comments yet