From Financial Education & Research Foundation (FERF): Going into the 2020s, it appeared that the crest-trough cycle (see the chart below) of material weakness disclosures would continue throughout the decade. Then a black-swan level event occurred. As a result, financial statement preparers are now left with the unenviable task of meeting the high-quality, high-velocity informational needs of various stakeholder groups while simultaneously navigating one of the most hostile economic environments in recent history.
To get behind the numbers on internal control issues in this new normal, the Financial Education & Research Foundation (FERF) partnered with Greenlight Technologies to produce this whitepaper on key trends to take through this crisis and into the coming decade.
Considering the Impact of SARS-Cov-2 on ICFR Material Weaknesses
FERF: What kind of impact do you think this public health crisis is going to have on material weaknesses disclosed in quarterly filings on the coming FERF/Greenlight ICFR Trackers?
Mark Kissman: We’ll definitely see an increase in delayed filings and we'll likely see an increase in material weakness disclosures. If remote work arrangements, facility closures or unavailability of key personnel due to illness result in an inability to apply or test control procedures, management may be forced to conclude that one or more material weaknesses in internal control exist, unless compensating preventive or detective controls are in place and able to be tested.
Satisfying the external auditors with sufficient evidence that controls are performing as intended could also be challenging in this environment. For example, people working remotely may not have access to typical work tools such as printers and scanners, making it difficult to evidence control performance.
Gauging materiality can get tricky as earnings, revenue and other benchmarks decline due to the COVID-19 crisis. It could result in the inclusion of some items in the scope of this year’s internal control assessment that were excluded in prior years.
Social Distancing and Internal Controls
FERF: How does the sudden increase of finance professionals working from home impact internal controls?
Mark Kissman: Remote working arrangements may result in the following: significant changes made to the way internal controls are executed, reduced oversight and communication across the organization, increased risk of management override of internal controls and rushed changes in processes and controls.
Additionally, new controls may not be implemented or current controls are not revised to account for remote workforces (e.g., increased access to systems or applications, etc.). This becomes increasingly important for protecting confidential data (e.g., electronic or hard copy). Also, increased user access or changes in employee job responsibilities may result in segregation of duties conflicts.
When it comes to the financial close or external reporting, it may be delayed. Satisfying the external auditors with sufficient evidence that controls are performing as intended could be challenging in this environment. For example, people working remotely may not have access to typical work tools such as printers and scanners, making it difficult to evidence control performance.
The Impact of Late Filers
What has remained constant over the two-year period is the cyclical trend of where disclosed material weaknesses in ICFR as a percent of total filings drop in the first quarter of each year, before steadily climbing throughout subsequent quarters.
That companies with materially weak internal controls over financial reporting struggle to close their books and require more thorough audits is demonstrated in the trough-crest relationship between Quarters 1 and 2 in the chart below. Quarter 1 has an artificially lower number of filings and material weakness disclosures due to the fact that companies with material weaknesses in ICFR are potentially more likely to be late filers ceteris paribus. In 2019, the late-filer effect is depicted in the 3.1-point difference in material weakness disclosure proportions in Quarters 1 and 2.
Other key impacts include the following:
- Significant changes may require disclosure in quarterly or annual financial statements; disclosures may not be accurately reflected or excluded from financial statements due to COVID-19;
- Heightened use of personal or public unsecured Wi-Fi networks increase the dependency of cybersecurity controls including: access security, system change control, and data center/network operations;
- Increased use of mobile devices or organizational assets outside of the office heighten the need for monitoring ITGCs; and
- Possible need to change the frequency at which certain controls are performed.
When it comes to ICFR reporting, size matters...
All things being considered, smaller companies typically require less robust internal control systems than those employed at large multi-national companies. After all, they typically lack the complexity associated with multiple subsidiaries in disparate locations. Even with the reduced complexity, finance teams at small companies are struggling to maintain an effective system of ICFR due to limited personnel and resources. For these companies, the marginal benefit of each incremental dollar invested in ICFR represents an outsized ROI, relative to those invested at larger companies.