Conflict Minerals Disclosures: Reporting Requirements and Implications for Auditing Free

The United States is the first jurisdiction to enact disclosure requirements for companies using conflict minerals. Section 1502 of the Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010 (Dodd-Frank Act) created a reporting requirement for publicly traded companies that manufacture products using “conflict minerals” from the Democratic Republic of the Congo (DRC) or adjoining countries.¹ The conflict minerals pertinent to the Dodd-Frank Act are cassiterite, columbite-tantalite, gold, and wolframite, or their derivatives. Cassiterite is an important source of tin, columbite-tantalite is known as tantalite or tantalum in industrial use, and wolframite is used to produce tungsten. Thus, the conflict minerals are sometimes referred to as the “3TG” minerals—tin, tantalum, tungsten, and gold (Ayogu and Lewis 2011). Table 1 summarizes conflict minerals and their uses in products.

Armed groups in the DRC and adjacent countries that have been associated with human rights abuses use these conflict minerals to fund their operations (Bafilemba and Lezhnev 2015). For example, Bafilemba and Lezhnev (2015) argue that illegally mined conflict minerals are fueling military corruption and violent rebel groups in the DRC, and Mbubi (2015) finds that both rebel groups and the Congolese National Army have been taxing and trading conflict minerals to help finance their operations. By requiring conflict minerals disclosures for publicly traded companies, the U.S. Congress aims to cut off funds for these armed groups and promote peace in the region (Securities and Exchange Commission [SEC] 2012).

The conflict minerals reporting requirement is a unique corporate social responsibility (CSR) requirement. Traditionally, SEC disclosures are financial in nature with the goal of informing and potentially protecting investors. However, Woody (2012) argues that the conflict minerals rule's objective is humanitarian in nature with moral and political goals. This reporting requirement represents the first mandated CSR requirement in the U.S. with the exception of mandated environmental disclosures. Consequently, as the U.S. is the first jurisdiction to require conflict minerals disclosures, this measure may not completely eliminate the conflict minerals issue. While there are no specified penalties for the use of conflict minerals, the U.S. Congress hopes that user companies might be shamed into reducing or eliminating such trade (Ayogu and Lewis 2011; Lindberg and Razaki 2012).

The European Union, Canada, and Australia, as well as certain states and municipalities in the U.S., have also taken steps to address concerns about conflict minerals (KPMG 2014; PricewaterhouseCoopers [PwC] 2015). For instance, the European Parliament is considering a “system for self-certification of importers of certain minerals and metals originating in conflict-affected and high-risk areas” (European Parliament 2014). Australia has issued due diligence guidelines to mitigate the risk of providing direct or indirect support to the DRC (Australian Government 2014). Some U.S. municipalities have issued resolutions or proclamations asserting that they will consider whether products contain conflict minerals in their purchasing and investment decisions (e.g., City of Pittsburgh 2011).

However, no other country or jurisdiction has passed a rule as rigorous as the SEC's conflict minerals rule (PwC 2015). In the U.S., not only do companies need to disclose whether they use conflict minerals originating from the DRC or adjacent countries in their products, they also must disclose the process used to determine the origin of their conflict minerals. Furthermore, companies that claim their products are free of conflict minerals from the DRC or adjoining countries must submit an audited report on their conflict minerals (SEC 2014). The main industry sectors subject to these new reporting requirements include aerospace and defense, automotive, industrial products, retail, and technology (PwC 2014).²

Following the requirements of the Dodd-Frank Act, the SEC's original “final rule” on conflict minerals disclosure was to take effect on November 13, 2012. The SEC outlined a three-step process related to disclosures. The first step requires companies to determine whether they are subject to the conflict minerals provision. The disclosure requirement applies to companies (hereinafter also known as the “covered companies”) that file reports with the SEC under the Exchange Act and use conflict minerals that are necessary to the functionality or production of a product manufactured (or contracted to be manufactured) by the company (SEC 2012). The second step requires the covered companies to determine whether its conflict minerals originated in the DRC or an adjoining country (hereafter also referred to as the “DRC Region”). Covered companies must disclose on a calendar year basis whether any of the conflict minerals originated in the DRC Region (SEC 2012). The disclosure is made on a Specialized Disclosure Report (Form SD). The company must also describe in the Form SD the reasonable country of origin inquiry process (RCOI) it used to reach its determination.

In the last step of the original SEC final rule, covered companies were going to be required to submit an audited Conflict Minerals Report (CMR) to the SEC if the companies' conflict minerals originated (or may have originated) in the DRC Region and did not come from recycled or scrap sources (see the “Opposition to the SEC Rules” section below for amendments to this requirement).^3,4 However, the last step of the rule still requires that the CMR include a description of the supply chain and the measures the company employed to exercise due diligence in sourcing conflict minerals.⁵ Additionally, covered companies need to disclose information on their products such as the country of origin, the smelters/refiners, and the efforts used to determine the mine or location of origin of the conflict minerals even for products that are categorized as not DRC conflict free (SEC 2014).⁶

The SEC established a temporary transition period of two years for covered companies (ending December 2014) and four years for smaller reporting entities (ending December 2016).⁷ During the transition period, companies could classify products as DRC conflict undeterminable if they are unable to determine whether the products are conflict free. The company must still file a CMR for these products, but reports containing only DRC conflict undeterminable products did not need to be audited during this transition period. Figure 1 shows the transition period for companies with products classified as DRC conflict undeterminable.⁸

The SEC rules met with much opposition. The National Association of Manufacturers (NAM), U.S. Chamber of Commerce, and Business Roundtable filed legal challenges requesting that the conflicts minerals rule be modified or set aside in whole or in part (Thomas 2012).⁹ Ultimately, on April 14, 2014, the Court of Appeals rejected all of the petitioners' arguments except for a First Amendment of the U.S. Constitution issue. Specifically, the Court of Appeals held that the conflict minerals provision violated the First Amendment by requiring the covered companies to report on their Form SDs, and state on their websites, that their products have “not been found to be DRC conflict free” (Thomas 2014).

In response, the SEC released a statement on April 29, 2014 confirming that companies must still describe and disclose their RCOI on Form SD, describe their due diligence if they are required to file a CMR, and disclose product information. However, companies are only required to obtain an independent private sector audit (IPSA) if they voluntarily choose to describe any products as DRC conflict free (SEC 2014).

Although the SEC sought to have their original rules reinstated (Faulk and Couvillion 2014; Sullivan 2015), on August 18, 2015, the Court of Appeals confirmed its previous ruling that the conflict minerals rule violates the First Amendment (EY 2015). Figure 2 provides a flowchart summary of the current conflict minerals disclosure requirements.

As noted earlier, the current disclosure rules require an IPSA for any company voluntarily classifying its products as DRC conflict free. The American Institute of Certified Public Accountants (AICPA) and the SEC provide guidance on auditing the CMR. On March 24, 2014, the AICPA Conflict Minerals Task Force provided non-authoritative guidance on CMR audits. These guidelines include examples of practitioners' reports as well as information on how to communicate findings (Journal of Accountancy [JoA] 2014). Covered companies required to obtain an IPSA can request either an attestation engagement or performance audit (Deloitte 2015). Exhibit 1 shows differences between attestation engagements and performance audits. Although only Certified Public Accountants (CPAs) can conduct an attestation engagement, non-CPAs (such as engineering firms or environmental consultants) can conduct performance audits (Herda and Snyder 2013).

In accordance with guidance from the SEC, the company's independent public accountant can perform the independent private sector audit of the CMR without violating any independence assumptions. However, an accountant or consultant must consider whether other non-audit services are inconsistent with the CMR's independence requirements (SEC 2012).

Further, the AICPA provided additional auditing guidance in January 2015 regarding management representation letters in an attest engagement. The guidance indicates that management representation letters may include statements that management is responsible for: the overall accuracy of the Form SD, implementing and maintaining effective internal control related to the Form SD, and asserting that the due diligence framework conforms with the Organization for Economic Co-operation and Development (OECD) framework (AICPA 2015).

The first conflict minerals disclosures required by Dodd-Frank were for the calendar year 2013 reporting period. Only 1,336 companies filed Form SDs, which is much less than the approximately 6,000 companies the SEC expected to file; this variance suggests that many companies may have interpreted the conflict minerals provision more narrowly than the SEC and decided they were not required to file (DavisPolk 2014).¹⁰ Littenberg et al. (2014) found that 56 percent of the companies subject to the Exchange Act have a market capitalization of less than $250 million (hereafter referred to as “small companies”); however, only 25 percent of the Form SD filers were small companies. Possible explanations for the low compliance rate of small companies include: small companies were more aggressive in determining their products were not within the scope of the conflicts minerals regulation, smaller companies had less in-depth understanding of the CMR requirements, and deliberate non-compliance (Littenberg et al. 2014).

Littenberg et al. (2014) report that 1,010 companies filed a CMR, which was approximately 76 percent of the Form SD filers. Furthermore, Usvyatsky (2014) found that companies that did not file a CMR determined that their products were free of conflict minerals based on their RCOI, and therefore did not need an audit opinion. However, for the companies that filed a CMR, only one described all of its products as “DRC Conflict Free,” a small number determined that a portion of their products were “DRC Conflict Free,” and the remaining companies were generally unable to determine the conflict status of their products (Usvyatsky 2014).^11,12,13 Companies claimed difficulty in determining the conflict status of their products because conflict minerals from different regions are combined in smelters and refiners, therefore it is difficult to link particular minerals from a smelter or refiner to a particular product or to determine the country of origin of the minerals in each product (Schwartz 2015).

Chasan (2014) found that four companies (Intel Corporation, Kemet Corporation, Koninklijke Philips N.V., and Signet Jewelers Limited) had their CMR audited in calendar year 2013 (CALYR 2013). Intel had its CMR audited by Ernst & Young, the same CPA firm that performed the audit of its fiscal year 2013 (FY 2013) financial statements. Similarly, Koninklijke Philips had its CMR audited by KPMG, the same CPA firm that performed the audit of its FY 2013 financial statements. Both of these audit reports noted that the auditors followed the AICPA's and the U.S. government auditing standards (GAS) for attestation engagements. Kemet Corporation had its financial statements audited by Ernst & Young, but opted to have its CMR audited by Douglas Hileman Consulting, who states that it used U.S. generally accepted government auditing standards (GAGAS) for performance audits. Signet Jewelers' financial statements were audited by KPMG, but its CMR was audited by SGS United Kingdom, Ltd. SGS stated that it used U.S. Government Accountability Office (GAO) performance auditing standards in accordance with GAGAS. Table 2 provides additional details about the auditing standards used by the firms performing the IPSA, as well as assertions by the audited company as to whether its products are DRC conflict free.

As indicated in Table 2, attestation engagements were performed by the financial statement auditors. Performance audits were performed by certification or conflict minerals compliance specialists. It should be noted that auditors conducting an IPSA of Conflict Mineral Reports audit the processes used by management to determine whether their products are DRC conflict free; the auditors do NOT give an opinion or statement as to whether or not the auditors agree with management's assertions as to which products are conflict free and which products or smelters are DRC conflict undeterminable.

The estimated IPSA fee for large issuers in the SEC's original estimates is $100,000 (SEC 2012). This IPSA fee must be reported as a non-audit service (Deloitte 2015). The reason for the relatively low cost is likely due to the IPSA's rather limited scope. For instance, Douglas Hileman Consulting LLC included the following in its IPSA report for CALYR 2013:

Our examination was not conducted for the purpose of evaluating:

• the consistency of the due diligence measures that the Company performed with either the design of the Company's due diligence framework or the OECD Due Diligence Guidance, other than as required to fulfill a stated audit objective;

• the completeness of the Company's description of the due diligence measures performed;

• the suitability of the design or operating effectiveness of the Company's due diligence process;

• whether a third party can determine from the Conflict Minerals Report if the due diligence measures the Company performed are consistent with the OECD Due Diligence Guidance;

• the Company's reasonable country of origin inquiry (RCOI), including the suitability of the design of the RCOI, its operating effectiveness, or the results thereof; or

• the Company's conclusions about the source or chain of custody of its conflict minerals, those products subject to due diligence, or the DRC Conflict Free status of its products.

Similar language was used by other IPSAs in their reports.

In order to assess conflict minerals reporting trends, we evaluated calendar year 2014 (CALYR 2014) disclosures. There were 1,280 Form SD filers for calendar year 2014.¹⁴ Interestingly, 63 filers were new Form SD filers.¹⁵ Given that there were 1,336 Form SD filers in calendar year 2013, this means that 119 companies that filed a 2013 Form SD have not filed a 2014 Form SD yet.¹⁶ Thus far, only 1.72 percent of these calendar year 2014 filers filed after the June 1, 2015 deadline, whereas 3.37 percent of calendar year 2013 filers filed their Form SD after the June 2, 2014 deadline.

To illustrate some of the information disclosed, we reviewed Form SDs, Conflict Minerals Reports, and financial statements filed from a judgment sample of 12 companies.¹⁷ See Table 3 for examples of calendar year 2013 and 2014 conflict mineral disclosures and comments in the related financial statements. Most of the companies selected filed a Form SD with an unaudited CMR. Most companies also revised their comments pertaining to conflict minerals in their 2014 financial statements, as compared to their 2013 disclosures.

Our review of Conflict Mineral Reports filed in May and June 2015 for CALYR 2014 revealed that the same four companies that had their CALYR 2013 CMRs audited also had their CALYR 2014 CMRs audited. The CALYR 2014 assertions by the audited companies as to whether their products are DRC conflict free were very similar to their CALYR 2013 assertions.

As of the writing of this manuscript, we found only two companies (Advanced Semiconductor Engineering, Inc. [ASE] and AVX Corporation) that had their CMR audited for the first time in CALYR 2014. The audit of the CMR for ASE was performed by KPMG (ASE 2015a), while the audit of its financial statements for FY 2014 was performed by Deloitte & Touche (ASE 2015b). The audit of the CMR for AVX was performed by Elm Sustainability Partners, LLC (AVX Corporation [AVX] 2015a), while the audit of its financial statements for FY 2014 was performed by PricewaterhouseCoopers (AVX 2015b).

The new disclosure requirement appears to be relatively low cost for most firms. Schwartz (2015) argues that “due diligence essentially boiled down to sending out a survey created by a third party and checking certain results against a third-party-generated list.” Although companies will have incurred additional internal control costs, the compliance costs were likely immaterial. Initial reports on the actual costs of the new provision indicate that the costs are much lower than initially estimated (Cohn 2014; Payson 2014). In addition, few companies have filed an audited CMR thus far and the penalties for non-compliance are relatively low.¹⁸

Although limited to date, several factors suggest that more companies will have their CMRs audited for CALYR 2015 and beyond. Almost certainly, many firms were potentially waiting for the legal issues associated with conflict mineral disclosures to be resolved before fully adopting the reporting requirements. However, now that the litigation has been resolved, it is likely that additional companies will more carefully address and adopt disclosure practices because the uncertainty is now removed.

Furthermore, Kristen Sullivan, a partner with Deloitte, asserts that there are many considerations that point to an increase in future IPSAs of conflict mineral reports (Sullivan 2015), including:

• Benchmarking against peers;

• Greater credibility in disclosures;

• Expectations by non-governmental organizations (NGOs);

• Demonstration of performance improvements; and

• Reducing reputation risk.

KPMG (2014) identifies similar reasons for an expected increase in IPSAs as follows:

KPMG also contends that the first two years of submitting Conflict Mineral Reports was a learning and transition period, and the quality of the reporting process is likely to improve in the future, as will the auditability of the results of mapping the supply chain (KPMG 2014). Further, globally recognized companies look for new and unique ways to differentiate themselves and their brands from their competition. Full conflict minerals reporting, including an independent audit, will set companies apart, will drive companies to obtain IPSAs, and is likely to motivate their competition to do the same. PwC (2015) notes that from an audit perspective, audits will evolve over time as supply chain information and reporting mechanisms mature.

Additionally, prior research notes increasing levels of corporate social responsibility (CSR) attestation. According to KPMG's survey of CSR reporting, the ratio of the world's largest 250 firms (G250 companies) that have their CSR report externally verified increased from 29 percent in 2002 to 59 percent in 2013 (KPMG 2008, 2013). Researchers argue these audits can be used to increase the credibility of the firm's message (for example, Cho, Michelon, Patten, and Roberts 2015; Cohen and Simnett 2015; Casey and Grenier 2015). Similarly, Coram, Monroe, and Woodliff (2009) argue that both financial and nonfinancial information credibility is increased by attestation, and Cho et al. (2015) find that external assurance leads to increases in CSR indexes.¹⁹

Electronics manufacturers such as Intel, Qualcomm, and Apple have promoted their efforts to eliminate conflict minerals from their supply chains for CSR and human rights purposes (Lewis 2015). As previously noted, electronics manufacturer Intel has already obtained audits of their CMRs, which provides credibility to its message. Given companies' likely incentives to appear credible, and given current CSR attestation rates and trends, a significant increase in IPSAs can be expected in the future.

Conflict minerals disclosures have not only heightened awareness of the humanitarian issues in the DRC (Ayogu and Lewis 2011; Lindberg and Razaki 2012), they have also apparently contributed to reducing armed groups' involvement in conflict minerals mining (Bafilemba, Mueller, and Lezhnev 2014). Bafilemba et al. (2014) find it has become less economically viable for the armed rebels and the Congolese army to mine three of the four conflict minerals. As a result, two-thirds of tantalum, tin, and tungsten mines surveyed in eastern Congo have been demilitarized. Consequently, the aim of this SEC disclosure requirement marks a departure from the traditional goal of protecting investors.

Legal decisions have left most of the SEC rules intact and allowed the mandatory disclosure requirements to be implemented on time. Thus, many companies must file a Conflict Minerals Report (CMR) with the SEC in addition to a Specialized Disclosure Report (Form SD). Only companies that claim their products are free of conflict minerals from the DRC must have an audit of their CMR. Further, while to date only a handful of companies have had audits of their CMRs, it is expected that substantially more companies will have their CMRs audited for CALYR 2015 and beyond (KPMG 2014; Sullivan 2015). This contention is supported by our review of a sample of unaudited CALYR 2014 CMRs that indicated companies are working with their external auditors to ensure that conflict minerals approaches and processes are auditable in future years. Furthermore, current CSR attestation rates and trends suggest that a significant increase in IPSAs can be expected in the future.

Thus, the auditing implications of CMRs are evolving, and audits of CMRs are likely to become much more prevalent as companies make progress toward achieving a conflict-free status for their 3TG minerals, enhance the transparency of their supply chain disclosures, and mitigate reputational risk (KPMG 2014; Sullivan 2015).