SUMMARY
SOX Section 404(b) continues to be of interest to legislators and regulators. Prior studies show that in the initial implementation years of SOX 404, the majority of material weakness (MW) disclosures were “surprise” MWs—i.e., disclosed at year-end, but not in prior quarterly filings (Hermanson and Ye 2009; Munsif, Raghunandan, and Rama 2013). We show that during the years 2010–2019, 74 (72) percent of MW disclosures by accelerated (non-accelerated) filers were surprise disclosures. Additionally, surprise MWs are more likely to be associated with internal control issues that involve year-end adjustments and/or documentation, procedure, or policy issues. “Early-warning” MWs are more likely due to systemic internal control problems, like segregation of duties. Our findings suggest a role for auditors and substantive audit tests in the disclosure of certain types of MWs. Increased auditor emphasis on interim substantive tests may reduce the likelihood of surprise MWs.
I. INTRODUCTION
The Sarbanes-Oxley Act's (SOX) Section 404(a) requires that management of all Securities and Exchange Commission (SEC) registrants include a report on internal control over financial reporting (ICFR) in their annual Form 10-K filings. Section 404(b) requires that auditors annually report on ICFR of accelerated (and large-accelerated) registrants.1 Prior to March 2020, accelerated filers were defined as issuers with a public float of $75 million or more. Identified material weaknesses (MWs) in ICFR are required to be disclosed in Section 404 reports. As currently defined, a MW is “a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of the company's annual or interim financial statements will not be prevented or detected on a timely basis” (PCAOB 2007).
SOX Section 302 requires that CEOs and CFOs certify the effectiveness of disclosure controls and material changes in ICFR in both quarterly (Form 10-Q) and annual filings. There is substantial overlap between disclosure controls and procedures and ICFR (SEC 2003). The SEC (2004, Question 9) states that filers should “carefully consider” whether MWs discovered as part of Section 404 testing should be disclosed under Section 302.
Although Section 404 requires an evaluation of ICFR “as of the end of the most recent fiscal year” (SOX 2002, Sec. 404(a)(2)) it is unlikely that MWs disclosed at the end of a fiscal year would suddenly emerge at year-end (Hermanson and Ye 2009; Munsif, Raghunandan, and Rama 2013). Hermanson and Ye (2009) and Munsif et al. (2013) note that financial statement users view Section 302 rules as requiring “early warning” about MWs in quarterly filings. However, in the first year of Section 404(b) reporting (fiscal years ending between November 15, 2004, to November 14, 2005) only 27 percent of accelerated filers with MW disclosures in their annual filings disclosed those MWs in their prior quarterly filings (Hermanson and Ye 2009). In 2007 and 2008, a large proportion of public companies continued to have surprise MW disclosures (Munsif et al. 2013).
Surprise MW disclosures may occur due to management's inability to detect MWs or to an unwillingness to classify internal control problems as sufficiently material to disclose in quarterly filings. Although the SEC's Regulation S-X requires that interim financial statements be subject to a review conducted by an independent external auditor prior to the statements being included in Form 10-Q (SEC 2000), the scope of such a review is much less than an audit. It may be that during their annual audits, auditors identify previously undisclosed MWs which, in effect, forces companies to disclose MWs in their annual filings. It may also be that observations about early-warning MWs during the initial years of a major rule, like Section 404, are not generalizable to later years.
Section 404(b) continues to be the target of many legislative efforts that seek to expand the set of registrants exempt from its requirements (e.g., Dodd-Frank Act 2010; Jumpstart Our Business Startups Act 2012; U.S. House of Representatives 2016, 2017). Similarly, regulatory efforts to exempt more companies from Section 404(b) requirements continue (e.g., SEC 2018). The cost and burden of auditor attestation is the primary reason for seeking exemptions from Section 404(b). In contrast, supporters of Section 404(b) argue that auditor attestation provides investors with an unbiased opinion and timely disclosure of internal control problems (Hermanson and Ye 2009; Munsif et al. 2013). In March 2020, the SEC expanded the set of registrants exempt from Section 404(b) by introducing a new revenue threshold ($100 million, when public float is less than $700 million) (SEC 2020).
In this paper, we examine the timeliness, or “early warning,” of internal control problems in companies' ICFR. Our data includes the quarterly and annual Section 302 certifications and annual Section 404 reports of 939 companies reporting MWs in their annual filings during the period from 2010 to 2019. Of these, 690 had no mention of internal control problems in their quarterly filings; 74 percent were “surprise” MWs.
Our findings highlight the role of auditors and substantive audit tests in the detection and disclosure of MWs. They reinforce prior suggestions that auditor involvement is necessary for the timely identification and disclosure of internal control problems (Bedard and Graham 2011; Hermanson and Ye 2009; Munsif et al. 2013).
II. ANALYSES AND RESULTS
To determine the frequency and nature of surprise MWs, we obtained the Section 404 reports, Section 302 certifications, financial data, and governance data for 27,518 firm-years during the period from 2010 to 2019.2 Our analyses begin in 2010 because although Section 404 became applicable for non-accelerated filers for fiscal year-ends on or after December 15, 2007, the global financial crisis may have affected reporting decisions in 2008 and 2009.
As seen in Table 1, our sample consists of 20,626 (6,832) accelerated (non-accelerated) filers' internal control reports including 517 (422) with first-time (i.e., not repeating) MW disclosures. Thus, in our sample, 2.5 (6.2) percent of accelerated (non-accelerated) filers have MW disclosures.3 For this set of firms, we check if the same fiscal years' quarterly Section 302 certifications included one or more of the MWs disclosed in the annual filing. We classify an MW disclosure as “early warning” if one or more of the MWs that were disclosed in the annual filing was also mentioned in a prior quarterly filing.
Table 1 shows that 132 of the 517 (117 of 422) accelerated (non-accelerated) firms with an MW disclosure in the annual filing also disclose one or more of MWs in the quarterly filing.4 Thus, about 26 (28) percent of the accelerated (non-accelerated) companies' MW disclosures are early-warning MWs. The remaining 385 (305) MW disclosures by accelerated (non-accelerated) filers are classified as surprise MWs; 74 (72) percent of accelerated (non-accelerated) filers with MW disclosures in their annual reports do not have an early warning in their quarterly reports. The difference between the two proportions is not statistically significant. These findings do not support arguments that the learning processes of managers and auditors is the reason for the high proportion of surprise MWs in the initial years of Section 404.
Differences Between Surprise and Early-Warning MWs
Table 2 details the average values of certain company and auditor characteristics, partitioned by whether or not the MW disclosure in the annual report was a surprise. The variables in Table 2 are based on prior research that suggests that such variables help in explaining both the presence of MWs (e.g., Chan, Farrell, and Lee 2008); Feng, Li, McVay, and Skaife 2015; Kim, Song, and Zhang 2011), and the characterization of the MWs as surprise or early warning (Hermanson and Ye 2009; Munsif et al. 2013).
As depicted in Table 2, accelerated filers with surprise MWs are less likely to issue equity securities and have, on average, longer auditor tenure (both at p < 0.01). The equity and auditor tenure findings also hold (both at p < 0.01) for non-accelerated filers with surprise MW disclosures.5 Overall, the financial and auditor characteristics do not tell a strong and consistent story for the presence of surprise MWs.
We next examine whether the underlying internal control problem differs comparing surprise and early-warning MWs. Specifically, we consider any type of internal control problem that was descriptive of at least 10 percent of either surprise or early-warning MWs using the categories defined by Audit Analytics.
Panel A (B) of Table 3 lists the types of specific internal control problems present in accelerated (non-accelerated) filers. The data show that, in both the accelerated and non-accelerated filer groups, companies with surprise MWs are more likely to have internal control issues related to (1) material and/or numerous auditor/year-end adjustments, and (2) documentation, policy, and/or procedures issues. In other words, auditors' year-end actions and judgments drive surprise MW disclosures. It may be that early warnings are not needed for MWs related to year-end adjustments, or that internal control problems associated with year-end adjustments or documentation may not have been sufficiently material to any individual quarter to warrant public disclosure.
Early-warning MWs are more likely to be related to (1) information technology, software, security, and access, (2) segregation of duties or design of controls, (3) unspecified, unidentified, or inapplicable FASB or GAAP issues, and (4) untimely or inadequate account reconciliations. Systemic or fundamental underlying problems appear to be associated with early-warning MWs.6 Management appears better able to detect or more willing to acknowledge severe problems without the auditor's year-end involvement.
Additional Analyses
We perform two additional analyses. First, based on the CHOICE Act, we partition the set of accelerated filers based on a market value threshold of $250 million. Second, based on the SEC's action in March 2020 to exclude certain registrants from Section 404(b) reporting, we partition the accelerated filer sample using a $100 million revenue cutoff.
As presented in Table 4, Panels A and B, for the market value-based partition, surprise MWs comprise 74 percent of larger companies and 76 percent of smaller companies. For the revenue-based partition, surprise MWs comprise 75 percent of larger companies and 74 percent of smaller companies. The differences between the proportions of surprise MW disclosures using the original market float, the $250 million market value-based, or the $100 million revenue-based partitions are not statistically significant.
III. IMPLICATIONS FOR PRACTICE
We find that for 74 percent of MWs reported in companies' annual filings with the SEC, there is no early warning in the companies' quarterly filings. This result raises questions about the efficacy of Section 302 certifications and highlights the role of auditors in the disclosure of MWs. An examination of the underlying internal control problems supports our assertion about the auditor's role in MW disclosures. We find that companies with surprise MWs are more likely to disclose issues that likely arise from the auditor's actions during year-end testing. This suggests that surprise MWs are likely discovered by substantive audit procedures, not tests of internal controls.
We also find that companies with early-warning MWs are more likely to be associated with information technology and/or segregation of duties issues—issues that are more likely identified by tests of internal controls. As these issues are more systemic in nature, they may be easier to detect, or management may be more likely to acknowledge and report them sooner.
Our findings suggest that auditors should consider performing some substantive tests at interim. For example, reviewing quarter-end closing procedures and journal entries may help early-detect, or may help prevent, year-end audit adjustments. Requesting documentation for substantive tests conducted at final during interim tests may early-expose potential documentation issues. Auditors can also sensitize audit committees, and stress to managers the importance of not delaying the disclosure of bad news until year-end.7
Our findings also suggest several avenues for future research. Unanswered is the question of whether surprise MWs are due to managerial inability to detect or reluctance to classify internal control problems as material. This question could be investigated experimentally or with access to auditors' work-papers. Differences in the timing of controls testing may contribute to the prevalence of surprise MWs. In this context, examining the association between the sophistication and involvement of internal audit and surprise MWs may be an interesting exercise. Finally, examining the association between surprise MWs and stock price returns is understudied.
REFERENCES
In this paper we do not differentiate between accelerated and large-accelerated filers. Hence, for expositional convenience, we simply refer to “accelerated filers.”
Section 302 certifications and 404 reports are from Audit Analytics, financial data are from Compustat, and governance data from BoardEx. Following prior research, we delete foreign companies, financial sector firms, and companies lacking financial data or having assets less than one million. We also delete observations where the company disclosed significant deficiencies in their Section 302 certifications or a restatement after the start of the third quarter. Finally, we also delete observations that had MW disclosures in either of the two prior fiscal years to ensure that our analysis is not contaminated by adverse Section 404 reports in prior years.
These numbers are lower than those reported by Hermanson and Ye (2009) and Munsif et al. (2013). This is expected given that (1) we have excluded companies with MW disclosures in the prior two years, and (2) our sample period is more recent. Over time, the proportion of public companies reporting MWs can be expected to decline. In addition, the differences between the proportions for accelerated and non-accelerated filers are statistically significant (p < 0.01).
Munsif et al. (2013) find that a few firms disclose MWs other than those disclosed in the Section 404 report at the year-end in 10-Qs. We do not find such instances in our sample.
Our results are contrary to both Hermanson and Ye (2009) and Munsif et al. (2013) who show that there are differences between accelerated and non-accelerated filers, although the inferences about which of the variables are significantly different between the two groups are not the same in the two prior studies. We attribute these differences among the studies to differences in the years examined.
In addition, “inadequate disclosure controls,” which could be viewed as a systemic problem, are more likely at accelerated filers with early-warning MWs. Conversely, revenue recognition problems are more likely at non-accelerated filers with surprise MWs. Such issues are perhaps more judgmental and fit with the narrative above.
While our analysis sheds some light on the benefits of auditor involvement in terms of the disclosure of MWs, we do not consider the costs associated with such involvement.
