The SEC’s Recent ICFR Enforcement Actions Remind Companies To Take Timely Remedial Action Upon Finding Internal Control Weakness

On May 22, 2019, the Securities and Exchange Commission (SEC) announced that it had settled internal control over financial reporting (“ICFR”) violations with four companies charged with violating Section 13 of the Exchange Act and the rules promulgated thereunder.  The SEC’s announcement provides an important reminder that companies must not only assess and disclose the material weakness in internal controls, but they must also take remedial steps to address material weaknesses in a timely manner.

Background

The SEC’s Enforcement Division has pursued accounting and financial reporting actions with greater frequency since it launched the Financial Reporting and Audit Task Force (the “Task Force”) on July 2, 2013.  The Task Force is focused on identifying securities law violations relating to the preparation of financial statements, issuer reporting and disclosure, and audit failures.  The Task Force’s principal goal is fraud detection and increased prosecution of violations involving false or misleading financial statements and disclosures. 

The Task Force is not required to make a finding of fraud and can also take action against companies for inadequate internal controls, failing to make timely disclosures, and failing to maintain adequate oversight resulting in a “reasonable possibility” that a material misstatement would go undetected.  Since its inception, the Task Force’s pursuit of ICFR actions has fluctuated, with only six companies being charged for the years 2017-2018 according to SEC press releases, following a major increase in ICFR enforcement for the years 2013-2015. However, the SEC’s January 29, 2019 press release indicates renewed SEC attention to the Task Force’s mandate.

ICFR Requirements

In evaluating the operating effectiveness of a company’s ICFR, the SEC requires that company management design and implement controls that will achieve the objectives stated in Exchange Act Rule 13a-15 of “provid[ing] reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with GAAP.”  Additionally, management is required to evaluate the effectiveness of these controls on an annual basis, i.e., whether the controls identified have been implemented and whether they actually operate in a manner consistent with their design.

According to the SEC’s ICFR Guidance Release, effective June 27, 2007, and as re-stated in recent SEC remarks published on December 10, 2018, company management must consider the risk of control failure and the risk of material misstatement when designing and implementing internal controls.  In determining whether its evaluation of the operating effectiveness of controls is sufficient, companies must specifically consider two factors.  First, they must determine whether the control is operating as designed.  Second, the nature, timing, and extent of the evaluation procedures should be linked to the assessed risk of control failure and the risk of material misstatement. 
Once a Company Has Identified Deficient Internal Controls, it Must Then Remedy Them in a Timely Manner
After a company has evaluated its ICFR and found material weaknesses, it must then take steps to remediate these problems in a timely manner.  The four companies charged by the SEC in the January 29, 2019 press release had, as required by the SEC, disclosed material weaknesses in their ICFR.  However, each of the companies took months or years to remediate their material weaknesses after being contacted by SEC staff.  Some of the companies remained in the process of remediating material weaknesses even after settling with the SEC.

Once a Company Has Identified Deficient Internal Controls, it Must Then Remedy Them in a Timely Manner

After a company has evaluated its ICFR and found material weaknesses, it must then take steps to remediate these problems in a timely manner.  The four companies charged by the SEC in the January 29, 2019 press release had, as required by the SEC, disclosed material weaknesses in their ICFR.  However, each of the companies took months or years to remediate their material weaknesses after being contacted by SEC staff.  Some of the companies remained in the process of remediating material weaknesses even after settling with the SEC. For example, in the January 29, 2019 SEC Order for In the Matter of Grupo Simec S.A.B. De C.V., Grupo Simec (“Simec”) disclosed the presence of material weaknesses in its Forms 10-K from 2008 through 2017.  The Company failed, however, to address its reporting deficiencies, prompting the SEC to take action.  The SEC’s January 29, 2019 Order determined that Simec had failed to file periodic and other reports with the Commission and failed to maintain ICFR.  Simec was required to pay $200,000 and undertake, among other things, the retention of an independent consultant to ensure remediation of material weaknesses going forward.

The SEC’s settlement orders and January 29, 2019 announcement explain that merely disclosing material weakness is not enough and that companies must “timely remediate material weaknesses” as well in order to comply with Section 13 of the Exchange Act and Rule 13a-15 promulgated thereunder.