Speech by SEC Staff:
Remarks before the 2008 AICPA National Conference on Current SEC and PCAOB Developments

by

Marc Panucci

Associate Chief Accountant, Office of the Chief Accountant
U.S. Securities and Exchange Commission

Washington, DC
December 8, 2008

As a matter of policy, the Securities and Exchange Commission disclaims responsibility for any private publication or statement of any SEC employee or Commissioner. This speech expresses the author’s views and does not necessarily reflect those of the Commission, the Commissioners, or other members of the SEC staff.

Good afternoon.

Today, I will discuss (1) how today’s economic environment may impact management’s annual assessment and the external audit of the effectiveness of internal control over financial reporting and management’s quarterly evaluation of disclosure controls and procedures and (2) certain observations regarding disclosures of internal control over financial reporting.

Potential Impact in Today’s Environment

Much of the discussion regarding today’s economic environment has focused on accounting issues. However, the current market conditions may also impact a company’s internal control over financial reporting and its disclosure controls and procedures.

The first phase for management and the auditor to consider when conducting an assessment or audit of internal control over financial reporting is to identify and assess the financial reporting risks. This underlies the entire process and consists of asking “what could go wrong?” Current market conditions have resulted in an increase focus on certain areas of financial reporting, such as valuation, impairment, and recoverability of certain assets; fair value measurements; pension and OPEB assumptions; and going concern considerations, just to name a few. As management and the auditor may find themselves devoting more time to these issues, they may need to consider whether the identification or assessment of the financial reporting risks related to these areas have changed, and if so, how those changes impact a company’s internal control over financial reporting. Also, difficult market conditions may increase pressure to meet financial targets; therefore, management and the auditor may also need to evaluate whether any changes to the fraud risk assessment are needed.

If management or the auditor determines that new financial reporting risks exist, or that its assessment of existing risks has changed, including the risk of fraud, then they should consider how this impacts management’s assessment or the audit of internal control over financial reporting.

Regarding management’s assessment, management has to determine whether it has the proper controls in operation to address the changes in financial reporting risks. For example, if impairment of long-lived assets is now considered higher risk because a triggering event requires management to determine whether an impairment charge should be recorded, management may need to evaluate whether they have the proper controls in place, including controls related to the development of significant estimates and assumptions, to mitigate this risk. Also, the design of a company’s internal control over financial reporting may be impacted through restructuring activities and/or employee terminations as a result of the current economic environment. As such, companies may need to consider the impact of these changes on its control structure, which may include whether certain controls no longer exist, whether new controls have been designed and placed in operation, or whether personnel now responsible for operating or monitoring the controls contain the level of expertise necessary to ensure the controls operate as intended. If changes to the fraud risk assessment occur, a company may need to evaluate whether its control structure is sufficient to mitigate the associated risks, including evaluating entity level controls and controls over management override. Furthermore, if the risk of material misstatement increases related to certain accounts, disclosures, or assertions, or risk related to the operation of controls increases, management may need to obtain more evidence regarding the effectiveness of those controls.

Regarding the audit of internal control over financial reporting, changes in financial reporting risks may impact the nature, timing, and extent of testing the design and operating effectiveness of a company’s internal control over financial reporting.

Management may also need to consider whether and how the current market conditions impact its disclosure controls and procedures. A company’s disclosure controls and procedures are designed to ensure that information required to be disclosed is recorded, processed, summarized and reported, within the time periods specified in the Commission’s rules and forms. In today’s economic environment, changes to existing disclosures or incremental disclosures may be necessary to comply with the disclosure requirements in areas such as risks and uncertainties, liquidity, and credit risks, just to name a few. As such, management may need to determine whether it has the proper procedures in place to gather the necessary information for these disclosures. For example, if the liquidity risk of certain operating divisions has increased, corporate management may need to ensure it is requesting and receiving the proper information to ensure the disclosures are adequate.

When considering the impact that today’s economic environment may have on a company’s disclosure controls and procedures and internal control over financial reporting, the best approach is to consider the impact together with the accounting issues and not as a separate process. An integrated approach may help in preventing and detecting material misstatements of the financial statements.

Disclosures of Internal Control over Financial Reporting

Next, I wanted to discuss some general observations regarding the disclosures of internal control over financial reporting. The SEC staff continues to review these disclosures and encourages companies to provide the most meaningful information to investors. I will discuss some observations regarding material weakness disclosures and other unique situations regarding disclosures of internal control over financial reporting.

The goal underlying material weakness disclosures is to go beyond describing the mere existence of a material weakness but to allow for investors to understand the cause of the control deficiency and to assess its potential impact. In disclosing material weaknesses, management might consider the following questions:

• Does the disclosure adequately describe the control deficiency? Companies should consider providing disclosures that allow investors to understand the control deficiency and the actual cause of the control deficiency. The SEC staff has observed in certain situations, a material weakness resulted from an adjustment to the financial statements but the material weakness identified is often a description of the financial statement adjustment rather than the control deficiency that resulted in the material weakness.
• Does the disclosure allow users to determine whether the deficiency has a pervasive impact on internal control over financial reporting? Material weakness disclosures that distinguish ones which have a pervasive impact on internal control over financial reporting may be more meaningful to investors. The SEC staff has observed in certain situations that the material weaknesses described are limited to specific areas where an error has been discovered. In these situations, a question may arise as to whether the material weakness impacts other areas of the financial statements.

Other questions to consider when evaluating whether the most meaningful disclosures regarding internal control over financial reporting are being provided to investors consist of the following:

• Have adequate disclosures been included when a company restates previously issued financial statements to correct a material misstatement? Management is not required to reassess or revise its conclusions related to the effectiveness of internal control over financial reporting but management should consider whether its original disclosures are still appropriate and should modify or supplement its original disclosure to include any other material information that is necessary for such disclosures not to be misleading in light of the restatement. When management restates previously issued financial statements to correct a material misstatement, it may have concluded a material weakness does not exist, existed but has since been remediated, or still exists as of the current year-end. Regardless of the conclusion, investors would generally benefit from information regarding management’s judgment in this area.
• Have all material weaknesses been disclosed? Items 308(a) and 308T(a) of Regulation S-K require management to disclose any material weaknesses in internal control over financial reporting that have been identified by management. The SEC staff has observed in certain situations that the disclosures of management’s remediation effort, suggest that all material weaknesses may not have been disclosed. Often material weakness disclosures are limited to discrete financial statement accounts but the remediation efforts describe much broader plans, such as, “adopt new policies and procedures related to the review process for all accounts,” “hire additional resources,” or make other changes that often seem to affect a variety of processes related to the financial statement closing process. While the SEC staff certainly encourages full and robust disclosures of management’s remediation plans, disclosures that do not appear to align with the material weaknesses that were identified in management’s assessment may call into question the validity and completeness of the material weaknesses disclosed. Specifically, these disclosures may suggest that there may be another, more pervasive material weakness, such as in a company’s risk assessment, control environment, or monitoring that should have been identified and disclosed.

Answering these questions may help management determine whether the internal control over financial reporting disclosures provides adequate information to investors. Furthermore, considering these questions may help identify the appropriate control deficiencies for remediation. Without understanding the root cause of control deficiencies, it may be difficult for the internal control over financial reporting to prevent or detect material misstatements of the financial statements in the future.

Conclusion

In closing, I hope you find today’s discussion helpful as you think about how today’s economic environment may impact management’s quarterly evaluation of disclosure controls and procedures and management’s annual assessment and the external audit of the effectiveness of internal control over financial reporting and communicating meaningful disclosures to investors regarding internal control over financial reporting. Thank you.