Remarks before the 2018 AICPA Conference on Current SEC and PCAOB Developments

Tom W. Collens

Professional Accounting Fellow

Washington D.C.

Dec. 10, 2018

The Securities and Exchange Commission disclaims responsibility for any private publication or statement by any SEC employee or Commissioner. The views expressed herein are those of the author and do not necessarily reflect the views of the Commission, the Commissioners or other members of the staff.

Introduction

Good morning and thank you for the opportunity to speak with you today. Like my colleague Emily Fitts, I'd like to spend my time with you today discussing internal control over financial reporting ("ICFR"). Specifically, I'd like to discuss some observations related to the evaluation of control deficiencies. These observations are based on OCA's involvement in the SEC's coordinated efforts on ICFR, including consultations with the Division of Corporation Finance and the Division of Enforcement.

Evaluating the severity of control deficiencies

A material weakness is a control deficiency, or a combination of control deficiencies, such that there is a reasonable possibility that a material misstatement of the financial statements will not be prevented or detected on a timely basis.[1] The critical determination when evaluating the severity of a control deficiency is whether or not that deficiency, either alone or in combination with other identified control deficiencies, rises to the level of a material weakness. When making this determination, management should evaluate the level of detail and assurance needed to support their conclusions by considering what the views of a "prudent official" would be in conducting their own affairs. Specifically, management should consider the level of detail and degree of assurance that would satisfy a prudent official looking to obtain reasonable assurance that the financial statements are in conformity with GAAP.[2] I believe that consistently applying this mindset will help management perform a more holistic and effective evaluation of the severity of control deficiencies compared to some of the more narrow evaluations we have seen in some instances through our consultations at OCA.

Avoid focusing solely on the misstatements identified

In regards to those consultations, I would like to start with a broad and, importantly, positive observation which is that we have seen improvements related to the evaluation of control deficiencies. However, some of our consultations, as well as a recent enforcement action,[3] suggest that there are still some bad habits yet to be fully shaken off.

In contrast to the more holistic evaluation approach I mentioned above, OCA continues to observe instances where management focused solely on the actual misstatements caused by a deficiency and failed to consider more holistically whether there was a reasonable possibility that a material misstatement would not have been prevented or detected on a timely basis due to the identified deficiency.[4] The tendency to focus solely on the actual misstatements that occurred due to a deficiency was the topic of a speech at this very conference four years ago.[5] From what we have observed since then, there have been fewer instances in which the focus was just on actual misstatements when evaluating control deficiencies. With that said, some of our other recent experience indicates that there is still more work to be done.

Other observations

On certain occasions, OCA has objected to management's conclusions regarding whether identified control deficiencies constituted a material weakness. In some instances, management was generally viewing the control deficiency through a lens that was at least somewhat broader than simply looking at the actual misstatements that occurred. However, in other instances, management's analysis still did not fully evaluate the type or magnitude of misstatements that were reasonably possible due to the identified control deficiency. Based on our recent experiences in this area, I would like to share a few observations with you.

First of all, I would like to reiterate how important it is to accurately define the control deficiency.[6] A thorough and accurate definition of the control deficiency is a prerequisite for (a) performing a holistic evaluation of the severity of the control deficiency, (b) developing an effective remediation strategy, and (c) making appropriate disclosures, if required. When defining the control deficiency, it is important to also evaluate the financial statement areas that are affected. We have seen instances where management believes that the effect of a control deficiency is relegated to the specific area in which a misstatement occurred without considering whether it is reasonably possible that other financial statement areas could be impacted based upon the root cause of the control deficiency. For example, if a deficiency is identified related to the sufficiency or competence of a registrant's accounting personnel due to a misstatement identified in a complex area of GAAP, management should consider whether it is reasonably possible that similar misstatements could occur in other areas of GAAP for the same reason.

My second observation is one to which I've already alluded and that is the importance of performing a holistic analysis of the severity of a control deficiency or, in other words, performing an honest analysis of the magnitude of a reasonably possible misstatement due to the existence of a control deficiency. We have seen instances where management attempts to estimate the potential magnitude of a misstatement that could result from a control deficiency without considering what might be reasonably possible based upon the information known. To illustrate, if a deficiency resulted in offsetting misstatements within a financial statement line item or disclosure, management might need to consider those misstatements from an absolute value perspective as a starting point for evaluating the potential magnitude of the misstatements resulting from the control deficiency when it was just by chance that the misstatements happened to offset.[7]

This leads to my final observation which is on compensating controls. It is certainly possible for controls to accomplish the objective of other controls that did not function properly, thereby reducing the severity of an identified control deficiency by limiting the potential magnitude of the reasonably possible misstatement. However, those compensating controls should operate at a level of precision that would prevent or detect a misstatement that could be material.[8] Further, to be a compensating control, the control should be designed to achieve the same objective as the control identified as deficient.[9] To illustrate, we have objected to instances where management believed that the existence of compensating controls reduced the severity of a control deficiency below the level of a material weakness despite the fact that a material misstatement did exist. This might occur because either the control intended to be a compensating control was not designed or operating at a sufficient level of precision to prevent or detect a material misstatement, or because the intended compensating control was not designed to achieve the same objective as the control identified as deficient.

Conclusion

In closing, I would like to recognize and reiterate that we are seeing progress in this area and I would like to thank this audience for your efforts. That concludes my prepared remarks. Thank you for your kind attention.