/>iWith many public companies recently completing the first fiscal quarter of 2020, the quarterly financial statement close and reporting process is in full swing for a large percentage of issuers. The COVID-19 pandemic poses unique and novel challenges to those companies during this process, particularly with respect to design and testing of both internal controls over financial reporting and disclosure controls and procedures. With public companies now under increasing scrutiny, we recommend that companies take stock of what has changed in the current financial reporting environment, consider whether existing controls are sufficient to prepare financial statements and disclosure documents at the reasonable assurance level, and determine what new controls (if any) are necessary to reduce the risk of errors and fraud. Regulators, congressional oversight committees, the press and the plaintiffs’ bar are gearing up to pursue all those who stumble.
Background
The COVID-19 pandemic’s impact on business cannot be overstated, and public companies large and small have begun to deal with a host of financial and operational issues that have adversely impacted their quarterly results and future prospects. In the coming weeks, public companies preparing their next Form 10-Q will face a myriad of novel and often unfamiliar financial reporting issues, including subsequent event disclosure, fair value and impairment measurement, accounting for loss contingencies and exit activities, revenue recognition, tax liabilities, going concern and potential insurance recoveries, just to name a few. Businesses accepting federal or other stimulus funds will be required to operationalize a variety of limitations on executive compensation, workforce relations, share repurchases and dividends, among other things. And the pressure on employees to cut corners is often greater in an economic downturn.
The 2008 financial crisis demonstrated how difficult these issues can be to navigate during a period of economic uncertainty accompanied by widespread volatility in the markets. In addition to the reemergence of these stresses, public companies must now also sort them out while their independent audit firms and substantially all of the key company participants in the financial reporting process are working physically apart from one another. With mandatory lockdown orders in place in most states, and at least one such order that extends all the way through June 10, it has become clear that there is no quick end in sight. Even when shelter-in-place and social distancing protocols become relaxed, many businesses could face a long glide path before one can expect some semblance of normality to return. Regretfully, some businesses will teeter on the edge of insolvency and others will face the prospect of bankruptcy.
Legal Framework
Briefly, Section 13(b)(2)(A) of the Securities Exchange Act of 1934 (the Exchange Act) requires public companies to make and keep books, records and accounts which, in reasonable detail, accurately and fairly reflect transactions and dispositions of assets. Section 13(b)(2)(B) of the Exchange Act requires public companies to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that transactions are recorded as necessary to permit preparation of financial statements in accordance with Generally Accepted Accounting Principles (GAAP) and to maintain accountability for assets.
Form 10-Q requires issuers to test their controls and procedures on a quarterly basis, and then make the disclosures required by Items 307 and 308(c) of Regulation S-K. Item 307 requires a public company to disclose the conclusions of its principal executive and principal financial officers, or persons performing similar functions, regarding the effectiveness of the issuer’s disclosure controls and procedures (as defined in Rule 13a-15(e) or Rule 15d-15(e)) as of the end of the period covered by the report, based on the evaluation of these controls and procedures required by paragraph (b) of Rule 13a-15 or Rule 15d-15.
Item 308(c), in turn, requires an issuer to disclose any change in its internal control over financial reporting identified in connection with the evaluation required by paragraph (d) of Rule 13a-15 or Rule 15d-15 that occurred during the issuer’s last fiscal quarter that has materially affected, or is reasonably likely to materially affect, the issuer’s internal control over financial reporting. An explanatory note to Item 308(c) provides that an issuer must maintain evidential matter, including documentation, to provide reasonable support for management’s assessment of the effectiveness of the issuer’s internal control over financial reporting.
The securities laws and auditing standards issued by the Public Company Accounting Oversight Board, together with a vast accounting and financial reporting literature, largely inform the process by which accounting professionals and management evaluate the effectiveness of internal controls. In light of the recent disruption to the markets and the widespread dislocation of key personnel, we expect audit firms to be especially vigilant in their interim reviews of internal controls during this Form 10-Q cycle.
SEC Enforcement Framework
The SEC regularly alleges violations of disclosure controls and internal controls when the agency brings accounting and disclosure cases against public companies, management and outside auditors. For example, one recent SEC enforcement case involved a well-known manufacturer and found that the company had no disclosure controls or procedures in place to determine whether its CEO’s social media posts contained information required to be disclosed in the company’s SEC filings. Among other charges, a second, unrelated SEC case alleged that the former chief financial officer and the vice president of internal audit failed to implement sufficient internal accounting controls and failed to ensure the defendant bank’s books and records were reasonably accurate.
A separate SEC enforcement case targeted a prominent consumer products company and found that from at least 2014 until May 2016 the company’s sales personnel gave sales incentives to the company’s two largest distributors to promote sales at the end of quarters, which were designed to help the company meet its internal sales targets. The incentives offered included rights of return for products that spoiled or expired before they were sold to retailers, as well as cash incentives of up to $500,000, substantial discounts and extended payment terms. Some of the incentives were agreed to orally and not documented, and others were documented only in email exchanges with the distributors. The SEC’s order found that the company lacked sufficient policies and procedures to ensure the incentives were properly documented and accounted for and that company’s finance department was not aware of the quarterly incentive practices until May 2016. Moreover, the SEC concluded that sales personnel were not appropriately trained or knowledgeable about the accounting implications of their sales practices. In settling the case, the company agreed to cease and desist from future violations of the SEC’s books and records and internal controls provisions.
Using the 2008 financial crisis as a benchmark, two SEC enforcement cases involving deficiencies in internal controls arising from market turmoil during that period are particularly instructive in light of current market conditions. The first settled case involved an investment manager that managed four equipment leasing funds, each of which filed periodic reports with the SEC under the Exchange Act. In early 2009, the downturn following the financial crisis and other economic factors resulted in a significant drop in shipping lease rates and equipment sale prices, resulting in even greater volatility in these markets than normal, all for a period that lasted nearly five years. In response to the depressed market, and after discussions with their outside auditor, the funds adopted an alternative valuation methodology for certain assets.
The SEC found that the funds’ reliance on this alternative method to make fair value determinations in situations where it possessed relevant contemporaneous market data violated GAAP and, along with other accounting errors and internal accounting control lapses, caused numerous material inaccuracies in the publicly filed financial statements and periodic reports for the four funds from 2009 through 2012. Key to the SEC’s case was a review of the funds’ own internal documentation, contemporaneous communications with third parties and other related evidence, which the SEC found to demonstrate that the funds lacked a reasonable basis for making various financial reporting entries.
Accordingly, the SEC determined that the funds did not keep accurate books and records, and did not devise and maintain a sufficient system of internal accounting controls. By reason of the foregoing, the SEC concluded that the fund manager and the four funds violated the SEC’s periodic reporting, books and records, internal controls and antifraud rules. As the entity that performed and was responsible for the funds’ accounting functions, including their recordkeeping and internal control functions, and for the preparation of the funds’ financial statements and periodic reports, the fund manager was also liable for “causing” the funds’ violations of these financial reporting, recordkeeping and internal control provisions. In addition to ordering the defendants to cease and desist from future violations of these provisions of the federal securities laws, the SEC also assessed a civil money penalty of $750,000.
The second settled case focused on a publicly traded real estate developer based in Florida, much of its senior management team and two senior members of its accounting department. There, the SEC found that the company improperly accounted for impairments surrounding the declining value of its residential real estate developments during the 2008 financial crisis and subsequently failed to correct those errors. As a result of this misconduct, the company reported materially overstated earnings and assets in 2009 and 2010. The SEC also determined that the company failed to disclose in its 2010 Form 10-K that it had decided not to proceed with the material development and planning of two of its largest real estate developments and had instead determined to sell the related undeveloped land in the future. Accordingly, the SEC charged the respondents with committing or “causing” various violations of the antifraud, internal controls, books and records, periodic reporting and other provisions of the federal securities laws.
The SEC’s order specifically called out the fact that the company failed to maintain adequate books and records concerning its impairment testing of real estate developments. Specifically, the SEC found that the company failed to sufficiently perform the following critical activities: maintain adequate records of quarterly impairment testing reviewed as part of its quarterly and annual accounting close process; document support for assumptions used in undiscounted cash flows used in impairment testing; document its processes and procedures concerning impairment testing; maintain the integrity of the economic models used in connection with past impairment testing; and document identified errors in past impairment testing. Importantly, the SEC emphasized that the company’s books and records failures adversely impacted the SEC’s investigation, including causing “unreasonably prolonged uncertainty” concerning the company’s historic impairment testing procedures and causing “substantial delays to, and otherwise unnecessary steps in, that investigation.”
In settling the case, the company and the individual defendants each agreed to cease and desist from future violations of the affected provisions of the federal securities laws. The company paid a civil monetary penalty of $2,750,000, and individual defendants agreed to disgorgement and civil monetary penalties ranging from $25,000 to over $550,000. Several individual defendants (including those with CPA licenses) were each denied the privilege of appearing and practicing before the commission as an accountant for various periods of time.
The Challenge for Management
We recommend that companies begin to assess their existing disclosure and internal controls by taking stock of what has changed in the current financial reporting environment. Unique or novel accounting issues should be carefully analyzed, and expert advice sought when internal resources are insufficient.
Potential and actual disruptions to a company’s supply chain, customer base, operations, processes and workforce should be weighed when evaluating the operating effectiveness of legacy controls. As part of this process, companies should also assess any potential deficiencies in review-type internal controls and the ability of individuals to perform control duties in light of shelter-in-place orders and other companyspecific remote-work protocols.
Based on this assessment, companies should determine whether existing controls are sufficient to prepare financial statements and disclosure documents at the reasonable assurance level. If a legacy control cannot be performed as previously designed, companies should determine what new controls may be necessary to reduce the risk of errors and fraud. In doing so, they should ensure that any changes in design address both the original risks of material misstatement as well as any new risks. We anticipate regular dialogue with counsel, the auditors and audit committees on these topics.
With many companies migrating to a telework environment, companies should especially reconsider the SEC’s guidance on cybersecurity controls and disclosure. We have recently observed an uptick in business email compromise schemes, which the SEC has previously identified as an emerging risk. According to the SEC, having internal accounting control systems that account for such cyber-related threats and related human vulnerabilities is vital to maintaining a sufficient accounting control environment and safeguarding company assets.
The SEC has provided a 45-day grace period and other minor accommodations for making periodic filings, including Form 10-Q, and we have observed public companies of all sizes availing themselves of the relief. Nevertheless, in a recent public statement, the SEC’s chief accountant emphasized that although the SEC staff has some degree of flexibility due to COVID-19 disruptions, ultimately the agency still expects high-quality accounting and disclosure from public companies. The SEC chairman and director of the Division of Corporation Finance echoed these sentiments in another recent public statement, urging companies responding to the pandemic to “provide as much information as is practicable regarding their current financial and operating status, as well as their future operational and financial planning.”
Relatedly, we remind companies to make sure that their disclosure controls are operating effectively so they can produce thoughtful and robust disclosures for investors. In a series of interviews and public statements, the SEC’s chairman and other senior officials have recently urged public companies to provide timely updates on the current and forward-looking impact of the pandemic on their businesses, including whether a company has applied for or received federal or other stimulus funds.
Finally, and in light of the above, public companies must determine whether they have made any change to the design of their internal controls that has materially affected, or is reasonably likely to materially affect, those controls such that disclosure is required in Form 10-Q in accordance with Item 308(c) of Regulation S-K. Likewise, management must be able under Item 307 to disclose the conclusions of its principal executive and principal financial officers as to the effectiveness of the issuer’s disclosure controls and procedures.
Parting Thoughts
In the current environment, public companies of all types should expect to find themselves under heightened scrutiny from the news media, putative whistleblowers, agency inspectors general, consumer watchdog groups, members of Congress and other political figures. Businesses accepting stimulus funds may find that scrutiny to be pervasive and relentless. Plaintiffs’ firms are already actively seeking out securities cases involving alleged misconduct relating to the pandemic. In an election year, some opportunistic politicians will also seek to use anti-business rhetoric to their political advantage.
As we alluded to above, the SEC after the last financial crisis brought a wide range of enforcement cases involving accounting irregularities, deficient controls, insider trading and other forms of securities fraud. These cases are frequently brought with the benefit of hindsight. We fully expect history to repeat itself when the current crisis abates.
The best defense against the prospect of future regulatory inquiries or outright litigation remains a robust control environment. Companies should not hesitate to change their procedures when circumstances require. And they should retain well-documented support files for all material disclosures.
