On January 29, the SEC announced settled charges with four public companies for failing to maintain adequate internal control over financial reporting (ICFR). According to the respective orders, each of these companies repeatedly disclosed material weaknesses involving “certain high-risk areas of their financial statement presentation” over numerous annual reporting periods. Yet, despite these public acknowledgments, the SEC alleged that these companies took “months, or years, to remediate their material weaknesses,” even after being contacted by the SEC. In addition to cease-and-desist orders, the SEC levied monetary penalties against each company ranging from $35,000 to $200,000.

In announcing these settlements, the SEC emphasized that these proceedings were predicated on the registrants’ unreasonable delays in remediating the disclosed internal control deficiencies, rather than the disclosures themselves. Melissa Hodgman, an Associate Director in the SEC’s Enforcement Division, stated in the press release accompanying these settlements that, “Companies cannot hide behind disclosures as a way to meet their ICFR obligations. Disclosure of material weaknesses is not enough without meaningful remediation. We are committed to holding corporations accountable for failing to timely remediate material weaknesses.” Consistent with Ms. Hodgman’s comments, none of the settlements provided any suggestion that these companies had materially misstated or omitted any ICFR weaknesses, or their effort to remediate the weakness that were reported.

Without admitting or denying the SEC’s allegations, these four companies settled the separately filed actions summarized below:   

• An NYSE-traded metals manufacturer disclosed material weaknesses on its Forms 10-K for 10 consecutive fiscal years from 2008 through 2017. These weaknesses related to the adequacy of accounting resources, segregation of duties and supervision, as well as procedures for the approval of related party transactions. The company’s remedial efforts, which began in 2016 and remained ongoing, involved the hiring of a Sarbanes-Oxley consultant and the design and testing of controls after the SEC’s outreach. The company settled violations of Exchange Act Section 13(b)(2)(B) and Rules 13a-15(a) and 13a-15(c) thereunder, and accepted a $200,000 civil penalty. Exchange Act Rel. No. 84996 (Jan. 29, 2019).

• A NASDAQ-traded dairy food producer disclosed on its Forms 10-K for the ten fiscal years between 2007 and 2016 material weaknesses pertaining to deficient and undocumented financial reporting procedures, inadequate financial statement review, and deficient journal entry and account reconciliation procedures. The company’s remediation, which began in 2013 and was completed in 2017, included the retention of two Sarbanes-Oxley consultants to develop and implement a remedial plan. The issuer agreed to settle violations of Exchange Act Sections 13(a), 13(b)(2)(A), 13(b)(2)(B) and Rules 13a-1, 13a-15(a) and 13a-15(c) thereunder, in addition to a $200,000 civil penalty. Exchange Act Rel. No. 84995 (Jan. 29, 2019).

• A NASDAQ-traded technology services provider disclosed material weaknesses on seven straight Forms 10-K during fiscal years 2011 through 2017. These involved deficiencies in the design and operation of internal controls related to its financial close and reporting processes. Although the company retained Sarbanes-Oxley consultants in both 2012 and 2015 to assist with control testing and devise a detailed remediation plan, it did not fully implement these corrective measures until 2018 – approximately two years after the SEC initially contacted the company. The settlement order identified violations of Exchange Act Section 13(b)(2)(B) and Rule 13a-15(a). The company incurred a civil penalty of $100,000. Exchange Act Rel. No. 84998 (Jan. 29, 2019).

• An OTC-traded biotechnology company disclosed “general and sweeping” material weaknesses on nine Forms 10-K from fiscal years 2008 through 2016. These weaknesses included the segregation of duties over authorization, review and recording of transactions, as well as the financial reporting of such transactions. Between 2012 and 2017, the company fully remedied these weaknesses by significantly increasing its accounting staff, implementing new controls, outsourcing information technology and – after being contacted by the SEC – engaging a Sarbanes-Oxley consultant. The company settled violations of Exchange Act Section 13(b)(2)(B), and Rule 13a-15(a) and accepted a $35,000 civil penalty. Exchange Act Rel. No. 84994 (Jan. 29, 2019).

Given the ostensive lack of urgency that these registrants demonstrated over many years, there may be inclination to view them as outliers and discount the significance of these settlements, despite the SEC’s clear intention to add substance to these enforcement results by announcing them collectively. A closer inspection offers a different perspective. Indeed, these enforcement actions appear to be part of a broader messaging to public companies, as evidenced by recent statements from SEC Chief Accountant Wesley Bricker. In the press release accompanying these settlements, Mr. Bricker declared that, “Adequate internal controls are the first line of defense in detecting and preventing material errors or fraud in financial reporting. When internal control deficiencies are left unaddressed, financial reporting quality can suffer.” This comment mirrored remarks that he presented last December, which detailed current SEC and PCAOB developments.

Although none of these settlement orders provided any particular indication why these companies did not remedy their material weaknesses in ICFR on a timely basis, these prolonged failures are often emblematic of other foundational problems plaguing a company. Financially troubled organizations are more susceptible to inadequacies in their internal controls because they lack the required capital to address material weaknesses quickly and fully, when they arise. Likewise, companies with shaky corporate governance structures may be unwilling to reallocate resources from corporate operations to address weaknesses promptly, or simply lack the expertise necessary to lead a company efficiently and effectively through the remedial process. The consequences from such shortcomings are only magnified when the material weaknesses are severe or institutionally pervasive.

The essential takeaway from these proceedings is that, while incremental remediation coupled with proper disclosure may delay the prospect of prosecutorial liability, it should not be perceived as a pathway to immunity. Companies need to implement decisive and comprehensive remedial actions when confronted with ICFR deficiencies, regardless of whether the SEC has taken the affirmative step of contacting the company. These actions include both internal initiatives (including senior management and staff modifications, and procedural enhancements and reviews designed to improve technical competence, segregate financial responsibilities, and foster timely and accurate reporting) and third-party investments (most notably, the use of outside consultants to assess and strengthen the company’s control environment).

Naturally, public companies already possess a variety of practical business incentives to remediate their ICFR problems in a timely fashion. Not only do prolonged material weaknesses increase the likelihood of significant disruption within an organization, they leave it vulnerable to stock price declines, debt and credit rating downgrades, and heightened auditor scrutiny. Now, if avoiding such negative market consequences were not motivating enough for registrants, these SEC settlements and related recent pronouncements concerning internal controls offer a distinct impression that the timely remediation of material weaknesses has become an emerging regulatory focal point.