In an 8-K filing, Kraft announced that it is restating its financial statements for 2016 and 2017 by $181 million due to misstatements caused by employees circumventing internal controls to meet aggressive bonus targets.  To show significant growth in EBIDTA, employees recognized the benefits of costs and rebates associated with supplier contracts in the wrong time period. The restatement is not quantitatively material, but it underscores the importance of maintaining internal controls over financial reporting (ICFR).

Maintaining adequate ICFR provides companies, investors, and other interested parties with reasonable assurance that misstatements, omissions, and fraud will timely be prevented or detected. This assurance is especially critical in a time when external auditors have failed to identify flaws in public companies’ ICFR. In 2016, the PCAOB inspected 12 publicly traded companies audited by PwC and found deficiencies in 10 of the audits related to testing controls for purposes of the ICFR opinion. PwC revised its opinion on internal controls in 6 cases. At Deloitte, the PCAOB identified problems in the internal-control audit for all 13 of the audits selected.

Recent ground-breaking research about the consequence of internal control deficiencies underscores the critical role that ICFR plays in detecting and preventing fraud. A 2017 article titled Internal Control Weakness and Financial Reporting Fraud published in Auditing: A Journal of Practice & Theory demonstrates that weak internal controls are associated with a higher risk of unrevealed accounting fraud. According to the research, the incidence of fraud disclosures at companies found to have material weaknesses in ICFR is about 80% to 90% greater than it is among companies generally, and approximately 30% of fraud revelations were preceded by reports of material weakness.

Yet the SEC is trying to exempt more registrants from Section 404(b) of SOX, which mandates an auditor attestation of the adequacy of ICFR.  And the SEC is taking a light touch approach to enforcement that puts investors at risk.  Commissioner Peirce has publicly mocked former SEC Chair Mary Jo White’s “broken windows” approach to enforcement, stating in a May 2018 speech that “perhaps the SEC should have changed its name to the ‘Sanctions’ and Exchange Commission, because it acted like a branch of the U.S. Attorney’s Office for the Southern District of New York.” And according to a WSJ article, Commissioner Peirce “has sometimes questioned the SEC’s enforcement attorneys so aggressively that she later apologized for remarks that could be seen as denigrating their work.”  In other words, she is dissuading Enforcement Staff from enforcing the federal securities laws.

In assessing the burden of SEC enforcement, Commissioner Peirce should consider the cost of fraud to shareholders and capital formation. Following the collapse of Enron and other corporations that lacked robust ICFR, the Dow fell to 7200 and the NASDAQ fell to just above 1100 in early October 2002.  And when the SEC was asleep at the wheel while Wall Street misled investors about their balance sheets, the U.S. financial system nearly collapsed eleven years ago.  Better Markets, a non-partisan think tank, estimates that cost of the 2008 financial crash is more than $20 trillion.

When a blue chip company like Kraft restates earnings due to inadequate ICFR, that should be a wake-up call to the SEC to focus more (not less) on requiring public companies to maintain controls that protect shareholders against fraud.

The “light touch” Ayn Rand approach to enforcement that Commissioner Peirce seeks to impose on the SEC, including recent miniscule fines for ICFR violations, sends a signal that fraud pays and puts retail investors’ savings at risk. Fraudsters know that if the SEC ever detects the fraud, the penalty would be a slap on the wrist.  Weak enforcement encourages the apparent decision calculus of the Kraft employees that circumvented internal controls – get the bonus today and deal with the remote adverse consequences in the distant future.

Rather than precipitating the next Enron, the Commission should strengthen its enforcement program. Ideologues at the Mercatus Center are entitled to espouse the radical notion that the market alone will weed out fraudulent participants and that government should play little or no role in detecting and preventing fraud.  But the SEC is not a Koch-funded laboratory to experiment with this approach to enforcement.  And there’s no need to perform the experiment again.  The near collapse of the U.S. financial system provides ample data about the need for the SEC to protect retail investors by enforcing the federal securities laws. Members of the Commission should make decisions on proposed enforcement actions based on the facts and the law, not based on radical, failed ideology.