The SEC recently announced settled administrative proceedings against Magnum Hunter Resources Corporation (MHR), the former chief financial officer and chief accounting officer of MHR, the engagement partner on MHR’s external audit, and the lead consultant responsible for documenting and testing MHR’s internal control over financial reporting (ICFR). The SEC states in the five orders issued on March 10 that registrants must fully document why a significant deficiency in ICFR is not a material weakness. Adequate documentation to provide reasonable support for the assessment of the effectiveness of ICFR is required by Instruction 2 to Item 308 of Regulation S-K and the SEC’s guidance relating to management’s report on ICFR in Financial Reporting Release No. 77.

The SEC’s orders state that none of the respondents used the right standard in evaluating whether a staffing deficiency in MHR’s accounting department, an entity-level control, constituted a material weakness in ICFR. The SEC’s orders state that the respondents should have considered whether the deficiency in ICFR created a reasonable possibility of a material misstatement not being prevented or detected on a timely basis rather than simply relying on the absence of the identification of any material error in MHR’s financial statements.

The orders also state that the audit engagement partner’s explanation of why the significant deficiency in an entity-level control as of December 31, 2011, was not in fact a material weakness did not comply with auditing requirements “because it did not adequately consider: (a) the misstatement that might result from having insufficient accounting staff; (b) MHR’s ability to prepare accurate financial statements based on the possible future consequences of the deficiency; (c) the amounts and transactions exposed to the deficiency; or (d) the volume of activity exposed to the deficiency that occurred in the current period or that is expected in future periods.”

According to the SEC’s orders, although both MHR’s audit engagement partner and the lead ICFR consultant concluded that MHR’s accounting department staffing inadequacy could result in errors, each also concluded that the staffing inadequacy represented a significant deficiency in MHR’s ICFR as of December 31, 2011, and not a material weakness. Errors did ultimately occur, and MHR disclosed those errors as well as related ICFR material weaknesses in November 2012, when it filed an amended quarterly report for the period that ended June 30, 2012, that contained restated financial statements for the quarter and six-month period that ended June 30, 2012, and its quarterly report on Form 10-Q for the quarter that ended September 30, 2012.

Lessons from these SEC orders include the following:

• The mere absence of an error in financial statements does not mean that a deficiency in ICFR is not a material weakness.

• The proper standard for evaluating whether a deficiency or combination of deficiencies in ICFR is a material weakness is to ask, is there a reasonable possibility that a material misstatement will not be timely detected or prevented based on the controls in existence as of the end of the period being evaluated?

• A deficiency in an entity-level control requires particularly careful evaluation, because an entity-level control can affect other controls throughout a company. The control must be fully understood and defined to determine the nature, extent, and severity of the deficiency, and the documentation of the evaluation must provide reasonable support for the conclusions about ICFR effectiveness.

• The documentation of ICFR effectiveness when a significant deficiency has been identified must address why that deficiency is not a material weakness.

• Planned or anticipated remedial efforts are irrelevant to the analysis of whether ICFR is effective as of a prior date.

Additional lessons for management include the following:

• Companies cannot simply rely on an outside consultant’s conclusions on ICFR in fulfilling their obligation to evaluate ICFR effectiveness.

• Companies must evaluate and address in the required written documentation of their ICFR assessment any observations made by an outside consultant or their auditor, as well as any consequences of the deficiency.