Five Common Mistakes Companies Make When Addressing a Material Weakness
This article first appeared in FEI Daily.
When a company discloses a material weakness in its internal controls, the integrity of its financial reporting may be compromised in the eyes of investors, often leading to a lower stock price. By obtaining a thorough understanding of the underlying cause of the deficiency, management teams can address material weaknesses and move swiftly to develop and disclose a comprehensive remediation plan.
For many entities, however, addressing a material weakness is an uncommon task. The difficulty of addressing an unfamiliar problem is often compounded by other pressing concerns that may be partial drivers of the control deficiencies themselves, such as significant transactions or turnover of key accounting and finance personnel. By understanding common pitfalls and the mistakes that entities make when addressing a material weakness, management teams can put their organizations on the right path to correcting the underlying deficiencies and disclosing the timely completion of the remediation plan to investors.
Here are five common mistakes that companies make when addressing identified deficiencies.
1. Failure to identify and address root causes
An effective remediation plan will address the source of a material weakness rather than its symptoms. For example, a company evaluating a material weakness related to complex technical accounting matters may consider whether the accounting department has the resources needed to allow senior members to devote proper time to perform comprehensive review procedures, rather than focusing their efforts on monthly close activities that would be more effectively performed by accounting managers. While proper staffing may seem like a clear root cause, this answer may only become evident by incorporating process owners into remediation efforts to thoroughly evaluate the control activities that take place (compared to formally documented processes), including the time allotted for them. After evaluation, management may determine that strengthening and focusing on certain key controls can reduce time spent on compensating controls and eliminate control redundancies rather than increasing headcount.
Root cause analyses should focus on the underlying cause of the deficiency, as well as an assessment of what could go wrong in the future. When a process or control breaks down, organizations should seize the opportunity to enhance the process holistically and avoid patch-fixes that could be susceptible to future failures.
2. Lack of urgency
The root cause analysis will take time given the need for business process redesign, control owner training, and enhancing documentation. Any delay in addressing the deficiencies can result in management scrambling to enact an updated process near the end of the fiscal year in order to have enough time to demonstrate that the updated process is in place and effective. Swift action to address prior year deficiencies not only minimizes the overall risk of material misstatement in the current period but also relieves the significant pressure that many management teams typically feel late in the year to deliver on remediation promises previously disclosed.
3 No auditor alignment
When a material weakness is identified, management should proactively align with the external audit team early in the year on planned risk mitigation efforts. While management is responsible for the control environment and to develop the path to remediate identified issues, a proactive approach to align with the audit team on remediation efforts can prevent surprises later in the year. A thorough understanding of audit risk can help ensure targeted approaches to remediation are cost-effective, while also addressing sources of auditor concern.
4. Failure to address completeness and accuracy
Companies may overlook the need to address completeness and accuracy of key reports or data sets when redesigning a process. For example, ensuring the supporting report or data source for a key control has been fully vetted to include all pertinent activity and data is imperative. Completeness and accuracy can be validated in a variety of ways depending on the nature of the underlying data source. For example, companies should not assume that because a report is generated from a system with effective underlying information technology general controls (“ITGC”), that no further procedures are necessary to validate completeness and accuracy of the information within the report. Further validation procedures may be required if the report is customized and effective controls surrounding change management are not in place.
5. Lack of accountability
Material weaknesses are often broad in nature, making it difficult to assign accountability for remediation efforts. Forming a task force or special project team can foster effective accountability for the required efforts. A company may also look to include remediation efforts within pertinent employees’ annual goals. As annual goals are typically established around the beginning of the year, this approach will highlight the urgency to take action when deficiencies are identified during the audit process. Regardless of how remediation efforts are planned, enforcing accountability for required actions will help ensure proper ownership of all necessary remediation efforts.
For companies that receive a material weakness or any control deficiency, it is important to understand the pitfalls that often befall remediation efforts. Awareness of and preparing for these common challenges is paramount to ensuring they do not beleaguer remediation efforts.