Disclosure alone is not sufficient; material weaknesses need to be actively remediated.
While the SEC's Financial Reporting and Audit Group has been relatively quiet, it started 2019 with a bang, bringing four coordinated actions against issuers for failure to maintain internal controls over financial reporting ("ICFR").
Allegedly, the four issuers disclosed material weaknesses in ICFR for an extended time, ranging from seven to 10 years, but undertook ineffective, or no, measures to remediate, even taking months or years to remediate after being contacted by the SEC. The clear message here is: (i) the SEC continues its focus on ICFR, and (ii) issuers must not only disclose but also put resources into remediating material weaknesses as swiftly as possible. These messages are not new, but they are significantly magnified by these new actions.
- The material weaknesses alleged here were disclosed, but an issuer cannot "hide behind the disclosure." Disclosure alone, especially year after year, is not sufficient; there must be active remediation and—most importantly, if the SEC raises questions—documented evidence of concerted efforts to remediate.
- None of this is to suggest disclosure is the problem. Without their disclosures, presumably, these issuers would have faced greater sanctions.
- The disclosure cannot be boilerplate. The SEC will focus on how the weakness and remedial steps were disclosed. The disclosure must include more than broad, generic, and sweeping terms. And it cannot be the same disclosure year after year, as this suggests a lack of effort in remediating the weakness.
- How long is too long to remediate a material weakness or to have continuing material weaknesses? This will vary based on the weakness, but clearly several years of continuing and multiple material weaknesses is too long.
The best solution may be to have sufficient resources focused on ICFR so that problems do not become material weaknesses. But if an issuer has a material weakness, sufficient staff or resources to remediate as quickly as possible are essential and can save a company the time, expense, and reputational harm of an enforcement action. It is clear the SEC continues its interest in internal controls.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.