Audit Analytics recently released a new report looking at trends in Sarbanes-Oxley (SOX) Section 404 disclosures, which pertain to Internal Controls over Financial Reporting (ICFR). SOX 404 Disclosures: A Twelve Year Review considers both management’s assessment and the auditor’s attestation. Pursuant to SOX 404(b), only larger companies (Accelerated Filers) are required to have their ICFRs audited by an external auditor.
Overall, the percentage of adverse 404 auditor opinions has seen a steady decrease, from 15.7% in 2004, the first year the requirements went into effect, to 5.3% in 2015. However, a less encouraging trend – depending on one’s perspective – is hidden in that overall view; the percentage actually hit its lowest point in 2010, at 3.4%. Since, we have seen an increase in the percentage of adverse 404(b) audit opinions.
Beginning in 2010, the PCAOB began to place a strong emphasis on whether the auditor obtained adequate evidence to substantiate its attestation of the effectiveness of ICFRs. This focus on the part of the PCAOB appears to have had an impact.
Turning our attention to smaller companies, we see a very different picture. One interesting aspect of our report highlights the difficulties faced by non-accelerated filers in achieving an effective level of internal controls over financial reporting. While larger companies rarely (5.3% in 2015) have material weaknesses in their ICFRs, smaller companies are much more often to be found in the weeds.
In 2015, 36.1% of companies that only present a management assessment of ICFRs disclosed that their controls were ineffective. That actually represents an improvement for smaller companies, since it marks the first drop in adverse management-only assessments in nine years. Nevertheless, the percentage of adverse management-only assessments in 2015 is still higher than all the years from 2007 to 2011. For comparison, as one can see in the top chart, adverse auditor attestations saw a maximum of only 7.9% during the same period since 2007.
Upon deeper review of the specific issues resulting in adverse disclosures, personnel issues such as inadequate competency and training, segregation of duty problems, and an ineffective, non-existent, or understaffed audit committee were seen as the most common reasons for ineffective ICFRs within adverse management-only assessments.
Many smaller companies appear simply not to have access to adequate personnel in number or talent to implement the processes required to achieve effective ICFRs.
After nine years of steady increases in the percentage of adverse management-only assessments, it will be interesting to see if the drop in 2015 will be merely an aberration, or if a new, more promising trend emerges. Another thing to monitor will be the recent uptick in the number of adverse SOX 404(b) auditor opinions. The PCAOB has found evidence that auditors have notably improved their SOX 404 procedures. But does the continued emphasis on SOX 404 suggest that the percentage of adverse opinions is likely to continue on this upward trajectory?
For further information on this topic or to request a copy of the full report, please contact us at info@auditanalytics.com.