Note: A version of this article was first available to subscribers of Accounting Quality Insights by Audit Analytics on Bloomberg, Eikon, FactSet, and S&P Global.
Recently we reviewed four companies fined by the Securities and Exchange Commission on January 29, 2019, for having longstanding ineffective internal controls over financial reporting (ICFR): Grupo Simec S.A.B. de C.V. [SIM: NYSE], Lifeway Foods [LWAY: Nasdaq], Digital Turbine [APPS: Nasdaq] and CytoDyn [CYDY: OTC].
In the SEC’s ruling, the agency said simply disclosing ineffective internal controls isn’t sufficient, but that these firms also need to demonstrate remedial actions and fix the problems. Among some of the issues these four companies had in common was a failure to maintain effective internal controls for seven to ten consecutive annual reporting periods. One of the companies was still undergoing the remediation process when the charges were announced.
At the time, we thought this was a rare enforcement action, as the SEC usually doesn’t cite internal controls as the main reason for bringing charges. We decided to look deeper into the topic and found that past SEC investigations into companies with weak internal controls has itself become a risk factor.
Below we highlight three companies with internal control weaknesses and their common issues, noting they also have some similarities with the four companies fined in January. We also noticed similarities between the three companies with weak ICFR and SEC investigations as a risk factor, even if they are in different industries.
Nearly identical risk factors disclosure
The three companies, pharmaceutical preparation company Cocrystal Pharma [COCP: Nasdaq], cryptocurrency firm TimefireVR [TFVR: OTC], and patent owner and lessor VerifyME [VRME:OTC] all used almost the exact same language when describing risk factors for 2018. This is unlikely to be a coincidence.
Cocrystal Pharma has a $84.7 million market cap and is the largest of the three firms. It is an accelerated filer. For its 2018 annual filing, Cocrystal used the following language (emphasis is ours):
Recently the SEC sued four public companies alleging in part that they had violated Section 13(b) of the Exchange Act resulting from their failure to remediate material weaknesses in their internal control over financial reporting over an extensive period of time. Three of these companies had remediated their material weaknesses at the time the lawsuits were filed. Since we acquired Cocrystal Discovery, Inc., our principal subsidiary, in January 2014, we have identified and disclosed material weaknesses in internal control over financial reporting beginning with the year ended December 1, 2014 and have since made significant progress in remediating them. As of December 31, 2018, we had two material weaknesses, both of which had previously been identified as of December 31, 2017 and have not been remediated.
VerifyMe has a $23.9 million market cap and has a smaller reporting company filer status with the SEC. Below is the language used for its 2018 annual filing (emphasis is ours):
Recently the SEC sued four public companies alleging in part that they had violated Section 13(b) of the Exchange Act resulting from their failure to remediate material weaknesses in their internal control over financial reporting over an extensive period of time. Three of these companies had remediated their material weaknesses. We have identified and disclosed material weaknesses in internal control over financial reporting beginning with the year ended Dec. 31, 2016. While we are taking steps to remediate any material weaknesses we have not yet fully remediated our internal control failures.
TimefireVR has a $1.1 million market cap and is also a smaller reporting company. The language for its annual filing for 2018 is below (emphasis is ours):
Recently the SEC sued four public companies alleging in part that they had violated Section 13(b) of the Exchange Act resulting from their failure to remediate material weaknesses in their internal control over financial reporting over an extensive period of time. Three of these companies had remediated their material weaknesses at the time the lawsuits were filed. Since we acquired TLLC in September 2016, we have identified and disclosed material weaknesses in internal control over financial reporting beginning with the year ended December 31, 2016 and have not made progress in remediating them. As of December 31, 2018, we had three material weaknesses.
Explicit references to SEC Accounting and Auditing Enforcement Release
The three companies, despite being in different industries, had nearly identical risk factor disclosures. The risk factors explicitly cite the January AAER and the SEC’s increased interest in companies with very poor internal controls.
While Cocrystal Pharma and VerifyMe previously cited risk factors related to ineffective controls, this language is new. Cocrystal Pharma admitted the problem in the risk factors section for three years: 2015, 2016, and 2017. VerifyMe initially cited it in 2017. This was the first instance for TimefireVR. Yet these firms’ previous disclosures for weak internal controls doesn’t tell the whole story. Historical filings show that two of these companies had more than a decade of ineffective ICFR.
Cocrystal Pharma and TimefireVR have a long history of a failure to remediate ineffective controls, similar to the four companies charged by the SEC in January 2019. Based on historical filings, Cocrystal Pharma’s ineffective ICFR dates back to the fiscal year ending December 31, 2007, while TimefireVR’s ineffective ICFR occurred as early as December 31, 2006. VerifyMe’s disclosed weak ICFR in fiscal-year ending December 31, 2016, consistent with the information disclosed in the 2018 risk factor.
The years of neglect could come back to haunt Cocrystal Pharma and TimefireVR. The SEC was blunt in its January press release: “Companies cannot hide behind disclosures as a way to meet their ICFR obligations. Disclosure of material weaknesses is not enough without meaningful remediation. We are committed to holding corporations accountable for failing to timely remediate material weaknesses”, said Melissa Hodgman, an associate director in the SEC’s Enforcement Division.
It remains to be seen if these companies disclosing ICFR weakness now as a risk factor will serve to mitigate consequences from past failures.
Specifics with ICFR material weaknesses
The two smaller companies cited similar reasons for the material weakness with ICFR. VerifyMe said inadequate segregation of duties led to the problem. TimefireVR also cited that reason, adding that a lack of an audit committee and outside directors caused the ineffective oversight. TimefireVR additionally said it had ineffective controls over period-end financial disclosure and the financial reporting process. Cocrystal Pharma said it didn’t properly prepare and review manual account reconciliations and it had a poor financial reporting process with respect to generally accepted accounting principles.
Both Cocrystal Pharma and VerifyMe say they are taking steps to fix the problems. VerifyMe says it now outsources accounting department duties and has formed an audit committee. Cocrystal Pharma outlined four tactics: implementing entity-level controls, properly segregating duties, giving control owners education and training, and improving how it monitors the underlying business process controls effectiveness. TimefireVR has not yet said what it will do to remediate its ineffective controls.
Companies with material weakness in ICFR need to be aware of the risks they face when it comes to SEC investigations. At the conclusion of the investigation by the SEC’s Financial Reporting and Audit (FRAud) Group, the agency imposed civil monetary penalties on the four firms with longstanding material weakness in ICFR; those penalties ranged from $35,000 to as high as $200,000.
For companies with limited financial resources a monetary penalty, in addition to potentially incurred legal fees and remediation costs, may have detrimental consequences.
It appears public companies are taking notice of the SEC’s January statement that merely disclosing ICFR material weakness is not enough. This year we may see more companies disclose ineffective controls, and this is meaningful because of the SEC’s scrutiny.
In conclusion, analysts and investors need to be on guard for more companies disclosing material weakness with ICFR. Further, they need to consider that admission of weak internal controls doesn’t necessarily mean 2018 was the first year the firm had problems. It’s possible historical filings could show years of ineffective ICFR.
For more information on this article, please contact us at 508-476-7007 or email info@auditanalytics.com.