Remediating Internal Control Weaknesses During Pandemic

As 2020 comes to a close, many public companies are gearing up for fiscal year ends and preparing annual financial statements. Particularly important this year is determining how to disclose pertinent information about COVID-19 in annual reports. Given the widespread disruption on regular operations, a disclosure of particular interest will be internal controls over financial reporting (ICFR); specifically, how the pandemic may have impacted the ability to remediate existing internal control weaknesses.

The COVID-19 pandemic heightens the risk for controls to operate ineffectively; established controls may not be equipped to handle remote work and there are potential consequences associated with operating and testing controls amidst reduced personnel.. 

While companies can modify their internal controls to cope with the impact of the pandemic, there is evidence that suggests some companies with an internal control weakness – that exists irrespective of pandemic – have faced challenges during the pandemic with efforts to remediate the weakness.

Internal control weakness remediation during pandemic

Hampered remediation efforts creates a notable risk: the inability to timely remediate a material weakness – whether due to external circumstances such as the pandemic, or otherwise – heightens the risk of committing an error that later necessitates a financial restatement.

For example, Aspen Technology [Nasdaq: AZPN] disclosed a material weakness in controls as of FYE June 30, 2019 resulting from the adoption of ASC 606 amidst an “ineffective risk assessment and the lack of timely creation of relevant reporting tools and information used to support the functioning of internal control.” The control weakness resulted in a material misstatement, requiring the restatement of financials for fiscal years 2017, 2018 and 2019.

Aspen Technology anticipated that the internal control weakness would be remediated by FYE June 30, 2020. However, in their delinquent annual report – which was delayed due to the discovery of additional errors related to the previous control weakness and conditions caused by the pandemic – disclosed that “the COVID-19 pandemic and resulting remote working environment made timely completion of these remediation procedures more challenging.” The Company now anticipates that the weakness will be remediated by the end of fiscal year 2021, but there is no telling how long the pandemic will continue to impact the working environment and Aspen Technology’s ability to rectify the issues.

Internal control weakness remediation during pandemic

As long as an internal control weakness exists, there exists the potential for a misstatement; interrupted remediation efforts due to external factors extends the amount of time that an internal control weakness is present, and thus, extends the exposure time for the potential for errors that must be corrected in a restatement. Restatements can then lead to reduced investor confidence and shareholder value, SEC fines, reputational damage, and lawsuits.

In general, traditional steps to remediate internal control weaknesses include:

  • hiring and/or engagement of additional qualified resources;
  • implementing new controls or additional review and monitoring of transactions to ensure compliance with new policies/procedures;
  • training of personnel responsible for preparation and review of financial information

Operating with a remote workforce poses a challenge to many remediation actions due to the inhibited ability to implement broad changes with a scattered workforce. This includes the limited ability to have in-person meetings for purposes of training surrounding new controls, as well as restricted travel measures that make it difficult for executives and other leadership to travel to different company locations.

Management’s report on the effectiveness of ICFR is required annually; as of December 15, 2020, seven companies have been identified that disclosed interrupted internal control weakness remediation efforts in the context of COVID-19. This figure is reasonably likely to increase after annual reports are filed in early 2021 for filers with 12/31 year ends.

Considering some companies struggle with ineffective controls on a recurring basis, it will be interesting to see disclosures from these companies regarding the pandemic’s impact on remediation efforts.

For example, Phibro Animal Health [Nasdaq PAHC], Net Element [Nasdaq: NETE], and Recon Technology [Nasdaq: RCON] have all had longstanding weaknesses in internal controls, with six, eight, and ten consecutive annual reports, respectively, disclosing a material weakness in controls. All three of those companies disclosed in their annual reports filed in 2020 that remediation efforts have been impacted by conditions arising during the pandemic. Given the longstanding nature of the material weaknesses for those companies, it is not certain that those companies would have been able to correct the weakness in their controls had the pandemic not occurred.

Prior to the pandemic, the SEC demonstrated that it will not tolerate companies that are unable or unwilling to correct ineffective internal controls.

Overall, internal controls are meant to safeguard assets, ensure operations are conducted appropriately, and mitigate the risk for errors. It is vital for the users and preparers of financial statements to consider how COVID-19 may impact, and may continue to impact, efforts to remediate internal control weaknesses and consider the risks associated with an ongoing material weakness in internal controls.

Data in this post was obtained from the Internal Controls database, powered by Audit Analytics.

For more information about Audit Analytics or this analysis, please contact us.

Interested in our content? Be sure to subscribe to receive our email notifications.