Earlier this week, the Securities and Exchange Commission announced that it had settled charges against four public companies for failing to maintain internal control over financial reporting (ICFR) over the course of seven to ten consecutive, annual reporting periods. For years, these companies reported ongoing material weaknesses in ICFR relating to high-risk areas in their financial statements. In some cases, the companies took years to remediate material weaknesses even after being contacted by the SEC, and one company’s remediation efforts remained ongoing as of the settlement. As an additional violation, two of the four companies failed to complete the required evaluation of effectiveness of ICFR for two annual reporting periods. Financial penalties in the settlements ranged from $35,000 to $200,000.

Echoing remarks at the 2018 American Institute of Certified Public Accountants Conference on Current SEC and PCAOB Developments (see our prior post), SEC Chief Accountant Wesley Bricker emphasized that “[a]dequate internal controls are the first line of defense in detecting and preventing material errors or fraud in financial reporting. . . . When internal control deficiencies are left unaddressed, financial reporting quality can suffer.” 

While these enforcement actions target egregious situations, the enforcement actions nevertheless underscore for all companies the SEC staff’s broad focus on controls and procedures, including ICFR. As an Associate Director in the SEC’s Enforcement Division noted, “Companies cannot hide behind disclosures as a way to meet their ICFR obligations.” For companies that have identified material weaknesses in ICFR, clear disclosure must be accompanied by timely, meaningful remediation efforts.