SEC Hits Firms on Internal Control

The Securities and Exchange Commission dinged four companies on Wednesday for poor internal control over financial reporting — a clear warning to companies that simply disclosing a material weakness in ICFR is not sufficient to fulfill a company’s compliance duties. Executives actually have to fix the problem, and not take too long to do so.

The SEC imposed a total of $435,000 in penalties against the four firms. All of them had let material weaknesses in their ICFR linger for years; one of them has a material weakness still unresolved today. Two of them didn’t even bother  to complete the required evaluation of the effectiveness of ICFR for two years straight.

While the SEC has sanctioned companies for poor internal control before, typically those failures led to some other problematic event, such as improper revenue recognition. This is the first time I’ve ever seen the SEC go after firms on internal control issues simply because the companies were taking too long to get their act together.

Simply disclosing a material weakness in ICFR is not sufficient to fulfill a company’s compliance duties. Executives actually have to fix the problem, and not take too long to do so.

“Companies cannot hide behind disclosures as a way to meet their ICFR obligations,” said Melissa Hodgman, associate director in the SEC Division of Enforcement. “Disclosure of material weaknesses is not enough without meaningful remediation. We are committed to holding corporations accountable for failing to timely remediate material weaknesses.”

The offenders were:

• Grupo Simec, a steel company in Mexico. Grupo Simec disclosed material weaknesses in its annual filings for 10 consecutive years, from 2008 to 2017. In 2015 and 2016, management failed to complete the required ICFR evaluation; and Grupo Simec still has unresolved material weaknesses today. Penalty: $200,000. Grupo Simec also needs to hire an outside monitor to ensure those material weaknesses get remediated, and stay remediated.
• Lifeway Foods disclosed material weaknesses for nine years (2007 through 2015), plus significant deficiencies that collectively constituted a material weakness in 2016. Lifeway management failed to complete the required ICFR evaluation in 2013 and 2014; and the company has limped through three financial restatements since 2012. Penalty: $100,000.
• Digital Turbine disclosed material weaknesses for seven fiscal years, 2011 through 2017. The company did not fully remediate its material weaknesses until the end of fiscal year 2018. Penalty: $100,000.
• CytoDyn, working on HIV treatments, disclosed material weaknesses in nine years from 2008 through 2016. CytoDyn also recycled the same boilerplate disclosure of material weaknesses for those nine years, and didn’t put its issues to rest until 2017. Penalty: $35,000.

Internal Control: Get With the Program

This is the second SEC action we’ve seen recently where the agency faulted the company for inadequate resources that led to sloppy financial reporting. In December the SEC fined Hertz $16 million for sloppy accounting practices that led to a financial restatement in 2015. That complaint minced no words: “Hertz’s internal audit function lacked systems and personnel adequate to ensure the adequate monitoring of control activities,” and ultimately Hertz had to hire fresh audit talent to get itself back on the road.

We see a lot of similar themes here: too many accounting issues, too few executives moving with sufficient speed to solve the problems. Consider this line from Grupo Simec’s settlement order:

Although Respondent hired a SOX consultant in August 2016, there was limited progress in devising a control structure and remediating material weaknesses prior to the [SEC] staff’s outreach in February 2017. Respondent completed the design and testing of its internal controls during the period ending March 2018 though there continues to be material weaknesses that it is still in the process of remediating.  

At CytoDyn, the company muddled through four years of material weaknesses before it “doubled its accounting staff” by hiring a CPA in 2012, and didn’t hire a SOX consultant until SEC staff came knocking circa 2016.

Granted, CytoDyn is a life sciences company; it has seen no revenue for years, while it develops its HIV therapies. Still, the company went from operating expenses of $7.4 million in 2012 to $27.3 million in 2017, when it finally straightened out its accounting act. That’s a growth rate of 370 percent. Would your audit committee allow that type of growth while it slow-rolled material weaknesses in the accounting department?

Or take Digital Turbine, which began the 2010s as a small-time tech company in Austin, Texas, with annual revenue around $7 million to $9 million. But revenue grew to $24.4 million in 2014 and $40.2 million in 2017. Meanwhile, the SEC said, the company had material weaknesses stemming from (among many other issues)—

…failures to maintain sufficient qualified personnel or adequate accounting information technology systems resulting in a manual close with insufficient documentation of the procedures employed.

Smaller firms (and except for Grupo Simec, the others are smaller firms) might argue that they can’t implement flawless internal control systems from Day 1 of operations. That’s a fair point, but it doesn’t quite address the SEC’s complaint: that management ignored internal control weaknesses year after year, leaving audit teams short of personnel, resources, and executive support.

Are revenue growth and product development important? Of course. But they are not important at the expense of all other priorities — and effective financial reporting must be a priority too, if your company wants to trade on the capital markets. If not, do the civilized thing and sell out to private equity.

So if any single group is to blame here, I’d fault these four companies’ audit committees. It’s the audit committee’s job to insist that accounting and audit functions have the resources they need to maintain effective internal control over financial reporting. For too long, that didn’t happen here.

Might be a point to mention next budget planning cycle.