An Internal Governance Basket Case

Talk about the gang that couldn’t shoot straight: One of the largest online gun marketplaces in the United States just filed its latest annual report, and the thing is an internal controls and corporate governance catastrophe. If you’ve ever needed an example of how not to manage your governance operations, read onward.

The company in question is Ammo Inc., which proudly trades under the ticker POWW and bills itself as a maker of specialty ammunition and operator of e-commerce website GunBroker.com. Ammo filed a 10-K last week that reported annual revenue of $191.4 million, a net loss of $4.6 million — and included enough bullet-point disclosures about ineffective internal controls to fill a Colt 45 revolver.

Specifically, Ammo confessed to five material weaknesses:

• Failed to maintain appropriate entity-level controls to govern the control environment, primarily due to “limited personnel to assist with the accounting and financial reporting function and inadequate oversight and accountability over the performance of control activities.” The control activities in disarray include establishment of a whistleblower hotline, acknowledgement of code of conduct, approval of the annual budget, and more.
• Failed to maintain effectively designed controls over journal entries, account reconciliations, and periodic flux analysis. Journal entries weren’t always accompanied by sufficient supporting documentation and weren’t adequately reviewed and approved for validity, completeness, and accuracy. In most instances, Ammo said, persons responsible for reviewing journal entries and account reconciliations were also responsible for preparing those entries too. 
• Failed to maintain properly designed segregation of duties, both within manual processes and system access. This comes as little surprise, given the previous weakness disclosed above. 
• Failed to maintain effectively designed controls over the period-end financial reporting process, including adequate tie-out and review of documentation that supports the financial statements.
• Failed to maintain effectively designed controls over IT general controls to manage user provisioning and de-provisioning, application change management, operating system and logical access controls, and segregation of duties for IT systems that support Ammo’s financial reporting process.

I mean, wow. This is impressively bad. This is so bad it’s really a contribution to the literature on internal control, so that accounting professors and audit partners can show the young ones what happens when internal control surrenders to the dark side of the force. It’s terrifying and thrilling at the same time; you want to recoil, but can’t look away.

Where did I find this astonishing example of bad governance, you ask? On Twitter, of course. Which brings us to even more crazy stuff.

More Governance Misfires

First, we should give credit to someone on Twitter who travels under the sobriquet 3:10 Value. I don’t know who 3:10 is, but he or she identifies as a business analyst, and 3:10’s tweets about Ammo were what first drew my eye to this company. 

So what else did Ammo disclose in its 10-K to raise a good governance enthusiast’s eyebrows? For starters, the company’s board approved a one-time cash bonus of $129,000 to CFO Robert Wiley. It also gave Wiley a raise, with annual salary going from $217,000 last year (according to Ammo’s most recent proxy statement) to $325,000.

Wily, 31 years old, first joined Ammo in 2018 as controller, and was promoted to CFO in 2019. As recently as two years ago, his annual salary was $127,500. So Ammo has more than doubled his annual salary (and also his total compensation, which went from $218,00 to $567,000 last year) while he presided over that tour de force of material weaknesses the company disclosed last week. 

In the Contingencies section of the 10-K, we have a lawsuit filed by a man named Steve Urvan, one of Ammo’s largest shareholders and previously owner of that gun e-commerce website, GunBroker.com. Urvan filed his lawsuit against Ammo in May, claiming that he’d been duped into selling the site to Ammo for $240 million in exchange for a 17 percent stake in the merged company. 

This is actually the second lawsuit Urvan has filed against Ammo. He had filed a first lawsuit in 2022 and settled it with Ammo later that year, with stipulations including a few new board directors and plans for CEO succession, since current CEO Fred Wagenhals is 81. 

The Contingencies section also mentions that a whistleblower had previously filed a SOX whistleblower complaint against Ammo in 2019 with the Labor Department, alleging financial improprieties and retaliation for raising those concerns. The complaint led to a special investigation by the board. The board found that the allegations were groundless, but did recommend “enhancements to certain corporate governance charter documents and processes which the company promptly implemented.” 

So those improvements were separate from the five material weaknesses still outstanding, I guess? I’m confused. Anyway, the complaint ended in “successful mediation” one year ago and insurance covered a payout to the whistleblower.

3:10 went on to raise other questions about the pricing of stock grants given to various insiders. We won’t explore those here since that’s too niche even for us, but you get the idea. This company has more questions swirling around it than a preschool teacher surrounded by two-year-olds. 

How’d We Get Here?

If we want to trace the roots of Ammo’s predicament, this might be the cause: over the last five years, Ammo’s revenue went from $4.56 million (2019) to $191.44 million (2023). This is a company that lunged ahead on a rapid expansion strategy without erecting necessary guardrails along the way. 

In 2019, for example, Ammo had one operating segment that made specialty ammunition. The company had 93 employees, including four in accounting and finance. It still reported net losses then too, but the balance sheet was reasonably stuffed with tangible assets. You could see that Ammo had a business logic to it. 

By 2023, the first line of the 10-K’s business description says it all (emphasis mine): “Ammo Inc. is a conglomerate of two premium positions in the shooting sports industry.” The company had ballooned to 342 employees, with 41 “in various corporate and administrative functions.” 

How are those 41 roles allocated among IT, or accounting, or finance? We don’t know. But since a shortage of personnel is the very first material weakness Ammo mentions, one assumes the answer is not enough, across the board. 

The mess here seems to be the acquisition of GunBroker.com. The deal was originally announced in February 2021, back in those halcyon days when interest rates were low, inflation was lower, the stock market was roaring, and life was great — especially for gun lovers, buying ammunition and weapons at a brisk pace. The deal closed that May.

By August 2022, things were different. Ammo announced plans to split the newly merged company back into two separate publicly traded businesses. But interest rates were rising, inflation was too, and the IPO market went into the deep freeze. So here we are, nearly a year later, with Ammo’s strategic plan firing blanks and its internal governance full of holes.

So What Comes Next?

Let’s go back to Ammo’s disclosures from last week. In addition to the blizzard of material weaknesses, the company did promise that remediation is on the way.

• Hiring an outside consultant with internal audit experience, and specifically internal controls, to develop Ammo’s fundamentals on risk assessments, documentation, IT general controls, and more.
• Implementing an internal whistleblower system, which apparently the board of directors reviewed and approved only recently.
• Launching an IT remediation project with outside consultants to design and implement controls over user provisioning and de-provisioning, application change management, segregation of duties, and more. 
• Implementing improved procedures for journal entries and approvals. 

We wish Ammo the best. For everyone else — well, as bad as you might sometimes believe your company to be, clearly we have much worse candidates out there. Remember that the next time you want to bang your head against the wall.