A Fresh Example of Poor Control Environment

The Securities and Exchange Commission has charged a Massachusetts company with allowing a poor control environment and weak segregation of duties, which in turn allowed one of the company’s corporate finance directors to inflate his division’s financial performance for years.

The company in question is Circor International, a maker of industrial valve systems for the defense and aerospace sectors. The SEC announced settled charges against Circor on Thursday; and also charged the company’s former finance director for a U.K. subsidiary with taking advantage of those internal control weaknesses to run a fraud scheme from 2019 through 2021.

Let’s start with Circor’s control failures, since they are enough to make an internal auditor or SOX compliance officer wince. 

As described in the SEC settlement order, Circor had a U.K. subsidiary called Pipeline Engineering — and like many other Circor business units, Pipeline maintained its own books and records in a local accounting system, and then sent its financial data to Circor on a regular basis to be consolidated into Circoro’s financial reporting system.

That unto itself would be OK, if Circor had transparency into those local accounting systems and could, when necessary, investigate a subsidiary’s financial reporting directly. Except, that’s not how Circor arranged things. 

Instead, Circor had designed its financial reporting processes so that the subsidiary’s finance director, a man named Nicholas Bowerman, was the only employee with access to both Pipeline’s local accounting system and the Circor’s consolidation system; and Bowerman had responsibility for transmitting the business unit’s financial statements and reconciling the updated information in both systems. 

Even worse, Circor didn’t have sufficient control over its cash reconciliations. For example, the company didn’t have direct access to certain business unit bank accounts, including Pipeline’s. 

This meant that CIRCOR’s corporate treasury group couldn’t independently verify cash balances and activity at Pipeline. It relied solely on Bowerman’s word that financial transactions were accurately reflected in the company’s books and records. 

Enter the Accounting Allegations

Now let’s shift to the SEC’s complaint against Bowerman, filed this week in federal district court in Massachusetts. 

According to the SEC, Bowerman began his fraud scheme in 2019. He repeatedly made unsupported and unauthorized accounting adjustments in Pipeline’s local accounting system, and then transmitted those bogus records to Circor’s consolidation system. For example, Bowerman overstated cash balances held in bank accounts in the UAE, inflated the value of lease-related assets, deflated the size of lease-related liabilities, and so forth.

Bowerman then covered his tracks by manipulating account reconciliations and business reports and falsifying certifications; fabricating bank confirmation statements; altering emails; and misleading CIRCOR management and the company’s auditors. 

Bowerman continued his fraud for nearly three years, until an audit of the company’s 2021 results brought everything into the light. By then, the SEC says, Bowerman had managed to… 

• Overstate 2019 operating income by $7.2 million, or 24 percent; 
• Understate a 2020 operating loss by $34.5 million, or 36 percent; and 
• Understate an operating loss for the first nine months of 2021 by $12.5 million, or 120 percent.

Bowerman’s frauds even mucked up a goodwill impairment charge Circor declared in the first quarter of 2020. Had the company included actual results instead of Bowerman’s fabrications, the SEC says, Circor would’ve impaired goodwill by another $21.9 million.

In other words, this was a big mess for Circor, which at the time was booking roughly $785 million in annual revenue. The company fired Bowerman in March 2022, restated three years’ worth of financial results later that year, and ultimately was taken private in 2023 for $1.6 billion.

Internal Control Analysis

Obviously you have to wonder what Circor executives were thinking. They didn’t just allow subsidiaries to run their own accounting systems; they tolerated a lack of transparency into those systems, so that Circor was dependent on the integrity of the subsidiary financial employees running those isolated systems.

More alarming is that Circor’s senior management knew this was a problem. For example, in the company’s 10-K filing for 2019, management admitted that it had inadequate internal control over financial reporting. The company even singled out its lack of effective control over the review of account reconciliations, which is precisely the weakness Bowerman is accused of exploiting. Then it allowed those material weaknesses to endure in 2020 and 2021. 

Remember the root problem here, people: a poor control environment. And what is perhaps the clearest red flag that your control environment is flawed? Known material weaknesses that go unaddressed. Why did Circor’s board allow this state of affairs to endure? 

There’s more. One might also reasonably ask what Circor’s external auditors were doing during this period. Well, Circor’s auditor for 2019 was PwC, which did flag numerous internal control weaknesses in its audit opinion for that year, including those flawed controls over account reconciliations.

In June 2020, however, Circor’s audit committee moved to drop PwC as the company’s auditor in favor of Ernst & Young. The following spring, Ernst gave a clean opinion of Circor’s internal control over financial reporting. Wha? 

One obvious lesson here is segregation of duties. The company had a flawed system that concentrated too much power in the hands of solitary employees, and one of those employees now stands accused of exploiting that weakness to goose financial reporting and keep his job.

The true, deeper issue here, however, really is about leadership, tone at the top, and the control environment. Management and the board knew they had a problem and didn’t move quickly to fix it. Should we be surprised that some unscrupulous person then took advantage of that poor leadership?

In the End

The off-key epilogue to this story is that the SEC imposed no monetary penalties against Circor, because once the company did uncover the fraud, it took all proper steps to rectify matters:

• A prompt internal investigation
• Swift disclosure of the issue to the SEC
• Extensive cooperation with the SEC, including detailed examples of Bowerman’s unsupported and unauthorized adjustments
• An overhaul of its financial controls

“While this matter involves serious violations of the securities laws, once the company became aware of the violations, it promptly self-reported, cooperated, and remediated the gaps in its accounting systems,” Nicholas Grippo, head of the SEC’s Philadelphia regional office, said in a statement. “As also reflected in other recent Commission resolutions, this kind of response by a corporate entity can lead to significant benefits including, as here, no penalty.”

I mean — ugh, I guess so; Circor is a victim here too, and it did try to do the right thing once the fraud was exposed. But the company was a day late and a dollar short, and think of all the money it might have saved by insisting on a strong control environment from the start.