Auditors and companies could soon clash on the issue of whether companies have the proper systems in place to avoid significant errors in their financial statements, Greg Wilson, deputy director of the Public Company Accounting Oversight Board’s inspections division, recently warned audit firms new to reviewing their clients’ internal controls.
Things may get touchy indeed. “There are going to be situations where issuers will have stated that in their view there are no material weaknesses and their auditors will finding something,” Wilson said during a recent Webcast sponsored by the Center for Audit Quality. “I don’t think it’s going to be terribly frequent,” he added, “but the nature of the beast is such that it will happen and there will be some interesting dialogue.”
While the largest of U.S. publicly traded companies are in their fifth year of complying with Section 404, the internal-controls provision of the Sarbanes-Oxley Act, smaller companies have yet to fully comply. It was only last year that nonaccelerated filers — defined by the Securities and Exchange Commission as those with a market capitalization of below $75 million — began filing management’s assessments of internal controls with their 10-Ks. For fiscal years ending after December 15, 2009, for the first time they’ll have to get their auditors’ signoff on their internal controls, also known as 404(b) reports.
It’s rare that disagreements between a company and its accounting firm as described by Wilson play out publicly, but it has happened at least once this year. First Place Financial, a bank with $3.4 billion in assets, fired its audit firm, Crowe Horwath, last month due to a disagreement about the effectiveness of one of its internal controls over financial reporting for its fiscal year ended June 30, 2009.
The issue: during its audit, Crowe found the bank’s fair-value calculation of loans held for sale was wrong — which would have resulted in First Place understating its net loss for the fourth quarter by 12.47%. The correction upped First Place’s net loss by $1.41 million; in the meantime, Crowe gave the bank an adverse opinion on its internal controls.
“Based upon…the potential magnitude of an error in determining the fair value of loans held for sale, the magnitude of the error we identified during our audit and the fact that the company’s internal control over financial reporting processes did not detect that error prior to our identification of it, we have determined it represents a material weakness in the company’s internal control over financial reporting at June 30, 2009,” Crowe wrote in a report dated September 14.
First Place doesn’t dispute its mistake, but doesn’t cotton to the notion that its internal controls will be branded ineffective until its next 10-K. The bank has since hired KPMG to take Crowe’s place.
Under the PCAOB’s Auditing Standard No. 5, a company that has one or more material weaknesses has ineffective internal controls. The error, according to First Place, wasn’t material and merely reflects a “significant deficiency,” which auditors consider “less severe” than a material weakness, meaning the deficiency doesn’t warrant public disclosure but management should be aware of it.
From First Place’s perspective, the error was not material: when taken in context of the entire year, the bank’s net loss would have been off by only 1.29%. Plus, the bank believes it would have eventually caught the mistake, and has since implemented new verification procedures for its loans. Both First Place CFO David Gifford and Crowe declined CFO.com’s request to elaborate beyond the data reported in the bank’s recent regulatory filings.
Coincidentally, at the same Webcast that featured the PCAOB’s Wilson, Crowe Horwath executive Wendy Cama commiserated with her colleagues who are 404(b) first-timers, noting that they could have “difficult conversations” with their clients in the months ahead. The Webcast was the third in a series to ready auditors of nonaccelerated filers to follow AS5.
“There are many situations where you may arrive at a material weakness because of the magnitude; because of what could happen,” said Cama, despite proof from a company that a misstatement has not occurred. “Even if you can explain to me that everything’s been reported accurately, the fact that there’s not a control to prevent something from going wrong and the fact that the magnitude is so significant could be a material weakness.”
Adding to the likely tension between smaller companies and the auditors is the fact that internal-controls reports of smaller companies will probably have a higher rate of adverse opinions than those of larger companies. Last year research firm Audit Analytics looked at the difference between the 3,435 companies whose auditors did not opine on their controls — most of which were nonaccelerated filers — and the 4,012 companies that did file 404(b) opinions as of September 10, 2008. The study revealed that 30.7% of nonaccelerated filers reported they had ineffective controls. At the same time, just 7% of the larger companies, which have had to file auditor attestations of their internal controls, received adverse opinions from their auditors on those controls. Next time out, of course, the nonaccelerated filers will have to include those auditor’s reports.
Indeed, notes Wade Lindenberger, director of corporate governance services at finance and accounting consultancy RoseRyan, “small companies typically have greater risk to begin with because of challenges with segregation of duties, limited budgets to procure adequate systems and tools, and lack of resources to regularly execute internal controls.”
At the very least, companies should be halfway through testing their controls so that they fix any internal-controls issues before their reporting period ends, Lindenberger adds.
However, smaller firms may be still dragging their feet after getting used to so many delays from regulators even though another one doesn’t appear likely, says Bob Benoit, president and director of SOX Research at consultancy Lord & Benoit. The SEC expects to release a long-awaited cost-benefit study of 404 compliance for smaller companies later this month.
As for accounting firms’ readiness for the new round of internal controls, the PCAOB recently reported that for the most part, the eight largest firms are doing a good job of following AS5. However, in its review of 250 internal-controls audits by BDO Seidman, Crowe, Deloitte & Touche, Ernst & Young, Grant Thornton, KPMG, McGladrey & Pullen, and PricewaterhouseCoopers, the firms’ watchdog noted they could improve. “The inspectors observed situations where auditors failed to test a relevant control appropriately, or in some cases, at all,” the PCAOB wrote.