Evaluating Internal Control Deficiencies Guide

Management is responsible for maintaining a system of internal control over financial reporting (ICFR) that provides reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements in accordance with the applicable accounting principles framework. The Securities and Exchange Commission (SEC) rules require management of registrants to evaluate on an annual basis whether ICFR is effective at providing reasonable assurance and to disclose its assessment to investors. In supporting its assessment, management is responsible for maintaining evidential matter, including documentation.

This guide focuses on management’s responsibilities and key considerations when control deficiencies are identified. While this guide includes specific requirements for SEC registrants, the control deficiency evaluation process is similar for private companies and can be applied in the same manner with the exception of reporting considerations, which may differ depending on the applicable financial reporting standards. A deficiency in ICFR exists when the design or operation of a control does not allow management, in the normal course of performing its assigned functions, to prevent or detect misstatements on a timely basis. These include:

• A deficiency in the design of ICFR, which exists when (a) controls to address identified financial reporting risks are not present, or (b) existing controls are not properly designed so that, even if the control operates as designed, the financial reporting risks would not be addressed.
• A deficiency in operation, which exists when a properly designed control does not operate as designed, or when the person performing the control does not possess the necessary authority or competence to perform the control effectively.

BDO’s Professional Judgment Framework (PJF) identifies six steps within a sound judgment process. These steps may be applied specifically to evaluating internal control deficiencies by clearly articulating the identified control deficiency and judgments to be made.

Specifically, which control(s) failed and why? Next, identify the potential impact that the deficiency may have on the financial statements. Then, gather and analyze information about the deficiency, including the root cause of the control failure.

And finally, once a conclusion is reached as to the severity of the control deficiency, step back and reflect. Are the conclusions properly supported and documented and then communicated to those charged with governance and the external auditor as necessary?

The framework for evaluating control deficiencies within this guide is structured in a way that allows management to execute this six-step professional judgment framework. Creating and retaining records of the judgments made throughout each step of the process, including consideration of evidence both in favor of and contrary to the conclusion reached, assists management in supporting the conclusions reached.

Responsibility of Management in Evaluating Control Deficiencies

As stated in the SEC Interpretive Release Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting Under Section 13(a) or 15(d) of the Securities Exchange Act of 1934:

“Management is responsible for maintaining a system of internal control over financial reporting (ICFR) that provides reasonable assurance regarding the reliability of financial reporting and the preparation of financial statements for external purposes in accordance with generally accepted accounting principles. Management may not disclose that it has assessed ICFR as effective if one or more deficiencies in ICFR are determined to be a material weakness.”

It is management’s responsibility to assess the severity of an entity’s deficiencies whether identified by management, internal audit, or the external auditors. In order to determine whether a control deficiency, or combination of control deficiencies, is a material weakness, management evaluates the severity of each deficiency that comes to its attention.

An appropriate evaluation involves an objective assessment of all the relevant facts, including any contradictory evidence, particularly with respect to (i) whether there is a reasonable possibility that the company’s ICFR will fail to prevent or detect a misstatement of a financial statement amount or disclosure, and (ii) the magnitude of the potential misstatement resulting from the deficiency. It is important to keep in mind that the basis for concluding on the severity of a control deficiency is not limited to whether a misstatement actually occurred, but what the potential misstatement could be and potential future consequences had the deficiency not been identified. Proper evaluation of control deficiencies can assist management in determining how deficiencies may affect the records and financial statements of the entity, as well as how management might enhance control processes to remediate any identified deficiencies.

As part of this evaluation, management will need to conclude, independently of the external auditor, on the severity of each deficiency or combination of deficiencies identified.

It is management’s responsibility to communicate deficiencies timely (including in connection with interim reporting requirements). Thus, it is important to evaluate the severity of the deficiencies as they are identified.

Definitions

Control Deficiency: A deficiency in internal control over financial reporting exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent or detect misstatements on a timely basis.

Significant Deficiency: A deficiency, or a combination of deficiencies, in internal control over financial reporting that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the company’s financial reporting.

Material Weakness: A deficiency, or a combination of deficiencies, in internal control over financial reporting such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected in a timely manner.

Control Deficiency Evaluation Process

This framework describes the typical sequence of judgments management would be expected to consider in its evaluation. Remember, management should evaluate the severity of all control deficiencies that are identified during the period, not just control deficiencies that are unremediated at year-end, as different or incremental risks may be present in the period during which the control deficiency existed.

The severity of a deficiency in ICFR does not depend on whether a misstatement actually occurred but rather on whether there is a reasonable possibility that the entity’s ICFR will fail to prevent or detect a misstatement on a timely basis. In determining the potential financial statement impact on the current and/or future periods, management should consider the following:

• What is the potential magnitude?
  • What account balances are exposed to the deficiency?
  • What is the volume of transactions exposed to the deficiency?

In evaluating the magnitude of a potential misstatement, the maximum amount that an account balance or total of transactions can be overstated is generally the recorded amount, while understatements could be larger.

• What is a reasonable possibility that a deficiency, individually or in the aggregate, will result in a misstatement?
  • What is the nature of the financial reporting elements exposed to the deficiency? (For example, related party transactions would likely involve greater risk.)
  • What is the susceptibility of the account balance to fraud?
  • What is the degree of subjectivity, complexity, or judgment involved in the operation of the control? (For example, deficiencies related to significant estimates would likely involve greater risk of a potential misstatement.)
  • What is the interaction of the control with other controls? (Consider interdependence with other controls both upstream and downstream in the business process.)
  • What are the possible future consequences if the deficiency hadn’t been identified or if the deficiency is not remediated?

The examples on the following page are for illustrative purposes only. Management should consider specific facts and circumstances when evaluating the potential magnitude and potential likelihood of a material misstatement going undetected.

Example 1

Sales invoices with a value above $50,000 are reviewed and analyzed for proper revenue recognition. The total value of invoices less than $50,000 is $10 million, which is material to the financial statements. If the control related to the invoices greater than $50,000 is operating effectively, there may, nonetheless, be a potential risk that the sales invoices contain a material misstatement that is not prevented, or detected and corrected, on a timely basis because there is no control related to invoices with a value less than $50,000, the total of which constitutes a material amount. In this instance, the maximum exposure to a potential misstatement is $10 million, which is the starting point for purposes of evaluating the severity of this deficiency.

Example 2

All invoices greater than $100,000 require approval prior to payment. The control owner uses a system-generated report to identify invoices greater than $100,000. The control design does not contain an attribute over the validation of the completeness and accuracy of the report. The potential magnitude for a misstatement as a result of this control failing would be invoices greater than $100,000. Factors considered in determining the likelihood of a misstatement might be the volume of invoices greater than $100,000 relative to the total number of invoices processed, or the volume and historical experience with vendors and the involvement of the control owner in aspects of the business that might provide them with the requisite knowledge to review invoices greater than $100,000. These factors could impact the potential magnitude and likelihood of a misstatement and should be considered in reaching a conclusion.

Example 3

The control owner reviews the forecasted revenues and related assumptions that support the valuation of certain intangible assets. Specifically, the control owner validates the completeness and accuracy of underlying supporting data used in developing the forecast. The control owner did not evidence his or her review of 1) the assumptions made as part of the valuation or 2) the completeness and accuracy of the forecasted amounts in the valuation model. In determining the potential magnitude, management might consider the sensitivity of the valuation model to these inputs and potential impact on the final valuation of the intangible assets.

The severity of a deficiency may be mitigated by the presence of effectively designed, implemented, and operating compensating controls. To have a mitigating effect, a compensating control should operate at a level of precision that would prevent or detect a misstatement that could be material due to the previously identified deficiency. When considering compensating controls, determine:

• Did a compensating control identify the misstatement that led to the deficiency?
• Are there compensating controls that reduce the overall exposure for a misstatement resulting from the control deficiency?
• Did the compensating control(s) operate effectively in the period during which the deficiency was present?

Multiple control deficiencies that affect the same financial statement area (amounts or disclosures) may, when combined, constitute a material weakness. Control deficiencies should be evaluated for potential aggregation to determine if there is a reasonable possibility that a material misstatement would not be prevented or detected in a timely manner. Although deficiencies may individually be less severe than a material weakness, the aggregation of such deficiencies may result in an elevated severity for the deficiencies identified. When determining whether to combine deficiencies for purposes of further evaluation, management should consider the following for any noted commonalities or differences in the deficiencies identified:

• Nature of the deficiencies identified
• Underlying root cause of the deficiencies
• Financial statement area and assertion impacted
• Component of internal control (for example, COSO 2013 Framework or other applicable internal control framework principle)
• IT systems affected (if applicable)
• Remediation efforts necessary (is the remediation similar in nature?)

If management concludes that it is appropriate to aggregate deficiencies, the severity of the deficiencies in aggregate should be evaluated consistent with the considerations in Step 5.

Once management has gathered and analyzed the relevant facts, a judgment is to be made on the severity of a deficiency individually and in the aggregate with other deficiencies, as appropriate. In order to evaluate the severity of a deficiency or group of deficiencies, management should consider the following:

• The likelihood of a misstatement occurring that is not prevented or detected in a timely manner as a result of the deficiency
• Whether the magnitude of the potential misstatement(s) that is reasonably possible to have occurred or could occur in the future as a result of the deficiency was, or could be, material to the financial statements
• Whether compensating controls would have timely prevented or detected a misstatement had it become material

Certain events or conditions may be indications of a material weakness; specifically,

• Identification of fraud, whether or not material, on the part of senior management
• Restatement of previously issued financial statements to reflect the correction of a material misstatement
• Identification of a material misstatement of financial statements in the current period in circumstances that indicate that the misstatement would not have been detected by the company’s internal control over financial reporting
• Ineffective oversight of the entity’s financial reporting and internal control over financial reporting by the company’s audit committee

Once a judgment has been made as to the severity of the deficiency, management should document the basis for its conclusions in order to support its assessment. This documentation may also be used by the external auditor to evaluate management’s conclusions.

Additionally, management must consider the reporting implications depending on the severity of the deficiency and communicate accordingly. Specifically:

For Material Weaknesses

• Management’s annual report on internal control over financial reporting must include disclosure of any material weakness(es) in the issuer’s internal control over financial reporting identified by management. This disclosure would generally be included in Item 9A of Management’s Annual Report on Form 10-K.
• Prevents the conclusion that ICFR was effective in the period.
• To provide context, management should consider also providing disclosures that allow investors to understand the cause of the material weakness and potential impact. This also includes disclosure of management’s plans regarding remediation of the material weakness. The objective behind this disclosure is to provide transparency to the users of the financial statements beyond just the existence of a material weakness.

For Significant Deficiencies

• No disclosure is required in management’s annual report on internal control over financial reporting.
• Significant deficiencies are reported to the entity’s audit committee and the external auditor pursuant to management’s compliance with the certification requirements (Exchange Act Rule 13a-14).

For Control Deficiencies

• No disclosure is required in management’s annual report on internal control over financial reporting.
• Management should discuss these deficiencies with its external auditor.

Refer to the following section on remediation for interim reporting considerations.

Remediation of Control Deficiencies

In order to effectively remediate deficiencies in internal control, management must plan, implement, monitor, and evaluate remediation procedures. Management should identify remedial actions to be taken and monitor remediation until the deficiency has been successfully remediated. Ongoing communication with the external auditor during the remediation period will allow for timely evaluation of remedial actions and testing (by management, internal audit, and the external auditor, as applicable) of changes in the design, implementation, and operating effectiveness of the control(s) in order to conclude on whether the deficiency has been satisfactorily remediated. The passage of time or the absence of additional control exceptions or misstatements generally does not mean the deficiency is remediated. Management should consider the following regarding remediation procedures:

• Planning Phase
  • What changes or remediation procedures are required to correct the deficiency identified?
  • When will the changes be implemented?
  • If deficiencies were aggregated, does the remediation plan take into account all aspects of the deficiencies identified?
• Evaluation of Remediation
  • Reflect on changes implemented and whether further change is required
  • Did the remediation properly respond to the control deficiencies; specifically,
    • Is the root cause corrected from the remediation implemented?
    • Has the remediated control been in place and operating effectively for a sufficient period of time to support that the deficiency no longer exists?
    • Have there been other deficiencies identified that suggest the deficiency has not been fully remediated?
    • Have all aspects of an aggregated deficiency been satisfied?
  • Does the entity have a process in place to revisit identified deficiencies outstanding as of the period end date to reevaluate through its framework?
    • Recommended to be performed quarterly until management concludes that the control deficiencies have been remediated. Involvement of the external auditors, as applicable, as the remediation progresses is important during this process.

Remediation & Interim Reporting Considerations

With respect to the evaluation of disclosure controls and procedures, companies must evaluate the effectiveness of those controls and procedures on a quarterly basis.

In addition, if a change to internal control occurred during the fiscal quarter covered by the quarterly report, or the last fiscal quarter in the case of an annual report, the registrant is required to disclose such change if it materially affected, or is reasonably likely to materially affect, the company’s internal control over financial reporting. This includes a change or improvement to remediate a material weakness or a significant deficiency that materially affects the company’s internal control over financial reporting.

• If management identifies a significant deficiency, it is not obligated by virtue of that fact to publicly disclose the existence or nature of the significant deficiency. However, management should consider whether it is necessary to discuss further the nature of the significant deficiency in order to render the disclosure not misleading.
• Management may also provide disclosure related to the progress towards remediation, providing investors with timely information through these quarterly disclosures.
• Significant deficiencies that remain unremediated after some reasonable period of time should be evaluated to determine whether they represent an indicator of a material weakness.