SEC Takes Seriously Both Internal Control Weakness Disclosure and Remediation

On January 29, 2019, the SEC announced settled enforcement actions against four companies for failures to maintain internal control over financial reporting (“ICFR”) as required by Section 13(b)(2)(B) of the Securities Exchange Act and Rule 13a-15 over extended periods even though in most cases material weaknesses in their ICFR were disclosed.[1]  These companies took seven to ten years to remediate their material weaknesses, even after being contacted by the SEC staff, with one still in the process of remediating its material weaknesses.

The SEC’s announcement had two key messages:

• The SEC’s Chief Accountant, Wes Bricker, emphasized the importance the SEC places on ICFR, stating:

“Adequate internal controls are the first line of defense in detecting and preventing material errors or fraud in financial reporting.  When internal control deficiencies are left unaddressed, financial reporting quality can suffer.”

• Associate Director of the SEC’s Division of Enforcement, Melissa Hodgman, added that disclosure alone is not enough, stating:

“Companies cannot hide behind disclosures as a way to meet their ICFR obligations.  Disclosure of material weaknesses is not enough without meaningful remediation.  We are committed to holding corporations accountable for failing to timely remediate material weaknesses.”

Companies subject to the ICFR requirements should take seriously their internal control over financial reporting and the need to disclose any material weaknesses.  In addition, they should act promptly to remediate any material weakness.  We do not, however, see this SEC announcement as a harbinger of an aggressive enforcement campaign in the absence of a sustained failure to disclose or remediate material ICFR weaknesses.

[1] A copy of the SEC press release is available at https://www.sec.gov/news/press-release/2019-6.