What Canada teaches us about internal controls

This article was first published on CFO.com on July 31, 2019 and is reprinted with permission of the authors and CFO.com.

Responding to the bankruptcies of Enron and WorldCom, Congress passed a spate of accounting reforms in the Sarbanes-Oxley Act of 2002. Most controversially, the reforms imposed two new requirements.

First, senior management of most public companies must issue an annual assessment of their internal accounting controls. Second, each public company’s independent auditor must issue its own internal controls report (in addition to its regular audit opinion) based on its review of management’s assessment.

However, Congress did allow the Securities and Exchange Commission to exempt smaller public companies from that second requirement (see Section 989G of the Dodd-Frank Act). The exemption now covers companies with a public float of less than $75 million.

Recently, the commission proposed that the exemption be broadened to include any company with a public float of less than $250 million regardless of its revenues, and any company with a public float of less than $750 million if its annual revenues were less than $100 million.

Under the proposal, 966 small public companies would become newly exempt from the requirement for an auditor report on their internal controls. The proposal has stimulated a heated debate between its advocates and critics.

The advocates maintain that the existing requirement does not meet a cost-benefit test for small public companies, thereby discouraging them from going public. The critics point out that many smaller companies have weak internal accounting controls, as shown by the fact that more than 100 companies that would have been exempt under this proposal restated their financials from 2014 to 2018.

Robert Pozen is a senior lecturer at MIT Sloan School of Management and a former president of Fidelity Investments..

In resolving this debate, the SEC should look at at a parallel situation in Canada. There, the management of every public company, but not its auditor, must assess and report on its internal controls. The results of our study of the Canadian situation show that, without some type of external prodding, management cannot be counted on to report material weaknesses in their internal controls.

To identify public companies that were likely candidates for weaknesses in internal controls, we reviewed all the financial restatements of Canadian-listed companies from 2009 through 2016 (excluding companies with public floats below $75 million and companies listed on both U.S. and Canadian exchanges).

There were 78 financial restatements by such Canadian companies during this period. However, only 18 of them resulted in a company’s public disclosure of a material weakness in internal controls. Under Canadian law, any public company with a material weakness in its internal controls must publicly disclose the nature of such weakness, its impact on the company, and its plan for remediation.

To eliminate financial statements done for technical reasons, we further analyzed the 78 restatements to determine which ones were material to investors, either quantitatively or qualitatively. A total of 43 restatements were material, although only 14 resulted in a company’s public disclosure of a material weakness in internal controls.

Using the standard criterion for quantitative materiality, we looked to see whether the revised financial statements decreased the company’s net income by 5% or more. Under that criterion, 29 restatements were quantitatively material.

For example, the financial restatement of Orca Exploration Group reduced its income by 30%. Nonetheless, the company’s management decided not to file a public report of material weakness in its internal controls.

Under Canadian accounting rules, a financial restatement can also be material based on qualitative factors such as fraud by a senior officer, investigation by outside counsel, or special review by a regulator. According to that criterion, 14 restatements were qualitatively material.

For instance, Martinrea International restated its financials because of a fraud by a division’s controller. Yet that company too declined to publicly disclose a material weakness in its internal controls.

Most disturbingly, there were 11 instances of multiple restatements announced by the same company within a few years. This typically means that the company has a material weakness in its internal controls. For example, Boston Pizza Royalty and the ADF Group both restated their financials twice within three years, but neither made a public disclosure that its internal controls had a material weakness.

In short, without the U.S. requirement for an auditor’s report on internal controls, management of most Canadian companies with financial restatements decided not to report any material weakness in their internal controls. This decision seems dubious, especially for the 43 Canadian companies whose financial restatements were clearly material to investors.

Thus, there are several paths that the SEC could follow. It could drop its proposal to increase the exemption of companies with public floats up to $700 million subject to a revenue test. Or, it could limit the broader exemption to companies without public floats of up to $250 million regardless of revenues.

Both of those SEC actions would be based on the view that an auditor report on internal controls would not be that costly, and that it would be quite helpful in improving internal controls.

Alternatively, the commission could adopt its proposal to broaden the exemption for an auditor’s report on internal controls, while mandating other means to encourage these exempt public companies to pay more attention to their internal controls.

For example, the commission could significantly enhance the scrutiny of internal controls as part of the annual audit of these exempt companies. Then the auditors could submit a summary of their findings on internal controls to the audit committees of these exempt companies.

The commission also could require the management of any exempt company, if it announces a financial restatement, to answer specific questions in its SEC filings about whether the restatement involved any breakdown in internal controls.

Robert Pozen is a senior lecturer at MIT Sloan School of Management and a former president of Fidelity Investments. Olga Usvyatsky is a PhD student at Boston College and formerly was vice president of Audit Analytics, which provided the data for the study discussed in this article.