Repeat adverse ICFR assessments

Sarah Keohane Date published: Sep 25, 23 Last updated: Mar 07, 24

Section 404 of the Sarbanes-Oxley Act of 2002 (SOX 404)  requires companies to annually review and disclose the effectiveness of their internal controls over financial reporting (ICFR). An adverse ICFR disclosure is filed when ICFR is found to be ineffective by management and/or an external auditor.

Ideally, a company would address the issues that came forth during the adverse assessment and provide an effective ICFR assessment the following fiscal year. However, our data shows that it is not necessarily uncommon for companies to receive multiple repeat adverse ICFR disclosures.

Ineffective internal controls pose a risk for stakeholders, as vital information disclosed by the company may be incorrect. In this analysis, we explore how often companies receive multiple adverse ICFR disclosures and what issues continue to go unresolved.

Repeat adverse disclosures

A repeat adverse disclosure is when a company that filed an adverse ICFR disclosure the prior year, files another for the current year. Over the 19-year period, we found that there were 4,892 companies that had at least one repeat adverse ICFR disclosure.

Between 2004 – 2022, 3,636 companies filed between one and four repeat adverse disclosures each. On the other hand, 81 companies filed a repeat adverse disclosure between 13 and 16 times over the period.

Notably, the largest number of repeated adverse disclosures reached a high of 16 for a single company. During this period, there were three different companies that filed this number of repeated adverse disclosures.

Overall, accounting documentation, policy and/or procedures was the most common internal control issue, cited in 98% of repeated adverse disclosures between 2004 and 2022. Of all repeated adverse disclosures, 73% had cited unspecified Financial Accounting Standards Board (FASB) or generally accepted accounting principles (GAAP) issues, the most common accounting issue. Due to the common nature of these issues, they are typically coupled with other issues that contribute to an ineffective ICFR assessment.

Top five repeated internal control issues in 2022

Adverse disclosures citing internal control issues highlight weaknesses arising from deficiencies found in the internal control structure. Aside from accounting documentation, these issues are cited, at least in part, as to why a company’s ICFR was ineffective.

In 2022, the most common internal control issue that appeared in a repeated adverse disclosure was accounting personal resources. Of all repeated adverse disclosures, 77% had cited the need for more highly trained accounting personnel.

Segregation of duties issues, also relating to personnel, followed closely and was cited in 69% of all repeat adverse disclosures in 2022.

Top five repeated accounting issues in 2022

Internal control weaknesses arising from GAAP or accounting failures often contribute to the conclusion of an ineffective ICFR. Aside from unspecified FASB/GAAP failures, these issues were contributing factors to a company’s ineffective internal controls.

In 2022, the most common accounting issue cited in repeat adverse disclosures was revenue recognition issues. Revenue recognition issues consist of control deficiencies associated with a failure to properly interpret sales contracts or apply funds. Of all repeated adverse disclosures, 8.1% had cited these issues.

Accounts receivable, investment and cash issues were in 7.5% of all repeated disclosures, ranking second for accounting issues.

Highest repeated adverse disclosure count

As mentioned above, there were three different companies that filed 16 repeat adverse disclosures between 2004 and 2022.

• Federal National Mortgage Association (Fannie Mae) filed 16 repeat adverse disclosures between 2005 and 2022. The company’s most cited internal control issue in adverse ICFR assessments, excluding accounting documentation, was inadequate disclosure controls relating to the financial close process and third-party records. A second, cited in only five repeat adverse disclosures, was ineffective regulatory compliance issues. Since 2005, the leading provider of mortgage financing in the US filed an effective ICFR assessment only once for FY2007.
• Of the 16 repeated adverse disclosures filed by Elys Game Technology Corp, accounting personnel resources and segregations of duties were cited 15 times each. The online betting platform cited both issues every year excluding FY2012. Instead, accounting documentation was the only internal control issue that contributed to an adverse disclosure that given year.
• Lastly, Utstarcom Holdings Corp, a telecom infrastructure provider also cited a repeated adverse ICFR disclosure 16 times over the 19-year period. During that period, the company had filed only one effective ICFR assessment for FY2011. Accounting personnel issues were the most prominent internal control issue for the company, aside from accounting documentation, cited in 13 repeated adverse disclosures.

Ideagen Audit Analytics offers a comprehensive overview of trends within ICRF disclosures in our latest report, SOX 404 Disclosures: A Nineteen-Year Review. Additionally, this annual report provides further insight into the most common internal control and accounting issues found within adverse disclosures.