Risk of Internal Controls Failures

Companies are required to maintain and assess the effectiveness of Internal Controls over Financial Reporting (ICFR). Accelerated Filers are required to provide an audit report on the effectiveness of ICFR. For Non-Accelerated Filers, only a management assessment is required. The management assessment is usually disclosed in Item 9A of a Form 10-K: Management’s Report on Internal Control Over Financial Reporting.

In 2016, 4% of Russell 3000 companies disclosed at least one ICFR weakness.

Recent reports from CFO.com indicate that an ineffective ICFR report may place the company on the SEC Division of Enforcement radar. It should come as no surprise, then, that during 2016 almost 40% of Russell 3000 companies disclosed an ICFR-related risk factor.

icfr-rf-tableInterestingly, only a fifth of the companies with ICFR risk factors disclosure discussed current or already remediated material weakness. The remaining simply recognized ICFR as a material, but general, risk affecting their business.

At the same time, the overwhelming majority of companies with a current material weakness had a parallel risk factor disclosure. Only 18% did not disclose such a risk factor, and we are not sure why. If anything, a current, actual material weakness emphasizes that the risk is no longer merely hypothetical.

With such a strong correlation between ICFR reports and ICFR-related Risk Factors, is there additional insight that investors can obtain by reading the Risk Factors?

There is no specific requirement for companies to disclose an ICFR risk factor. In fact, Regulation S-K 503(c) states that companies should “not present risks that could apply to any issuer,” which suggests that ICFR Risk Factor should be tailored to provide additional disclosure not available elsewhere in the filing. Numerous research papers (e.g., Hope et al. 2016; Filzen 2015) suggest that analysts and investors see value in more specific risk factors disclosures.

To illustrate the value of risk factors disclosures, let’s assume that, just after an IPO, an Emerging Growth Company identified a significant deficiency in internal controls. EGCs are exempt from ICFR reporting requirements. Moreover, significant deficiencies that do not rise to the level of material weakness are not normally disclosed in ICFR reports. We would think that this information should be important to investors, but with no ICFR report, would any disclosure be available? In some cases, disclosure controls may provide some insight. In other cases, the risk factors section may be the only option.

Teledoc, Inc., an emerging growth company, disclosed a material weakness in their ICFR in the risk factors section, but was not required to issue either a Management or Auditor’s Report on Internal Control Over Financial Reporting.

In connection with our December 31, 2015 and 2014 audits, we identified a material weakness in our internal control over financial reporting. A material weakness is defined as a deficiency, or a combination of deficiencies, in internal control over financial reporting, such that there is a reasonable possibility that a material misstatement of our annual or interim financial statements will not be prevented or detected on a timely basis.


The material weakness pertains to the breadth of our internal accounting team. Specifically, we do not have a sufficient number of accounting personnel to effectively design and operate proper internal controls over financial reporting. We are working to remediate the material weakness. We have begun taking steps and plan to take additional measures to remediate the underlying causes of the material weakness, primarily through the continued hiring of additional accounting personnel. In addition, we are in the process of documenting and assessing our internal controls over financial reporting and once complete, we will test these controls. The actions that we are taking are subject to ongoing senior management review, as well as audit committee oversight. Although we plan to complete this remediation process as quickly as possible, we cannot at this time estimate how long it will take to fully remediate the material weakness. If our remedial measures are insufficient to address the material weakness, or if significant deficiencies or material weaknesses in our internal control over financial reporting are discovered or occur in the future, it may adversely affect the results of our management evaluations and, when required, annual auditor attestation reports regarding the effectiveness of our internal control over financial reporting required by Section 404 of the Sarbanes‑Oxley Act. In addition, if we are unable to successfully remediate the material weakness and if we are unable to produce accurate and timely financial statements or we are required to restate our financial results, our common stock price may be adversely affected and we may be unable to maintain compliance with the NYSE listing requirements.

Risk factors should not be seen as a replacement for more formal (and more structured) ICFR reports. In most of the cases, Item 9A disclosures are in tune with the Item 1A (Risk Factors) section. Yet, many companies use risk factors to enhance their ICFR reporting, and risk factors can be an important area for stakeholders to glean additional information.