A material weakness, according to the Public Company Accounting Oversight Board (“PCAOB”), is a deficiency, or a group of deficiencies, in a company’s internal control over financial reporting (“ICFR”), that makes it reasonably likely that a material misstatement cannot be avoided or identified in the financial statements of the company promptly.
Deficiencies in one or more of a company’s internal controls are frequently the source of a material weakness. Often, there is no one reason for the material weakness but rather a collection of control deficiencies that result in a material error in the financial statements.
The risk caused by controls not being adequately designed or working effectively is also considerably higher for companies going through many changes or are growing fast.
If a material weakness is found, it can harm a company’s stock price and credit rating and a loss of investor trust and expensive audits. Hence, companies should seek to avoid such internal control deficiencies.
How to assess material weaknesses?
Companies can reduce the risks that cause material weaknesses by understanding the circumstances where such deficiencies emerge and the trends in material weaknesses.
There are a few typical circumstances that put a company’s ICFR at risk:
1) When adopting new accounting standards
During the adoption of a new accounting standard, a company usually faces several control risks. It should design the necessary controls and procedures and ensure that the controls in place for the adoption are adequate. The controls developed must support the accounting conclusions and minimize the risk of any material misstatement. As the adoption window given is usually quite short, it is not uncommon that these types of controls tend to be ignored by most companies, especially those that have large amounts of data.
2) When key accounting and finance personnel resign
The control environment might be temporarily compromised as a result of their resignations. If it is so unfortunate that some ongoing transactions are as significant as a merger and acquisition, the problems may be worsened. Lack of resources, coupled with the need to handle complex accounting and financial reporting issues that arise from these transactions in a short timeframe, increases a company’s risk of exposure to material weaknesses.
Therefore, there should be proper procedures in place to ensure knowledge transfer when there is turnover. This also addresses the issue of accountability for transferred duties.
3) When accuracy and completeness are ignored
During an external audit, auditors will always verify the accuracy and completeness of reports and data used to implement critical controls. A report extracted from a system is not always enough to establish the control’s accuracy, completeness, or effectiveness.
Regular validation processes should be carried out to verify that all customisable reports are populated with the correct data using consistent queries. If the control involves editable files like an Excel workbook, further validation processes will be required. The company should properly document all these validations performed.
4) When new technology is introduced
Change management, particularly when a new technology is introduced, may be difficult for companies to traverse. Change management controls related to introducing new technology may cause material weaknesses to arise when these controls fail to maintain data integrity during the transition stage.
Such data integrity concerns may damage a company’s control environment, and if not handled properly, it may even damage the company’s reputation. To lower the risk, companies should proactively implement a change management strategy that includes controls designed to maintain data integrity, such as cross-system reconciliations during the parallel-run phase.
Now that we know the circumstances that may cause a material weakness to arise, here are some common examples of high-risk areas to focus on:
- Lack of proper risk assessments: Especially in the case when there is a change in the company’s business, such as business combination, a lack of regular risk assessment may result in the exposure of the company to new and unknown risk categories.
- Over-reliance on third parties or accounting system: Some examples include the use of accounting system that does not have features such as audit logs or third-party services that do not offer Type II reports.
- Lack of review procedures: The lack of such a control procedure can result in material errors as the risks may not be properly addressed. This is especially prominent in complicated accounting areas that require a lot of judgement.
- Lack of segregation of duties: An example includes individual employees who execute incompatible activities, such as a purchase manager who approves his or her own purchase requisitions.
All these high-risk areas can cause a material error in the financial statements to be reasonably likely not be identified promptly, resulting in a material weakness.
So now, what are some of the important criteria to consider to make sure what is detected is really a material weakness? Here are some guidelines:
- What is the extent of the possible misstatement as a result of the control deficiency? For instance, the total monthly transaction amounts involved.
- Is the control deficiency material enough to warrant the attention of those in charge of the company’s financial reporting?
- Is there any sign of material weakness? For example, the audit committee’s poor monitoring of the company’s ICFR or the detection of fraud.
- What are the risk considerations made on the associated controls, the type of the account and their potential consequences?
- Would the deficiency prevent the company’s financial statements from complying with the relevant accounting standards or laws and regulations?
- Is there any well-functioning mitigating control to reduce the risk of a potential misstatement?
- Is it reasonably likely that the controls might fail to prevent a material error in the financial statements?
Knowing all these common risk areas will allow us to detect a potential material weakness earlier. The earlier a potential material weakness is detected, the faster it can be corrected, the better it will look for the company.