A question for you all. 1830

  • You are the SOX manager responsible for concluding on your company’s compliance with 404. You have identfied and documented all the key processes using a threshold of 10million for significant deficiency and 50million for material weakness.
    You successfully test the operation of a key process that operates effectively up to 30 November. On the 1 December the system is upgraded and the process falls apart. Data is corrupted, multiple payments are made whilst others are missed, incorrect calculations are made, etc. Before the upgrade reliance was placed on manual controls but these are unable to cope with detecting the nature and extent of the errors because payment history reports, etc cannot be produced. You therefore realise that it will not be possible to quantify the extent of the errors, nor remediate them before your financial year end on 31 December.
    As this process covers the recurring payments of 15million per month do you:

    1. Conclude you have a significant deficiency as you know it is not possible for a material error to occur on this years accounts?
    2. Conclude you have a material weakness because you know that unless this is remediated you would be faced with errors on an annual expenditure of 180million going forward?
    3. Disregard the monetary value and instead raise a concern about the ‘tone at the top’ that has permitted a project to deliver so late in the day and has clearly failed to follow proper procedure by ensuring that all enhancements are working properly before going live?
    4. Something else (updating your cv perhaps.)?

  • I would consider it a material weakness to implement a new system so late in the year and would document that there was concern over the 2 tone at the top’.
    BY Q4 management should ideally pupostpone any new IS systems until the new financial year. I have seen a lot of issues come accross where this has occured and the company and it can give rise to unreconciled differences in the Trial Balance as well as having a significant impact on automated controls processes that are key for sox.

  • Very interesting scenario. I look forward to the different responses that this will bring.
    I will start off by throwing in my opinion after thinking about this for less than a minute.
    My gut would tell me that we have a significant deficiency for the current year based on the potential financial statement impact (see my caveat below). This will be a material weakness in the following year, if not remediated. I thought about the implications of calling this a material weakness in order to signal to investors that we may have larger issues in the coming year, but backed off of that as we may have time to either fix the problem or revert to the prior system before we report Q1 earnings. Of course, the BOD would be updated as to the issue and the company should be pulling out all stops to get the issue fixed.
    Assuming that we have good historical financials and have had good analytics in the past, we should be able to estimate the impact of any significant or material misstatement caused by this system in the current year (we know that disbursements run about USD15MM per month). This will allow us to make adjustments to the financials to reflect our best guess as to results. If we cannot do this, then my answer would likely change to reflect a material weakness.
    For the sake of WrightLot, I hope that this is a hypothetical question.

  • I agree with Kymike in that I hope the question is hypothetical.
    I would be very concerned about any management team who would think of implementing such changes so close to the year end. Especially when that organisation is subject to SOX, and if it was the case - the CV senario may be the option to take…

  • I would consider it a material weakness to implement a new system so late in the year and would document that there was concern over the 2 tone at the top’.
    I disagree. While it may not be prudent to implement a new system so late in the year, this should not constitute a material weakness. I would also not use just one instance of poor judgement to question tone at the top. If there is no pattern of management recklessness or poor decision-making, then it would be difficult to conclude that there is a larger issue.

  • The facts are clear, but I would perform the exercise to properly document your decision as to how you reported the control deficiency currently and next year by considering the decision flowchart previuosly developed and proposed by the Big-4,
    ‘A Framework for Evaluating Control Exceptions and Deficiencies’
    The process of conducting this exercise alone will bring to light other considerations to help you to form a decision now and equally important, to support it later if necessary. Thus, it is important to logically conclude your decision and document the basis of it immediately. Later, you may be required to defend it and you will be adequately prepared to provide justification.
    I agree with the earlier posting that implementation of a key system late in the year does not indicate a repotable condition in connection with tone at the top.
    Good luck,

  • This is a Material Weakness.
    SOX requires that internal controls be effective as of a point in time. That PIT happens to be year-end. So if your internal controls are effective every day of the year except the last, then, by definition, you have failed 404. Yet it is impossible that controls that are ineffective only on the last day of the FY would effect the financials released for that FY. Ergo: Whether or not internal controls are effective in preventing financial misstatements means whether they are effective in preventing misstatements of future financials.
    The following is relevant material from the IIA’s comments on 404 (emphasis mine):
    The adequacy of a system of internal control should be evaluated based on whether its condition as of that point in time provides reasonable assurance that material errors would be prevented or detected in future financial statements filed with the SEC.
    As noted above, the assessment should reflect the quality of the controls as of the date of assessment and whether they provide reasonable assurance that future material misstatements will be prevented or detected on a timely basis.
    I have had correspondence with the SEC on this, which I intend to post on my website - [url]www.sarbox404.com[/url]. The issue there was the opposite: what happens if a MW will not effect future financial statements, because the segment with the MW will be dissolved before the next financial statement release. That issue is a bit more complex - hope to write about it here tomorrow.
    PS - Changing a system close to year-end may be unwise and risky, but it does not constitue a MW, if its controls can be tested before year-end.

  • I just had a quick look at your website Shapi. It looks very interesting

  • Thanks. I’m in UK now on business (SOX business. Sigh.) but when I get back I and am going to try to be more active in these forums. I like them.

  • I just had a quick look at your website Shapi. It looks very interesting
    I agree - an excellent blog resource 🙂
    Please add ‘www’ and paste into browser

  • As previously stated - probably a material deficiency

  • I just had a quick look at your website Shapi. It looks very interesting
    I agree - an excellent blog resource 🙂
    Please add ‘www’ and paste into browser

Log in to reply