Health Check on Emerging Growth Companies: PCAOB Reports High Incidence of Material Weaknesses

By Charles Soranno, Managing Director
Financial Reporting Compliance and Internal Audit

 

 

 

A new white paper from the Public Company Accounting Oversight Board (PCAOB) and an April increase in qualifying revenue limits have put emerging growth companies (EGCs) in the news recently.

The EGC designation, established under the Jumpstart Our Business Startups (JOBS) Act of 2012, makes it easier for small and growing businesses — specifically those on track for an initial public offering — to attract investors and access capital by relaxing regulatory requirements and cutting some red tape. There are a number of benefits to a registrant being classified as an EGC – see Protiviti’s Guide to Public Company Transformation for what they are.

The original law established a revenue cap of $1 billion for a company to qualify as an EGC, but provided for that cap to be adjusted every five years for inflation. The Securities and Exchange Commission (SEC) made the first adjustment in April 2017, raising the revenue cap to $1.07 billion.

Another provision of the JOBS act was a mandate for the PCAOB to report via white papers, semiannually, on the extent to which EGCs actually benefitted from regulatory relief, and any unintended consequences stemming from the more permissive environment. The purpose of the PCAOB’s white papers is to provide general data about EGCs to inform the analysis contained in PCAOB rulemaking releases regarding the impact of applying new standards to the audits of EGCs.

The latest white paper, published in March 2017, found that of 1,951 companies reporting as EGCs in the 18 months prior to the reporting period, more than half (51 percent), received an explanatory paragraph in their most recent auditor’s report expressing substantial doubt about the company’s ability to continue as a going concern. Equally important, within that group of 1,951 EGC filers, 1,262 provided a management report on internal control over financial reporting in their most recent annual filing, and 47 percent – nearly one-half of all EGC filers – reported material weaknesses.

Protiviti explores the findings in the PCAOB’s March white paper at length in a recent Flash Report, but I wanted to highlight a few of the takeaways here.

First and foremost, while certain regulatory exemptions and benefits may be attractive, they do not mean that EGCs should accept or minimize issues surrounding potential findings of material weaknesses. These deficiencies in internal control over financial reporting may undermine a company’s reputation and reduce company value, to say the least.

The risk is real and should be addressed proactively. Protiviti has developed a financial reporting risk profile (FRRP) to identify financial reporting issues in advance and manage them to avoid potential financial restatements.

An effective FRRP focuses on six areas: accounting principle selection and application, estimation processes, related-party transactions, business transaction and data variability, sensitivity analysis, and measurement and planning. The underlying objective is to identify the most likely areas of potential misstatements and apply the appropriate oversight and control.

Second, EGCs should take the steps necessary to document key business processes so that these processes are well-defined and repeatable, reducing reliance on ad hoc activity by key employees. These processes may include a fair amount of financial reporting; related policies and activities, such as those that aid in the preparation of financial schedules for external auditors in the support of audits; filings; executive compensation; and employee benefits. Pre-public companies should design and implement a process for documenting conclusions on reporting and accounting matters.

Internal controls and documentation are critical because they minimize the risk of material weaknesses in the organization’s financial reporting. Consider the effects of just one material weakness: erosion of shareholder confidence, potential share price reduction, a fair amount of distraction throughout the organization, reduced brand quality, and significant remediation costs.

The high incidence of material weaknesses among EGCs is disappointing but, in many cases, generally preventable. It is important not to wait until the first auditor attestation to address potential issues. Many of the preventive measures – governance protocols, fraud controls, internal controls over financial reporting – should be in place prior to the company’s first public filing (e.g., 10Q filings, 302/906 certifications), and others should be in place prior to the initial management assertion on the effectiveness of internal control over financial reporting, as required by Sarbanes-Oxley Section 404(a). If these areas have not been addressed and the first public filing is upcoming, the organization should prepare itself by putting in place a robust remediation program. See the Protiviti Flash Report for additional points and information.

 

2017 Technologies Driving GRC Change

By Scott Wisniewski, Managing Director
GRC Tech Advisory Solutions

 

 

 

Digital transformation was probably one of 2016’s top buzzwords, meaning many different things to different analysts, journalists and vendors. For me, it represents real and significant investments in modernizing IT infrastructures, including those that support GRC activities and processes.

Consider the trends we’re immersed in. Enterprises are adopting cloud and mobile technologies at an extraordinary rate in the hopes of driving greater productivity and collaboration, and organizations of all sizes are launching data initiatives involving the collecting and analyzing of massive amounts of data in order to drive better business decisions and improve customer experience. At the same time, the rapidly evolving regulatory environment, such as the EU’s impending Global Data Protection Regulation (GDPR), is putting pressure on legal, compliance, security and IT departments to invest in a range of new data initiatives, consulting services and technologies.

In response to the trends, organizations are rethinking their GRC infrastructures, hoping to gain a much broader and deeper understanding of risk drivers and the bigger GRC picture. Further, to make GRC work effectively in increasingly complex and highly distributed organizations, GRC leaders recognize they must embed GRC into the everyday activities of the business.

The combined impact of all these activities will make 2017 the year that GRC practitioners will:

  • Acknowledge that effective GRC cannot be achieved via a single technology or application. Instead it will depend on a new, complete architecture. A single GRC application today may expose operational risk, but it cannot develop and present the type of complete GRC picture that regulators and boards are now demanding. Developing such a picture requires the combination of traditional GRC applications and new tools to:
    • Extract data from internal systems, such as information security and ERP
    • Consume external content, such as regulatory content feeds
    • Incorporate performance metrics, such as sales and financial results
    • Collect and consolidate market and credit risks as well as the risks identified by business intelligence tools and other analytics

With all these new tools in place, organizations will finally be able to build new presentation layers that provide a complete – and far more useful – picture of their GRC profile.

  • Take advantage of increased information sharing and collaboration to improve governance. As part of their digital transformations, many enterprises are focused on developing new and more effective ways to share information and collaborate. The ability to manage and track this activity will enable GRC programs to incorporate affirmative governance components, such as corporate culture and business achievements. It will also enable the embedding of GRC program elements, such as activities assigned to Line 1 business owners, into the enterprise applications they access every day, encouraging them to more consistently follow governance best practices as they engage in their daily activities.
  • Improve risk decision-making by using data analytics. Thanks to an array of new technologies – in-memory computing, visualization tools, mobile reporting services, etc. – organizations can now rapidly aggregate and analyze huge volumes of data from systems across the enterprise. Data scientists are also developing new methodologies and business rules to aggregate and optimize data for analytics more effectively. As a result, organizations will finally be able to automate many GRC tasks, such as risk scoring assessments, thereby automatically exposing potential risk hot spots that previously went undetected until the damage was done.

I have never been more optimistic about the evolution of GRC. As assurance professionals, lines of business and IT work together to implement new strategies and new supporting technologies, we will transform GRC from mere operational risk management to a function that can protect organizations while actually helping them to be more successful.

Compliance News Roundup: The Clearing House AML Recommendations, CFPB on Alternative Data and More

Protiviti published its March issue of Compliance Insights this week. We sat down with Steven Stachowicz, Managing Director with Protiviti’s Risk and Compliance practice, to discuss some of the highlights. Listen to our podcast below, or click on the “Continue Reading” link to read the interview.

 

In-Depth Interview, Compliance Insights [transcript] Continue reading

Embracing Analytics in Auditing: New Protiviti Survey Takes a Look

In a digital world, the time for internal audit functions to embrace analytics is now. This is the most significant takeaway from Protiviti’s 2017 Internal Audit Capabilities and Needs Survey, released today. The results show that chief audit executives and internal audit professionals increasingly are leveraging analytics in the audit process, as well as for a host of continuous auditing and monitoring activities.

Learn more by watching our video below. For more information and our full report, visit www.protiviti.com/IASurvey.

Four Ways for Insurers to Prepare for New NAIC Cybersecurity Rules

By Adam Hamm, Managing Director
Risk and Compliance

 

 

 

Cybersecurity and technology represent immense challenges and opportunities for all insurers and financial services companies. Organizations need to protect sensitive information and customer data to the greatest extent possible, and to recover as quickly as possible in the event of a breach.

Insurance companies store large amounts of personal information about their policyholders. Cybercriminals know this, and have been increasingly targeting insurers. The past two years have seen a dramatic increase in successful cyberattacks, exposing the personally-identifiable information of more than 100 million Americans. As a result, state insurance regulators have been looking for ways to protect consumers and ensure the integrity of the industry. This month, New York became the first state to adopt cybersecurity guidelines. And the National Association of Insurance Commissioners (NAIC) is working towards completing its Data Security Model Law.

Continue reading

New York Steps Up With First State-Level Cybersecurity Regulations for Financial Services Companies

By Adam Hamm, Managing Director
Risk & Compliance

 

 

 

With the future of federal regulations uncertain, the New York Department of Financial Services (NYDFS) has taken cybersecurity matters into its own hands. Effective March 1,, 2017, banks, insurers and other financial services regulated by the NYSDFS must maintain a cybersecurity program designed to protect consumers and ensure the safety and soundness of New York State’s financial services industry.

New York is the first state to adopt comprehensive cybersecurity regulation. Others are watching closely. The National Association of Insurance Commissioners (NAIC) is still crafting its own highly anticipated cybersecurity model law, and comparisons between the two frameworks will continue. We will be following up on these developments as they happen, as well as monitoring whether other states will follow New York’s lead.

Much more than a ritual box-checking exercise, the New York regulation requires the state’s banks, insurance companies and other financial service providers to each conduct a thorough cybersecurity risk assessment and design a robust cybersecurity program based on the findings.

Risk assessments will vary according to the individual risk profile of each covered entity but, generally, the documented risk assessment needs to do the following:

  • Provide criteria for the evaluation and categorization of identified cybersecurity risks or threats which the entity may face.
  • Design criteria for the assessment of the confidentiality, integrity, security and availability of the entity’s information systems and nonpublic information, including the adequacy of existing controls in the context of identified risks.
  • Develop a risk mitigation program that describes how actual risks will be mitigated (or accepted) and how the company will monitor these risks. It is important to document the systems that are in place to detect and defend against cyberattacks, and test employee response to ensure that protocols are both followed and effective.
  • Develop policies and procedures for the implementation and operation of the cybersecurity program, and train employees in these procedures.

In addition, each entity must designate a qualified chief information security officer (CISO) to administer the cybersecurity program. This may not be news to larger financial institutions, but for a smaller entity it may be a brand new requirement that requires some restructuring.

A CISO doesn’t have to come from within the entity’s ranks. Third parties can provide the CISO oversight services in an outsourced capacity. It is important to note, however, that while the responsibility for the oversight can be delegated, liability for the risk as well as for compliance is not transferable and remains with the entity.

There are many more specific details in the NYDFS regulation that covered entities will need to carefully look into as they shape their cybersecurity programs. Among them are specific initiatives that companies will either need to undertake now, or review to make sure they comply with the rule: incident response plan, data encryption, multi-factor authentication, third-party service provider security policies, penetration testing and vulnerability assessments, access privileges, and an audit trail for all these efforts, among others.

Covered entities have until February 15, 2018, to submit their first certification of compliance (annual requirement). This is a very short timeframe. I would urge companies to begin their risk assessments with utmost speed to ensure adequate time to identify and remediate any security gaps before the 2018 compliance deadline.

You can read the full regulation here.

Some Considerations for Manufacturers as U.S. Lawmakers Work to Peel Back Regulations

Sharon LindstromBy Sharon Lindstrom, Managing Director
Manufacturing and Distribution Industry Leader

 

 

 

It took the new Trump administration essentially no time to start issuing executive orders and presidential memoranda designed to ease regulations on U.S. businesses. Certain changes the administration is advocating would be welcome news for manufacturing and distribution companies, such as:

  • A presidential memorandum that is intended to streamline federal permitting processes for, and to reduce regulatory burdens that affect, domestic manufacturers.
  • An executive order that orders a review of the Dodd-Frank Wall Street Reform and Consumer Protection Act (DFA). Scaling back these financial regulations, which were instituted in 2010 following the financial crisis, would reduce reporting requirements for many businesses.

Potential Suspension of DFA Section 1502

One DFA-related change that the Trump administration is reportedly considering could benefit many manufacturing and distribution companies: suspension of Section 1502. The so-called Conflict Minerals Rule requires certain public companies to disclose whether they use specific conflict minerals that originated from the Democratic Republic of the Congo or nine adjoining “Covered Countries.” Conflict minerals, such as tin, tantalum, tungsten and gold, are used to manufacture products across a wide range of industries, including technology and consumer products. Section 1502 required companies to assess whether any manufactured products contained such minerals and determine whether these materials originated in the Covered Countries by conducting supply chain due diligence and reporting annually.

Overtime Exemption Rule on Ice

The future is also uncertain for the controversial Fair Labor Standards Act overtime rule, which was introduced during the Obama administration and was supposed to go into effect on December 1, 2016. The rule increased the threshold for overtime pay whereby salaried workers who earn less than US$47,476 annually would be eligible for overtime pay when they work more than 40 hours a week. Companies must either compensate these workers with overtime pay or raise their salaries so they are above the threshold.

The National Association of Manufacturing’s Center for Manufacturing Research has estimated that overtime costs for manufacturers will reach $24 billion within the next 10 years under the Obama overtime regulations. However, the final overtime exemption rule under the Fair Labor Standards Act was blocked by a federal court in Texas one week before its effective date. In January, the Trump administration essentially put the rule on ice following a regulations freeze.

Regulatory Risk: It’s Still Out There

Manufacturing and distribution executives must consider the potential risks that accompany regulatory changes that are already in the works or that may be on the horizon. Industry executives who took part in the latest Executive Perspectives on Top Risks Survey from Protiviti and North Carolina State University’s ERM Initiative cited the following as a top risk for their companies in 2017: Regulatory changes and regulatory scrutiny may heighten, noticeably affecting the manner in which our products or services will be produced or delivered.

Change takes time, and many of the regulatory changes proposed in recent weeks could take years to fully play out. As The Wall Street Journal noted in a recent article about Trump’s executive order stipulating that government agencies eliminate two regulations for each new regulation they introduce: “[Any] effort to scrap a regulation triggers its own process, complete with draft rules, comment periods, and regulation rewriting. That process [also] can be subject to litigation.”

While certain changes would be welcome by manufacturing companies, the changing global trade landscape must be monitored vigilantly, as well. The Trump administration’s approach to trade and negative view toward multinational trade agreements are likely to create previously unanticipated challenges, costs and risks for manufacturing and distribution companies inside and outside of the U.S. For some of these businesses in the U.S., any potential regulatory relief may be offset, at least in the short term, by revisions to free trade agreements that could impact the ability to conduct business with trusted partners in other countries.

Still, for now, manufacturing and distribution companies have a lot to be optimistic about. Even before Trump took office and started taking steps to ease regulations, there were signs that the U.S. manufacturing industry was beginning to grow again. The Institute for Supply Management Index hit 56 percent in January, rising 1.5 percentage points from December and exceeding many economists’ expectations. This is the fastest pace of growth in more than two years.