Twenty years ago, the SEC brought cases against the auditors and executives of Enron for failures of internal controls and financial reporting. In the wake of this fraud, Congress and financial regulators instituted extensive changes to prevent similar issues from recurring. The Sarbanes-Oxley Act (SOX) was adopted in 2002 in light of the Enron crisis. Immediately, “SOX” became part of the daily business language.

One critical aspect of corporate reporting and SOX compliance are effective Internal Controls over Financial Reporting (ICFR). ICFR is designed to protect and enhance the accuracy and transparency of financial reporting data by public companies. “Adequate internal controls are the first line of defense in detecting and preventing material errors or fraud in financial reporting,” said SEC Chief Accountant Wesley Bricker in 2019. “When internal control deficiencies are left unaddressed, financial reporting quality can suffer.”

In 2020, nearly two decades after the Enron scandal, Wells Fargo agreed to pay an astounding $3 billion fine for its “cross-selling scandal.” The bank encouraged and enabled employees to open nearly 3.5 million fraudulent accounts, falsifying records and reporting incorrect information which mislead investors. These high-profile cases represent only a small number of the numerous ICFR related actions by the SEC Division of Enforcement over the years. More than ever, the SEC and market continue to be focused on effective and high-quality financial reporting.

Re-focusing on SOX: The process drives the final product (SOX Certification)

Most issuers focus on the final product--SOX certification in their reports. The reality is that the process of assembling and managing an effective SOX program, guided by a well-documented and tested set of internal controls, is just as important. Even with accurate and error-free financial data, if material weaknesses in ICFR are detected, then companies may still face SEC and market scrutiny, enforcement actions and, ultimately, damage to their business reputation. The entire point of ICFR, as defined and required by Sarbanes-Oxley (SOX), is to put procedures in place to reasonably ensure compliance with the company’s policies and compliance requirements.

The process itself is just as critical as the presentation and accuracy of the final product.

CEOs and CFOs put their name on the line — literally

When CEOs sign off on their quarterly and annual SEC filings, they are certifying to the content and accuracy of the report, including the critical strength of the controls of that data and awareness of any material errors and fraud. When it comes to ICFR, they are — quite literally — putting their names on the line via separate Sarbanes-Oxley Section 302 and 906 Certification (filed as exhibits with their 10-Q and 10-K). In the view of the SEC, there is no pleading ignorance regarding material weaknesses — CEOs are accountable for the process as much as the end product. That is just one reason why Wells Fargo executives are themselves facing fines and sanctions.

Poor ICFR have cascading negative impacts on the business

Even if your company doesn’t end up in the headlines as a target of SEC enforcement actions, restating financial statements, due to failure of ICFR, can have cascading negative effects on your business. When a company restates financials, they are required to acknowledge and report all material weaknesses in ICFR. Acknowledging errors and/or material weaknesses causes everyone — analysts, investors and regulators — to examine everything you’ve stated, including in previous filings. Moreover, as we will cover in an upcoming post, if you have poorly designed and executed controls in one area of your SOX compliance management program, the SEC reports this demonstrates a high statistical likelihood you have issues in other controls as well— and that you’ve probably had these issues consistently from quarter- to-quarter, year-over-year. As increased SEC scrutiny uncovers further issues, more unwanted questions arise. Analysts grow less interested in following your company — after all, they can’t trust your data. Investor confidence and interest wanes. All are outcomes no company wants.

You have to want to execute ICFR well

For all these reasons, every public company must have effective ICFR required under SOX. Beyond compliance and risk mitigation, there are good reasons that you should want to execute ICFR well. Just as careless management of SOX compliance creates a negative cascade, executing SOX compliance properly drives a snowball of positive effects: Effective internal controls mean your financial statements will consistently be the best they can be. This means your data will be high-quality and will tell the financial story the company intended.

SOX is complicated — technology can help

There’s no question that SOX compliance can be complex and challenging. Moreover, most companies see SOX compliance as a burden on personnel and financial resources — leading to a general lack of continual focus. However, it is clear that failing to properly focus on internal controls can result in SEC scrutiny and end up costing your company much, much more.

The good news is there are robust, yet simple to implement and operate, financial reporting and SOX compliance technologies that are rapidly replacing antiquated Excel spreadsheet-based SOX program management methods. Companies are quickly realizing the benefits of these platforms in reducing the burden — and the cost — of SOX compliance and bringing immediate transparency to key stakeholders, including executive leadership and external auditors.

SOX is here to stay — SEC paying closer attention

SOX is here to stay and recent SEC actions make it clear that regulators are paying more attention than ever to failures of ICFR. Forward-thinking companies should be looking for ways to leverage these smart technologies, such as Toppan Merrill SOX, to automate ICFR and SOX compliance process— and take advantage of sophisticated and technology infused with deep SOX subject matter expertise that expose material weaknesses and potential reporting errors long before they can embarrass or damage their business.

Reach out to jump start a partnership that will bring speed, security, accuracy and efficiency to all of your complex content and communication requirements. 

Jennifer Froberg, Senior Product Specialist at Toppan Merrill

With over 15 years of industry experience in the SEC regulatory landscape, Jennifer supports and advises clients in how to get their filings right. Part of a Toppan Merrill team of EDGAR experts who provide practical compliance expertise in a variety of subjects, Jennifer focuses on analyzing the scope of SEC rulemaking and where the agency is headed. Toppan Merrill’s deep SEC subject matter knowledge provides companies with an array of pragmatic tools to navigate the frequently changing SEC requirements. Jennifer is immersed in how regulatory changes will impact the filers, investors and the market. She has a particular focus on structured data and ESG initiatives.