Time is on management’s side when addressing material weaknesses in financial reporting, study shows

The SEC requires that all companies disclose any material weakness, or misstatement, in their internal controls in order to prevent financial statement irregularities and fraud, and to promote efficiency and accountability. However, research has shown that disclosure of these material weaknesses in a company's accounting and auditing processes doesn’t necessarily lead to successful remediation. New research from the University of Notre Dame explores why and when a company’s remediation strategies will likely be successful or fail. 

“Remediation and controls in general are, to some extent, a black box,” said Andrew Imdieke, an assistant professor of accountancy at Notre Dame’s Mendoza College of Business. “There isn’t really a guidebook for how to fix a control.” Even before entering academia, Imdieke spent a lot of time considering internal control deficiencies while working as the director of internal audit for Borders Group, Inc. (Borders Books & Music). He observed that the cost benefit of improving internal controls wasn’t always immediately apparent, leading management to at times invest the bare minimum in remediation strategies. 

“I became very skeptical about the extent to which other companies were really fixing these problems,” said Imdieke. “There were these cases where a company would report a material weakness in inventory and then say they fixed it, but then a year later, you'd see a restatement related to the same exact problem.” 

Imdieke dug deeper into this observation with the paper “The Role of Timing and Management’s Remediation Actions in Preventing Failed Remediation of Material Weaknesses in Internal Controls” published in Contemporary Accounting Research. 

For his sample, Imdieke analyzed remediation disclosures from company filings made with the SEC between 2004 and 2018, identifying instances where there was a material weakness reported one year followed by no reported weakness the next year. He then looked back through the filings to determine when the weakness was first disclosed and how it was addressed. He placed these remediation actions into categories, such as hiring staff or enhancing policies and procedures. 

“The length of time it takes to remediate makes the biggest difference,” he said of the results. “Companies that are disclosing that they’ve solved the problem in less than a year are significantly more likely to be in the failure category later. They need to take the time to let these remediation processes operate and test the effectiveness of their strategy.” 

Along with dedicating enough time to addressing material weaknesses, Imdieke’s research also revealed the need to take holistic actions rather than approach the weakness with a limited response. “The number of actions they’re doing to fix the problem shows how seriously they're taking it,” he said. “There are some companies that don't take it seriously enough, and you can tell that just by looking at their disclosures.” 

Though failing to remediate a material weakness may not affect a company’s bottom line right away, Imdieke points to evidence that it can still lead to negative consequences. “With failed remediation there is a higher likelihood of management turnover, including at the C-suite level, and there also is an increase in board turnover,” he said. While sifting through the data, Imdieke was surprised to find that auditors appear to rarely challenge companies on their lack of disclosures and the SEC also rarely goes after companies for failing to even disclose their remediation strategies. 

The consequences from this lack of oversight, he said, could be a future research topic. He also is interested in studying how staffing challenges within the industry are impacting material weaknesses. “More large companies are disclosing material weaknesses related to accounting staffing issues,” said Imdieke, who recently discussed  how a national accountant shortage is affecting financial statements in a Wall Street Journal article. 

“To the extent that there are changes in the types of material weaknesses that these larger companies are reporting, we might see some differences in remediation strategies related to those.” In the meantime, the study lends itself quite well to the classroom, where Imdieke teaches the fundamentals of auditing. 

“I use this paper to teach students that they can have an internal control that they think is designed well, but if they don't take the time to actually test that it’s operating effectively,  they’re never going to catch an operating flaw if it exists.” He also appreciates that in the classroom he can explore certain nuances of material weakness categorizations that are difficult to flesh out in a study. 

“Severity is a continuous kind of measurement that’s subject to a lot of judgment, where maybe companies are able to perform a small action to go from where something was severe enough to be a material weakness to now it's this internal control deficiency that doesn’t have to be disclosed,” he explained. “I can't rule that out in my study, so I like to talk about how the judgment around severity is also really important for auditors in thinking about the potential consequences of their internal control decisions.”