October 25, 2018

SOX 404: Excluding New Acquisition from Report a Red Flag?

Corp Fin has long permitted businesses acquired during the current fiscal year to be excluded from management’s report on internal control over financial reporting – but a recent study says that you may want to think twice before you opt to do that. This “Audit Analytics” blog discusses the study’s conclusions. Here’s an excerpt:

A recent academic paper provides some insight into acquisitions that may generate negative returns to investors. In the “Costs and benefits of internal control audits: Evidence from M&A transactions”, Kravet found evidence that acquisition targets that were excluded from the assessment of internal controls by the acquiring companies generated statistically significant negative stock returns of 0.8% at the time of the exemption announcement (typically, months after the acquisition news hits the market).

The authors identified statistically significant negative returns of 8.8% and 12% for the period of two and three years after the exemption announcement, indicating that negative outcomes are not fully priced at the announcement date. In addition to negative stock returns, Kravet associated acquiring companies that elect to exclude acquisition targets from control assessments with other negative outcomes, such as higher likelihood of goodwill impairments, lower return on investment, higher probability of a financial restatement and overall lower quality of financial reporting.

As a practical matter, the blog says that a company’s decision to take advantage of the SOX 404 exemption for a newly-acquired company provides an early warning that it may need more scrutiny on a going forward basis.

More SOX 404: Management-Only Reports & Auditor’s Attestations

Audit Analytics seems to be locked-in on Sarbanes-Oxley 404 reporting lately – in addition to its analysis of the potential “red flags” associated with excluding acquisitions from management’s report on ICFR, this recent blog discusses its report on 14 years of trends in auditor’s attestations & management-only SOX 404 assessments.

If you’ve ever read Audit Analytics’ stuff, you know that there’s great information there, but pulling it together sometimes takes a little effort.  Fortunately for me, Cooley’s Cydney Posner’s done that work so I don’t have to. Check out this excerpt from her recent blog summarizing the report’s conclusions about trends in auditor attestations:

Starting in 2004, there were 454 adverse auditor attestations (or 15.9% of the total population of attestations). That number increased in 2005 to a high of 492 (although declining as a percentage to 12.6%), but then tiptoed down to a low of 141 (3.5%) in 2010.

Arguably, following SOX, the introduction of auditor attestations imposed some discipline on the process, which led initially to the identification of more ICFR issues, but declined thereafter as companies began to get a better handle on the process. After that, the number steadily rose again to hit 246 (6.7%) in 2016, which the analysis attributes to more aggressive oversight from the PCAOB. In 2017, the number of adverse attestations declined to 176 (4.9%), a 28% decrease and the first decline since 2010.

Cydney points out that trends in the management-only assessments that non-accelerated filers provide don’t exactly line-up with those for reports including auditors’ attestations:

The first year non-accelerated filers were required to make assessments was 2007. In that year, there were 1,089 adverse assessments, representing 30% of small companies. The number rose to a high of 1,727 (34.9%) in 2010—curiously, a year when adverse auditor attestations were at their low point. Unlike auditor attestations, the numbers were almost identical for the period from 2011 to 2013 at around 1,616; however, the percentages varied from 35.6% to 39.5%.

Although the number dipped in 2014 to 1,556, the percentage of smaller companies with management reports showing ineffective ICFR reached a high in that year of 40.8%, then dipped every year after. In 2017, the number fell to 1,191 (38.1%). The most startling aspect of the analysis here is that at least one-third of non-accelerated filers disclosed ineffective ICFR every year, reaching a high of almost 41% in 2014.

Transcript: “Blockchain in M&A”

We have posted the transcript for the recent webcast: “Blockchain in M&A.”

John Jenkins