Ineffective Internal Controls: Issues That Public Companies May Face After Receiving A Negative Report - Part II

Part I of this article appears in the October 2004 issue of The Metropolitan Corporate Counsel.

In Part I of this article, we discussed the general disclosure and reporting requirements related to the assessment of an issuer's internal controls over financial reporting, or "internal controls," by its management and auditor. In Part II of this article, we discuss various issues which may arise if the issuer receives a "negative report" regarding its internal controls because either management's report or the auditor's attestation report states that the issuer's internal controls are ineffective. For purposes of both Parts, we have assumed that such a negative report does not result in the issuance of a qualified auditor's report on the issuer's financial statements or a restatement of financial statements previously issued by the issuer. If either of those assumptions were incorrect, the issuer would likely be faced with serious implications apart from those related to the negative report. In addition, for purposes of both Parts, we have assumed that such a negative report does not result in a change in previously recorded financial amounts (even if it does not result in a restatement) that could affect calculation of such matters as determination of compliance with financial covenants, achievement of incentive compensation targets or calculation of tax attributes where such changes may have material consequences.

Market Effect. A negative report may adversely impact the issuer's market capitalization and reputation. The extent of this impact may vary depending on:

• 
  
• the number of other issuers which receive a negative report;

• 
  
• the nature of the material weakness;¹

• 
  
• whether the issuer has undertaken remedial measures;

• 
  
• the progress of such remedial measures and whether they will be timely completed; and

• 
  
• the costs and operational impact of such remedial measures.

As mentioned below under "SEC Filings and Rule 144," a negative report should not, by itself, create a legal obstacle in the issuer's access to the capital marketplace. However, a negative report may create a marketing obstacle due to the significant diligence concerns they raise for underwriters from both a liability and a reputation standpoint.

From a liability standpoint, underwriters are subject to liability for material misstatements and omissions contained in an offering document unless they perform a certain level of due diligence on the issuer.² In order to proceed with an offering, the existence of a negative report puts the underwriters on notice that they should undertake sufficient due diligence procedures to ensure that there is no material misstatement or omission in the offering document in relation to the matters covered by the negative report. In addition, it is likely that the underwriters would seek to have the issuer, in the underwriting or purchase agreement, represent and warrant as to the effectiveness of its internal controls.

From a reputation standpoint, some underwriters may elect to not participate in an offering by an issuer that received a negative report. Some investors may also refrain from investing in such an issuer's securities for the same reasons.

Foreign Corrupt Practices Act. A negative report could call into question whether the issuer has complied with the FCPA's accounting provisions.³ For violations of such provisions, the SEC may initiate a civil injunctive action or seek monetary penalties against the issuer ranging from $50,000 to $500,000. For willful violations, the DOJ may seek additional criminal sanctions of up to $5 million and 20 years' imprisonment for individuals, and up to $25 million for issuers. Historically, violations of the FCPA's accounting provisions did not customarily generate prosecutions on their own; they were almost always brought as a "tack on" charge in the context of some other illegal activity. However, this practice may change in light of the current focus on internal controls as a separate and distinct issue.

Financial Statements. A negative report does not necessarily preclude the auditor from expressing an unqualified opinion on the issuer's financial statements.⁴ This is so in cases where the auditor, when conducting its audit of the financial statements:

• 
  
• did not rely on the specific control as to which there is a the material weakness described in the negative report; and

• 
  
• performed additional substantive procedures to determine whether there was a material misstatement in the account related to that control.

If, as a result of these procedures, the auditor determines that a material misstatement did not exist in the account, it should be able to express an unqualified opinion on the financial statements.

Disclosure Controls and Procedures. The existence of a material weakness in internal controls may also constitute a weakness in the issuer's disclosure controls and procedures that could preclude the CEO and the CFO from giving an unqualified certification as to the effectiveness thereof.⁵ However, if the material weakness relates to a control that does not impact the issuer's disclosure controls and procedures, or if a countervailing control exists, then they may be able to conclude that the issuer's disclosure controls and procedures are effective. If they so conclude, the issuer should consider including in the applicable periodic report an analysis of their determination and the uncertainties associated therewith.

SEC Filings and Rule 144. A negative report will not, by itself, prevent a registration statement filed with the SEC from going effective or render an issuer's periodic reports deficient. In addition, an issuer's eligibility to use Forms S-2, S-3 or S-8, and a stockholder's eligibility to rely on Rule 144, would not be impaired solely by virtue of a negative report.⁶ Obviously, any material risks or uncertainties associated with the material weakness covered thereby should be disclosed.

NYSE. Issuers that have equity securities listed on the NYSE must maintain an internal audit function to provide management and the audit committee with ongoing assessments of the issuer's risk management processes and system of internal controls.⁷ A negative report may call into question whether the issuer's internal audit function was adequate under the NYSE's rules. Violation of the NYSE's rules could result in a public censure and, in more egregious cases, delisting.

Environmental. Under a number of environmental laws and regulations, an issuer may be required to provide assurance that it maintains adequate financial resources to meet obligations relating to generation, use, transportation and disposal of wastes and hazardous materials.⁸ If an issuer cannot provide such financial assurance on its own, it may need to provide an alternate form of financial assurance, such as a third party guarantee. An issuer who is unable to provide such financial assurance, whether on its own or through an alternate form, may have permits revoked and be required to cease certain operations and take remedial actions. In the most egregious cases, a negative report could potentially affect an issuer's ability to provide or obtain such financial assurance.

Other. In addition, a negative report may impact any agreement involving the issuer which contains representations, warranties or covenants that address matters such as:

• 
  
• maintenance of books and records in accordance with GAAP or as necessary to prepare financial statements in accordance with GAAP;

• 
  
• delivery of financial statements prepared in accordance with GAAP;

• 
  
• delivery of financial statements with an unqualified auditor's opinion;

• 
  
• delivery of agreed upon procedures reports or similar reports;

• 
  
• compliance with certifications as to compliance with financial statements, measures and conditions (e.g., financial covenants);

• 
  
• compliance with laws (e.g., the FCPA);

• 
  
• maintenance of effective internal controls;

• 
  
• absence of a material adverse change; and

• 
  
• material misstatements or omissions in disclosure, including misleading certifications.⁹

These provisions are typically found in connection with agreements and arrangements such as:

• 
  
• credit agreements;

• 
  
• indentures;

• 
  
• merger/acquisition agreements;

• 
  
• underwriting/purchase agreements;

• 
  
• registration rights agreements;

• 
  
• joint venture agreements;

• 
  
• worker's compensation or employee benefits regulations; and

• 
  
• applications for director's and officer's insurance policies.

Issuers should undertake a review of all of the foregoing agreements and arrangements to which they are a party to determine whether and to what extent they would be impacted if the issuer receives a negative report.

¹While any material weakness in the issuer's internal controls will ultimately result in a negative report, not all material weaknesses are the same. For example, a material weakness in the control environment or safeguarding of assets may be more problematic than a material weakness in record keeping or retention.
² See Section 11(a) of the Securities Act of 1933, which imposes liability on, among others, issuers, underwriters, and selling security holders if any part of the registration statement, when such part became effective, contained a material misstatement or omission. See also Section 12(a)(2) of the Securities Act, which imposes liability on any person, including an issuer, underwriter and selling security holder, who offers or sells a security by means of a prospectus or oral communication which includes a material misstatement or omission.
³ Note that a material weakness may not necessarily give rise to an absence of reasonable assurance under the FCPA.
⁴ The consequences of receiving a qualified or adverse opinion on the financial statements may be drastic and are beyond the scope of this article.
⁵ Rules 13a-15(e) and 15d-14(e) under the Exchange Act require issuers to establish and maintain disclosure controls and procedures, which are defined as:

controls and other procedures of an issuer designed to ensure that information required to be disclosed by the issuer in the reports that it files or submits under the [Exchange] Act is recorded, processed, summarized and reported, within the time periods specified in the [SEC's] rules and forms. . . [and] include, without limitation, controls and procedures designed to ensure that information required to be disclosed by an issuer in the reports that it files or submits under the [Exchange] Act is accumulated and communicated to the issuer's management, including its principal executive officer or officers and principal financial officer or officers, or persons performing similar functions, as appropriate to allow timely decisions regarding required disclosure.
⁶Forms S-2, S-3 and S-8 are short-form registration statements commonly utilized by issuers to register securities with the SEC. Rule 144 under the Securities Act permits certain stockholders to sell unregistered securities if certain conditions are met. One of the conditions to using Forms S-2, S-3 and S-8, and relying on Rule 144, is that the issuer must have timely filed all reports and information required to be filed under the Exchange Act during the prior 12 months. Receipt of an adverse or qualified opinion on the financial statements may impact an issuer's ability to use Forms S-2, S-3 and S-8, and a stockholder's ability to rely on Rule 144.
⁷See Section 303A.07(d) of the NYSE Listed Company Manual.
⁸For example, if the issuer owns or operates one or more landfills that are regulated as either Treatment, Storage and Disposal Facilities or sanitary waste landfills under the Resource Conservation and Recovery Act of 1976, or equivalent state statutes, RCRA regulations (and comparable state statutes) may require a demonstration and certification of the issuer's assurance that it will have adequate financial resources to implement a corrective action or emergency response measure that may be required in connection with the landfill.
⁹ Note that even if an agreement does not specifically address any of these provisions, it could also be impacted thereby if it includes a cross-default provision based on a document containing any of these provisions.