Armanino Blog

Material Weakness: Causes, Prevention & Impacts

by Jeremy Sucharski
February 13, 2017

It’s no secret that material weaknesses lead to higher audit fees. But how much, and for how long? To help quantify this and determine which business areas are most prone to control failures, we studied 150 public companies that disclosed a material weakness in 2013. This report summarizes our study findings and provides insight into the causes of material weaknesses, as well as best practices for preventing them.  

About the study
The purpose of our study was to examine the association between audit fees and the pervasiveness, severity and remediation of internal control material weakness reported by SEC registrants pursuant to Sarbanes-Oxley Act (SOX) Section 404.  We performed multivariate regression models for a sample of 150 public companies that disclosed material weakness for the first time in fiscal year 2013; this sample was a subset of the companies that filed an auditor attestation disclosing ineffective internal controls over financial reporting (ICFRs) for that year. We also reviewed the total population of SEC filers in 2013 and found that one-fifth of them (21%) reported ineffective ICFRs.

How internal control weaknesses impact audit fees
The graph below provides historical information about the subset of 150 companies that filed an auditor attestation that disclosed ineffective ICFRs for 2013. From 2002 to 2015, these companies paid average audit fees of $599 per million in revenue.

For fiscal years 2010 and 2011, the audit fees paid were very close to the average. However, the fees rose above the average for the year prior to the adverse auditor attestation (2012), increased more the year of the disclosure (2013), and increased again the year after the adverse disclosure (2014).

Although the audit fees decreased slightly for fiscal year 2015, the amount was still much higher than average. As the graph shows, the 150 companies paid $985 per $1 million in revenue in 2015 for audit fees, 64% higher than the average fee of $599 per $1 million in revenue.

Our findings show that the events surrounding an adverse auditor attestation have a dramatic effect on a company’s audit fees. In addition, many of the 150 companies had deficiencies in their ICFRs that persisted and were not easily corrected.

The added hours of testing were priced into the audit fees charged to the client. As firms disclose additional internal control weaknesses, the auditor assesses more risk, increases testing, and charges higher fees.  

Our finding: Additional internal control weaknesses are associated with higher audit fees. Two years after the material weakness disclosure, fees were 64% above the average fees of $599 per million of revenue, due to adverse opinion.


Auditors charge a risk premium even after remediation
We tested several years after remediation and found that fees remained higher for firms that disclosed an internal control weakness. This indicates that auditors build a risk premium into the audit fee at the time of disclosure.

Although audit effort should not increase significantly due to a disclosure in the second year, our study also showed that firms that report the same or different material weaknesses in consecutive years pay higher audit fees. Furthermore, we found that firms reporting the same material weakness pay significantly higher audit fees than firms that report a different material weakness in consecutive years.

These findings indicate that auditors charge a risk premium for firms with consistently ineffective internal controls, and this premium is greater when the firm fails to remediate a previously identified weakness. We found that firms continue to pay higher than normal audit fees one, two and three years following remediation, as compared to firms that do not report an internal control weakness. This indicates that a portion of the increase in fees in response to the disclosure is due to the existence of a risk premium, rather than solely due to an increase in auditor effort.

Our finding: Audit fees remain higher for at least three years after the remediation of a material weakness.

Where and why material weaknesses occur
These are the top five business areas in which the 150 companies studied reported material weaknesses in 2013. 

  1. Review of complex and non-routine transactions
  2. Tax
  3. Revenue
  4. Inventory
  5. Internal control environment

In our experience, these weaknesses have several common causes, including: 

Failed management review controls - Failures in the top three areas (complex/non-routine transactions, tax and revenue) generally do not occur because a sale or confirmation wasn’t signed off on, etc.  Most often, the weakness is in a management review control (MRC). These typically fail when the review was not precise enough, or there is lack of evidence of a precise review.  For an MRC, it’s not sufficient to say that an item has been reviewed; you also need to document your review steps and have documented consideration of outliers. For example, a reviewer would need to show the follow-up questions they had for the preparer.

Imprecise controls - Another common issue for both complex/non-routine transactions and tax is having too many attributes built into one control. So if one attribute fails, the whole control fails.  To prevent this and mitigate your risk, you need to break out the elements of the review into separate, decoupled controls. For example, a vague control like “the CFO reviews and approves the tax provision” could be broken into eight to 10 precise controls, such as “as part of the review of the annual tax provision, the controller reviews the deferred tax assets.” 

Technical complexity - This is a major cause of weakness in the area of revenue, particularly for software firms, because revenue recognition is so complex. Companies may not understand the technical accounting for their ongoing revenue recognition, so they don’t have the correct processes in place. Or, they may have a one-off revenue transaction that they don’t account for properly. 

Inaccurate valuation – This is a primary cause of weakness for inventory.  For example, manufacturers typically have a liability set up for excess and obsolete inventory. If they aren’t analyzing demand accurately enough, their valuation will be off, and they will not have the right reserve calculated for that liability.

Systemic weakness - When you have a large number of control deficiencies in one or more business areas, it is seen as evidence of a systemic problem. This can cause a material weakness in the internal control environment.

Preventing material weakness
As the old saying goes, prevention is the best medicine. These are some best practices that can help you avoid the lingering pain of a material weakness.

  • Have earlier and more frequent communication between management, the SOX provider, and the internal and external audit teams during the initial risk assessment phase.
  • Complete your risk assessment earlier (ideally by the end of Q1) and share the information with the audit committee and external auditors, to get their buyoff on the findings. The Public Company Accounting Oversight Board (PCAOB) has highlighted this information sharing as a critical part of compliance efforts.
  • Set up a regular biweekly or monthly status call between management, your SOX provider, and your internal and external audit teams, to make sure there are no fire drills. Everyone needs to be on the same page about what the issues are and what work is being done.
  • Put your process narratives into a flowchart form. Traditional word document narratives are hard to read and increase the risk of control gaps. Flowcharts make it easier to show where risks are in a given process and help you ensure that you have mitigating controls in place, because you can see the link between risks and controls. (The PCAOB typically starts their inspection process by translating narratives into flow charts.)
  • Utilize your auditor’s templates and methodologies. This synergy leads to smaller samples and reduced fees. 
  • Make your internal controls more precise. For example, “this account reconciliation is reviewed and approved by the CFO” is too vague.  A precise control would be:  “This account reconciliation is reviewed and approved by the CFO; as part of his review, he looks at all reconciling items over $1000, ensures clerical accuracy of all calculations, and ensures that the balance for the general ledger (GL) on the face of the reconciliation ties to the GL in the system.”
  • Utilize audit analytics/internal audit technology.  This enables you to get better results in less time. For example, audit analytics allow you to do 100% control testing instead of performing sample-based testing, which is prone to manual errors.     

The bottom line
A material weakness will increase your audit fees significantly for years after the disclosure, and the fees will typically remain higher even after remediation. The best practices outlined above will help you avoid this pain, by enabling you to better assess and mitigate your risks.

February 13, 2017

Stay In Touch

Sign up to stay up-to-date with the latest accounting regulations, best practices, industry news and technology insights to run your business.

Related News & Insights
Women in Life Sciences ESG
Join us for a blooming ESG discussion and a floral arrangement workshop!

July 20, 2022 | 03:00 PM - 05:00 PM PT
Unleash Your Nonprofit’s Fundraising Cloud Strategy
Realizing you need to replace outdated and siloed technology is step one.

July 19, 2022 | 01:00 PM - 01:30 PM PT
Why SaaS Metrics Matter Webinar Thumbnail
Discover how collecting and reporting the right SaaS metrics can help analyze the health of your organization.

July 19, 2022 | 10:00 AM - 11:00 AM PT