Material Weakness Remediation and Disclosure in the Form 10-K: What Management Must Say

Once management concludes that a material weakness exists, two things happen: the conclusion on ICFR is fixed, and a disclosure follows. Item 308 of Regulation S-K and the SEC's interpretive guidance set the rules. This post covers the required language, what investors should be told beyond the bare statement, and how to run remediation so that a later conclusion of effectiveness holds up.

What Item 308(a) requires

Management's annual report on ICFR must include a statement of management's responsibility for establishing and maintaining adequate ICFR, a statement identifying the framework used to evaluate effectiveness, management's assessment as of the end of the most recent fiscal year including a statement of whether ICFR is effective, and, for companies that include one, a statement that the registered public accounting firm issued an attestation report. The rule says management must disclose any material weakness identified, and it is not permitted to conclude that ICFR is effective if one or more material weaknesses exist.

Item 308(c) separately requires disclosure of any change in ICFR during the last fiscal quarter that has materially affected, or is reasonably likely to materially affect, ICFR.

The conclusion language

The SEC guidance says management should clearly disclose its assessment and should not qualify it, for example by saying ICFR is effective except for identified material weaknesses. If a material weakness exists, management may not state that ICFR is effective, but it may state that controls are ineffective for specific reasons.

Disclosure beyond the minimum

The guidance says companies should consider including in the disclosure:

• The nature of any material weakness.
• Its impact on financial reporting and ICFR.
• Management's current plans, or actions already taken, to remediate it.

It adds that the goal is disclosure and analysis that goes beyond describing the mere existence of a material weakness, with enough information for investors to understand the cause of the deficiency and assess the potential impact of each, and that the disclosure is more useful if management differentiates material weaknesses that have a pervasive impact on ICFR from those that do not. See /us/blog/5-whys-root-cause-analysis-for-control-failures for how root cause supports this disclosure. Significant deficiencies need not be disclosed in the annual ICFR report, though they are reported to the audit committee and the auditor.

Sample disclosure structure (illustrative, not a template to copy)

1. Statement that management concluded ICFR was not effective as of fiscal year-end, citing the framework.
2. Description of each material weakness in plain terms: what control failed, which accounts and assertions were affected, and why.
3. How it was identified and what the potential effect on the financial statements was.
4. Remediation: actions completed and planned, owners, and when management expects to complete and test them.
5. Statement of changes in ICFR during the fourth quarter, as Item 308(c) requires.

Restatements

The guidance addresses restatements. When a material misstatement of previously issued statements is discovered, the company must restate. The restatement does not, by itself, require management to revisit its prior conclusion on ICFR. Management should consider whether its original disclosures remain appropriate and should modify or supplement them with any other material information needed so they are not misleading in light of the restatement. A company may need to disclose the impact of the restatement on its original conclusions on ICFR and disclosure controls. A restatement is also one of the four indicators of a material weakness.

Remediation workplan

Remediation is design, implementation and testing. A workable plan for a revenue cutoff and credit memo weakness, using the example in /us/blog/control-deficiency-aggregation-memo-sec-guidance-and-written-conclusion:

The SEC guidance says evidence should cover a reasonable period during the year, and that direct testing as of a point in time gives evidence at that time. A control redesigned in the last month of the year may not have operated enough times to conclude it was effective at year-end, which is why companies often report remediation as in progress and disclose the change in the quarter it is implemented.

Documentation

Management must keep reasonable support for its assessment, including documentation of the design of controls and of the methods and procedures it used to gather and evaluate evidence. The documentation does not have to cover every control, only those management concludes address financial reporting risks.

Common mistakes

• Disclosing the weakness without cause or impact.
• Qualified language such as "effective except for."
• Treating remediation as complete at implementation rather than after testing.
• Forgetting the quarterly change-in-ICFR disclosure.

Related reading

• /us/blog/sox-404-management-assessment-and-auditor-attestation
• /us/glossary/material-weakness

CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.

Sources

• SEC, 17 CFR 229.308, Item 308 of Regulation S-K, Internal control over financial reporting: https://www.ecfr.gov/current/title-17/section-229.308
• SEC, Release No. 33-8810, Sections II.B.2 to II.B.4 (expression of assessment; disclosures about material weaknesses; impact of a restatement): https://www.sec.gov/rules/interp/2007/33-8810.pdf

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error