Share

Key Considerations in Material Weakness Remediation

The management of public companies is responsible for maintaining a strong internal environment, including implementing and executing well-designed controls and applying timely remedial actions on control issues identified.

Recent emphasis by the PCAOB, as noted in their “Spotlight – Staff Update on 2023 Inspection Activities,” relates to auditors’ testing of controls that included a review element, specifically on whether controls operated at an appropriate level of precision. This specific observation is by no means a new concept and has been cited in numerous PCAOB reports. We continue to see existing controls that seemingly appear to be perfectly designed and working for many years seem to have gaps if the review is deficient due to factors such as quality of inputs, segregation of duties, and lack of documentation highlighting review criteria (Management Review Controls). The following areas are seen to lead to an increase in the number of internal control issues and, at times, material weakness-related disclosures:

• Lack of adequate internal accounting resources and expertise to provide a qualitatively sufficient review
• Lack of an appropriate risk assessment
• The identification of material and/or numerous  audit adjustments
• Insufficient assessment of Segregation of Duties across processes and inadequate considerations in the review of non-routine and complex transactions, especially Management Review Controls
• Lack of sufficient Information Technology General Controls (ITGCs), particularly in access management, change management, and controls over the use of third-party service providers

For a company that has previously disclosed a material weakness in its control environment, its eagerness to disclose that it has remediated the issue is often a key focus of management in subsequent periods. Before making such a conclusion, management needs to ensure that it has enough basis to do so to prevent making a premature determination that a material weakness has been remediated and disclosing that in an SEC filing, only to disclose the same material weakness in a subsequent SEC filing. This is often a challenging path, as management needs to consider its internal control framework, best practices, accounting standards, applicable guidance from the SEC and PCAOB, and its own resource constraints in coming up with remediation acceptable to all stakeholders such as process owners, audit committees or board of directors, and internal and external auditors. The following points discuss key aspects of implementing an effective remediation plan:

1. Analyze the root cause
   Perform a root cause analysis of your material weakness and the risk factors associated with it. Many times, these are qualitative factors: lack of education regarding policies and procedures, lack of proper documentation, lack of adequate data, etc. Identification and agreement on the root cause is the first step in developing remediated procedures and is often not as simple as it seems. Many people will not continue to ask the “why” question until they reach the correct answer.
   
2. Build your remediation team
   Successful remediation should involve relevant stakeholders to ensure all parties are heard. While the process owner (head of the department or similar) may be the lead in charge of the remediation process, inputs from various stakeholders, such as internal auditors for technical expertise, senior management for additional resources (e.g., people or technology tools), IT Department for required data inputs, and external vendors for providing any outsourced services, are required. The nature, timing, and extent of their involvement will vary, but their inputs are important ingredients to a practical and effective solution.
   
3. Develop a resolution plan aligned with management, internal and external auditors
   The remediation team may come up with alternatives that work for its own control environment. Remediation can take a variety of forms, such as formalizing an existing operational control into the SOX program, tweaking the existing process, outsourcing certain activities to enhance competency or segregation of duties. All such alternatives should be evaluated to ensure they address the root causes identified and mitigate the concerning risks. As a best practice, remediation should include the external auditors since they will have to ultimately agree with the conclusion. One interesting point identified by the PCAOB in their Spotlight was the connection between remote work, the lack of in-person training for new hires to the profession, and the negative impact on audit quality. This is certainly a link that companies will want to consider in establishing their remediation teams and in the approach their audit firms might take going forward.
   
4. Perform a feasibility assessment
   Remedial action plans should be feasible and backed by an appropriate cost-benefit analysis and not be termed as “best-laid plans” that never actually worked. Management may decide to perform a feasibility study on the best alternative to see if the alternative can truly be implemented and estimate resource requirements from personnel, system, and budgetary perspectives.
   
5. Obtain buy-in from stakeholders
   Once alternatives are rated in terms of feasibility and management is keen to implement the remediation, it is necessary to share the remediation plan with internal and external stakeholders and other governance-related committees (for significant changes) to ensure alignment. This buy-in eases effective implementation.
   
6. Make a timely decision
   A remediation simply designed and implemented is not sufficient to remove material weakness. Any controls, including remediation, need to be performed consistently to enable assessment of their operating effectiveness either by management or its external auditors for a sustained period (approximately 3-6 months).
   
7. Update SOX documentation
   Once implemented, the remediated procedures and related controls should be incorporated in the formal SOX process documentation as soon as possible to enable various SOX compliance procedures, such as testing, to be performed in a timely manner so that the effectiveness of the newly implemented remediation can be monitored. Remember that, depending on the type of deficiencies, the absence of an error (audit differences) does not necessarily mean that the control environment is operating effectively.
   
8. Evaluate and Monitor
   Consistency and auditability are key to demonstrating effective remediation. Management needs a sufficient basis to demonstrate the effectiveness of its remediation and, hence, should document its testing of remediated controls in a timely manner. Effective monitoring criteria to perform the control on a consistent basis need to be formalized to ensure sustained accurate execution has occurred.
   
9. Disclose
   It is not prudent to repeat material weakness related disclosures from quarter to quarter, let alone from year to year. Following the above steps would allow management to disclose the elimination of material weakness totally or to demonstrate progress in its steps to achieve remediation in a timely manner.
   

How Centri Can Help

At Centri, our risk advisory experts understand the complexities and challenges associated with material weakness remediation. Our team can assist you in every step of the remediation process, from a feasibility assessment to audit remediation. We provide comprehensive support to ensure your internal controls are robust and effective, helping you mitigate the risk of material misstatement and address material weakness vs significant deficiency issues. Our services include:

• Conducting thorough feasibility assessments to determine the best remediation strategies.
• Assisting in the development and implementation of entity-level controls.
• Providing guidance on preventive vs. detective controls to enhance your control environment.
• Supporting your team with audit remediation efforts to ensure compliance and effectiveness.

Contact us to learn how we can strengthen your internal controls and achieve sustainable compliance.

Editor’s note: This article was originally published on April 28, 2020. It was updated on October 29, 2024.

Gareth Montague-Smith

Managing Director

Gareth is a Managing Director at Centri Business Consulting. He has more than 27 years of finance and accounting experience, providing financial, auditing, and internal audit services across multiple industries. View Gareth Montague-Smith's Full Bio