SEC Enforcement of Internal Control Over Financial Reporting

On March 10, 2016, the Securities and Exchange Commission (“SEC”) instituted settled cease-and-desist proceedings against the oil company Magnum Hunter Resources Corporation (“MHR”), its Chief Financial Officer (“CFO”), Chief Accounting Officer (“CAO”), audit engagement partner and a consultant, due to alleged failures to “properly implement, maintain, and evaluate” internal control over financial reporting (“ICFR”). [1]

Factual Background and SEC Findings

According to the SEC, “MHR’s rapid growth strained its accounting resources.” [2] The company grew from $6 million in revenues in 2009 to $23 million in 2010 to over $100 million in 2011, largely due to a series of acquisitions. In February 2011, Wayne Gray, MHR’s audit engagement partner allegedly informed CFO Ronald Ormand, CAO David Krueger and MHR’s Audit Committee that “MHR’s accounting department was experiencing ‘manpower issues’ and lacked sufficient personnel to complete all required tasks on a timely basis.” Furthermore, beginning in November 2011, the company—as a result of its revenue growth—allegedly “failed to complete its standard monthly close process and began formally closing its books on a quarterly basis with only sporadic monthly closes in 2012.”

MHR engaged a public accounting firm registered with the Public Company Accounting Oversight Board (“PCAOB”) to provide it with Sarbanes-Oxley Act consulting and internal auditing services. A partner at the firm, Joseph Allred, “led consulting engagements to document and test MHR’s ICFR,” which culminated in a written report. The report, issued in February 2012, “identified problems in MHR’s accounting department, including that the ‘accounting and financial reporting team has experienced significant delays in preparing financial statements and reports.’” As a result, the SEC found, Allred and his team were unable to complete their testing activities within the time allotted. Allred’s report also indicated that “two balance sheet account reconciliations for the month ending October 2011 were not reviewed and approved in a timely manner and that management review of the consolidated October 2011 financial statements had not been formally documented.”

According to the SEC, the report identified specific control deficiencies within MHR’s accounting function and found that “the potential for error in such a compressed work environment presents substantial risk.” Nonetheless, the report did not conclude that the staffing problem amounted to a “material weakness,” which is defined in Regulation S-X as a “deficiency, or a combination of deficiencies, in [ICFR] such that there is a reasonable possibility that a material misstatement of the company’s annual or interim financial statements will not be prevented or detected on a timely basis.” [3] Rather, according to the SEC, the report “concluded, without explanation, that MHR’s staffing deficiency represented only a significant deficiency,” which Regulation S-X defines as a “deficiency, or a combination of deficiencies, in [ICFR] that is less severe than a material weakness, yet important enough to merit attention by those responsible for oversight of the registrant’s financial reporting.” [4] The SEC found that CFO Ronald Ormand and CAO David Krueger accepted this conclusion, without preparing any supplementary evidence of their own, and further “relied on the absence of an actual identified material error in MHR’s financial statements as evidence that a material weakness did not exist as of December 31, 2011.” [5] Accordingly, MHR did not publicly disclose the deficiency in its ICFR, instead stating that its ICFR for 2011 was effective.

The SEC also determined that Gray, MHR’s audit engagement partner, misapplied the PCAOB’s auditing standards and thus “improperly approved the issuance of the external auditor’s audit report containing an unqualified opinion on MHR’s ICFR as of December 31, 2011.” Specifically, in February 2012—one year after first raising MHR’s “manpower issues”—Gray informed MHR’s Audit Committee of a “‘[d]elay in closing the books due to [the] Company manpower shortage relative to [the] volume of financial activity,’” which resulted in “significant audit inefficiencies.” Gray further conveyed his belief that “there is not adequate internal control over financial reporting due to inadequate and inappropriately aligned staffing,” which “increases the possibility of a material error occurring and being undetected and reduces the Company’s ability to file its 10-K on time.” Nonetheless, Gray concluded—without adequate supporting documentation as required by Accounting Standard No. 3—that the deficiency amounted to a “significant deficiency,” rather than a “material weakness.” In reaching this conclusion, Gray reasoned that:

• “the audit work did not identify material errors for the reporting period,” and
• “he understood that MHR had recently hired additional accounting staff and that the existing staff, while overworked, was competent.”

According to the SEC, however, this was “a misapplication of the applicable standards” as codified in Rule 1-02(a)(4) of Regulation S-X and Appendix A of Accounting Standard No. 5. Under these standards, explained the SEC, “[t]he severity of a deficiency does not depend on whether an error actually occurred.” In addition, under Accounting Standard No. 5, every auditor is required to “evaluate the severity of each control deficiency that comes to his or her attention to determine whether the deficiencies, individually or in combination, are material weaknesses as of the date of management’s assessment.” [6] Moreover, Gray’s analysis did not adequately consider, as it should have under Accounting Standard No. 5:

• “the misstatement that might result from having insufficient accounting staff”;
• “MHR’s ability to prepare accurate financial statements based on the possible future consequences of the deficiency”;
• “the amounts and transactions exposed to the deficiency”; or
• “the volume of activity exposed to the deficiency that occurred in the current period or that is expected in future periods.” [7]

Turning to MHR’s management, the SEC stated that, while “MHR management retained ultimate responsibility for assessing MHR’s ICFR, including evaluating the severity of any deficiencies in ICFR,” the information provided by Allred and Gray was relevant to management’s assessment. The SEC found, however, that although CFO Ormand and CAO Krueger knew of “the stress placed on MHR’s accounting department” as a result of the company’s rapid growth, “they did not sufficiently consider Allred’s or Gray’s findings in analyzing the severity of the control deficiencies, or the appropriateness of Allred’s and Gray’s conclusions in light of all other information which they were aware.” Additionally, the SEC explained that pursuant to Item 308 of Regulation S-K and the SEC’s interpretive guidance, MHR’s management was responsible for maintaining documentation to support its assessment of the effectiveness of the company’s ICFR. However, according to the SEC, the company and its management failed to “generate or maintain documentation supporting [their] basis for determining the severity of [the company’s] accounting staff deficiency” and thus did not adequately document their ground for concluding that the deficiency was a “sufficient deficiency” rather than a “material weakness.”

Finally, the SEC found that, like Gray, “Ormand and Krueger failed to apply the appropriate standard when determining the severity of MHR’s internal control deficiency.” The SEC reiterated that “the presence of an actual error is not a prerequisite to concluding that a material weakness exists.” Rather, the SEC stated, management must consider “whether there is a reasonable possibility that a material misstatement will not be timely detected or prevented.” Additionally, the SEC clarified, “the effectiveness of a company’s ICFR is assessed at a specific point in time—as of the end of the fiscal reporting period”—and thus, “[p]lanned or anticipated remedial efforts are irrelevant to the analysis.”

The Settlements

MHR, Ormand, Krueger, Allred and Gray entered into settlement agreements with the SEC without admitting or denying the SEC’s findings.

• MHR agreed to pay a penalty of $250,000 (subject to bankruptcy court approval).
• Ormand and Allred agreed to pay penalties of $25,000 and $15,000, respectively.
• Krueger and Gray were each “denied the privilege of appearing or practicing before the Commission as an accountant.” The SEC’s orders allow Krueger and Gray to apply for reinstatement after one year.

Significance of the Action

As noted by the director of the SEC’s Fort Worth Regional Office, Shamoil T. Shipchandler, the SEC’s enforcement action “emphasizes that all those involved in ICFR assessments—companies, management, external auditors and consultants—must take their responsibilities seriously and rigorously assess controls, including those over financial reporting.” [8] In particular, the SEC’s action underscores the importance of:

• properly evaluating the severity of any internal control deficiencies and correctly applying the standards codified in the SEC’s rules, regulations and guidance in determining the effectiveness of the company’s ICFR; and
• generating and maintaining adequate documentation supporting any conclusions regarding the severity of any deficiency and the effectiveness of the company’s ICFR.

Finally, the action serves as a crucial reminder that management must give careful consideration to input from consultants, among other sources; however, since management maintains ultimate responsibility for assessing the company’s ICFR, management should not rely upon consultants’ conclusions when it possesses knowledge suggesting that there may be a material weakness in the company’s ICFR.