What an Item 4.02 filing concludes
Item 4.02 of Form 8-K is filed when previously issued financial statements should no longer be relied upon because of an error. Under Item 4.02(a), the trigger is a conclusion by the board, a board committee or authorised officers; under Item 4.02(b), it is notice from the company’s auditor. The report is due within four business days and describes the periods affected and the facts underlying the conclusion.
A non-reliance filing is a conclusion about the numbers. It says nothing yet about the controls. But the controls question follows immediately, and it is the one that takes longer to answer: how did an error large enough to require a restatement get through the company’s internal control over financial reporting?
Whether, when and how to disclose — and how the restatement interacts with the Section 302 and 906 certifications, the disclosure controls conclusion and Item 308 — are securities-law questions. Securities counsel and the company’s auditor should be involved before anything is drafted.
From restatement to root cause
A restatement tells you where the error landed. Remediation needs to know why it was not prevented or detected. The two are not the same, and a plan built on the first will fix the symptom and leave the cause.
Work back from the error to the control environment:
- Which accounts, disclosures and assertions were misstated, and in which periods.
- Which controls were designed to prevent or detect that misstatement — and whether any existed at all.
- Why each one failed. A design gap, where no control addressed the risk or the control was too imprecise to catch an error of that size. An operating failure, where the control existed but did not run as designed. Or an upstream cause: unreliable reports and data, inadequate segregation of duties, a lack of technical accounting capacity, or a judgement area with no effective review.
“Human error” is not a root cause. It describes what happened, not why the control environment allowed it.
Assessing the control deficiencies
Each deficiency identified has to be evaluated for severity — as a control deficiency, significant deficiency or material weakness — individually and in aggregate, considering any compensating controls and whether they operate with sufficient precision.
A restatement to correct a material misstatement carries particular weight. The PCAOB’s standard for integrated audits lists the restatement of previously issued financial statements to reflect the correction of a material misstatement as an indicator of a material weakness (AS 2201.69), and the SEC’s interpretive guidance for management addresses the same circumstances (Release No. 33-8810). An indicator is not an automatic conclusion, but concluding otherwise requires documented, persuasive reasoning.
The evaluation also has to be consistent everywhere it appears: the ICFR conclusion, the disclosure controls conclusion, the risk factors and the remediation narrative. An inconsistency between them is an avoidable source of SEC comment.
Designing the remediation plan
Every remediation action should answer the root cause it is attached to. A stronger reviewer performing the same imprecise review does not fix a precision failure. A policy that says one person must not do two incompatible things does not fix a segregation-of-duties failure.
A plan that will stand up to the audit committee, the auditor and eventually the market carries, for each deficiency:
- the deficiency, linked to the control and the risk it addresses;
- the root cause, stated specifically;
- the remediation action, and how it addresses that cause;
- a named owner with the authority to make the change;
- the date the redesigned control starts operating; and
- the planned re-test and its result.
Disclosed remediation plans are read closely. Specific, dated and resourced reads as a company in control of the problem. A paragraph of intentions reads as the opposite.
Evidence, operating period and reassessment
Remediation is not complete when a control is redesigned. It is complete when the redesigned control has operated for a sufficient period and has been tested.
That constraint governs the calendar. A monthly control needs several post-remediation instances before a conclusion can be supported; a quarterly control needs at least one, and preferably two; an annual control that failed cannot be re-performed within the year. Working backwards from the year-end tells you when each redesigned control has to be operating.
Re-testing is a new test, not a follow-up: its population is post-remediation instances only, it covers any new attributes the redesign introduced, and its sample should not be reduced because the control has been fixed. Agree in advance with the auditor what a sufficient operating period means for each control.
Management then reassesses. Where remediation of a material weakness is completed in a quarter, that is itself a change in ICFR and is ordinarily considered for disclosure under Item 308(c). The conclusion that a weakness is remediated should rest on the evidence of the redesigned control operating — not on the completion of a project.
Sources
- SEC Form 8-K, Item 4.02 — Non-Reliance on Previously Issued Financial Statements or a Related Audit Report or Completed Interim Review
- Regulation S-K Items 307 and 308; Sarbanes-Oxley Act §§302, 404, 906
- PCAOB AS 2201, paragraphs .62–.70 — pcaobus.org
- SEC Release No. 33-8810 (2007), Commission Guidance Regarding Management’s Report on Internal Control Over Financial Reporting
This article is general information, current as at its publication date. It is not legal, accounting or audit advice.