Get ready. Between now and Mar. 16, hundreds of companies will issue their first formal assessments of their internal financial controls in their annual 10-K reports to the Securities & Exchange Commission. These new disclosures, among the most important requirements of the Sarbanes-Oxley corporate cleanup law, will likely set off storms of confusion. And this is just the first batch: As the year rolls on, virtually all public companies will be making such reports.
In some cases companies will be filing what appear to be contradictory statements. They'll show one letter from auditors with a bad grade for their controls on financial numbers and another from the same auditors giving their O.K. to the income statements built with those numbers. Some 10% to 20% of companies will probably report problems tracking their internal accounts, auditors estimate.
The market likely will beat down shares of some of those companies. In other cases the stocks won't flinch. "There is going to be a huge disparity," said Steven Galbraith, strategist for hedge fund Maverick Capital, at a recent day-long conference of regulators, auditors, and investors on the disclosures. That has become clear as some companies have gone ahead and fessed up ahead of the deadline. For example, shares of Sirva (SIR ), a relocation services company, plunged 44% in the two days after it warned of problems Jan. 31. Yet shares of Eastman Kodak (EK )rose 2% after it disclosed faults Jan. 26. Why the different reactions? Probably because Sirva's problems contributed to a charge against pretax income, whereas Kodak's involved a technical accounting issue over income taxes.
LOSE THE LEGALESE
Regulators and auditors are urging companies to be clear in their disclosures so that investors can react appropriately. William McDonough, chairman of the Public Company Accounting Oversight Board (PCAOB), which wrote the regulations, says executives should plainly describe the problems, tell how they happened, explain their significance, and say what they are doing to fix them. But many may still defer to their lawyers, who are sure to use legalese.
The good news for investors is that a little knowledge of the terms used in the reports, plus a bit of smart analysis, will go a long way toward understanding what risks the new information reveals. Start by finding out what companies may have previously disclosed. Many companies months ago acknowledged control issues in quarterly reports or in financial restatements -- and the market has already digested the news. For example, on Oct. 28 the stock of Terex (TEX ), a construction equipment maker, swooned 19% and then recovered as investors sorted through its initial disclosure that its check of internal controls had uncovered contradictions in account balances. According to the newsletter Compliance Week, 582 companies acknowledged problems in 2004. But some of those gave few details. And some companies will probably find more serious concerns when closing their yearend books. In fact, on Jan. 31, Ceridian (CEN ), a payroll services company, reported more flaws than it had revealed before.
The main thing to remember when studying the new disclosures is that a "deficiency" or "weakness" doesn't necessarily mean any number is wrong. It just means the auditors found a way that an error could happen. That's why auditors may still give passing grades to final financial reports. When auditors find fault with controls, they run more cross-checks on accounts to ensure that the final numbers are essentially right.
The starting point of any problem is a "control deficiency," one of the terms the PCAOB established to rank the threats. It is the least worrisome level. An example would be not checking for changes a salesman may have made in terms for a minor contract. Those changes might mean revenue was counted before it was earned.
Strictly speaking, companies won't have to disclose control deficiencies because, by the PCAOB's definition, they carry only a "remote" chance of leading to an even "inconsequential" financial misstatement. Auditors usually think of "remote" as a 1-in-20 chance of happening. Still, probably to ward off lawsuits, some companies are disclosing deficiencies that are likely irrelevant.
More serious are "significant deficiencies." These result when companies have so many deficiencies of enough total import that there's "more than a remote" chance of significant misstatement. An example could be not checking for changes to the terms of several key contracts. Significant deficiencies need only be reported to directors, but some companies are making them public anyway.
The worst are "material weaknesses," and they must be disclosed. That means a company's deficiencies are so bad that there's "more than a remote" chance of a "material" misstatement in financial reports. Regulators admit they have not come up with a satisfactory guideline for how much is "material," but it is sometimes thought of as being enough to move a stock's price. An example is when a bank does not regularly check for errors in estimating loan-loss expenses. An undetected error, for instance, could be rooted in a formula in a computer spreadsheet that projects how much current lending will sour. Fannie Mae (FNM ), the mortgage finance company, reported a $1.3 billion error from its computer models before its accounting scandal late last year. "Sometimes these models are built in spreadsheets in uncontrolled environments" where mistakes can go undetected, says Tim Ryan, partner at auditor PricewaterhouseCoopers. He says a lot of the material weaknesses he's seeing is with flawed checks on formulas used to figure income-tax expense, which is different than taxes actually paid in a period.
Part of judging material weaknesses is assessing how they threaten earnings. Problems in valuing financial assets could mean big trouble for banks but probably not for computer services companies. Computer companies are more at risk from inadequate monitoring of contracts. Issues in tracking tax expenses, which are near the bottom of income statements, are generally less worrisome that those involving top-line revenue.
The reports can also give clues to how much management cares about getting their numbers right. Be more wary when the disclosures seem incomplete or when the problems run throughout the company and have existed for years. Are executives committed to fixing the problems? If not, there's more risk in continuing to own the stock than you thought.
By David Henry