For Accounting Integrity, Start With The Rank-And-File

This article was originally published in Law360. Reprinted with permission. Any opinions in this article are not those of Winston & Strawn or its clients. The opinions in this article are the authors’ opinions only.

In late November, leading department store retailer Macy's announced that it had postponed the release of its third-quarter results after identifying an issue related to delivery expenses in one of its accrual accounts.

In a press release dated Dec. 11, the company stated that following an independent investigation and forensic analysis, it had determined that an employee with responsibility for small package delivery expense accounting intentionally made erroneous accounting accrual entries and falsified underlying documentation to conceal approximately $151 million in delivery expenses from late 2021 through the third quarter of 2024.

Although the company said there was no material effect on its financial results as a result of the accounting issue, it acknowledged that it was seeking to improve its internal controls.

While the full effect of the accounting errors has been a source of speculation among Wall Street analysts and investors, relatively little attention has been paid to the corporate governance implications.

The errors underscore the importance of not only reevaluating the efficacy of existing internal controls required by the Sarbanes-Oxley Act of 2002 and other corporate governance protocols, but also assessing whether supplemental measures are needed. Here, we introduce measures that company leaders should consider implementing to prevent similar errors from occurring.

Cultivate Accounting Integrity and Robust Oversight

While the seniority of the Macy's employee responsible for the accounting errors is not known, the fact that it was a single employee highlights a broader issue that Sarbanes-Oxley may not adequately address — namely, ensuring that all employees, particularly at the base level, fully comply with the law.

Fostering compliance with Sarbanes-Oxley among rank-and-file employees requires that a company's leadership cultivate a culture committed to strong accounting integrity and robust oversight.

Company leaders can foster this strong accounting culture at the foundational level by adopting key supplemental measures that augment internal controls required by Sarbanes-Oxley. The core features of such supplemental measures are described below.

Assess

Company leaders should consider deploying cost-effective artificial intelligence measures to assess the accuracy and precision of financial data entered by rank-and-file employees. Real-time error detection software or AI analytics tools can help reduce the likelihood of human error, thereby promoting enhanced accounting integrity.

In addition, AI may foster more robust oversight of rank-and-file employees across the entire accounting function. For instance, AI can be used by higher-level accounting personnel to not only verify the work of subordinates, but also to identify anomalies in financial data early, thereby allowing companies sufficient time to correct irregularities and ensure Sarbanes-Oxley compliance.

Report

Company leaders should consider implementing a formal self-reporting error system among rank-and-file employees. Such a system would require employees to immediately report errors to designated company personnel confidentially, to avoid the risk of punitive consequences.

While a pattern of repeated errors may be grounds for discipline, the use of the formal self-reporting system to disclose one-off errors would not merit action.  Among other benefits, a formal self-reporting system would minimize the risk that initial errors are masked through subsequent, intentional errors, as was the case in the Macy's matter.

Certify

Company leaders should consider establishing personal accountability measures for rank-and-file employees.

While Sarbanes-Oxley requires the chief executive officer and the chief financial officer of a publicly traded company to certify the accuracy of a company's financial statements and disclosures, the law does not require rank-and-file employees to provide certifications. Implementing personal accountability measures for such employees would help enhance accounting integrity by compelling them to have some skin in the game.

These personal accountability measures include quasi-certifications, such as requiring initials or digital signatures for rank-and-file employees when they have completed specific accounting tasks, such as inputting entries. Such measures would also strengthen oversight, as supervisors would have a formal method to track which employees had worked on specific accounting tasks.

Financial Metrics in Public Communications

The Macy's matter also serves as a reminder of the importance of thoroughly evaluating the use of financial metrics in public communications. To ensure that financial metrics are used properly, company leaders should identify such metrics early and subject them to rigorous review before they are used in public communications.

The objectives of this rigorous review are threefold: (1) to establish the accuracy of the financial metric, (2) to ascertain the suitability of the proposed use of the financial metric and (3) to compile meticulous backup support showing how such metric was derived. The key features of such review are best captured by the three C's.

Cross-Disciplinary

Before using financial metrics in public communications, they should be carefully vetted by a cross-disciplinary advisory review team consisting of company personnel from all levels of seniority across various functions, including corporate development or strategy, investor relations, legal, compliance or risk, accounting or finance and treasury.

Subjecting each financial metric to committee review serves as an additional quality control measure and could help uncover potentially costly accounting errors early. Not only would the review team help ensure the proper use of financial metrics from a Sarbanes-Oxley perspective, but it could also provide other benefits.

For example, in recent years, the U.S. Securities and Exchange Commission has been focused on the proper use of financial measures that do not employ generally accepted accounting principles and has released guidance regarding them.

Comprehensive

The review should be comprehensive. In particular, it should evaluate the suitability of the use of each financial metric in public communications holistically, including both qualitative and quantitative uses across a variety of mediums, such as press releases, earnings calls with investors, investor presentations, public speeches, media interviews, social media and SEC filings.

Coordinated

The review should be coordinated and should involve constructive collaboration and dialogue among members of the cross-disciplinary review team, relevant C-suite personnel, a public company's external audit firm and external legal counsel.

Compliance Approach for Certain Sarbanes-Oxley Requirements

Finally, to prevent similar accounting issues from occurring in the future, company leaders should adopt certain Sarbanes-Oxley requirements, particularly at the board of directors level. Leaders should view certain Sarbanes-Oxley requirements as minimum standards, not optimal standards, thereby requiring them to voluntarily adhere to more stringent compliance requirements. 

Composition

In exercising this approach, company leaders should reassess the composition of the audit committee. Sarbanes-Oxley requires that the committee be made up of fully independent members with at least one member having financial expertise.

To prevent similar accounting mistakes from occurring, it would be prudent to have at least one other committee member with financial expertise.

Multiple members with demonstrated experience interpreting complex financial statements, reviewing financial disclosure and overseeing controls would facilitate the exchange of multiple perspectives and potentially differing viewpoints, thereby providing a checks-and-balances system of sorts to the audit committee.

Competency

In addition to reevaluating their Sarbanes-Oxley compliance approach, company leaders should reassess their approach to its audit committee competency requirements. At present, the only such requirement is financial expertise.

Company leaders should adopt a more expansive interpretation of this requirement and seek audit committee members with demonstrated expertise navigating accounting errors and restatements.

Additionally, company leaders should consider the following competencies when identifying prospective committee members: crisis management experience, legal experience and investor relations experience.

Comfort

Finally, company leaders should view the Sarbanes-Oxley requirement to rotate the audit partner every five years as a minimum requirement and should insist via the audit committee — which has authority over the hiring of outside audit firms — that their outside firm rotate the partner on the committee every three years.

While this Sarbanes-Oxley five-year requirement was intended to minimize conflicts of interest, a shorter time period would provide several additional advantages.

First, it strikes the right balance between continued institutional knowledge and assurance that the lead auditor on the account is not too comfortable, thereby promoting independence and fresh perspectives — two qualities necessary to not only detect existing accounting errors and irregularities, but also prevent accounting issues from occurring in the future.

Second, a shorter time period is more pragmatic and less costly than other alternatives, such as rotating the outside audit firm entirely.

Conclusion

Accounting errors can be costly and damaging in many ways, including financial expense, legal repercussions and reputational damage. To prevent similar accounting issues from occurring, company leaders should consider implementing the supplemental corporate governance measures discussed herein to augment existing statutorily required controls and protocols.

While these measures are not free from risk and may be expensive and cumbersome to implement initially, their ability to prevent accounting issues far outweighs any potential disadvantages.