English Case Studies

SEcfloNTHREE IivruRN.q.L.CoNrnollssues

recommended that Foamex take the following specific actions to remedy these problems:

0 make significant improuements in the control enuironment ond reporting prac- tices of Foomex's foreign operations;

(2) conduct a comprehensiue analysis of financial results on a quarterly basis; (3) improue inuentory reporting; and (4) deuelop a comprehensiue information technology strategy, including an

enterprise-wide security program.

During the 2000 audit of Foamex, Pwc informed the company's audit committee on multiple occasions of reportable conditions similar to those included in the Re- port to Management issued in May 2000. After completing the 2000 audit, pwC re- signed in June 2001. The following month, Foamex retained l)eloitte & lbuche as its independent audit firm.

Foamex's management informed the sEC in 2002 that the cornpany was in the process of resolving the internal control problems previou:;ly identified by pwC. Nevertheless, in early 2003, during its 2002 audit, Deloitte identifled five reportable conditions that it communicated to Foamex's audit committe€r.3 These conditions in- volved the following areas of concern:

(1) ouersight of financial reporting by international subsidiaries; (2) inuentory procedures, processes, and systems; (3) integration of IT systems; (4) occess and security for IT systems; ond, (5) process for reuiewing and opprouing journal entries.

In January 2004, Foamex restated the financial statements included in its Forrn 10-Qs filed with the SEC for the first three quarterly reporting periods of 2003. These restatements were necessary because of a major glitch discovered in the process- ing of inventory transactions. After completing its 2003 audit of Foamex in March 2004, Deloitte notified the company's audit committee of four reportable conditions. Three of these items involved control issues identified in Delojtte's 2003 report to the audit committee. The fourth reportable condition concerned control weaknesses in Foamex's quarterly financial reporting system.

After receiving Deloitte's internal control report in March 2004, Foamex's audit committee dismissed Deloitte and retained KPMG as the company's nety audit firm. Over the following few months, Foamex made several changes in its senior manage- ment. One of those changes involved appointing a former Ernst & Young partner to the company's board of directors and audit committee. Foamex's new nanagement team also hired a "special consultant on internal accounting controls" to remedy the company's pervasive internal control problems.

Foamex's efforts in 2004 to improve its internal controls were "too little and too late" to satisfy the SEC. In 2005, Foamex became the first SECI registrant to be sanc- tioned by the federal agency solely for having inadequate internal controls. In the,4c- counting and Auditing Enforcement Release summarizing its in''zestigation of Foamex, the SEC defended the decision to sanction the company desprite its belated attempt to improve its internal controls.

The repeated obseruations of the auditors and Foamex's history of restating its interim frnanciol reports show that Foamex did not deD'ote the appropriate managerial effort

3. The SEC enforcement release for this case did not reveal whether Deloitte discovered reportable con- ditions in Foamex's internal controls during its 2001 audit.

and other resources to remediate its deficient internal controls, whiclt were identified as reportable condit[ons in 1999.

The cease and desist order issued to Foamex by the SEC included a road map for the company to follow to improve its internal iontrols. During the 2005 audii, the SEC ordered Foamex to "cooperate fully" with KPMG's review and evaluation ol the- ggmpany's internal controls pursuant to Section 404 of the Sarbanes-Oxley Acl of 2002. Following the 2005 audit, the SEC instructed KpMG to issue a .Section 404 Report" to Foamex's audit committee. That report would document any .,significant deficiencies" in Foamex's internal controls. The audit committee would then forward the report to Foamex's special consultant on internal controls.

Within 90 days, the special consultant would issue a report to Foamex's audit com- mittee and the SEC that identified specific recommendations for eliminating the internal control deficiencies. The SEC mandated that Foamex adopt those recommen- dations or propose alternative measures that would be equally as effective. The special consultant was also instructed to issue quarterly reports to Foamex's audit committee and the SEC until ail of the reported internal control deficiencies were eliminated.

The sEC's decision to sanction Foamex was interpreted as a ,,message,,a being sent by the federal agency to public companies. The intended message was that the SEC would rigorously enforce the new internal control initiatives included in the Sarbanes-Oxley Act. Ironically, absent the SEC's specific directive that required KPMG to perform a Section 404 review and evaluation of Foamex's internal con- trols, the company wourd have been exempt from that requirement because it was a "non-accelerated filer."s Due to widespread concern that Section 404 audit and in- ternal control remediation costs would be onerous for small public companies, the SEC had delayed the implementation of the principal Section 404 requirements for those registrants. In late 2010, congress passed alaw that permanently exempted non-accelerated filers from being required to obtain Sectibn 404 reports on ih"i. internal controls.

Questions 1' Who has the final responsibility for the integrity of an SEC registrant's internal

controls: its audit committee, its management team, or its independent auditors? b x D l a i n .

2. Un$er the professional standards currently in effect, what responsibiiity do auditors have to identify internai control problems within their crients' accounting systems? To whom must auditors communicate such problems? In responding to these questions, indicate how auditors' responsibilities differ, if at all, between public and nonpublic clients.

3. under what conditions is a public company allowed to dismiss its independent audit firm? Under what conditions is an independent audit firm alrowed to resign as the auditor of a public company? what disclosures, if any, does the sEC mandate when a pubric company experiences a change in its independent auditors?

4. should the sEC selectively prosecute companies, organizations, or individuals to encourage compliance with Iegar or professional itandards? befend your answer.

cA,sE 3.7 Fonurx It'trERNATtot raL INc.

4' P'J' Martinek, "SEC Probe Into Foamex Internal Controls Won't Be Last," Compliance l4zeeA (online), 12 April2006.

5' Non-accelerated filers are generally SEC registrants that have a market capitalization of $75 million or less