Plus: List of large cap and mid cap companies with material control weaknesses
On October 26, 2022, Ernst & Young expressed an adverse opinion on UniFirst Corporation’s ($UNF) internal controls over financial reporting for the year ended August 27, 2022. UniFirst, a uniform rental company based in Wilmington, Massachusetts with a market cap over $3 billion, had material weaknesses in its internal controls related to its revenue and accounts receivable process. $UNF did not establish appropriate user access within its IT system, which impaired segregation of duties.
What is the potential risk here? At the extreme, unauthorized personnel could have accessed $UNF’s systems and manipulated its data to overstate revenue. UniFirst is a publicly traded company, and its management is incentivized to maximize the company’s shareholder value. If management knows that its company’s IT system has defective user access controls, they could be tempted to manipulate revenue data in order to maximize reported earnings.
Opportunity is one-third of what’s known as the “fraud triangle”, a commonly used framework for assessing fraud risk. $UNF had over $5 million in share-based compensation during fiscal year 2022, giving management an opportunity to maximize their personal wealth through manipulated earnings.
UniFirst, is however, a relatively low risk company making it unlikely that one material control weakness indicates fraud. In most instances, a material control weakness does not indicate fraud but still can be indicative of fundamental risks impacting future performance.
Hudson Labs performed backtesting on how material control weaknesses increase risks and impact a company’s future returns. Control weaknesses are ultimately significantly more predictive than assumed by most analysts and investors.
Below is a chart showing the percent of publicly traded companies that have disclosed material control weaknesses in the last six months, grouped by market cap size. The larger a company is, the less likely the company will have internal control issues. Material weakness disclosures from a mid cap or large cap company is less common than material weakness disclosures from micro or small cap companies. Therefore, if a mid cap or large cap company has control issues, that is a major red flag and can have a significantly negative impact on the company’s future returns.
Understanding internal controls and related disclosure
Internal controls are the systems and processes established at companies that make sure that financial statements are correct. Internal controls include really basic things like making sure that employees can’t easily move millions of dollars out of the company’s bank account into their own pockets and making sure the same person doesn’t review their own work.
A material weakness in internal controls means there was a failure in the company’s systems or processes that could have resulted in a misstatement in their financial statements that investors would care about, i.e., a material misstatement.
In the case of UniFirst Corporation, Ernst & Young concluded that the company’s internal controls in its revenue and accounts receivable process were so bad that the system was not robust enough to prevent material misstatements in its financials. This also means that it would have been possible for individuals at UniFirst to manipulate these accounts without internal detection and/or correction.
Most misstatements are not the result of fraud. Often, material misstatements are made due to error. Internal controls are meant to prevent or detect material misstatements due to both error and fraud. If a company’s internal controls have material weaknesses, its systems would not catch erroneous or fraudulent activity made by management.
Companies are likely to disclose a material weakness in internal controls in the following situations:
They restate their financial statements. Internal controls are designed to prevent misstatements in financial statements. If companies provided incorrect financial figures to investors and had to restate them later, it’s safe to say that their internal controls were not effective enough to prevent the need for subsequent restatement.
The external auditors express an unfavorable opinion on their internal controls. This would happen when the auditors identify a flaw in a company’s system or process before management was able to catch it on their own. This occurred at UniFirst Corporation. It is likely that Ernst & Young identified the revenue process control issues before the company had a chance to remediate them. A public company should never rely on its auditors to catch their mistakes. That’s what internal controls are for. Public companies are now required to have systems in place that should prevent and detect material misstatements from being disclosed in their financial statements. The external auditors of publicly traded companies are required to audit both the actual financial numbers as well as the internal controls that are meant to maintain the integrity of those financial numbers.
The finance team could be too small and incompetent, or the financial processes are not robust enough to fulfill the regulatory requirements for a public company. This is the least severe level of internal control weakness (although still not a good thing). This type of internal control weakness is considered more acceptable/expected at small or new companies.
Overall, ineffective internal controls or material weaknesses in internal controls have an association with future downside events. Some of the most well-known corporate frauds of our history (like the Enron scandal) were borne out of terrible internal control environments.
It is unusual to see a company as large as UniFirst Corporation, a mid cap company, report material control weaknesses. Only 9.9% of mid cap companies have reported a material control weakness in the last 6 months.
Furthermore, mid cap companies that report a material weakness are 1.51 times as likely to see a substantial, persistent price decline in the next 6 months. We define a substantial persistent price decline as an abnormal negative return of more than 12 percent month-over-month (substantial) where the price did not recover in the following month (persistent).
Mid cap companies that have disclosed material control weaknesses this past week:
Shift4 Payments Inc ($FOUR) - $3.2 billion market cap
Clarivate Plc ($CLVT) - $6.6 billion market cap
Certara Inc ($CERT) - $2.1 billion market cap
Dentsply Sirona Inc ($XRAY) - $6.0 billion market cap
Mid cap companies that have disclosed material control weaknesses since September 2022:
Joby Aviation Inc ($JOBY) - $2.8 billion market cap
API Group ($APG) - $4.1 billion market cap
World Wrestling Entertainment Inc ($WWE) - $5.5 billion market cap
Dynatrace Inc ($DT) - $9.6 billion market cap
Healthequity Inc ($HQY) - $6.4 billion market cap
Chargepoint Holdings ($CHPT) - $4.3 billion market cap
It is even rarer to see larger companies report internal control issues. Only 5.0% of large cap companies have reported a material control weakness in the last 6 months.
Also, large cap companies that report a material weakness are 2.23 times as likely to see a substantial, persistent price decline in the next 6 months.
Large cap companies that have disclosed material control weaknesses since August 2022:
Microchip Technology Inc ($MCHP) - $35 billion market cap
NXP Semiconductors ($NXPI) - $39 billion market cap
Coupang Inc ($CPNG) - $30 billion market cap
Rivian Automotive Inc ($RIVN) - $28 billion market cap
CBRE Group Inc ($CBRE) - $22 billion market cap
Should all material control weakness disclosures be treated equally?
No. Some are more concerning than others. For example, very specific/detailed control weakness disclosure is concerning because it indicates that the auditors likely found an error in that account. The implication is that the company’s reporting is less reliable and, in some cases, that the management team isn’t setting the right tone at the top.
Look out for control weakness disclosure discussing revenues or accounts receivable. Revenue is one of the most common accounts targeted for manipulation or exaggeration. Investors tend to care a lot about revenue growth and it impacts other important metrics like gross margin and EBITDA. Control weaknesses over revenue are often more concerning and severe.
In the case of UniFirst Corporation, it is relatively unusual to see material control weakness disclosures for companies of their size. To make matters more concerning, their internal control issues relate to revenue and accounts receivable. Therefore, the company’s control failures should be taken very seriously.
Material control weaknesses are more severe when there are more than one. If the disclosure describes weaknesses found in multiple areas e.g. both accruals and inventory, that’s a bigger deal. If the company discloses material control weaknesses for several years in a row, that’s also a bigger deal.
When material weaknesses co-occur with other risk factors, they matter more. This goes without saying, but a new control weakness is more concerning in the presence of other problems or risks.
When do control weaknesses matter less?
Weaknesses in internal controls are considered less severe when they are fixed right away and don’t recur. The process of fixing these weaknesses is called “remediation”. Look out for companies that disclose detailed steps for remediation and subsequently take action on those plans.
Control weaknesses are also more forgivable in the first year as a public company, especially for small companies. Issues like not having the right IT controls in place or enough financial staff to review complex transactions tend to be more common in these instances