Address the root causes across people, processes, technology and data

ARTICLE | November 04, 2024

Authored by RSM US LLP

For organizations that must remediate material weaknesses or significant deficiencies in their financial reporting, the stakes associated with addressing their internal control environment couldn’t be higher. In fact, such failures can translate into ballooning audit costs, stress to and loss of key staff, erosion of investor confidence and limitations to future growth.

The first challenge of remediation is that internal control failures rarely result from standalone issues. The root causes tend to be pervasive throughout an environment or business unit. Ultimately, these failures are often masked within an organization’s people, processes, technology and data. Identifying and addressing root causes for material weaknesses are essential both for the health of the business and compliance.

In this article, we’ll explore the potential harms of failing to address the root causes of material weaknesses and how to avoid common remediation missteps and prioritize action items when facing multiple material weaknesses.

The negative impacts of ignoring root causes

Every CFO wants to fix material weaknesses in the most cost-effective and efficient manner. But even the largest of Fortune 500 companies often lack the in-house knowledge needed to tackle remediation holistically. The same is true for growing middle market companies, especially in an era where the number of people seeking accounting degrees is generally declining, according to the Journal of Accountancy.

These resource shortages sometimes cause companies to take a piecemeal approach to remediation. But doing so is akin to treating the symptoms rather than the disease. Often, managing the underlying issues causing material weaknesses is a much bigger challenge than executives anticipate.

When organizations don’t properly address root causes, they often fail to remediate their material weakness in a timely manner.

This creates myriad downstream impacts, including:

Scalability and growth issues

A lack of consistent processes and operational effectiveness erodes investor confidence and inhibits growth.

Avoiding the most common remediation missteps

Most organizations believe they’re taking the right steps to remediate their control challenges, but many well-intentioned plans don’t deliver the desired results. This is in large part because a holistic view of the organization’s people, process and technology is required. Three common errors in addressing material weaknesses include:

1. Underestimating the value of people

Compliance with the GMTA, which is based on consolidated financial information, may be a rigorous data-driven exercise. Early conversations with advisors on the GMTA will help meet the demands of this new legislation and ensure the right systems are in place to do so.

2. Implementing new technology alone to fix the problem

Since data is integral to the reporting process, it is understandable that organizations would want to replace outdated legacy systems that are more susceptible to errors. But while implementing a new ERP system or GRC tool may be a component of remediating a material weakness, it also has the potential to create more challenges rather than address the current ones. More technology may be part of the solution, but it is not a silver bullet.

3. Designing new controls on broken processes

Before organizations propose new internal controls, they should first try to find the weaknesses in their existing processes. In fact, there is often an aggregation of control failures that need evaluation. Until all underlying process problems are addressed, no amount of new controls can eliminate risk.

One common challenge is the segregation of duties. When a user has access to more than one process, they may rationalize or feel pressured to override controls. This is especially common in smaller companies with limited staffing. Until this underlying risk is addressed, the potential for control failures remains.