In the past few weeks, the Securities and Exchange Commission (“SEC”) has announced three settled enforcement actions alleging violations of the internal controls provisions of the federal securities laws.  The cases are notable less for the SEC penalties involved—which ranged from no penalty to $400,000—but rather for the other, more dire consequences the companies experienced as a result of internal controls failures, such as financial restatements, delayed SEC filings that led to an exchange delisting, and serious employee misconduct that went unchecked.  The cases underscore the importance of establishing and maintaining effective systems of internal control over financial reporting.

All of the cases – which the companies settled while neither admitting nor denying the SEC’s allegations – highlight the importance of integrating new subsidiaries into the parent’s system of internal controls; maintaining adequate accounting personnel and clear lines of communication; and, when accounting problems are discovered, of acting quickly to investigate and remediate.

National Energy

On August 28, 2024, the SEC announced settled charges against National Energy Services Reunited Corp. (“National Energy”), a former special purpose acquisition company, or “SPAC,” which provides oilfield services.  According to the SEC’s allegations, the company became an operating company in 2018 when it acquired two companies located in the Middle East and North Africa, but it was not until March 2022 that the company discovered a slew of accounting errors and internal controls deficiencies at the acquired companies that affected their accruals and accounts payable.  Later that same month, the company publicly disclosed that its financial statements from 2018 through 2020 were no longer reliable pending a restatement.[1]  After a nine-month delay in making required SEC filings, the company restated three years’ worth of financials.  An Audit Committee investigation found that the accounting errors were due to “pervasive, systemic deficiencies in the Company’s systems, processes, controls, and resources, including supply chain, finance, and accounting” tracing back to legacy practices of the acquired companies.[2]  Crucially, the investigation found that the company relied on these deficient legacy practices for financial reporting without conducting an adequate assessment.

Although the SEC charged the company with financial reporting, accounting and internal controls violations, it gave the company credit for its internal investigation, its progress in remediating the controls failures, and its self-report to the SEC, agreeing to a civil penalty of $400,000 while requiring remedial undertakings.  The SEC’s order also has a “springing penalty” component, meaning that if the company fails to complete its controls remediation in a timely manner deemed acceptable by the SEC, the company will have to pay an additional $1.2 million.

Portland General

On September 4, 2024, the SEC announced settled charges against Portland General Electric Company (“Portland General”), a publicly-traded electric utility company.  The company uses derivatives to hedge fluctuations in the cost of providing electricity to its customers, and under certain circumstances is allowed to capitalize trading losses as regulatory assets and later recover those losses through customer pricing.  While the company historically traded in derivatives only to hedge and only related to electricity prices in its own region, it significantly shifted its trading activity from 2018 to 2020, taking on a net short position with significant exposure to electricity prices outside its region.  When sudden shifts in those prices caused the company to incur $127 million in trading losses in August 2020, the company ultimately wrote off the losses, determining that the trading had been “imprudent,” had failed to qualify for capitalization, and could not be recovered.  Moreover, according to the SEC, the company had failed to make required disclosures about its trading activity that might have foreshadowed the increased risk of loss.  The company allegedly failed to establish accounting controls to adequately ensure that information about the nature and extent of its derivatives trading was transmitted to the proper accounting personnel, who instead simply assumed that the trading activity remained static.  Further, the SEC faulted the company for not implementing controls to ensure that management and the Disclosure Committee had access to information relevant to ensure accurate derivative market risk disclosures per Item 305 of Regulation S-K.  The SEC imposed no penalty due to the company’s cooperation and remediation, which included a prompt independent investigation and withholding incentive compensation from key officers.[3]

CIRCOR

On September 5, 2024, the SEC announced settled charges against CIRCOR International, Inc. (“CIRCOR”), a formerly publicly-traded company that manufactures components for the industrial, aerospace, and defense markets.  In March 2022, the company announced that its financial statements from 2019 to 2021 were no longer reliable due to misconduct by a subsidiary’s finance director, who the SEC alleges had manipulated the company’s books and records by artificially inflating its net assets and operating income by tens of millions of dollars.  The finance director had sole responsibility for providing the subsidiary’s financial results to be consolidated into the separate corporate accounting system and for providing account reconciliations.  Moreover, the finance director was allegedly able to misstate the subsidiary’s cash without any verification occurring at the corporate level because the corporate treasury department did not have access to subsidiaries’ local bank accounts.  The finance director allegedly covered up his scheme by preparing false certifications and fabricated bank documents.  The company restated its financials, reporting that the fraud had caused operating income to be overstated by 24 percent and operating loss to be understated by 36 percent in one year.  Based on the company’s self-report and the extent of its cooperation and remedial efforts, which included controls improvements and withholding incentive compensation from a former officer, the SEC did not impose a civil penalty on the company.[4]  The company was only charged with reporting, books and records, and controls violations, but the finance director has been sued for intentional fraud.

Takeaways

These cases are part of a trend in which the SEC has focused, sometimes exclusively, on internal accounting and disclosure controls violations as the basis for an enforcement action.  Several takeaways are clear from this line of cases:

• Post-merger integration of internal controls is critical:  National Energy allegedly failed to assess the adequacy of internal controls at the companies it acquired for several years, and CIRCOR allegedly did not adequately assess the control system at foreign subsidiaries.  And just last week, the SEC collected $9.9 million in disgorgement and penalties in an enforcement action alleging that John Deere failed to adequately integrate a newly-acquired foreign company into its system of internal controls, which allowed the subsidiary to continue a practice of making unlawful payment to officials in Thailand to obtain business.[5]  These are just the latest in a string of SEC cases citing a failure to address controls shortcomings at acquired companies, especially those located overseas.[6] The message is clear:  companies should engage in a prompt, risk-based review of accounting and disclosure controls after engaging in mergers and acquisitions.  There is no “grace period” for maintaining effective controls after acquiring other companies.
• Avoid “left-hand/right-hand” disconnects:  The SEC faulted Portland General because the people responsible for accounting and disclosure did not know what the derivatives traders were doing.  SEC accounting cases often involve a breakdown in communication between subject matter experts (the company’s proverbial “right hand”) and those responsible for accounting and disclosure (its “left hand”).
• Beef up accounting staff:  The SEC has increasingly noted in enforcement actions such as these that a lack of adequate accounting staff, including those with experience in technical accounting matters, contributed to a company’s controls breakdowns.  Investing in suitable, experienced accounting staff is one way to avoid problems in the long run.
• Cooperation and remediation matter:  The SEC is increasingly willing to reduce penalties or forego them all together in recognition of exemplary cooperation and remediation.  In the cases described above, critical actions included promptly initiating an independent investigation at the direction of an audit or special committee; self-reporting to the SEC, including before the investigation results were known; providing the SEC information that would be hard for it to otherwise obtain, such as explaining accounting data, providing downloads of employee interviews; and making employees in foreign locations available for interviews.  The SEC also credited two of the companies for withholding incentive compensation from executives.  Notably, the cooperation of the companies seems to have resulted in lesser charges being brought, as the SEC focused on reporting, books and records, and internal accounting and disclosure control violations, even though the elements of negligent securities fraud appeared to be met by the allegations against National Energy, Portland General, and CIRCOR, or for violating the FCPA’s anti-bribery provisions in the case of John Deere.  This indicates that exemplary and prompt cooperation and remediation can reduce not just the penalties a company faces, but the severity of charges as well.
• Weak internal controls lead to bigger problems than the SEC:  This is not to say that these companies got off easy just because the SEC went light on penalties.  Restatements can be traumatic and time-consuming:  in the case of National Energy, the nine-month delay in making SEC filings led to its delisting from Nasdaq.  Portland General’s controls problems led it to realize it could not recover $127 million in trading losses from customers, leading it to write off the regulatory assets and wipe out 45 percent of its 2020 profit.  In all three cases, company announcements of the accounting errors were followed by precipitous declines in stock prices.  In the cases of CIRCOR and John Deere, poor controls allowed serious employee misconduct, with potential criminal ramifications, to fester for years.

In sum, companies that keep a tight handle on their internal controls systems may spare themselves the expense and disruption of financial restatements and internal and external investigations.  In the event that a company discovers internal controls issues, promptly investigating and remediating the problems can significantly mitigate penalties.

Endnotes

1See, Press Release, NESR Announces Update On Previously Issued Financial Statements And Full Year Revenue of 2021, https://investors.nesr.com/websites/nationalenergy/English/2110/press-releases.html?airportNewsID=0ab81813-981e-43bf-8cfa-211df3b493e4 (Mar. 14, 2022).(go back)

2See, In the Matter of National Energy Services Reunited Corp.,https://www.sec.gov/files/litigation/admin/2024/34-100845.pdf (Aug. 28, 2024).(go back)

3See, In the Matter of Portland General Electric Company, https://www.sec.gov/files/litigation/admin/2024/34-100917.pdf (Sept. 4, 2024) (“the Commission is not imposing a civil penalty based upon its cooperation in a Commission investigation”).(go back)

4See, In the Matter of Circor International, Inc., https://www.sec.gov/files/litigation/admin/2024/34-100934.pdf (Sept. 5, 2024).(go back)

5See, Press Release, SEC Charges John Deere With FCPA Violations for Subsidiary’s Role in Thai Bribery Scheme, https://www.sec.gov/newsroom/press-releases/2024-124 (Feb. 4, 2024).(go back)

6See, e.g., Press Release, SEC Charges GTT Communications for Disclosure Failures, https://www.sec.gov/newsroom/press-releases/2023-195 (May 19, 2023) (highlighting the company’s failure to integrate client management and billing systems post-acquisitions).(go back)