The Audit: How to Avoid the Ruh Roh items

Sep 11

Part 3 of 4 of Getting Through Your First Audit

Speaking to other CFOs and auditors, it seems there is a recurring theme when it comes to things that can cause problems during an audit. These include Revenue Recognition, Asset & Liabilities Value, Internal Controls and Intercompany Transactions.

Revenue Recognition: Auditors will hone in on this

Improper Revenue Recognition: Auditors are warned about manipulation of when and how revenue is recognized which can lead to discrepancies between reported financials and actual performance. There is typically no ill intent on your part so just have everything ready to explain in terms of how and why you performed the revenue recognition the way you did.

Companies sometimes prematurely recognizing revenue or using aggressive accounting practices to overstate revenue. Auditors focus on ensuring that revenue recognition follows established rules, such as the revenue recognition principles under GAAP so have your support documents ready. There are a lot of complex issues with revenue rec and some examples of what not to do below:

Complex Rev Rec.

Ambiguities or complexities in recognizing revenue, especially in industries with subscription-based models, multiple-element arrangements, or long-term contracts can raise red flags.

Improper timing of revenue recognition is an issue in which companies manipulate their financial reporting to create a false impression of meeting targets. Think about it from an auditor's perspective. Remember Marvell when they were charged for moving sales from future quarters to bridge the gap between actual and projected revenue? These premature recognitions constituted up to 16% of the company's quarterly revenues, according to the SEC. Marvell settled the case by paying $5.5 million.

A similar investigation involves Under Armour which ended up with a $9 million fine.

Stick to the Framework of ASC 606 and Document It

When in doubt, make sure to have all the standalone selling price work documented and stick to the GAAP rules and ASC 606 framework outlined below:

Step 1: Identify the Performance Obligations Identify the distinct goods or services promised to the customer in the contract. These are known as performance obligations. For your SaaS company, this includes software licenses, implementation services, training, support, etc.

Step 2: Determine the Standalone Selling Price (SSP) ASC 606 provides several methods for determining the standalone selling price when it's not directly observable. The preferred methods are:

Observable Prices: If the SaaS company sells the same good or service separately, use the observable standalone selling price (simplest and most reliable method).
Adjusted Market Assessment Approach: Estimate the standalone selling price based on market conditions, including competitor prices and other relevant market information.
Cost-Plus Approach: Calculate the standalone selling price by adding an appropriate margin to the cost of providing the good or service.
Residual Approach: If the standalone selling price of one or more performance obligations is not directly observable, start with the total transaction price and allocate it to the known standalone selling prices of other performance obligations. The residual then becomes the estimated standalone selling price for the remaining performance obligation(s).

Step 3: Consideration of Factors When estimating standalone selling prices, consider the following factors:

Market Factors: Competitor prices, pricing strategies, and general market conditions.
Costs: The costs of providing the good or service, including direct and indirect costs.
Customer Characteristics: Customer demographics, willingness to pay, and any volume-based discounts.
Economic Conditions: Inflation rates, interest rates, and other economic factors.
Geographic Factors: Pricing variations based on different geographic regions.

Step 4: Allocation of Transaction Price Once the standalone selling prices are determined, allocate the total transaction price to each performance obligation based on their relative standalone selling prices. This allocation ensures that revenue is recognized appropriately for each distinct element of the contract.

Step 5: Documentation Document the methods, assumptions, and information used to determine the standalone selling prices. This documentation is crucial for both external auditors and regulatory compliance. You can save a lot of time by having the documentation ready to go.

Some Problems Particular to SaaS on Revenue Recognition

For your SaaS company and basic annual plans, revenue recognition is straightforward. But the complexity gradually increases when there are modifications to subscription plans such as:

Hardware as a service
Cancellation of a subscription mid-stream Upgrade from a monthly plan to an annual plan in the middle of the year
Downgrade from a higher plan ($12000) to a lower plan ($6000) It gets more complex with these features that are often bundled in SaaS:

Set-up fees.
Discounts on annual plans
Support fees
Consulting services
Customization
Usage-based fees

Depending on the nature of performance obligations and how they're fulfilled, SaaS companies have a number of revenue recognition methods to choose from. We discuss a breakdown of common revenue recognition methods and how they're implemented in SaaS businesses. In complex revenue scenarios, revenue recognition needs to be prorated and recalibrated. Problems & Examples from the Auditor’s Point of View

Premature Revenue Recognition: Mistake: Recognizing revenue when performance obligations are not fully satisfied. Example: A software company recognizes revenue for a subscription service upfront, even though the service will be delivered over the next year.
Overstated Revenue: Mistake: Inflating revenue figures by counting revenue from unconfirmed contracts or verbal commitments. (Have the P.O.s prepared)Example: The company includes revenue from a potential project in its financial statements before the customer has officially accepted the proposal.
Bundling and Unbundling Errors: Mistake: Incorrectly bundling or unbundling products and services in multi-element arrangements. Example: A company fails to allocate revenue properly between a hardware and a long-term software contract, leading to improper revenue recognition.
Deferred Revenue Misclassification: Mistake: Misclassifying deferred revenue as earned revenue. Example: A SaaS company recognizes the full amount of a one-year subscription fee as revenue immediately, instead of recognizing it ratably over the subscription period. (this is why the start date is so important)
Change in Payment Terms: Mistake: Not adjusting revenue recognition when there's a change in payment terms. Example: A company changes its payment terms from upfront to installment-based, but continues recognizing revenue upfront without adjusting for the new terms. (If there is a change, have the new cut off date documented)
Warranty and Returns: Mistake: Failing to account for warranties or returns appropriately. Example: A company recognizes revenue for a product sale but does not set aside a portion for potential product returns or warranty claims.
Contingent Revenue: Mistake: Recognizing contingent revenue too early or inaccurately. Example: Recognizing contingent revenue for hitting certain performance targets before the conditions specified in the contract are met.
Material Right Assessment: Mistake: Not assessing whether customers have material rights. Example: A subscription-based media streaming service fails to consider a material right given to long-term customers for a discounted rate, leading to incorrect revenue allocation. (make sure all the terms are outlined in the customer contract)
Consistency in Application: Mistake: Applying different revenue recognition practices inconsistently between periods or contracts. Example: A software company switches between recognizing revenue upfront and recognizing it over time for similar types of contracts, causing inconsistency in reporting.
Non-GAAP Measures: Mistake: Misrepresenting non-GAAP revenue figures in external communications. Example: A technology company reports adjusted revenue figures that exclude contract liabilities without proper reconciliation to GAAP-reported revenue.

Asset & Liabilities Value Problems

Overstating Asset Values or Understating Liabilities: Inflating the value of assets or understating liabilities can lead to an inflated picture of a company's financial health. This can involve overstating the value of inventory, property, or intangible assets, or understating obligations such as debt or contingent liabilities.

The bulk of the time by the auditor will be spent on making sure the period cash is correct but you do want to make sure all the assets & liabilities are properly accounted for. Auditors scrutinize the valuation of assets and liabilities to ensure they are recorded at fair value and in accordance with accounting standards. Cancellations, refunds and the impact to assets will be closely tracked and here are two examples:

Internal Controls or the Lack Thereof

Inadequate Internal Controls: Auditors pay close attention to a company's internal control environment to assess the effectiveness of processes and safeguards in place to prevent inaccuracies or intentional misreporting. The big one is segregation of duties.

Internal Control Weaknesses:

Deficiencies in internal controls that affect financial reporting accuracy, including inadequate segregation of duties or lack of control document. Remember Groupon? It grew quickly but had problems with its internal controls. Subsequently it had to revise its first quarter as a public company, after discovering executives failed to set aside enough money for customer refunds. Its auditor at the time, Ernst & Young, called the error a “material weakness in its internal controls”.

MetLife Inc. had to pay a $10 million fine to settle SEC’s allegations that the insurer violated accounting rules in setting reserves for its annuities business.

The Auditors' Focus on Internal Controls

Auditors meticulously examine the effectiveness of internal controls to ascertain whether the processes and safeguards in place are capable of identifying and preventing errors and irregularities. The auditors' assessment extends beyond just numbers; they delve into the underlying procedures, documentation, and segregation of duties to ensure that the organization's financial reporting is accurate and reliable.

Strengthening Internal Controls

To fortify internal controls you can undertake the following measures:

1. Segregation of Duties: Dividing responsibilities among different individuals can help prevent a single person from having unchecked control over critical financial processes.

2. Control Documentation: Clearly documented control procedures and policies aid in ensuring consistency and transparency in operations. They also serve as a reference for employees and auditors.

3. Regular Monitoring and Testing: Continuously monitoring and testing internal controls helps identify weaknesses or gaps that might emerge over time. This proactive approach enables timely rectification.

4. Investment in Technology: Leveraging technology solutions such as automated financial systems and data analytics can enhance control accuracy and efficiency.

5. Training and Awareness: Employees should be educated about the importance of internal controls and their role in maintaining accurate financial reporting. This awareness can lead to a more conscientious workforce.

Intercompany Transactions: Avoiding Pitfalls

Intercompany accounting has received increased attention from auditors, regulators and accounting standards boards in recent years, in part because of errors in intercompany transactions that forced several high-profile companies to restate their financials.

Intercompany Transactions: Ensuring that intercompany transactions are accurately recorded and reconciled, especially for multinational companies.

Third-Party Confirmations: Verifying information with external parties, such as banks and customers, to ensure accuracy and completeness of reported balances.

Poor practices can also reduce transparency because documentation is not standardized or centralized, making it difficult to obtain a clear view of things. In worst cases, this lack of transparency can give unscrupulous professionals the opportunity to hide fraud or illegally redistribute business assets.

Here is another great reference from PWC:

A Plethora of Complex Transactions: A Cause for Concern at FTX

Digging deeper into FTX’s financial statements revealed a web of related-party activities, with insiders like Bankman-Fried serving both as liquidity providers and market makers on their own platform. This dual role immediately posed questions about potential conflicts of interest and the integrity of these transactions.

The significance of such related-party dealings should have prompted auditors and stakeholders to question their impact on the company's financial health and reporting accuracy.

Outsourced Management Activities: A Distinct Concern

The audited financial statements shed light on another precarious arrangement: related parties were entrusted with managing FTX Trading's currency and treasury activities on an "outsourced" basis. While this approach isn't inherently flawed, it raised questions about transparency and accountability. The reliance on related entities for significant financial activities underscored the need for a comprehensive review of internal controls and risk management practices.

Don’t Be This Guy

Source: FTX founder Sam Bankman-Fried jailed

An Alarming Statistic: Almost 90% of SPACs had to restate financials

Other Items to Watch Out For

Account Reconciliations: Discrepancies or inconsistencies between account balances, especially in balance sheet accounts like cash, accounts payable, and accounts receivable.
Deferred Taxes: Issues related to deferred tax assets and liabilities, particularly if the company operates in multiple tax jurisdictions or if tax regulations change.
Inventory Valuation: Challenges in valuing inventory accurately, particularly if there are complex production processes, changing market conditions, or obsolete inventory.
Lease Accounting: Compliance with lease accounting standards (ASC 842) can be complex, especially for companies with numerous leases, lease modifications, or complex lease terms.
Fair Value Measurements: Determining fair values for assets and liabilities, especially when market data is limited, leading to potential disagreements between the company and auditors.
Contingencies and Litigation: Assessing and disclosing contingent liabilities or pending litigation accurately and thoroughly.
Related Party Transactions: Identifying and disclosing related party transactions, ensuring proper documentation and approval processes.
Complex Transactions: Transactions that deviate from the norm, such as business combinations, acquisitions, divestitures, or restructuring efforts, require detailed assessment.
Consolidation Issues: Properly consolidating financial statements if the company has subsidiaries, joint ventures, or variable interest entities.
Segment Reporting: Determining and properly reporting segments if the company operates in different business segments or geographic regions.
Employee Benefits and Stock-Based Compensation: Ensuring accurate recording and valuation of employee benefits, pensions, and stock-based compensation, especially for complex equity instruments
Non-GAAP Measures: Ensuring that non-GAAP financial measures are properly reconciled to GAAP figures and are not misleading to stakeholders.
Going Concern Assessments: Addressing concerns about the company's ability to continue operations, especially if there are financial difficulties or uncertainties.
Changes in Accounting Policies: Properly applying and disclosing changes in accounting policies and estimates, including providing the required impact analysis.

See things From the Auditor's Perspective

It’s sort of a strange relationship between you and the auditor. You are paying them to scrutinize the work you have performed and they have to abide by strict external standards. At the same time, they want to have a long relationship with you as a client.

Having everything prepared, documented and outlined can help the auditor go smoothly while also building on this relationship. In our concluding series, we will go over the Audit report.

In Part 4, we discuss the Audit Report and what to do if you don't receive the unqualified opinion.

Go deeper: Guide 11, Audit & Transaction Readiness, part of the CFO Guide Series: 24 one-page guides for CEOs and founders.

Mark Sue