Where internal controls break down in financial services

Internal Controls over Financial Reporting (ICFR) are designed to support the accuracy and reliability of financial statements, aiming to prevent material misstatements due to fraud or error. Risk assessments, control activities, and monitoring provide comfort to stakeholders regarding the integrity of financial reporting, building trust in the financial information presented.

For a broader perspective on modernizing your control environment, see our earlier article: Rethinking internal controls for your financial institution.

The Role of Internal Controls in Financial Services

In the financial services sector, the importance of ICFR is amplified due to the complexity and high volume of transactions, which increase the risk of errors and fraud. Additionally, these institutions operate under stringent regulations, requiring robust internal controls. A well-structured environment builds trust and supports informed decision-making by reinforcing the reliability of financial statements for investors, regulators, and other key users.

A deficiency in ICFR is a flaw in the design or operation of a control that could prevent timely detection or correction of financial misstatements. When ICFR deficiencies are not remediated, the risk of material misstatements in financial statements increases, along with broader risk exposure across the organization. See below for categories of deficiencies:

Key ICFR Deficiencies in Financial Services

To improve internal controls, it’s important to recognize key deficiencies. These include:

1. Inadequate Risk Assessment

Institutions often fail to correctly identify and assess risks due to a lack of understanding of the current business environment and processes, leading to an increased risk of control gaps.

Examples:

• A bank outsources mortgage servicing but fails to assess vendor-related reporting risks. As a result, errors in escrow and interest calculations go undetected, leading to misstated liabilities and income.
• A bank expands its use of Level 3 fair value instruments without reassessing valuation risks and model assumptions. The lack of updated risk analysis leads to insufficient controls over valuation and misstated investment balances.

2. Weak Control Environment

Insufficient leadership commitment to integrity and ethics, in addition to poorly defined roles, can undermine the effectiveness of oversight and execution.

Examples:

• Senior management bypasses loan approval protocols to push through high-risk commercial loans at quarter-end to meet earnings targets.
• The financial and risk departments share responsibility for fair value validation but lack clear accountability, creating confusion and inefficiencies.

3. Deficient Control Activities

Inadequate segregation of duties and missing protocols around complex transactions increase the risk of fraud and reporting errors.

Examples:

• A single employee handling both initiation and approval of wire transfers increases the risk of unauthorized transactions.
• A hedge fund lacks adequate procedures for valuing complex derivatives, resulting in inaccurate asset reporting.

4. Inadequate Information and Communication

Poor data quality and ineffective communication channels can lead to errors and misstatements.

Examples:

• Outdated customer records cause billing errors and flawed account summaries.
• Data pulled from multiple legacy systems without reconciliation leads to inconsistencies in reported balances.

5. Insufficient Monitoring

Lack of ongoing evaluations and failure to promptly address identified deficiencies allows weaknesses to persist.

Examples:

• A credit union neglects to review its loan approval process, missing changes in market conditions that affect credit risk.
• A bank identifies a weakness in its fraud detection system but delays corrective action, leaving it vulnerable to fraudulent activities.

By addressing these weaknesses, organizations can take proactive steps to strengthen their ICFR frameworks for more reliable financial reporting.

Strategies to Avoid ICFR Deficiencies

Financial services organizations can strengthen their internal control frameworks by implementing the following approaches:

• Build a Strong Oversight Culture: Promote integrity and accountability with clear leadership and defined roles.
• Refine Risk Assessment: Regularly update risk assessments and use analytics to identify emerging threats.
• Strengthen Safeguards: Define roles clearly and restrict system access to protect sensitive data and support accurate reporting.
• Enhance Communication: Invest in reliable systems that deliver timely financial data and create clear channels for reporting issues.
• Improve Monitoring: Conduct regular internal audits and reviews, with structured follow-up on identified deficiencies.

These strategies help reduce ICFR gaps, support reliable financial reporting, and build trust with stakeholders.

Case Studies on ICFR Deficiencies

Case Study 1: Large Bank's Restatement Due to Revenue Recognition Errors

A multinational bank was forced to restate its financial statements after uncovering material errors in revenue recognition. These issues stemmed from weak oversight of complex financial products and gaps in governance.

Challenges:

• Complex Offerings: The bank lacked effective safeguards around intricate financial products, complicating accurate revenue recognition.
• Limited Oversight: Insufficient supervision of the revenue recognition process allowed errors to persist undetected until a restatement was necessary.
• Inadequate Documentation: The documentation requirements were not robust enough to support accurate financial reporting.

Resolution:

• Enhanced Review Processes: The bank implemented stronger controls and documentation requirements, with regular reviews by senior management.
• Improved Risk Assessment: A comprehensive risk assessment was conducted to identify vulnerabilities and reinforce financial reporting practices.

Lessons Learned:

• Tailored Safeguards: Risk mitigation strategies should be customized to address the complexity of financial products.
• Continuous Monitoring: Regular oversight helps identify and correct errors early.

Case Study 2: Mid-Sized Bank's Challenges with Q Factor Deficiencies in CECL

A regional bank encountered difficulties integrating qualitative factors (Q factors) into its CECL model, leading to inconsistent credit loss estimates.

Challenges:

• Inadequate Identification: The institution struggled to identify relevant Q factors for its diverse loan portfolio.
• Subjectivity and Lack of Documentation: Adjustments were based on judgment with minimal supporting records.
• Inconsistent Use: Departments applied Q factors inconsistently, undermining reliability.

Resolution:

• Standardization: Developed a standardized framework to guide consistent application across teams.
• Training and Recordkeeping: Implemented training and established detailed documentation procedures.
• Monitoring and Feedback: Set up regular reviews to refine Q factor adjustments.

Lessons Learned:

• Structured Framework: Promotes consistency and reliable estimates.
• Clear Documentation: Supports transparency and informed decision-making.
• Continuous Improvement: Keeps the framework aligned with changing conditions.

We Can Help

At Elliott Davis, we understand the unique challenges financial services organizations face in maintaining strong ICFR. Complex operations and stringent regulatory requirements can expose deficiencies in control environments, risk assessments, and reporting processes.

To mitigate these risks, our Financial Services Group works with institutions to:

• Evaluate your current ICFR framework
• Identify gaps in risk assessment, control activities, and monitoring
• Enhance reporting processes and reduce manual effort
• Align oversight mechanisms with business goals and regulatory expectations
• Support leadership with actionable insights and practical solutions

Let’s work together to build a control environment that supports accuracy, transparency, and confidence in your financial reporting. Contact us today to get started.

The information provided in this communication is of a general nature and should not be considered professional advice. You should not act upon the information provided without obtaining specific professional advice. The information above is subject to change.