4.04 The internal-control risk factor still describes an adverse ICFR conclusion as a future possibility and remediation as only being planned
Company H · a US-listed aerospace services company · Presentation point
In brief
This is the first Form 10-K in which management and the auditor had to report on internal control over financial reporting (ICFR). Management concluded ICFR was not effective at [date], and the auditor gave an adverse ICFR opinion. Item 1A still says 'If, when required in the future, we are unable to assert' that ICFR is effective, or if the auditor cannot give an unqualified opinion, as though neither had happened. It also says the company is 'now in the process of planning' remediation, while Item 9A describes measures already in place and three earlier material weaknesses remediated. Both sentences are copied word for word from the prior-year Form 10-K.
The evidence, as filed
Screenshot withheld to protect the company’s identity. Even with names, figures and dates boxed out, the wording on these pages could be searched back to the filer. Pages relied on: Form 10-K 2024 (prior year), front matter; Form 10-K 2025, page 20; Form 10-K 2025, page 21.
What the filing shows, and what the rule requires
| What the filing shows | What the rule requires |
|---|---|
Item 1A: 'If, when required in the future, we are unable to assert that our internal control over financial reporting is effective, or if our independent registered public accounting firm is unable to express an unqualified opinion'; 'we are now in the process of planning to implement measures'. Item 9A: ICFR 'was not effective as of [date]'; measures at 'various stages of designing and implementing', including a third-party advisory firm hired and a Disclosure Committee formed; the risk assessment, information and communication, and policies material weaknesses remediated. Auditor: The Company 'did not maintain, in all material respects, effective internal control over financial reporting'. | Item 1A should say that the reporting requirement now applies, that management concluded ICFR was not effective at [date], that the auditor issued an adverse ICFR opinion, and where remediation actually stands, consistently with Item 9A. Only the risk that the weaknesses persist into future periods should be framed as a possibility. |
The rule
Regulation S-K Item 105(a)
Where appropriate, provide under the caption “Risk Factors” a discussion of the material factors that make an investment in the registrant or offering speculative or risky.
Version: Text in force at the date of this review · Source: Regulation S-K, 17 CFR 229.105, as amended by Release 33-10825
Regulation S-K Item 105(b)
Concisely explain how each risk affects the registrant or the securities being offered.
Version: Text in force at the date of this review · Source: Regulation S-K, 17 CFR 229.105, as amended by Release 33-10825
Exchange Act Rule 12b-20
there shall be added such further material information, if any, as may be necessary to make the required statements, in the light of the circumstances under which they are made not misleading
Version: Text in force at the date of this review · Source: 17 CFR 240.12b-20 (eCFR text as of the law pack date)
Why it applies here. The full facts are in Item 9A and the auditor's report, so nothing is omitted; the defect is a risk factor that presents a realized risk as hypothetical and understates remediation progress, inside the same filing.
Why it matters
- A reader of Item 1A alone would think the company had not yet failed an ICFR assessment or started remediation.
- Risk factors written as hypothetical when the event has occurred are a pattern the staff often raises; a comment asking for revised wording in future filings is the realistic outcome.
How often the SEC staff raises this. In 1,100 SEC staff comment letters on fiscal 2023 and 2024 Forms 10-K, released January 2025 to October 2026, risk factors drew 27 of the 1,774 numbered comments (1.5%): topic 14 of 25 by frequency.
Exposure
Possible SEC staff comment under Regulation S-K Item 105 and Rule 12b-20, usually settled by an undertaking to revise future filings; no monetary penalty.
Our workings
the cover page ticks the box for the auditor's attestation under Section 404(b) of the Sarbanes-Oxley Act (SOX), and Item 9A reports management's conclusion that ICFR was not effective at [date] because of material weaknesses in the control environment, monitoring, period-end financial reporting and IT general controls. The auditor's report states that the Company did not maintain effective ICFR.
the Item 1A risk factor on material weaknesses closes with a sentence that begins 'If, when required in the future', and describes the remediation as being planned. The prior-year Form 10-K, filed when the company was a newly public registrant not yet required to report on ICFR, contains both sentences in the same words.
Item 9A lists measures already taken during 2025 (a third-party advisory firm and additional accounting personnel hired, a Disclosure Committee formed, reconciliation and journal-entry review enhanced) and reports that three previously reported material weaknesses (risk assessment, information and communication, policies and procedures) were remediated by [date].
the control-environment, period-end and IT general-control weaknesses were already reported at [date], yet Item 1A says they were identified 'in connection with the preparation of our consolidated financial statements for the year ended [date]'.
the risk factor was carried forward without updating for the first year of ICFR reporting. As a result it presents a risk that has already happened (an ineffective-ICFR conclusion and a non-unqualified auditor opinion) as a hypothetical, and understates remediation progress. Regulation S-K Item 105 requires a discussion of the material factors that make the investment risky and how each affects the registrant. Securities and Exchange Commission (SEC) staff regularly comment on risk factors written as hypothetical when the event has occurred. The full facts are given in Item 9A and the auditor's report, so this is an internal inconsistency, not an omission.
| Statement in Item 1A | What the same Form 10-K shows elsewhere | Status |
|---|---|---|
| 'If, when required in the future, we are unable to assert' ICFR is effective | Reporting required now (cover 404(b) box ticked); management concluded ICFR not effective at [date] (Item 9A) | Risk has occurred |
| 'or if our independent registered public accounting firm is unable to express an unqualified opinion' | Auditor states the Company did not maintain effective ICFR (adverse opinion) | Risk has occurred |
| 'we are now in the process of planning to implement measures' | Item 9A: measures at various stages of design and implementation; advisory firm hired; Disclosure Committee formed; three earlier weaknesses remediated | Stale; understates progress |
| Weaknesses 'identified' in preparing the 2025 statements | Control environment, period-end and IT general-control weaknesses already reported at [date] in the prior-year Form 10-K | Carried forward, not new |
Management’s best defense, and our reply
Management would say the sentence looks forward: it addresses future annual assessments ('when required in the future'), and the risk factor's heading and opening paragraphs already state that material weaknesses exist at [date]. They would add that Item 9A and the auditor's report, in the same filing, give the full ICFR conclusion and remediation status, so investors are not misled overall. However, 'when required in the future' is wrong on its face for a large accelerated filer that ticked the 404(b) box this year. The risk factor nowhere states the negative management conclusion or the adverse attestation, and 'now in the process of planning' contradicts Item 9A's description of measures already taken. Cross-disclosure elsewhere reduces the severity but does not make Item 1A accurate. The SEC staff's position is that a risk that has materialised should be described as such in the risk factor itself.
The fix
- Replace the closing sentence with, for example: 'Management concluded that our internal control over financial reporting was not effective as of [date], and our independent registered public accounting firm issued an adverse opinion on its effectiveness. If we are unable to remediate these material weaknesses ...'. Align the remediation paragraph with Item 9A (measures taken, the three weaknesses remediated, those that remain), and say the remaining weaknesses were first reported at [date].
Evidence relied on
| # | What it shows | Type | Where |
|---|---|---|---|
| 1 | Item 1A frames an ineffective-ICFR conclusion as a future possibility | Document | Form 10-K 2025, page 21 |
| 2 | Item 1A frames a non-unqualified auditor ICFR opinion as a future possibility | Document | Form 10-K 2025, page 21 |
| 3 | Item 1A describes remediation as at the planning stage | Document | Form 10-K 2025, page 20 |
| 4 | Item 1A presents the weaknesses as identified in preparing the 2025 statements | Document | Form 10-K 2025, page 20 |
| 5 | Cover page: the Section 404(b) attestation box is ticked, so ICFR reporting is required for this year | Document | Form 10-K 2025, unnumbered page |
| 6 | Item 9A: management's ICFR conclusion is negative | Document | Form 10-K 2025, page 130 |
| 7 | Auditor's report: adverse ICFR opinion | Document | Form 10-K 2025, page 71 |
| 8 | Item 9A: remediation is under way, not merely planned | Document | Form 10-K 2025, page 131 |
| 9 | Item 9A: a remediation step already taken | Document | Form 10-K 2025, page 131 |
| 10 | Item 9A: a further remediation step already taken | Document | Form 10-K 2025, page 132 |
| 11 | Item 9A: three previously reported weaknesses were remediated by year end | Document | Form 10-K 2025, page 131 |
| 12 | Prior-year Form 10-K: the same sentence, written before ICFR reporting applied | Document | Form 10-K 2024 (prior year), unnumbered page |
| 13 | Prior-year Form 10-K: the control-environment weakness was already reported at [date] | Document | Form 10-K 2024 (prior year), unnumbered page |
Prepared by Pramanex from the company’s public SEC filings, without the company’s involvement, to show how a 10-K Pre-filing Check reads. The company is not named, and nothing on this page is a statement about any identifiable company. Observations are not an audit, review or other attestation or assurance engagement, and not legal advice. An SEC-style question is a question, not a conclusion.
Want this on your own 10-K, before you file?
Start with three free findings on your latest 10-K, or book a fixed-price 10-K Pre-filing Check.
Your next 10-K will be in draft before the audit is done.
Have it read before you file.
Start with three free findings on your latest 10-K, or book a fixed-price 10-K check. Drafts only under NDA, inside your insider trading policy.