Remarks At The PepsiCo-PwC CPE Conference: Controlling Internal Controls, SEC Commissioner Caroline A. Crenshaw, Nov. 16, 2021

Thank you for the kind introduction Kevin [Gould]. It’s a pleasure to be here today at the annual PepsiCo-PwC CPE conference, which I understand is a tradition going back 18 years now. I appreciate the opportunity to speak, and I look forward to answering your questions today. 

It’s not often—even in this job—that I find myself speaking before such a large group of controllers, accountants and other finance professionals of public companies. And I welcome it because it means we can get a bit more technical and talk about financial reporting issues. I suspect many of you will not be surprised that Kevin and his team have shared with me that ESG is top of mind for this group.  I understand there is an interest in hearing what ESG means to the SEC and what ESG regulations are on the horizon. It’s a big question, and spoiler alert – I cannot speak for the Commission and tell you what is to come. I have to caveat my statements today with the standard disclaimer that any views I express today are my own and do not reflect the views of my fellow Commissioners, the Commission or its staff. But I am an U.S. Army reservist, and the Soldier in me truly appreciates your commitment to readiness.  So even though I cannot speak for the Commission, today I will discuss how I have been thinking about ESG in the public issuer context.

I. ESG Risks Facing Today’s Investors & Public Companies

ESG is not a monolithic concept. As you know, it generally refers to environmental, social and governance risks, and these are some of the most pressing issues companies are facing.  In March of this year, the Commission sought public comment on climate change disclosure.[1] We received hundreds of responses; many of which also addressed disclosures concerning other ESG risks. An overwhelming number of comment letters state that investors view ESG information as material to financial performance and that investors need consistent and reliable disclosures of ESG information to inform their investment decisions.[2] According to commenters, ESG related information helps investors assess the long-term sustainability or value of an investment.[3] And this makes sense if you think about the position investors are in today. Many Americans are no longer able to rely on defined-benefit retirement plans. They must, instead, rely on themselves in order to save for their children’s education or for their own retirement.  And they must, in doing so, take on the risks associated with managing the money themselves.[4] Investors increasingly need to consider how companies will “weather” over a longer time horizon when making investment decisions.[5] That requires looking at the risks today’s companies face and analyzing how these risks will impact future financial performance.

With ESG now front and center, the reliability of corporate ESG risk disclosures, and their potential impact on and connectivity to financial statements, is critical. As you know, corporate internal controls play a crucial role in ensuring such risk disclosures are consistent and reliable.  The term “internal accounting controls” refers to an organization’s plan, methods, and procedures related to safeguarding a company’s assets and ensuring the reliability of corporate financial records.[6] These controls broadly include systems designed to ensure transactions are authorized and recorded in a way that maintains accountability for assets and allows for financial statement preparation in conformity with GAAP.[7]  They also include procedures that control access to assets and the systems designed to test the effectiveness of internal controls.[8] The concept of accounting controls is intentionally broad, because a company’s system for tracking its assets and recording transactions – regardless of their form – is vital to accurate financial reporting. And it is vital to identifying risks to the financial statements so leadership can manage them and prepare GAAP-compliant financial statements and disclosures accordingly. At the end of the day, management is responsible for establishing and maintaining an effective system of internal controls that reasonably safeguards corporate assets from risk.[9] So as you think about and discuss ESG risks during this conference, I encourage you to think about them in the context of your internal accounting controls and audit functions.[10]

II. Internal Accounting Controls and ESG Risks

To best serve their function, internal accounting controls must be dynamic enough to consider and respond to changes in the markets, such as those posed by ESG issues. Companies have to evolve over time because the market place is constantly changing in response to new developments and challenges. These changes can be prompted by new technology, developments in the global economy, or even by our planet. Change drives innovation for not just corporate America, but investors, consumers and citizens. Change can be a good thing. But as markets change, so do the risks that can impact a company’s financial statements. Corporate internal accounting controls must evolve as well. Although these are relatively technical matters often thought of as within the remit of accounting and legal professionals of a specific company, I am regularly reminded that, in the aggregate, these details matter to all Americans.  These details impact the companies whose aggregate financial performance undergirds the retirement savings of tens of millions of workers, and retirees.

If we think back to when the American Institute of Certified Public Accountants (AICPA) first defined internal controls in 1949, I expect few companies were thinking about the specific ESG risks investors are focused on today. But, at that time, it was less common for supply chains to be disrupted by flooding, or wild fires, or ransomware attacks, or global pandemics,[11] as they are today.[12] Most, I suspect, did not contemplate that the majority of economic transactions would happen electronically rather than face-to-face, or the ubiquity of the computing hardware and related software that today informs every aspect of our personal and professional lives. We simply could not foresee that. At that time, the risk that a businesses’ entire operations could be taken offline by a technological glitch – or a cyber-attack – did not exist.[13] And although I understand that companies have, for some time now, put processes in place to protect customer information from theft or to detect and protect against spoofing and malware, it’s only more recently that companies are facing this frequency of ransomware attacks. And it’s only recently that public companies are starting to hold corporate assets in the form of digital assets that are not necessarily custodied and controlled by a regulated bank or financial institution. 

Given all these changes, it is important to think about many risks.[14]  But there are a few specific ESG risks where internal corporate accounting controls play a critical role, and it is particularly important to assess whether these existing corporate internal accounting controls are sufficient to provide reasonable assurances that each business and its assets are, in fact, adequately controlled. [15]

A. Safeguarding Information and Systems

I’ll start with cybersecurity, which can fall into the “S” or “G” bucket depending on the specific risk at issue. The Commission noted in a 2018 statement that “[c]ompanies today rely on digital technology to conduct their business operations and engage with their customers, business partners, and other constituencies. In a digitally connected world, cybersecurity presents ongoing risks and threats to our capital markets and to companies operating in all industries, including public companies regulated by the Commission.”[16] Unfortunately, the gravity of the threat appears to have grown since the statement was issued – or at least evolved in light of the recent rise in ransomware attacks.[17] You may recall that earlier this year, a motor vehicles manufacturer suffered a nationwide IT infrastructure outage after a ransomware attack demanding payment of Bitcoin.[18] And those of you on the East Coast were likely impacted by the ransomware attack that took offline the computer systems that manage the gasoline pipeline system responsible for transporting around 45 percent of the East Coast’s fuel supply.[19]

Cyber-intrusions are no longer limited to events that put sensitive information for sale on the dark web. Every day, companies’ operations are disrupted and management must make difficult choices about how to respond, typically when faced with only expensive and unwelcome options.[20] It is understandable that investors might consider how companies manage the risk of cyber-intrusions when making investment decisions.

Turning back to internal controls, I’m particularly interested in understanding how public companies are responding to the various types of cybersecurity intrusions and attacks public issuers are facing, since these create threats to management’s ability to safeguard the company’s assets, in particular. Are companies evaluating authentication protocols and potential weaknesses in security frameworks? And what internal controls are in place to protect electronic systems from unauthorized access or to ensure financial transactions are processed as authorized and not diverted?  I am also thinking about whether it might make sense for companies have expertise at the management and board levels to evaluate the resources the company is putting into these controls, and to regularly brief the C-suite and board on internal controls testing and effectiveness. Otherwise, it could be hard to assess whether management truly has control over corporate assets.

For good reason, the Commission has brought enforcement actions when public companies and regulated entities have lacked adequate internal accounting controls, or made inadequate public disclosures concerning cyber-intrusions and related risks.  This is an area where I expect our Enforcement and Exams Divisions’ staff would continue to pay attention.

B. Identifying and Measuring Climate Risk

In the world of ESG, I suspect climate change risk is an area you’re thinking about as much as cyber.   It is on my mind too.  I would like to hear how public companies are assessing whether and how climate change risk impacts revenues and expenses, both now and in the foreseeable future. In particular, I am interested in understanding how companies are evaluating whether climate risk impacts their business. Some issues that I would think companies are considering as part of this process include whether assets are at risk of depreciating more quickly or becoming “stranded” in response to climate change; whether supply chain or transportation networks are at greater risk of being impacted by extreme weather events; or whether existing revenue streams depend on the status quo, such that new regulations pertaining to deforestation or carbon emission could potentially reduce income.[21] No matter where public companies come out on these topics – or how they assess climate risk – I would like to understand the underlying internal accounting controls that guide decision making.  On a related note, if climate change presents risks to a company, or at least requires disclosure, I’m interested in understanding how that company evaluates climate change risk. For example, do companies rely on third party service providers, and if so, do they evaluate the controls that the service providers have in place over information and disclose to investors the identity of the service provider, in the same way you disclose your auditors and underwriters?

I do not think I am alone in wanting to understand how companies are determining whether and how financial statements are impacted by climate change risk; how assumptions used to reach these determinations are set, tested, and reevaluated over time; and how any existing disclosures are being formulated. I have an open door policy and welcome input on these issues, and of course other issues as well. 

C. Safeguarding Digital Assets

Finally, I want to touch on one last fairly recent risk that potentially implicates governance issues. There are media reports that public companies are purchasing digital assets with corporate cash, or accepting digital assets as a form of payment.[22] Such decisions raise a whole new set of internal controls questions, including whether and what internal accounting controls are in place to safeguard those assets from unauthorized use or other custodial risks. It would seem beneficial for companies transacting in digital assets to consider instituting robust processes that validate custody, verify transactions and protect assets from ransomware events. Otherwise, it could be difficult to authorize and account for the transactions.[23] I think it is critical for companies to consider, among other things, whether the internal accounting controls frameworks safeguarding these assets are working, how they need to be modified from existing frameworks applied to transactions in fiat currencies, and what changes need to be implemented, if any.

III. Conclusion

The purpose of internal accounting controls is, and has always been, to provide for corporate and managerial control over a company’s assets. It’s about ensuring accountability to shareholders and building a foundation that reasonably assures that financial reporting and corporate disclosures are accurate and reliable. As businesses and transactions evolve, so too do the risks to corporate assets. It is for these reasons, among others, that I think of internal accounting controls when I think of ESG risks.

ESG risks serve as a good reminder of the need to be vigilant about regularly reexamining and reconsidering the risks to public companies and their financial statements. It is important, particularly for financial professionals, to identify and assess the ESG risks that might impact company or client, not just in this year, but in future reporting periods too. Of course, we all know that internal controls are only effective if they work, so it is also important to evaluate and test controls frameworks to ensure that they are adequately managing risk. As today’s investors are evaluating how ESG risks might impact their investments in companies, I would not be surprised if they are also assessing corporate readiness to manage new and emerging risks.

Thank you for your time. I look forward to your questions.