I. Introduction
In May 2014, the Financial Accounting Standards Board (FASB) issued Accounting Standards Update No. 2014-09, Revenue from Contracts with Customers (Topic 606) for public business entities, certain not-for-profit entities, and certain employee benefit plans. The amendments become effective for public entities for annual reporting periods beginning after December 15, 2017. In other words, we are now less than six months away from a new Revenue Recognition (“new rev rec”) standard which may significantly impact the compliance profession, compliance programs and compliance practitioners going forward.
I recently sat down with Joe Howell, Executive Vice President (EVP) at Workiva Inc. and asked him if he could walk me through some of the key changes and how it might impact compliance going forward. This blog post begins a multi-part exploration of the new rev rec standard.
FASB recognized that its revenue recognition requirements around U.S. generally accepted accounting principles (GAAP) differed from those in the International Financial Reporting Standards (IFRS) and that both sets of requirements needed improvement. This led to a project by FASB and the International Accounting Standards Board (IASB) to jointly clarify the principles for recognizing revenue and to develop a common converged revenue standard for GAAP and IFRS. Hence the new rev rec standard.
The implementation will be a massive undertaking. According to Howell, “The accounting standard itself is 700 pages long, and in the US accounting literature it replaces over 200 other pieces of accounting guidance on revenue.” The official name is “Revenue from Contracts with Customers” and Howell noted there are “lot of surprises, and the things that is true for almost everybody is that they are going to be facing some level of change in the way they account and report revenue. They will most certainly have to change the way they disclose things related to their revenue. There are, included in the revenue standards, over six pages worth of new disclosure requirements.”
One of the key differences in this new rev rec standard is that it requires companies to disclose new information beyond data a company might have been required to release in the past. Howell thinks this will put pressure on auditors “to get comfortable with what the company provided them and which they incorporated into their decision- making process in forming an opinion. For disclosure control this is something quite different, because the auditor’s typically not relying on those.” This will create risks for auditors adjusting to the new rev rec standard because as they learn more about the new standard and apply it going forward into 2018, they may have to revisit prior reporting and revise some of it.
The reason this is important to the compliance profession and the compliance practitioner is internal controls over financial reporting involved in implementing this new standard are critical to the effective use of implementation and how you implement. The Securities and Exchange Commission (SEC) has said explicitly in several public statements and through their early comment letters on disclosures made in advance of implementation, that companies must inform the SEC about the accounting policies that they are changing, and how this new standard will affect a company’s accounting processes, and finally how those effects are going to be managed. Howell believes “The SEC is making it perfectly clear that this is a real compliance issue.”
Moreover, the SEC has indicated that these disclosures are central to the new rev rec standard. Howell said, “typically, if a company has some sort of failure in their disclosures for an accounting standard, they’re treated under section Sarbanes-Oxley (SOX) Section 302 of the SEC rules, and that has a level of significance or liability, which is much lower than the liability that a company might face under SOX Section 404, which has to do with the actual internal controls over financial reporting.” While disclosure of internal controls might not typically bring Section 404 scrutiny, under the new rev rec standard, they may now do so.
Howell articulated that usually when performing a financial audit, an auditor would not rely on a disclosure control in the past. However under the new rev rec standard, if there is a change during the year in how an auditor views a disclosure control, it could require them “to go back and either figure out if the audit work that they did is tainted and they need to go back and do that work in the form of a substantive testing, or they need to go back to see if there were mitigating controls that were in place that still allowed them to rely on the internal control processes to get comfortable with what the company provided them and which they incorporated into their decision making process in forming an opinion. For disclosure control this is something quite different, because the auditor’s typically not relying on those.”
Of course, this is overlaid on the requirements of effective internal controls under the Foreign Corrupt Practices Act (FCPA) and the lack of any materiality standard. One only need to consider the Wells Fargo fraudulent accounts scandal to see how a lack of materiality does not prevent the types of risk from moving forward to become huge public relations disasters, hundreds of millions of dollars in fines and costs estimated at over $1bn for failures of internal controls.
Yet there are other tie-ins into compliance which the compliance practitioner needs to understand and prepare for going forward. The prior rev rec standard was rules based. As a lawyer, that was an approach I was quite comfortable with both from a learning stand point and communicating to business folks. But now the standard is much more judgment based and when a standard is more judgment based, there can be more room for manipulation. Howell explained the response by compliance is “making sure that you have changes in the business processes necessary to gather the information that has not previously been required to continue to monitor; how that information is factoring into the judgements that managers must make as they report their revenue under the new standard; and that those judgements themselves are properly documented.”
This final point demonstrates the convergence and overlap between the compliance profession, compliance programs and compliance practitioners going forward. Compliance internal controls are in place to both detect and prevent. Now they can also be used to gather the information which will be presented to auditors under the new rev rec standard. Many professional are focused on the new rev rec from the auditing and implementation perspective. However, if you are a Chief Compliance Officer (CCO), you might want to go down the hall and have a cup of coffee with your Chief Financial Officer (CFO) and find out what internal controls might be changing or that they might be adding and consider how that will impact compliance in your organization.
II. Contracts
The key to understanding the new rev rec standard is that it is judgment based, not rules based. This will allow more room for interpretation but also allows for more room for manipulation. This is where the new rev rec standard intersects with compliance and where the compliance practitioner needs to not only understand the new rev rec standard but also understand the role that internal controls will play in complying with this new standard going forward.
There are five elements that you must consider to make a determination of whether revenue can be recognized. FASB identifies these five elements as the following:
FASB states that Step 1: Identify the Contract with a Customer, as follows:
A contract is an agreement between two or more parties that creates enforceable rights and obligations. An entity should apply the requirements to each contract that meets the following criteria:
1. Approval and commitment of the parties
2. Identification of the rights of the parties
3. Identification of the payment terms
4. The contract has commercial substance
5. It is probable that the entity will collect the consideration to which it will be entitled in exchange for the goods or services that will be transferred to the customer
Howell said, “The first step is to figure out what the contract is, and the most important point there is that contracts do not need to be written. The key about what is the contract means that if your business practices differ from what’s written in the contract, you have to make a judgment about which survives. For example, if you have a contract that says you have 90-day return privileges but you as a business practice always give 360 or 365 days return, what’s the contract? Is the contract the 90 days that’s written or is the contract the 365 days that you’re actually giving?” Obviously in the compliance world, the failure to follow the contract terms and conditions can raise one very large red flag as it might signify conduct the compliance function has not evaluated or approved.
But Howell points out how the failure to follow one of the most basic compliance requirements, i.e. following the terms of a contract, can negatively impact a company’s ability to recognize revenue under this new standard. “If you don’t have a contract, if you legitimately don’t have a contract, then you can’t recognize revenue until you actually get the cash. This can most often occur when a company follows a business practice that is not recorded or written. One would determine that the company has a business practice that was simply not written down. Of course, there are companies which ship based upon POs alone but in that case you must discuss any pricing concessions that might be given in the PO and from that point try and determine what that actual contract might be going forward. This means your company may have a contract of some kind but it may be enforceable only as a business practice not as a written contract.”
Howell also noted another important consideration is that a written contract represents the performance obligations of both parties. Moreover, there may “be some sort of credit factor that is considered in the contract and that’s something that’s quite new that changes the way the judgments need to be formed. In the past, you would have reserves for bad debt now you need to factor in to the actual revenue the amount of the revenue that could be affected by lack of ability to perform through any revenue that could be recognized until you actually collect it.”
Given that a written contract is specified in the Ten Hallmarks of an Effective Compliance Program as a key internal control, you can easily see how the lack of such a written agreement can fall into the realm of compliance. Even Foreign Corrupt Practices Act (FCPA) enforcement actions are relevant here as one of the well-known bribe-funding tactics is to provide a discount to a customer but not credit the company’s books but instead take the actual discounted amount and give to a corrupt official as a bribe. With this first element of the new rev rec standard apparently recognizing that the lack of a contract is not an impediment to eventually recognizing revenue, compliance practitioners may well need to more thoroughly review contracts with governmental entities or state-owned enterprises.
III. Performance Obligations
FASB states that Step 2: Identify the Performance Obligations in the Contract, requires the following:
A performance obligation is a promise in a contract with a customer to transfer a good or service to the customer. If an entity promises in a contract to transfer more than one good or service to the customer, the entity should account for each promised good or service as a performance obligation only if it is (1) distinct or (2) a series of distinct goods or services that are substantially the same and have the same pattern of transfer.
A good or service is distinct if both of the following criteria are met:
1. Capable of being distinct—The customer can benefit from the good or service either on its own or together with other resources that are readily available to the customer.
2. Distinct within the context of the contract—The promise to transfer the good or service is separately identifiable from other promises in the contract.
A good or service that is not distinct should be combined with other promised goods or services until the entity identifies a bundle of goods or services that is distinct.
Howell said, “The second step is to determine what are the performance obligations. Again, those performance obligations may not be immediately obvious to the casual observer and the contract needs to be picked apart to determine if those performance obligations are such that you would recognize that or complete that at a point in time, or if you’re going to be performing those over a period of time. If it’s for a period of time, what period of time?”
Obviously with any type of revenue recognition standard, “there are judgments made about the performance obligations themselves, if they’re performed at a point, if there’s some period of time, what is that period of time? Those all need to be documented and you need to have a process to monitor the future contracts that are going to be entered into by the company or any modifications to the contract or to the performance obligations.”
These time points are critical as obligations that are performed can be satisfied revenue recognized over time or at a point in time. One commentator has stated, “Performance obligations are satisfied over time if one of the following criteria is met: (1) The customer simultaneously receives and consumes the benefit as the entity performs; (2) The performance creates or enhances an asset that the customer controls; (3) The asset created has no alternative use to the entity and the entity has an enforceable right to payment for performance completed to date.” Somewhat surprisingly and not consistent with prior rev rec rules, the possibility of the contract with the customer being terminated should not be considered relevant.
For a contract that has Foreign Corrupt Practices Act (FCPA) implications and scrutiny, this new element may well cause consternation. Typically when a party performs, payment is due. However under this element there can be partial performance, a rolling performance or something altogether different. Some third party representatives may have contracts that read more like customer agreements contemplated under Topic 606, for example commissioned sales agents and distributors are two which come to mind. If there is now more flexibility on payment, will it allow nefarious actors to manipulate both data and financials to hide the creation of pots of money to pay bribes? Chief Compliance Officers (CCOs) and compliance practitioners need to consider these issues in the context of compliance internal controls going forward.
IV. Determining the Transaction Price
FASB states that Step 3, determine the transaction price, is the amount of consideration to which an entity expects to be entitled in exchange for transferring promised goods or services to a customer, excluding amounts collected on behalf of third parties. To determine the transaction price, an entity should consider the effects of:
1. Variable consideration - If the amount of consideration in a contract is variable, you must determine the amount to include in the transaction price by estimating either the expected value or the most likely amount, depending on which method the entity expects to better predict the amount of consideration to which the entity will be entitled.
2. Constraining estimates of variable consideration - An entity should include in the transaction price some, or all, of an estimate of variable consideration only to the extent it is probable that a significant reversal in the amount of cumulative revenue recognized will not occur when the uncertainty associated is subsequently resolved.
3. The existence of a significant financing component - An entity should adjust the promised amount of consideration for the effects of the time value of money if the timing of the payments agreed upon by the parties to the contract provides the customer or the entity with a significant benefit of financing for the transfer of goods or services to the customer. In assessing whether a financing component exists and is significant to a contract, an entity should consider various factors. However, an entity need not assess whether a contract has a significant financing component if the entity expects at contract inception that the period between payment by the customer and the transfer of the promised goods or services to the customer will be one year or less.
4. Noncash consideration - If a customer promises consideration in a form other than cash, an entity should measure the noncash consideration at fair market value. If an entity cannot reasonably estimate the fair market value of the noncash consideration, it should measure the consideration indirectly by reference to the standalone selling price of the goods or services promised in exchange for the consideration. If the noncash consideration is variable, an entity should consider the guidance on constraining estimates of variable consideration.
5. Consideration payable to the customer - If an entity pays, or expects to pay, consideration to a customer in the form of cash or items, such as a credit, a coupon, or a voucher, that the customer can apply against amounts owed to the entity, the entity should account for the payment as a reduction of the transaction price or as a payment for a distinct good or service, or both. If the consideration payable to a customer is a variable amount and accounted for as a reduction in the transaction price, an entity should consider the guidance on constraining estimates of variable consideration.
Howell said one of the keys is to determine if there is some period “where you create some sort of discount in the future to determine the transaction price?” from there you move to the next question, “Is the transaction price fixed and determinable or is there some variable component?” He went to explain that if there are volume purchase discounts that you will provide in the future “and they’re related to the activity you’re undertaking today, what is the potential impact on the revenue over that period of time?”
For a contract that has Foreign Corrupt Practices Act (FCPA) implications and scrutiny, this new element speaks directly to a wide variety of corruption risk. Typically, only attorneys are concerned with such arcane topics as ‘consideration’. However now a judgment call must be made regarding the consideration that can be expected to be achieved. This would seem to provide a clear area for possible manipulation unless there are sufficient controls in place. While this might not seem like a compliance control, such detect and prevent controls could alert relevant employees, both in finance and compliance, if excessive evaluation or variance was assigned to a large contract with a state-owned enterprise or foreign government.
Finally, this is where the documentation required under a best practices compliance program is so critical. Not only is it evidence to present to a regulator of compliance but it also will form an internal database that a company (or its auditors) can measure against for reasonableness of such variations going forward. Chief Compliance Officers (CCOs) and compliance practitioners need to consider these issues in the context of compliance internal controls going forward.
V. Allocation and Revenue Recognition
FASB states Step 4: Allocate the Transaction Price to the Performance Obligations in the Contract with the following:
If a contract has more than one performance obligation, an entity should allocate the transaction price to each performance obligation in an amount that depicts the amount of consideration to which the entity expects to be entitled in exchange for satisfying each performance obligation.
To allocate an appropriate amount of consideration to each performance obligation, an entity must determine the standalone selling price at contract inception of the distinct goods or services underlying each performance obligation and would typically allocate the transaction price on a relative standalone selling price basis. If a standalone selling price is not observable, an entity must estimate it. Sometimes, the transaction price includes a discount or variable consideration that relates entirely to one of the performance obligations in a contract. The requirements specify when an entity should allocate the discount or variable consideration to one (or some) performance obligation(s) rather than to all performance obligations in the contract.
An entity should allocate to the performance obligations in the contract any subsequent changes in the transaction price on the same basis as at contract inception. Amounts allocated to a satisfied performance obligation should be recognized as revenue, or as a reduction of revenue, in the period in which the transaction price changes.
FASB states Step 5: Recognize Revenue When (or as) the Entity Satisfies a Performance Obligation with the following:
An entity should recognize revenue when (or as) it satisfies a performance obligation by transferring a promised good or service to a customer. A good or service is transferred when (or as) the customer obtains control of that good or service.
For each performance obligation, an entity should determine whether the entity satisfies the performance obligation over time by transferring control of a good or service over time. If an entity does not satisfy a performance obligation over time, the performance obligation is satisfied at a point in time.
Step four requires a company to allocate the transaction price to the performance obligations and five then follows to recognize the revenue after a business has satisfied it the performance obligation. According to Howell, this “means you have to figure out what is the ability to judge if what’s going to be returned. If you’re just starting out and they have a right to return, and then you have no transaction history, then it’s really hard to build the case that it’s not impossible but it’s harder to build a case that you can recognize some part of that revenue.”
As you might guess at this point the key is to document evidence of the performance obligations to support your conclusions. So Document, Document, and Document are still the three most important things. But here Howell noted that this requirement does not fall solely on the shoulders of the accounting function of an organization. He stated that a company must “build processes with their sales organization, their sales op organization, their marketing organization, their legal department to figure out what is the evidence. Now, this requires that the accountants have conversations with your sales team early on to figure this out but also as we talked about the capturing the judgments related to the cost to acquire the contracts, that they work closely with the sales organization on these commissions.” This is another way of saying “operationalize the process.”
These final two elements demonstrate the convergence between the new rev rec standard and overlap of the compliance profession, compliance programs and compliance practitioners going forward. Compliance internal controls are in place to both detect and prevent. Now they can also be used to gather the information which will be presented to auditors under the new rev rec standard. Many professional are focused on the new rev rec from the auditing and implementation perspective.
VI. What Does it All Mean?
A key reason this is important in the compliance area is because the internal controls over financial reporting involved in implementing this new standard are critical to effective implementation. The Securities and Exchange Commission (SEC) has said explicitly in several public statements, and through their early comment letters on disclosures made in advance of implementation, that companies must inform the SEC about the accounting policies that they are changing, and how this new standard will affect a company’s accounting processes, and finally how those effects are going to be managed. Howell believes “The SEC is making it perfectly clear that this is a real compliance issue.”
Moreover, the SEC has indicated that these disclosures are central to the new rev rec standard. Howell said, “typically, if a company has some sort of failure in their disclosures for an accounting standard, they’re treated under section Sarbanes-Oxley (SOX) Section 302 of the SEC rules, and that has a level of significance or liability, which is much lower than the liability that a company might face under SOX Section 404, which has to do with the actual internal controls over financial reporting.” While disclosure of internal controls might not typically bring Section 404 scrutiny, under the new rev rec standard, they may now do so.
Under step 1 above, you must identify the written contract and who your counter-party is. While the answer to the inquiry of Who is the customer? may seem straight-forward in the compliance arena, it may not be so clear. A third-party sales agent contract or even a distributor agreement may have elements which might fall under the new rev rec standard and hence require a different analysis and internal controls standard. Further, as written contracts are specified in the Ten Hallmarks of an Effective Compliance Program as a key internal control, you can easily see how the lack of such a written agreement can fall into the realm of compliance. Even Foreign Corrupt Practices Act (FCPA) enforcement actions are relevant here as one of the well-known bribe-funding tactics is to provide a discount to a customer but not credit the company’s books but instead take the actual discounted amount and give to a corrupt official as a bribe. With this first step of the new rev rec standard apparently recognizing that the lack of a contract is not an impediment to eventually recognizing revenue, compliance practitioners may well need to more thoroughly review contracts with governmental entities or state-owned enterprises.
The 2nd element may well cause the compliance professional consternation. Usually, when a party performs, payment is due. However, under this element there can be partial performance, a rolling performance or something altogether different. Some third-party representatives may have contracts that read more like customer agreements contemplated under Topic 606, for example commissioned sales agents and distributors are two which come to mind. If there is now more flexibility on payment, will it allow nefarious actors to manipulate both data and financials to hide the creation of pots of money to pay bribes? Chief Compliance Officers (CCOs) and compliance practitioners need to consider these issues in the context of compliance internal controls going forward.
Step 3 speaks directly to a wide variety of corruption risk. Typically, only attorneys are concerned with such arcane topics as ‘consideration’. However now a judgment call must be made regarding the consideration that can be expected to be achieved. This would seem to provide a clear area for possible manipulation unless there are sufficient internal controls in place. While this might not seem like a compliance internal control, such detect and prevent controls could alert relevant employees, both in finance and compliance, if excessive evaluation or variance was assigned to a large contract with a state-owned enterprise or foreign government.
This is where the documentation required under a best practices compliance program is so critical. Not only is it evidence to present to a regulator of compliance but it also will form an internal database that a company (or its auditors) can measure against for reasonableness of such variations going forward. CCOs and compliance practitioners need to consider these issues in the context of compliance internal controls going forward.
Step 4 presaged the theme of the Department of Justice’s (DOJ’s) Evaluation of Corporate Compliance Programs (Evaluation) of operationalization I and firmly demonstrates the convergence between the new rev rec standard and compliance overlap going forward. Compliance internal controls are in place to both detect and prevent. Now they can also be used to gather the information which will be presented to auditors under the new rev rec standard. Many professionals are focused on the new rev rec from the auditing and implementation perspective.
Step 5 is to recognize the revenue as appropriate. Yet this seems to me to emphasize the over-arching requirement of this new rev rec standard: Document, Document, and Document. The key is to document evidence of the performance obligations to support your conclusions. Yet, as Joe Howell made clear throughout this series, this requirement does not fall solely on the shoulders of accounting. He stated that a company must “build processes with their sales organization, their sales op organization, their marketing organization, their legal department to figure out what is the evidence. This requires that the accountants have conversations with your sales team early on to figure this out but also as we talked about the capturing the judgments related to the cost to acquire the contracts, that they work closely with the sales organization on these commissions.” This is another way of saying “operationalize the process.”
This new rev rec standards intertwines two concepts which I have been thinking a fair bit about recently. This first is the convergence and overlap between the compliance profession, compliance programs and compliance practitioners and internal controls. While largely seen as financial in nature, compliance internal controls are in place to both detect and prevent. Now compliance internal controls can also be used to gather the information which will be presented to auditors under the new rev rec standard. Many professional are focused on the new rev rec from the auditing and implementation perspective. However, if you are a Chief Compliance Officer (CCO), you might want to go down the hall and have a cup of coffee with your Chief Financial Officer (CFO) and find out what internal controls might be changing or that they might be adding and consider how that will impact compliance in your organization.
The second concept is the continued operationalization of compliance. During my tenure in compliance, you rarely heard a CCO consider revenue recognition as a compliance related issue. By going into detail with each step, I have shown how this new rev rec standard can change the manner in which a company might recognize revenue, leading to a greater risk of the obfuscation of payments for bribery by corrupt employees. This means as a CCO you must not only be aware of the risk to manage it but you also must take active steps to mitigate against it.
