QSGI, Inc., is in the business of purchasing, refurbishing, selling, and servicing used computer equipment, parts, and mainframes. During its 2008 fiscal year (FY) and continuing up to its filing for Chapter 11 bankruptcy on July 2, 2009 (the "relevant period"), Mark Sherman was the CEO and chairman of the board of directors. The SEC alleged that Sherman was aware of deficiencies in and the circumvention of internal controls for inventory and the resulting falsification of the Company's books and records. The SEC alleged that Sherman withheld this information from the Company's external auditors in connection with their audit of the financial statements for the FY 2008 and review of the financial statements for the quarter ended March 31, 2009, and made affirmative material misrepresentations and statements that were materially misleading as a result of his omission of information in management representation letters to the auditors about the design, maintenance, and operation of internal controls. It was further alleged that Sherman signed a Form 10-K and Form 10-K/A for the 2008 fiscal year, each containing a management's report on ICFR as required by Section 404 of SOX and Exchange Act rule 13a-15(c), which falsely represented that he, in his capacity as CEO, had participated in assessing the effectiveness of the ICFR. Sherman also signed certifications required under Section 302 of SOX and Rule 13a-14 of the Exchange Act included in filings with the SEC falsely representing that he had evaluated ICFR and, based on this evaluation, disclosed all significant deficiencies to the auditors. The certifications were attached to the 2008 Forms 10-K and 10-K/A, and to the first quarter 2009 Form 10-Q filed with the Commission, which Sherman also signed.

Facts of the Case

Leading up to its bankruptcy in 2009, QSGI experienced recurring inventory control problems. Throughout the relevant period, Company personnel: (1) shipped certain inventory out to customers without making the appropriate entries and (2) removed items from physical inventory without reducing inventory on the Company's books. Company personnel removed component parts from the physical inventory for such parts without recording the parts removed and occasionally stripped component parts from operating systems without recording the parts removed. As a result, the Company's books and records incorrectly reflected certain components in inventory and operating systems as intact systems. These component parts were then sold by the Company or used for the Company's maintenance services. These internal control problems resulted in the falsification of QSGI's books and records relating to its inventory.

QSGI's efforts to introduce new controls during FY 2008 largely failed. The Company failed to design procedures taking into consideration the control environment, including the qualifications and experience level of persons employed to handle accounting. Controls were mostly ignored during FY 2008 and well into FY 2009. For example, sales and warehouse personnel often failed to document their removal of items from inventory or, to the extent they did prepare paperwork, accounting personnel often failed to process the paperwork and to adjust inventory in the company's financial reporting system. The Company's attempts to monitor compliance on an ongoing basis were also inadequate. Company personnel regularly circumvented controls.

During the relevant period, Sherman knew of ongoing deficiencies in and the circumvention of internal controls relating to inventory. As an example, in the final days of FY 2008, QSGI senior management, including Sherman, openly communicated amongst themselves about the failed implementation, including training in, and circumvention of, controls introduced into operations earlier in the year. Management agreed that corrective action was needed which, given the timing, could not be undertaken until 2009. Based on further communications, management, including Sherman, was aware that the problems continued through the Company filing for bankruptcy in July 2009.

Sherman's False Representations in Management's Report on ICFR and Critical Accounting Policies

At no time during the relevant period did Sherman disclose, or direct anyone to disclose, to QSGI's external auditors the foregoing inventory issues and the resulting falsification of QSGI's books and records. To the contrary, in the management representation letters to the auditors, Sherman made affirmative misrepresentations and made statements that were misleading as a result of his omitting material facts which were necessary in order to make the statements made not misleading. He represented to the auditors that either there were no significant deficiencies or that he had disclosed to the auditors all such deficiencies. At the conclusion of FY 2008, he provided yet another representation letter in connection with the auditor's audit of the FY 2008 financial statements in which he acknowledged his responsibility for establishing and maintaining ICFR. Omitted from the letter was any reference to the existence, or his disclosure to the auditors, of significant deficiencies. In the management representation letter relating to the auditors' review of the first quarter 2009 financial statements, Sherman affirmatively misrepresented that he had disclosed to the auditors all significant deficiencies.

QSGI's Form 10-K for FY 2008 included a Company management's report on ICFR, as required by Section 404 of SOX and Exchange Rule 13a-15(c). A management's report on ICFR was also included in a Form 10-K/A for FY 2008. These management reports falsely represented that QSGI's management, with the participation of CEO Sherman, had evaluated ICFR using the criteria set forth by COSO Internal Control - Integrated Framework (see chapter 3). In fact, Sherman did not participate as CEO, did not participate in the referenced evaluation, and was unfamiliar with the referenced framework.

The discussion on critical accounting policies in QSGI's Form 10-K for FY 2008 falsely stated that "[m]anagement continually monitors its inventory valuation..., closely monitors and analyzes inventory for potential obsolescence and slow-moving items on an item-by-item basis. Sherman knew, or was reckless in not knowing, that these statements were materially false and misleading because he knew that the Company did not closely monitor inventory in the manner described because the Company lacked the necessary resources. Sherman signed the 2008 Form 10-K and 10-K/A. He was the sole signing officer for the 10-K/A.

Sherman's False SOX Certifications

Pursuant to SOX Section 302 and Exchange Act Rule 13a-14, Sherman signed certifications attached to the financial statements that said, based on his and the other certifying officer's (CFO) "most recent evaluation of [ICFR]," they had disclosed to QSGI's external auditors all significant deficiencies, "in the design or operation of [ICFR] which are reasonably likely to adversely affect [QSGI's] ability to record, process, summarize and report financial information." Omitted from the certification attached to the Form 10-K, but included in the certification attached to the Form 10-Q, were Sherman's certifications to the effect that the other certifying officer and he: (1) had been responsible for establishing and maintaining ICFR and designing, or supervising others in the design of, ICFR and (2) had designed, or caused to be designed, such ICFR. These certifications were false because Sherman had not participated in or evaluated ICFR and did not make referenced disclosures to the external auditors.

Findings

The SEC found that Sherman violated various Sections of the Exchange Act dealing with proper financial statements and certifications under SOX. Sherman was ordered to cease and desist from committing or causing any future violations of the Act, prohibited for five years from acting as an officer or director of any issuer of stock, and pay a civil money penalty of $7,500.

1. Assume that a third party(ies) is considering whether to sue the external auditors of QSGI. What could they allege in their lawsuit and why?
2. Assuming a third party(ies) files the lawsuit, what defenses could the external auditors use to rebut the charges?