Comments
Internal control means
(1) decision rights: preventing decisions not in the interest of the organization by limiting an employee’s set of decisions.
(2) monitoring: detecting poor decisions once they happen.
As regards (1), organizational participants have limited authority. Participants cannot do anything or spend organization
resources any way they wish. Their set of decision rights is limited to the management’s guess about what is best
compromise between the participant’s superior local knowledge and the participant’s possible misuse of decision authority.
As regards (2), after decisions are made, the organization reviews employee activities to see whether the employee has
misused authority, or stepped beyond their specified authority. Detecting misused authority or stepping outside of
appropriate authority is also an implementation of internal control.
Internal control is not perfect. Whether it is an activity that slips through the cracks or management overrides the system,
errors and irregularities happen.
Problem Statement
Press Release
Mylan to Pay $30 Million for Disclosure and Accounting Failure Relating to EpiPen FOR IMMEDIATE RELEASE 2019-194
Washington D.C., Sept. 27, 2019 —
The Securities and Exchange Commission today announced charges against Pennsylvania-based pharmaceutical company
Mylan N.V. for accounting and disclosure failures relating to a Department of Justice (DOJ) probe into whether Mylan
overcharged Medicaid by hundreds of millions of dollars for EpiPen, its largest revenue and profit generating
product. Mylan agreed to pay $30 million to settle the SEC's charges.
According to the SEC's complaint, Mylan classified EpiPen as a "generic" drug under the Medicaid Drug Rebate Program,
which resulted in Mylan paying much lower rebates to the government than if EpiPen had been classified as a
"branded" drug. The complaint alleges that in October 2014, the Centers for Medicare and Medicaid Services (CMS)
informed Mylan that EpiPen was misclassified as a generic drug. Starting in November 2014, and continuing for nearly two
years, the DOJ conducted a civil investigation into whether Mylan misclassified EpiPen and thereby overcharged the
government for EpiPen sales to Medicaid patients. During the investigation, DOJ issued multiple subpoenas and
investigative demands, rejected Mylan’s arguments to close the investigation, and indicated its intent to sue Mylan if Mylan
failed to make a settlement offer. As alleged in the complaint, Mylan produced documents and other information to DOJ,
including providing potential damages calculations and making offers of settlement.
As alleged in the complaint, public companies facing possible material losses from a lawsuit or government investigation
must (1) disclose the loss contingency if a loss is reasonably possible; and (2) record an accrual for the estimated loss if the
loss is probable and reasonably estimable. Mylan, however, failed to disclose or accrue for the loss relating to the DOJ
investigation before October 2016, when it announced a $465 million settlement with DOJ. As a result, Mylan's public
filings were false and misleading. Further, as alleged in the complaint, Mylan's 2014 and 2015 risk factor disclosures that a
governmental authority may take a contrary position on Mylan's Medicaid submissions, when CMS had already informed
Mylan that EpiPen was misclassified, were misleading.
"As alleged in our complaint, investors were kept in the dark about Mylan's EpiPen misclassification and the potential loss
Mylan faced as a result of the pending investigation into the misclassification," said Antonia Chion, Associate Director in
the SEC's Division of Enforcement. "It is critical that public companies accurately disclose material business risks and
timely disclose and account for loss contingencies that can materially affect their bottom line."
The SEC's complaint, filed in federal court in Washington, D.C., charges Mylan with violating Sections 17(a)(2) and
17(a)(3) of the Securities Act of 1933, Sections 13(a), 13(b)(2)(A) and 13(b)(2)(B) of the Securities Exchange Act of 1934,
and Rules 12b-20, 13a-1, 13a-11 and 13a-13 thereunder. Without admitting or denying the SEC's allegations, Mylan has
agreed to the entry of a final judgment ordering a $30 million penalty and permanently enjoining it from violating those
provisions.
The SEC's investigation was conducted by Ian Dattner and Daniel Maher, under the supervision of Lisa Deitch, Peter
Rosario, and Antonia Chion.
I saw these reports on internal control over financial reporting on the Mylan annual reports.
Management stated DELOITTE & TOUCHE LLP stated
2014 management has concluded that the
Company maintained effective internal
control over financial reporting as
of December 31, 2014
our report dated March 2, 2015 expressed an
unqualified opinion on the Company's internal
control over financial reporting.
2015 management has concluded that the
Company maintained effective internal
control over financial reporting as
of December 31, 2015
our report dated February 15, 2016 expressed
an unqualified opinion on the Company's
internal control over financial reporting
2016 Company maintained effective internal
control over financial reporting as
of December 31, 2016
our report dated March 1, 2017 expressed an
unqualified opinion on the Company's internal
control over financial reporting
Required:
Look at the press release and the reports on internal control over financial reporting. We don’t know anything other than
what is reported in the press release, so let’s take the information as an adequate representation.
1. What would have been the financial affect of accruing the loss?
2. Why might management prefer not to record the loss? Feel free to pick one or more of the following thoughts or
describe your own ideas. Management might not want to record the loss
• because management was concerned with their reputation for competency or honesty, having misclassified
drugs to the CMS,
• because investors might react to the loss by reducing the value of the stock, making it more difficult to raise
capital
• because profits would be lower and the board might reduce or eliminate management bonuses.
3. What processes should be place to review for lawsuits that might need accruing? Whatever processes are in place,
one of the most difficult challenges for any system is when top management overrides the internal control process.
[COSO has this to say about a preferred process: Reviewing* the completed financial reporting checklist (which is
periodically updated for changes in financial reporting rules and standards) to ascertain that material presentations
and disclosures have been prepared in accordance with Generally Accepted Accounting Principles
*Who should do the reviewing? Who has competency to know what should go in the 100 or more pages that
comprise the annual report to the SEC? Who has the authority or status in the organization to challenge the draft of
the annual report before it is filed?]
