Comments

Internal control means

(1) decision rights: preventing decisions not in the interest of the organization by limiting an employee’s set of decisions.

(2) monitoring: detecting poor decisions once they happen.

As regards (1), organizational participants have limited authority. Participants cannot do anything or spend organization

resources any way they wish. Their set of decision rights is limited to the management’s guess about what is best

compromise between the participant’s superior local knowledge and the participant’s possible misuse of decision authority.

As regards (2), after decisions are made, the organization reviews employee activities to see whether the employee has

misused authority, or stepped beyond their specified authority. Detecting misused authority or stepping outside of

appropriate authority is also an implementation of internal control.

Internal control is not perfect. Whether it is an activity that slips through the cracks or management overrides the system,

errors and irregularities happen.

Problem Statement

Press Release

Mylan to Pay $30 Million for Disclosure and Accounting Failure Relating to EpiPen FOR IMMEDIATE RELEASE 2019-194

Washington D.C., Sept. 27, 2019 —

The Securities and Exchange Commission today announced charges against Pennsylvania-based pharmaceutical company

Mylan N.V. for accounting and disclosure failures relating to a Department of Justice (DOJ) probe into whether Mylan

overcharged Medicaid by hundreds of millions of dollars for EpiPen, its largest revenue and profit generating

product. Mylan agreed to pay $30 million to settle the SEC's charges.

According to the SEC's complaint, Mylan classified EpiPen as a "generic" drug under the Medicaid Drug Rebate Program,

which resulted in Mylan paying much lower rebates to the government than if EpiPen had been classified as a

"branded" drug. The complaint alleges that in October 2014, the Centers for Medicare and Medicaid Services (CMS)

informed Mylan that EpiPen was misclassified as a generic drug. Starting in November 2014, and continuing for nearly two

years, the DOJ conducted a civil investigation into whether Mylan misclassified EpiPen and thereby overcharged the

government for EpiPen sales to Medicaid patients. During the investigation, DOJ issued multiple subpoenas and

investigative demands, rejected Mylan’s arguments to close the investigation, and indicated its intent to sue Mylan if Mylan

failed to make a settlement offer. As alleged in the complaint, Mylan produced documents and other information to DOJ,

including providing potential damages calculations and making offers of settlement.

As alleged in the complaint, public companies facing possible material losses from a lawsuit or government investigation

must (1) disclose the loss contingency if a loss is reasonably possible; and (2) record an accrual for the estimated loss if the

loss is probable and reasonably estimable. Mylan, however, failed to disclose or accrue for the loss relating to the DOJ

investigation before October 2016, when it announced a $465 million settlement with DOJ. As a result, Mylan's public

filings were false and misleading. Further, as alleged in the complaint, Mylan's 2014 and 2015 risk factor disclosures that a

governmental authority may take a contrary position on Mylan's Medicaid submissions, when CMS had already informed

Mylan that EpiPen was misclassified, were misleading.

"As alleged in our complaint, investors were kept in the dark about Mylan's EpiPen misclassification and the potential loss

Mylan faced as a result of the pending investigation into the misclassification," said Antonia Chion, Associate Director in

the SEC's Division of Enforcement. "It is critical that public companies accurately disclose material business risks and

timely disclose and account for loss contingencies that can materially affect their bottom line."

The SEC's complaint, filed in federal court in Washington, D.C., charges Mylan with violating Sections 17(a)(2) and

17(a)(3) of the Securities Act of 1933, Sections 13(a), 13(b)(2)(A) and 13(b)(2)(B) of the Securities Exchange Act of 1934,

and Rules 12b-20, 13a-1, 13a-11 and 13a-13 thereunder. Without admitting or denying the SEC's allegations, Mylan has

agreed to the entry of a final judgment ordering a $30 million penalty and permanently enjoining it from violating those

provisions.

The SEC's investigation was conducted by Ian Dattner and Daniel Maher, under the supervision of Lisa Deitch, Peter

Rosario, and Antonia Chion.

I saw these reports on internal control over financial reporting on the Mylan annual reports.

Management stated DELOITTE & TOUCHE LLP stated

2014 management has concluded that the

Company maintained effective internal

control over financial reporting as

of December 31, 2014

our report dated March 2, 2015 expressed an

unqualified opinion on the Company's internal

control over financial reporting.

2015 management has concluded that the

Company maintained effective internal

control over financial reporting as

of December 31, 2015

our report dated February 15, 2016 expressed

an unqualified opinion on the Company's

internal control over financial reporting

2016 Company maintained effective internal

control over financial reporting as

of December 31, 2016

our report dated March 1, 2017 expressed an

unqualified opinion on the Company's internal

control over financial reporting

Required:

Look at the press release and the reports on internal control over financial reporting. We don’t know anything other than

what is reported in the press release, so let’s take the information as an adequate representation.

1. What would have been the financial affect of accruing the loss?

2. Why might management prefer not to record the loss? Feel free to pick one or more of the following thoughts or

describe your own ideas. Management might not want to record the loss

• because management was concerned with their reputation for competency or honesty, having misclassified

drugs to the CMS,

• because investors might react to the loss by reducing the value of the stock, making it more difficult to raise

capital

• because profits would be lower and the board might reduce or eliminate management bonuses.

3. What processes should be place to review for lawsuits that might need accruing? Whatever processes are in place,

one of the most difficult challenges for any system is when top management overrides the internal control process.

[COSO has this to say about a preferred process: Reviewing* the completed financial reporting checklist (which is

periodically updated for changes in financial reporting rules and standards) to ascertain that material presentations

and disclosures have been prepared in accordance with Generally Accepted Accounting Principles

*Who should do the reviewing? Who has competency to know what should go in the 100 or more pages that

comprise the annual report to the SEC? Who has the authority or status in the organization to challenge the draft of

the annual report before it is filed?]