How the Ctrl Worx Watch List™ works

The Five-Year List shows public companies that reported a material weakness in internal control over financial reporting, or concluded that it wasn’t effective, in five or more annual reports in a row. Every fact comes from the company’s own filings with the SEC, and every row links to the filing.

What puts a company on the list

• In its annual report (Form 10-K), the company states one or more material weaknesses in internal control over financial reporting, or concludes that internal control isn’t effective.
• That happened in five or more fiscal years in a row.
• The latest of those years is fiscal 2024 or later.
• Each year is confirmed by reading the filing, not by keyword alone.

What the status means

• Still reporting means the weakness was in the company’s latest annual report.
• Last reported means the weakness was last reported in the fiscal year shown. Where a later annual report no longer reports it, we name that report.
• Only annual reports count. Management assesses internal control once a year, in the 10-K. A quarterly report that does not repeat a weakness does not clear it.
• A company that fixes its weakness keeps its row, marked Last reported, so the record stays complete.

The Watch List

The Clock covers every company whose latest 10-K or 10-Q reports a material weakness, or concludes that internal control over financial reporting isn’t effective, and no later annual report of its own has cleared it. A filing that concludes internal control isn’t effective counts even when it doesn’t name the weakness: under SEC rules, management can’t conclude internal control is effective if one or more material weaknesses exist (17 CFR 229.308). The Clock counts from the earliest period the company itself reported the weakness for, shown in years. If a company’s later filing states that its controls were not effective as of an earlier period end, the Clock starts at that earlier date, and the page quotes that later filing. If a later filing says a material weakness already existed at an earlier period end, the Clock starts at that period end (rule added Nov 10, 2026). If it says the weakness was found later, without placing it at that earlier date, the start date doesn’t move back. If an annual report inside that run concluded internal control effective, the Clock restarts at the first later report of the weakness, 10-Qs included. A clean annual report that a later report contradicts for the same year-end does not restart the Clock. After an annual report concludes internal control is effective, a later 10-Q restarts the Clock only if it says a material weakness exists at its own quarter end, or that its controls aren’t effective for a reason other than weaknesses disclosed before that annual report. An “effective” conclusion that leaves out the business unit where the weakness sits, such as a recent acquisition excluded from management’s assessment, doesn’t stop or restart the Clock. The Clock runs from the period for which the company’s filing states the weakness. Before a company goes on the Clock, the text of its latest filing is checked. If that filing says the weakness was fixed, or the text cannot confirm a current weakness, the company stays off.

A company stays on record until its own annual report says the weakness is fixed. The headline count, On the Clock, is companies still filing. Three other statuses are shown with their time but left out of every median: Stale filing (no 10-K or 10-Q has reported the weakness in the last 18 months; the company may still be filing; the Clock keeps running), Stopped filing (the company stopped reporting through a Form 15, a bankruptcy or delisting with no Form 15, or a registration revoked under Section 12(j); the Clock is frozen at the last report, and the company’s page gives the reason), and Now files as a foreign issuer (the company moved to Forms 20-F, 40-F or 6-K; the Clock is frozen at the last domestic report). Where one business appears under more than one registrant, the predecessor is marked Stopped filing with a pointer to the successor. SPACs that merged into another company and stopped filing as their own registrant aren’t kept on the Clock. When a company goes public through a reverse merger, a recapitalization or a deal with a shell company or SPAC, the Clock follows the operating business. It starts at the operating business’s own earliest report of the weakness, never at a weakness the shell or SPAC reported before the deal closed.

A company comes off the Watch List when its own annual report says the weakness is fixed. If an annual report concludes internal control is effective but says a material weakness still existed at its year-end, the stated weakness wins and the run goes on. We list it on the Cleared list with a quote from that filing and how long it took.

Until Oct 18, 2026 the count included companies that had stopped filing or had not filed for up to 18 months, and then dropped them silently after 548 days. Those companies now carry their own status and the headline counts only companies still filing, which moved the homepage figure from 1,331 to 1,231.

On Oct 18, 2026 we read the 513 companies whose later annual report our search had never caught (the search finds only reports that use the words “material weakness” and “not effective”). 500 of those reports are clean: they conclude internal control effective or state no weakness. 13 still state a weakness and were added to the record. One of them, HST Global, filed its annual report as page images only; we read the pages by hand, and it is on record as Stopped filing because it filed a Form 15 the same day.

No company is kept off the Watch List by hand. Of the 19 that were held off by hand until Oct 18, 2026, a full read of their own filings put 10 back on record (8 on the Clock, 2 stopped filing). The other 9 are off because their own latest annual report concludes internal control effective.

The Watch List covers companies that report to the SEC on Forms 10-K and 10-Q. Companies that only ever filed on other forms, such as Forms 20-F and 40-F, are not covered.

Where the data comes from

What the Watch List covers

• Public companies that file Forms 10-K and 10-Q with the SEC, of any size, from micro-caps to the largest companies.
• 10-K and 10-Q filings since January 1, 2021, found by EDGAR full-text search, amendments included.
• We search SEC EDGAR every 15 minutes and usually check new entries within one business day.
• Each company page shows management’s conclusion, the weakness in the company’s own words, the auditor and every filing behind it, linked to SEC EDGAR.
• Free to read. No sign-up.

Filings on SEC EDGAR, found through EDGAR full-text search and read in full. Filer status comes from the cover page of the annual report. The auditor column shows whether the latest annual report includes the auditor’s opinion on internal control. Our records start with filings made in 2021, so for some companies the true run is longer than the table shows.

Corrections

If a row is wrong, email russell@ctrlworx.com with the filing that shows it. We review every report within two business days and record every change here. We change a row because a filing shows it is wrong, never because a company asks.

How often we’re wrong. Every company on the Watch List rests on a sentence from its own SEC filing, read by machine and checked by hand. Random hand checks against the filings: the November 4, 2026 check of 50 rows found 5 start dates wrong, all from SPAC filings before a merger; each was fixed and logged in the corrections log on November 4 and 5. The November 7, 2026 check of 50 rows tested each row’s status, and its start date against its start filing, and found no errors; it flagged one source link. A rebuild of every start date from the filings is under way. On October 18, 2026 we read every company On the Clock a second time (14 of 1,245 (1.1%) came off: 13 because an annual report said the weakness was fixed, and one that should never have been listed), and every annual report behind the 100 longest clocks, 658 in all. No company among those 100 was listed wrongly, and five of their start dates have since been corrected, each logged in the corrections log. We also read the 513 companies we had presumed clean: 13 (2.5%) still reported a weakness, and went on record. Each change is in the corrections log, quoted from the filing.

Right of reply

A company on the list can send a statement or a link to its remediation update to russell@ctrlworx.com. Once we confirm it came from the company’s own email domain, we post it on its page, unedited and dated.

Why you can rely on the Watch List →

See also our independence policy, the guide to the Watch List and Watch List data for researchers.