Keeping Revenue Forecasts From Becoming Legal Liabilities

Fortinet’s stock unexpectedly plunged more than 20% in August. Things looking were looking up for the cybersecurity vendor. In fact, that same month, Gartner named Fortinet an industry leader in its Magic Quadrant for hybrid mesh firewalls. But the thing that sent Fortinet’s stock into a nosedive was a revenue forecast that didn’t pan out.

See Also: Live Webinar | 5 Critical Security and Privacy Lessons From CCPA Litigation

Investors have so far filed two class action lawsuits accusing the company of violating federal securities laws by making misleading statements about a “record” firewall refresh cycle that didn’t manifest in earnings reports.

Double-digit revenue growth is a common expectaton for investors in cybersecurity and other tech sectors. Senior leaders are always willing to tout aggressive go-to-market plans, but how can companies prevent their financial forecasts from becoming legal liabilities?

Experts say many publicly traded companies need to transform the forecasting process from a narrative exercise to an evidence-backed process. Companies must implement a three-tiered validation process in which the finance team builds forecasts, the risk and compliance teams challenge assumptions, and the internal audit team verifies data lineage.

The first step in improving forecasts is ensuring immutable audit trails and automated reconciliation across core systems including customer relationship management, enterprise resource planning and financial planning and analysis systems. This helps eliminate the possibility of plausible deniability in forecast statements and ensures that adjustments are time-stamped and verifiable, said UAE-based Anis Ahmed, an independent consultant focused on anti-fraud investigation and digital identity.

Company executives often see early warning signs of trouble ahead but fail to act, said G.D. Balasubramaniam, director of credit fraud management at leading bank in the Asia-Pacific region.

For example, a persistent variance between internal dashboards and investor guidance – when real-time operational or sales data consistently falls short of publicly announced forecasts – is a clear red flag. “Executives usually have access to these internal metrics well before investors do. Another indicator is a mismatch between the mix of units sold and the total projected value, which can reveal underlying issues in demand or pricing strategy,” Ahmed said.

Overstating pipeline conversion ratios amid declining win rates signals deliberate optimism. When CRM data shows a shrinking late-stage pipeline but finance still maintains bullish forecasts, projections may have no operational backing.

Other indicators include data spikes that give a last-minute bump to high-value deals. “It can signal someone’s trying to tamper with the model before results go public,” Balasubramaniam said.

Compliance controls and quantitative reconciliation are separate but equally important aspects of internal controls. And while most senior leaders keep some distance from the audit team, the audit process “needs to be part of everything,” he said.

“Most financial investigators are not necessarily technologists, and if you are approaching this as a technology problem, you won’t necessarily have the background,” said Steve Hindle, founder of consultancy Achilles Shield in an earlier interview with Information Security Media Group. “If you approach it as a financial problem and bring technology to automate that, then things will be better.”

The Legal Liabilities

Jay A. Dubow, partner with Troutman Pepper Locke, said executives should understand the legal liabilities before making forward-looking statements. “When you make a forward-looking statement, for a private plaintiff to bring a fraud case and say that the statement was materially untrue, they would have to show either that the speaker did not believe what they said, or that the statement was not accompanied by risk factors,” Dubow said.

Under the U.S. Private Securities Litigation Reform Act, which was enacted to help prevent frivolous lawsuits based on fraud claims, forward-looking statements receive Safe Harbor protection if they are accompanied by meaningful cautionary statements.

But Safe Harbor has its limits. “If you say we are going to sell 1 million widgets next year, that’s a fact. If you say, I believe that we are going to sell a million widgets next year, that now becomes an opinion,” Dubow said.

But an opinion can still be misleading if the facts on which it was based indicate the person didn’t have a reasonable belief in the opinion, he added.

In securities litigation, regulators often rely on key types of evidence to establish knowing misconduct. Critical sources include former employees who can testify about internal discussions in which executives knowingly made false public statements, Dubow said. Insider trading patterns such as stock sales preceding negative announcements may indicate fraud but intent can be tough to prove. Internal documents, reports and emails often reveal discrepancies between what executives knew and what they publicly disclosed, he said.

On the other hand, access to real-time data can help avoid misleading forecasts and the inevitable litigation that follows. Ahmed recalled one incident in which “an automated CRM-to-ERP reconciliation” report flagged inflated pipeline entries and prevented a company from disclosing misleading guidance to the investment community. “Similar controls could have prevented the WorldCom, Lucent Technologies and SolarWinds incidents, where weak segregation of duties allowed optimism to override operational reality,” Ahmed said.

“Most public companies, most of the time, management is not trying to make false statements,” Dubow said. “But things happen. Sometimes they don’t get the right information, or they’re trying to push the envelope to the line. Some executives will try to push the envelope to the edge, and some unfortunately, go over the edge because they might either say too much or say not enough to make the statements completely true.”