Re:Balance -- Jim Peterson

The PCAOB Wants to Name Audit Engagement Partners: Would Its "Red A" Really Matter?

As if it didn’t have real work to do, the Public Company Accounting Oversight Board in its October 11 release has revived its 2009 project, looking to require audit firms to disclose the names of their responsible engagement partners.

 With its persistent instinct for the capillary, the PCAOB presses for information that is:

•  Of no consequence to financial statement users sophisticated and informed enough to appreciate the complexity of a large audit.

• Of indifference to the bulk of the investor population already hard pressed to identify the firm auditing their portfolio companies.

•  Of interest mainly to the unremitting critics of the profession, for whom access to individual names would only fuel their continued antagonistic and unproductive axe-grinding.

Here’s a message for both sides: It’s a bogus issue, and not worth the distraction from serious matters.

Such as, first, the PCAOB’s own release of June 21, re-visiting the scope and content of the recognizably obsolete standard auditor’s report. A substantial discussion is now ready to start, that should include the responsibilities of issuers’ management and audit committees (some 150 comment letters are accumulating here). If only the PCAOB could align with the parallel undertaking of the IAASB, a truly coherent and comprehensive international dialog might constructively emerge (see here).

Second, it may be that the division in views of the PCAOB members on mandatory auditor rotation means that this time-worn subject was served up yet again, on August 16 (here), only to be killed off once for all. Here the problem is that, as selectively leaked, EU markets commissioner Michel Barnier has not only tabled mandatory rotation himself; in his enthusiasm, he threatens also to require joint audits with responsibility shared among multiple firms, and would also strip all non-audit services from the firms’ business models (here).

Time enough, when the details of Barnier’s proposals emerge for public scrutiny next month, to probe the fanciful and unrealistic nature of his expectations. That will also be the time for more vigorous and effective responses than are usual by all those concerned – large and small audit firms alike, along with their clients with whom in this area they have common cause -- to the destabilizing and dangerous effects of Barnier’s combined naïveté, ignorance and political zealotry.

Meanwhile, back to the naming of names:

Those charged with auditor selection already have access, on request, to the details of personnel identity and qualifications.

While over on the side of public “transparency,” branding individual auditors with the scarlet letter “A” might give satisfaction akin to that of the censorious townsfolk around Nathaniel Hawthorne’s Hester Prynne.

But to what end? As recognized at least by PCAOB member Lewis Ferguson (here), any engagement partner whose work is caught up in multi-year civil litigation and regulatory enforcement effectively suffers the end of his productive career – even if judgment-proof and indemnified – not only because of the overwhelmingly distracting time demands but because the emotional toll of defending even high-quality performance is ruinous to the capacity to exercise complex professional judgment.   

Which does not, on the other hand, mean that the US profession’s resistance to partner identification is a “hill worth dying on.” Partner signature is the practice around Europe, and some European filers so disclose in their NYSE filings, as chairman Doty has noted (here). As the world is not coming to an end thereby, a proof-seeking skeptic might well ask this: Are European shareholders really so “favored” over their American counterparts, as Doty suggests, or is it rather that the markets have compared the availability of partner names, and yawned with boredom?

Beyond partner names, the PCAOB goes off into another disclosure area, although reflection may suggest it has left a major hostage to fortune – namely, the proposed requirement that auditors disclose the names and work efforts of other firms, in their networks or otherwise, participating in their engagements.

Again, this is a matter on which investors have shown indifference – it being impossible to imagine that they are really engrossed on the subject, when they must suppose that local country rules on professional qualifications and rights to practice would be no less applicable for auditors than, e.g., for lawyers or doctors.

But given the back-footed positions of the SEC and the PCAOB on such matters as the recent scandals among the Chinese reverse-merger companies coming to the US capital markets, and the still-lengthy roster of ex-US firms and issuers not subject to the PCAOB’s halting efforts beyond its native soil (re-capped by Francine McKenna here), it might seem a dubious judgment for the PCAOB to encourage public airing of the gaping holes in its inspection and enforcement regime.

In other words, “be careful what you ask for” – advice perhaps not high on the list of commentary welcome in the halls of the PCAOB. But then, an agency capable of addressing mandatory auditor rotation with a straight face is equally liable elsewhere to trip onto its chin and mistake the pratfall for forward progress.

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are welcome, and subscription is easy and free, both at the Main page.

 

 

Can Value Be Brought Back to the Auditor's Report? A Tale of Two Systems

 Is it the best of times, in the struggle to re-introduce value into the traditional auditor’s report – or the worst of times? The age of wisdom or the age of foolishness?

Latest to join the Dickensian-length of characters is the International Auditing and Assurance Standards Board, which on May 16 released its consultation paper, “Enhancing the Value of Auditor Reporting: Exploring Options for Change” (here).

Compared to the others, whom to list takes up three full pages of its appendix, the IAASB brings the essential combination of intelligence and technical skills. Well it should, charged with the promulgation of international standards on auditing (ISA’s), thus conversant with such abstruse but centrally relevant topics as the auditor’s responsibility for published information other than financial statements (ISA 720), and use of “emphasis of matter” and other paragraphs in an auditor’s report (ISA 706). 

Among the most prominent of those heard from, and least likely to offer substantive contributions, is the United Kingdom’s upper legislative chamber, whose Economic Affairs Committee has this spring gotten its lordly knickers in a twist over the bogus suggestion of a malign influence of international accounting standards on the crisis-era reporting of the British banks (here), and also prodded the UK’s Office of Fair Trading into an inquiry as to the market dominance of the Big Four (here) – yet another tedious exercise destined to yield neither surprises nor constructive suggestions. 

Joining the Lords in fullness of volume and emptiness of ideas has been EU markets commissioner Michel Barnier, whose “green paper” consultation served mainly to remind anyone interested of the capacity of European bureaucrats to sacrifice forests of trees to document the lowest-hanging fruit on a fragile bush (here). 

The Americans arrived on May 5, when the chairman of the Public Company Accounting Oversight Board, James Doty, promised a “concept release” this summer “to consider how the auditor’s report can be changed to provide more useful, relevant and timely information” (here).

Where the IAASB suffers a gap between competence and authority, of course, is in its lack of muscle to carry out its aspirations. Sponsorship and support of senior regulators are required, led by the Americans, for a legislative re-engineering of the liability landscape, because assurance in any innovative area can only be designed and delivered if relieved from the devastating exposure to hindsight second-guessing that today shackles the auditors to their obsolete model.

Fantasize, for a moment, an “age of wisdom” in which the IAASB and the PCAOB actually made common cause. What might be accomplished?

The IAASB release makes the obligatory musings on possible adjustments to the current report itself – whether to move the opinion paragraph to the top, or to push the explanatory language to a footnote. But cosmetic niceties are inconsequential, as the grown-up technicians surely realize; knowledgeable readers would be neither confused nor influenced by this syntactical re-arrangement of the deckchairs, and others simply would not care.     

Once past political correctness, however, the IAASB does press into important new territory, recognizing “the demand for additional, and more pertinent, information about entities and the processes that support the quality of their financial information.”

Its delicate suggestion of “perceptions that auditor reporting is not meeting the needs of financial statement users” is a rhetorical bow to the tensions among competing constituencies and the understandable retreat into euphemism – where what is called for is removal of this barrier to clear thinking and precise articulation.

Teasing the blunt inference out of the IAASB’s sensitivity, today’s audit report is obsolete and, beyond compliance for which Doty and the other regulators are acutely self-interested, delivers no real user value.

If it were an old horse, it would be given due respect for its decades of good service -- then the worn-out old nag would be led off to the knacker’s yard and given the humane dispatch its dumb loyalty deserves.  

Within the scope of the IAASB’s standard-setting, it lists readily identifiable subjects for auditor contribution:

• “Corporate governance arrangements.
• “Business model, including the sustainability thereof.
• “Enterprise-wide risk management.
• “Internal controls and financial reporting processes.
• “Key performance indicators.”     

The release further tables the desirability and value of auditor insights in such financial reporting issues as:

• “The quality of the entity’s internal controls and financial reporting processes.
• “Qualitative aspects of the entity’s accounting policies, including the relative conservatism or aggressiveness reflected in management’s selected policies.
• “The auditor’s assessment of management’s critical accounting judgments and estimates, including where each critical judgment or estimate falls within a range of possible results.
• “The quality and effectiveness of the entity’s governance structure and risk management, and the quality and effectiveness of its management.”

 Here lies real opportunity. The IAASB solicits comments until September 16. Disinterest, silence and the retention of the status quo should not be tolerable options.

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments and suggestions are invited and welcome, and subscription sign-up is easy and free – both at the Main page.

 

 

The PCAOB Settlement in Satyam: PwC Agrees to Fall on its Pen-Knife

“Two aristocrats challenge each other to see which can come up with the larger number. The second agrees to the contest, concentrates for a few minutes, and proudly announces, “Three.” The proposer of the game is quiet for half an hour, then finally shrugs and concedes defeat.”

-- John Allen Paulos, “Innumeracy,” 1988

 

 The PCAOB’s April 5 settlement with the Indian firms of the PwC network, over the billion-dollar fraud at Satyam Computer Services Limited, adds a $1.5 million fine to the six million dollars the auditors also agreed to cough up to the SEC.

(Statements from the agencies are here and here; see Going Concern for the orders; and the NYT for statements from PwC.)

The amount compares to the aggregate salary of the five PCAOB members of $2,366,000. It would be a small fraction of either the annual compensation of PwC’s global chief Dennis Nally, or the firm’s legal fees on Satyam to date. And even measured by the $ 550 million ponied up by Goldman Sachs under its August 2010 SEC settlement of its one-issue dispute over the “Abacus” derivative peddled by its fabulous Fabrice Tourre (here), the amount is derisory. 

The Big Four giant is still facing on-going investor claims, to be sure. But the exposure is well-fenced; the Supreme Court’s June 2010 decision in Morrison closed the doors of the American courts to foreign securities claimants who bought their shares abroad, and the inexperienced Indian judicial system lacks the competence to be an attractive plaintiffs’ venue.

Consider the motives from the regulatory perspective. The settlement timing ahead of the April 6 hearing of the Senate Finance Committee on the role of the accounting profession in the financial crisis (here) gave senior officials a public forum. And the media coverage allowed the SEC’s enforcement head Bob Khuzami and FCPA unit chief Cheryl Scarboro, and the PCAOB’s chairman Jim Doty and his enforcement head Claudius Modesti, all to strut their achievement against foreign auditors – even while avoiding the obligation actually to try their case across international borders.

From the PwC perspective, meanwhile, the chance for a cheap exit from a major problem would have been a no-brainer. Consider:

First, an enforcement ding on the Satyam engagements had to be coming, sooner or later. From the PCAOB’s order – which PwC agreed not to contest – the Indian engagement teams on the audits from 2005 through 2008 basically did not:

• Adequately audit the company’s cash positions
• Control the confirmation process on bank balances or accounts receivable
• Pursue indications of inconsistent information or control weaknesses
• Follow PwC global directives on audit execution
• Inform or advise higher-level quality oversight personnel
• Document the work actually done (or not) in the work-papers, until subsequent back-dating while already under regulatory scrutiny

So a strategic decision not to defend the indefensible indicates early recognition of a step toward sustainable credibility. 

As for the sanctions – PwC’s undertakings on future practice quality, staffing, training and internal oversight are no more than necessary for an enterprise with aspirations to professionalism; the two-year presence of an outside monitor only adds one more stranger to the list of foreign intruders imposed on its Indian practice; and the six-month restraint on new SEC clients runs only to the settling Indian firms, so does not inhibit either the global network or its other Indian affiliates.

And, lastly, the financial impact of the fines on the massive PwC network is no more than a dime added to a roll of nickels.

For good measure, with the week’s news cycle dominated by military activities in Libya and a threatened government shut-down in Washington, and subsidiary attention to post-earthquake Japan’s nuclear hazards and Silvio Berlusconi’s “bunga bunga” trial, the entire story will drop off the media screen in less than no time.

Predictably, critics of the accounting profession who are unwilling to settle for less than the scalps of the Big Four leaders nailed to an enforcer’s door will make their outrage known.

But they will fail to acknowledge that both the regulators and PwC itself are only acting in full accordance with their respective DNA.

So once again, this settlement points up the challenge to the long-term achievability of a valuable, sustainable assurance function, to serve the issuers and users of the financial information of global-scale companies: the terms of the discourse are revealed as hopelessly inadequate.

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are welcome, and subscription is easy and free, both at the Main page.

 

Will the Auditors' Real Clients Please Stand Up? You're Lost Among the Mixed Messages

I try to raise the sense of my students in Risk Management for trends, patterns and common themes – early awareness being an opportunity for effective strategy.

So when the muddied state of auditor-clients relations was twice and separately further obscured in recent days, attention should be paid.

First, a reader sent me a lament overheard at a Thanksgiving table -- a second-year audit staffer at a Big Four firm, who had been trying without success to persuade his 38-year-old supervisor that there was a defect in the results of their engagement performance. The futility of his efforts was leaving him with the dispirited feeling, as he put it, that he had become in effect an employee of the client.

The second, at the AICPA’s Washington conference on SEC and PCAOB developments, was SEC Chief Accountant James Kroeker (here) – advocating “a change to our collective vocabulary…. (D)on’t use the word ‘client’ to refer to the management of companies under audit…. (I)t is time to give serious consideration to changing the perceived ‘client’ in audit relationships.” 

The uneasy dilemma of the beleaguered young staffer is no surprise, because among the many pernicious effects of Sarbanes-Oxley has been a three-fold degrading of the auditor/client relationship. From an advisory role to one of adversity and compliance – and so forms-and-process based that young professionals lack the environment in which to learn and absorb actual client business -- under on-going stress on revenues and profitability, the firms’ clear imperative to their staff is to complete the work needed to issue another commodity report, “on time, within budget, and without making waves.”

The dynamic for an eager but career-sensitive young professional is no better put than by my senior-level friend: “When you raise a problem, then by definition you become the problem.” No wonder, then, when “client satisfaction” – the long-popular mantra across the spectrum of commercial activity – readily elides to “client capture.”

While back in Washington, the vagueness of Kroeker’s musings became truly misleading as picked up and re-broadcast under the 140-bit limits of the profession’s twittering critics – mutated to the direct question “who is the client?” as if the auditor’s “primary responsibility was to investors, not the companies they audit.” 

Kroeker and his agency are of course entitled to advocate for a nationalized audit function carried out by civil servants. If so, let them say so with candor, and let the debate be engaged – it will be revealed quickly enough how the community of financial information users would compare the value of today’s archaic and obsolete report with an equivalent document delivered by federal agencies distinguished by their inaction during the tumultuous events of the last three years.

Until then, it requires recalling that it has been a basic premise since the 1930’s passage of the American securities laws, when the profession lobbied successfully for private control of the assurance franchise, that the company under audit does the hiring and pays the bills.

Indeed, the disregarded consequences of that plain election in favor of an unambiguous definition of “client” are amply shown in the vast amount of time and energy wasted in the intellectually ineffective attempt to define with precision what constitutes an “appearance of independence,” in light of the contractual and economic linkage of direct auditor engagement.   

It is also readily recognized that important rights and obligations arise outside the strict confines of a provider-client relationship. Concepts based in agency, trust and fiduciary duty are familiar – as is legislative authority to create duties based on extra-contractual reliance and expectations, whether for investors, consumers or even innocent by-standers.

But it does no favors to the complex challenges to evolve a valuable and sustainable audit function, to blur the lines of accountability with careless invocation of an ill-defined shift in client identity.

Or as I also try to instill in my MBA students, the guidance is still relevant as laid down by 18^th century lexicographer Samuel Johnson, that “sloppy language is a mark of sloppy thinking.”

As the poor staff auditor is learning under career-threatening pressure, the issues facing the role of auditors are already sufficiently profound. From the senior regulators in Washington, they deserve clearer articulation than they now receive.

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are welcome, and subscription is free and easy – both at the Main page.

A PCAOB "Reminder" on Significant Unusual Transactions: Is the World of Audit Guidance Now a Better Place?

Rumack: “Can you fly this plane and land it?”

Striker: “Surely you can’t be serious.”

Rumack: “I am serious … and don’t call me Shirley.”

-       “Airplane” (1980)

 There was at least one bit of good news implicit in the otherwise-dispiriting April 7 alert from the Public Company Accounting Oversight Board, “Auditor Considerations of Significant Unusual Transactions” (here). 

Which is that, although the large accounting firms may well not survive the wounds of their own exposures (see Francine McKenna’s March 23 compilation), they are in no present danger from their American regulator.

It is not clear, because neither auditors nor their overseers are recognized for their humor or their irony, whether it is cause for laughter, or perhaps tears, that the functionaries in Washington have so little respect for the profession, as to believe it useful to “remind auditors of public companies about …the risk …posed by significant unusual transactions.” 

Behind the text of the alert – which offers not a single example or illustration to suggest that the PCAOB itself has a clue – is another “reminder,” for anyone still thinking that government-provided audit guidance might supplant private assurance, in the event of Big Four disintegration and collapse: The PCAOB shows itself ill equipped to lead from Point A to Point B. 

It was never credible, that the very government that imposes on its citizens the Postal Service, Fannie Mae and the IRS should be capable of delivering assurance of any value on the complexity of global-scale corporate financial statements.

The PCAOB’s insult to intelligence now makes that crystal clear. The best advice on offer – eight years after the Sarbanes/Oxley law begat the PCAOB and a regulatory regime for which the world was not holding its breath – is the stunningly obvious proclamation (page 2) that “although the economic conditions have changed since December 2008, the risk factors, including the risks of unusual transactions, that existed in December 2008 continue to exist today….”

Whew – thanks for that insight, for sure.

Justification for an alert is said to be the highlighting of “new, emerging, or otherwise noteworthy circumstances.” By its own terms the alert fails on the first two, so the question is what might be “noteworthy” (page 2) about “compiling selected, relevant requirements from existing PCAOB standards … into one document.”

Does the PCAOB believe that audit professionals cannot read their basic literature, without their attention failing or their lips getting tired? 

With expectations that low, where do they expect the professional wisdom and judgment be found, in an audit engagement team out on the job, to comprehend the subtleties of whether “the form of transactions is overly complex” (page 5) or if “management is placing more emphasis on the need for a particular accounting treatment than on the underlying economics of the transaction”? (page 6, emphasis added) 

If so, the next expected step in the dumbing-down of regulation will be “GAAS for Twitter” – auditing such tough subjects as related parties and special-purpose-entities and complex derivatives, 140 characters at a time. Not, we should fear, a recipe for enhancing the value of the audit process.

Further, one seriously nasty hostage to politics in the PCAOB release is the admonition to engagement teams to “consult with individuals having appropriate levels of knowledge, competence, and judgment regarding significant unusual transactions.”

Not only does that finger-waving come with the warning that “the engagement quality reviewer cannot provide concurring approval of issuance if he or she is aware of a significant engagement deficiency, including those regarding significant unusual transactions.”

More importantly, as noted here, the PCAOB’s minders at the SEC in December besmirched an entire senior consultation hierarchy at Ernst & Young, announcing enforcement sanctions against the firm and six of its partners over the quality and risk review process followed for Bally Total Fitness – a shot across the bow of professional quality consultation that cannot be encouraging to the kind of consultative practices now urged by the PCAOB.

Regulatory “reminders” at the PCAOB’s elementary level may be an inevitable nuisance in a nanny-state environment of excessive bureaucratic intrusion, but their real impact will be a further degrading of the agency’s own stature and credibility. 

At this rate, the PCAOB’s next release will be a “reminder” that debits must still equal credits.      

 

Thanks for joining this dialog. Please share with friends and colleagues. And if not a subscriber, you are invited to sign on at the Home page.

 

Medical Check-Ups and Annual Audits: What if Your Doctor Reported Like Your Accountant?

Now being the winter of our discontent, the political scene in American is dominated by the rancorous wrangling over health care and insurance reform legislation.

In that context, I was exchanging notes with my friend the insurance industry risk-manager, over our recent annual physicals, and fell to musing about the comparability of a financial statement audit and a personal physician’s examination.  

Raise the question of personal health around a table of the reasonably responsible. The “organ recitals” of those surveyed will include familiarity with their own particular concerns – whether blood pressure, good and bad cholesterol levels, resting pulse, bone density, or hormone levels.

To achieve that awareness, on a periodic and routine basis, patients are poked and prodded and invaded in various intrusive and unpleasant ways – they give up samples of fluids and tissue for laboratory scrutiny, and they are screened and hitched and wired to exotic and expensive diagnostic machinery

The population of the diligent will also be subjected to inquiry by their doctors about their major behavioral risks – does their personal “control structure” include taking their medications, watching their cocktail intake, wearing their seatbelts, and avoiding handguns.

And then they receive several pages of detailed results, calibrated to standard norms of tolerance, and a briefing on what their trends are and what they might need in aide of maintaining or improving their well being.

Suppose instead, along with a bill whose magnitude is itself a threat to good health, the physician delivers this report:

“We’ve done a number of tests, the scope and results of which you don’t have, and we chose not to do a number of other, unspecified procedures.

“We’re not sure, but we think you’re unlikely to die of natural causes any time soon.

“Thanks -- we’ll see you next year. Be sure to pay on the way out. And have a nice day.”

Unacceptable – even with the multiple dysfunctionalities that render American health care an embarrassment among the world’s developed countries.

Does an audit report convey anything more about the health of a corporate body?

A company’s management may be well informed or sclerotic. Its products and strategies may be world-class, or senescent. It may be the equivalent of a gold-medal athlete, but with a malign and life-threatening growth lurking or metastasized. 

But the only available opinion is that, within the tolerance of undisclosed measures of materiality, its financial health is generally fair.

Does the company need the corporate equivalent of a slimming regime of diet and exercise? Are prescriptions indicated to bring the basic operational chemistry within tolerable limits? Something surgically targeted like joint replacement or a major arterial by-pass? Radical intervention or experimental drugs?

At the cost of millions of dollars, no such diagnosis is on offer – but only a single anodyne page, in the same language handed out once a year to every other patient who passes through the annual audit clinic.

An auditor’s report tells less about a public company’s health than a doctor’s report tells about an individual – in scope, detail and precision. And if investors and other financial information users are not happy, they are doing nothing to make their dissatisfactions effectively known.

It may be, as Mary Poppins puts it, that “a spoonful of sugar makes the medicine go down.” But in the audit environment, patients are getting only sweets and placebos – and still paying for the dubious privilege.

Thanks for joining this dialog. Please share with your friends and colleagues. And if not a subscriber, you are invited to sign on at the Home page.

 

The SEC Whacks Ernst & Young Over Bally Total Fitness -- Now for the Spoils of Victory

The SEC’s proceedings last month against Ernst & Young and six of its partners, relating to the financial statements of Bally Total Fitness, for the long-ago years 2001 – 2003 (here), threaten a double hazard under the axiom attributed to Winston Churchill, that “history is written by the victors.”

It’s not just tough enough for the accounting profession’s risk and quality managers, seeking to understand what really happened in Bally -- not only because the entire narrative is drafted by the enforcers, but also because without recourse to a public forum, the “consent decree” process acts as a muzzle on the targets. 

Worse – conceding that the only script available is written by the SEC itself – the array of sanctions and undertakings inflicted on E&Y signals that the environment for application of quality-oriented judgments has just become a lot more volatile, unpredictable and challenging.

This cannot be the place to debate either the facts or the justice of Bally; offered an exit from the SEC’s eternal grip, a target’s only strategy is to grit the teeth and roll over in silence.

Questions for the profession worth attention post-Bally, rather, are what to expect in the future, and how will behaviors be changed.

To start, with all other government agencies coming off the back foot in the financial crisis aftermath, the SEC carries three extra pieces of baggage: defensive reaction to its blinkered short-comings in failing to unmask Bernie Madoff, the passage of a half-decade in bringing the ancient Bally proceedings, and the lurking reality that pursuing a death-threat outcome against a Big Four firm itself would risk disintegration of the entire large-company assurance franchise.  

From these, it can be predicted – and the accounting profession should expect – that going forward, the SEC will aggressively aim its macho enforcement testosterone at the big firms’ individual personnel. Nuances and subtleties of professional judgment be damned, the agency will seek to show that its gun-slingers clank when they walk.

Which means, as Bally itself shows, that professional decisions will be second-guessed to the last degree. Where credit might be earned for careful risk considerations, E&Y had identified Bally as one of its highest risk clients – a sorting-out effort reflective of a profession-wide aspiration to differentiate levels of client complexity and reduce the commodity nature of the audit itself.

And E&Y also brought into consultations an entire circle of senior help, beyond the engagement and review partners – the geographic area manager, national practice quality assistance and even the firmwide head of practice and risk.

These actions should be encouraged. Picture the counter-factual: if Bally’s problems had gone as wrong as they did, and E&Y had not done so. The enforcement hounds at the SEC would have bayed to the skies. Instead, now, the firm’s personnel suffer individual censures and bar orders of up to three years, for conduct worthy of respect – albeit for results now deemed unsatisfactory.

What messages are sent to the profession’s quality and risk functions? Ought they to reduce the exposure of their senior personnel, by hanging out the line operators to struggle on their own? And by the way, who would aspire to the headaches of a consultative role, if only to finish a long career by dangling from the SEC’s noose?

One of E&Y’s undertakings in Bally is to re-visit, under the scrutiny of an outside examiner, its documentation of higher-level issue consultations.

So, under a sanction that only a bureaucrat could love, Bally will impel the Big Four’s national office boffins to “re-audit” information they receive from the field, and to build a fortress of memoranda to defend against the assaults of later second-guessing.

With the secondary effect that the time and energy available for real problem assessment must now be side-tracked to the same kind of self-protective file stuffing that is strangling American enterprise ranging from product safety to medical treatment to airport security. 

The SEC’s goal in the Bally settlements may not have been deliberately to degrade the large firms’ risk management capabilities. But the direction and effect will all go that way.

Thanks for joining this dialog. Please share with your friends and colleagues. And if not a subscriber, you are invited to sign on at the Main page.

 

On the Calendar: What Every Auditor Should Know About Litigation

The fall speeds on, and the calendar is packed. I am looking forward with enthusiasm to being at Baruch College in New York on Wednesday, December 2, for the Robert Zicklin Center for Corporate Integrity's 4th Annual Audit Conference, "Ensuring Integrity."

Information on the agenda and registration is here. It will be an interesting day, led by Professor Doug Carmichael and including senior staff members of the SEC and the PCAOB as well as representatives of the large firms.

I will be on the last panel of the day -- deliberately scheduled, I suspect, so as not to put anyone off their lunch -- "What Every Auditor Should Know About Litigation." Professor Carmichael will moderate, and I will be joined by Jim Sabella of the hot plaintiffs-oriented law firm of Grant & Eisenhofer, and Willkie Farr & Gallagher partner Mike Young, probably the accounting profession's best-known adviser/spokesman.

The content for our panel will be under development in the next few weeks. I have some ideas of my own -- but I invite you to write with your thoughts. What would you like to have addressed? On what litigation topics should auditors know more -- or other than -- they do now? For that matter, to bend the topic a bit, what should other constituencies know about auditor litigation.

I'll welcome and take up your suggestions -- and will report back later with more to say.

Thanks for joining this dialog. Please share with friends and colleagues. And if not a subscriber, please sign on at the Main page -- easy, free and non-commercial.

 

     

The Old Is New Again, Part II -- Accounting Scams Pose Risks to Sharia Finance

When a felon's not engaged in his employment
Or maturing his felonious little plans
His capacity for innocent enjoyment
Is just as great as any honest man's.

 -- Gilbert & Sullivan, “Pirates of Penzance”

When I wrote recently of the likely recurrence of old-fashioned accounting scams – here – based on non-existent assets and fictitious transactions, I promised to put up my own candidate as the sector ripe for eruption.

It’s this: the already huge and rapidly growing market for financial products and services based on Islamic law – Sharia – which is closing in on $1 trillion in size, targeted at Muslim customers comprising one-fifth of the world’s population, and predicted to expand at ten to twenty percent a year (here, here).

It can be safely predicted that market pressures, competitive greed and misaligned incentives will breed scandals in Sharia-based finance – going well beyond the large if simple issues of non-performance already seen in the suspension of debt payments by Kuwait’s Investment Dar as majority holder in carmaker Aston Martin, and the missed debt payments and cross-defaults of Global Investment House (here and here).

Why? And how, if they can be predicted, can they be prevented?

There are two drivers: the prospect that the bursting of the “shadow banking” bubble will bring a general global return to more traditional asset-based financing structures, and the certain cycles of re-emergent white-collar rascality.  

Koranic principles prevent the charging of interest or the assumption of undue risk. Sharia-based financiers are therefore inhibited in using derivatives or other hedging contracts, short selling, insurance in the Western sense or other risk-mitigating techniques.

Instead their financings involve the sharing of risks and rewards – exemplified by “sukuks” -- structured offerings of asset-based securities, with the “buyer” entitled to a “rent” based on a participation in underlying tangible property, and “murabahas” – financing commitments involving a “profit rate” rather than an interest payment.

Well enough, so far: boards of Islamic scholars vet and approve each transaction for compliance with Sharia principles as applicable, country-by-county. But what the resulting imprimatur – the “fatwa” -- does not do is extend to either up-front due diligence or on-going audit work to assure the fundamental bona fides of the transaction.

And right there lies the hazard. Islamic finance is a fermenting laboratory experiment for the cultivation of schemes and irregularities: a sector big enough to attract new and eager players, out-sized growth potential, modest size and limited talent and experience among the current participants, and cultural incentives to grow in competition against foreign non-believers.

History should teach that the incentives to gain or hold market share, or to stretch the level of transaction risk for the sake of enhanced volume and returns, open the door to irregular behavior on the part of individuals acting under stress -- no less for a Sharia-based sukuk than for a real estate investment trust or a field of oil wells.

One certainty is that the recurrence of financial frauds is no respecter of either piety or theology. The ecumenical scope of exploitive scandals ranges from the 1982 discovery of Roberto Calvi – “God’s Banker” – hanging dead under Blackfriars Bridge in London even as his Banco Ambrosiano suffered multi-billion lire holes in its balance sheet – to the disgraced fall of Christian evangelists Jim and Tammy Bakker – to Bernard Madoff’s looting the community of his Jewish friends and golf partners. 

And the pressures are only amplified where a sector is going through dramatic and rapid growth, with a stretching of experience and resources, increased transaction costs in lieu of interest-based revenue, and the ever-present temptation to minimize the red flags of risk in favor of the satisfaction of aggressive targets.

And so – Sharia transactions involving profit participations based on shared interests in presumably real assets raise exposures of the old-fashioned variety, namely the “sales” of assets that are inflated or fictitious – with variations on the shell-game devices used throughout history to evade due diligence and to fool the auditors.

Among the incisive comments on my last piece on likely audit threats were these:

•    One reader had the anxiety-raising concern that a gremlin may yet emerge in the securitized residential mortgage market, beyond the issues of bad credit and poor collateral – a portfolio of entirely fictitious houses or borrowers. The accuracy of his concern was promptly confirmed not only by the SEC’s broad charges of mortgage-related fraud against the Countrywide team led by CEO Angelo Mozilo (here), but by criminal charges over a New York scheme based on unbuilt buildings, fictional addresses and bogus appraisals (here).

•    And another, a regulator, had the reminder that beyond all the weaknesses in audit sampling, lies the ever-present threat of “shadow” control structures, designed and run for the pure purpose of evasion and manipulation.

Regulators, gate-keepers and systems of justice in Western traditions have been caught unprepared and flat-footed, all too often. Whether their counterparts in the emerging Sharia environment can somehow do better – despite an absence of history, tradition or experience – remains to be proved.

Thanks for joining this discussion. Please share with your friends and colleagues. If not a subscriber, you are invited to join at the Main page -- easy, free and non-commercial.

The Indian Regulators Pronounce on Satyam -- And a False Dawn is Promised

Is corporate India now vaccinated against an outbreak of white-collar financial fraud?

The great and the good of the country’s regulators would think it – taking at face value their prideful descriptions of the investigative scrutiny of scandal-ridden Satyam Computer Services Ltd.

The former chairman of the Securities and Exchange Board of India, Meleveetil Damodaran, is quoted – here -- as calling the fraud at Satyam “unique,” and “an isolated case, not reflective of the state of affairs of India Inc.”

He would say so, of course, as a current board member of Tech Mahindra, the successful bidder now grasping the handle of the poisoned Satyam chalice. But the annoying question persists: on what basis could he possibly make such an over-reaching claim?

Not from the work of the Central Bureau of Investigation, which invokes its use of “cyberforensics” – here -- in order to “uncover how in-house computer systems (at Satyam) were exploited to generate false invoices.”

Please. Spare us another exaggerated claim on behalf of the “forensics” of post-exposure inquiry.

A sewer worker can unplug a cesspool, too, if given a shovel and told – pointing to the clogged hole – “Dig here.” Admirable are the muscles involved. But the worker is not thereby qualified to engineer the waste plant, nor to monitor the flow through its twisted pipes and drains.

The forensic program to illuminate a revenue statement inflated by bogus business would start – and typically would end – with a single sharp finger pointed to the designer of the information system:

“Will you please show me the back-door technique by which alternative invoices – authorized or not – can be entered into the system? And for good measure, would not such an entry be concealed from the mainstream reporting process?”

That’s it. Not the stuff of brilliance or epiphany.

It does remain to be revealed, probably in court, whether such simple and direct questions were ever asked in the normal course of Satyam’s risk management process – under audit or otherwise. But conceiving them after the fact is hardly the matter of revelation now being publicized by the Indian regulators.

As for the excessive enthusiasm of the good Mr. Damodaran. Nassim Nicholas Taleb’s “Black Swan” presents the two lessons essential to avoid the “induction trap” into which the SEBI veteran falls headlong:

•    First, no number of observations of white swans can disprove the existence of a black one. Likewise, however superficially successful may appear the historical performance of a financial reporting and assurance structure, the past can give no comfort that a catastrophic failure will not suddenly emerge.

•    Second, the single observation of a black swan not only destroys the baseless over-confidence that the species does not exist – it must also contemplate the prospect of other like specimens. More directly, Satyam as one mega-fraud not only establishes that it can happen in India, but supports the necessary expectation that others exist, only as yet undiscovered.  

Or in more folksy terms – the first appearance of a cockroach, in a kitchen thought to be pest-free, both disproves any assumption of health-code compliance, and also reasonably alerts the chef – since vermin are not known to be solitary – to the unpleasant presence of more.

The Institute of Chartered Accountants in India, meanwhile, is off on a wild-goose-chase of its own – here and still here -- chasing after the details of the international affiliations among the only accounting firms globally established enough to participate in the delivery of audit services in a true cross-border involvement.

As if agreements as to name-sharing, letterheads and business cards had anything to do with the defalcation at Satyam. Or, either, with the provincial stature of India’s locally-biased profession – flailing away in back-footed defensiveness as it confronts the reality that it is at least a generation behind the modernization required to participate in a globalized economy.

Rather than take comfort that a black pot of India Inc has been bleached to lily white, in other words, prudent investors and gate-keepers alike would do well to view the pronouncements of naïve regulators as a symptom that the country’s environment for financial chicanery remains fertile and inviting. 

Thanks for joining this dialog. Please share with friends and colleagues. If not a subscriber, you are invited to sign on at the Main page – easy, free and non-commercial.

Once and Future Accounting Schemes -- What Will They Think Up Next?

       

"Everything old is new again ...."
                -- Peter Allen

To pull off the next large accounting scam – or, more virtuously, to try to prevent it – where would we look?

This always-pertinent question has global dimensions, with criminal charges now lodged against two Price Waterhouse partners in India – see here – for their alleged complicity in the fraud perpetrated at Satyam Computer Services Ltd. under the leadership of CEO Ramalinga Raju.

Those inclined to heed memory and history as guides for the future will find familiar the recited bad deeds by which the Satyam accused are now answerable to the Indian courts:

• Bogus invoices for customer work never performed lay at the heart of the mid-‘80’s house of cards known as ZZZZ Best.
• Inflated rolls of non-existent employees echo the ledgers of fictitious insureds a decade earlier at Los Angeles-based Equity Funding.
• Shadow businesses and opaque investments recall the undrillable pools of petroleum, said to lie deep under the Canadian Arctic, sold as snake oil in the 1960’s by Bernie Cornfeld in the original version of Fund of Funds.

In a world of borderless impacts, and with the certainty that details of the Satyam criminal file will now implicate the defensibility of the investor lawsuits lodged in the United States as well as in India, it’s well to ask what new risks lie over the next hill.

Especially since, as similarly structured schemes have kept recurring with dreary regularity, decade after decade, the learning capacity of the financial gate-keepers is slight enough in fighting the last war, let alone to anticipate or prevent the next.

A starting point will be the predictable re-emergence of another rogue trader – almost routinely expected if still highly impactful – the next generation’s reincarnation of Nick Leeson at Barings or Yasuo Hamanaka at Sumitomo or Jerôme Kerviel at Société Générale.

But it’s also back to basics, in a world said to be reverting to older styles of banking and finance. In the recent era of exotic financial derivatives and black-box valuation models, the pervasive separation of deal-doing incentives from underlying transaction risks provide illusory and ultimately disastrous. Looking ahead, it can be anticipated that the next generation of white-collar schemers will unsheathe the simpler tools that have served so effectively throughout the past to entice the investors and evade the auditors.

Old memories may still spark, for example, to recall the 1960’s tanks full of “vegetable oil” in the meadows of New Jersey: collateral for the negotiable warehouse receipts issued by American Express, but actually nothing but water – a scheme that succeeded because the auditors looked from the top of the tanks at the thin layer of oil on the surface, rather than taking taps from the bottom.

Or the herds of ghost cattle, sold in fractional interests to urban investors: the livestock numbers were inflated by repeatedly cycling the same calves through the counting chutes – under the noses of the city-based audit staff who failed to prevent double-counting by the simple control of a chalk-stick mark on the forehead of each animal as it passed by.

Or the heavy-duty oil-field trucks comprising salable equipment portfolios: sensibly counted as they were scheduled through their repair and maintenance depots -- except that each one slipped past the auditors multiple times by the simple expedient of driving behind the repair shed to swap the identifying bar code on its engine block.

Or – to tie off a list that could otherwise go on a while – the allocation to investors of interests in a giant hill of Latin American coffee beans: except that under a thin layer of the real thing, the mound consisted of sand and bales of hay – undetected by the auditors too fastidious or pressed for time to drill or dig deeply enough to the core to get a legitimate sample.

All real stories – none of them all that original. But any of them will likely show up again soon, as timeless devices used to inflate the performance of money-gathering institutions basing their business on asset-based transactions.

Let the gate-keepers be warned – and the future perpetrators too. But only if the lessons of the past are learnable.     

Drop me a note if you have a candidate for an industry or a practice having special exposure. As a teaser -- I will soon take a specific look at a particular sector where I would see this aspect of risk to be both newly emergent and especially acute.

And thanks for joining this dialog. Please share with your friends and colleagues. And if not a subscriber, you are invited to sign on at the Home page – easy, free and non-commercial.

Satyam's "Ghost Employees" -- An Innovative Approach to Job Creation?

On the record so far, it is safe to predict that the legal and political maneuverings around India’s Satyam Computer Services will be continue to be noisy, protracted and inefficient. But the answer will come quickly to one question:

Did or did not former chairman Ramalinga Raju loot the company by diverting the payroll of 13,000 fictitious employees, out of some 53,000, as alleged by prosecutors and, as of today, at least, denied – or at least not admitted – by both Raju himself and the company.

Whatever the answer -- with its broad implications for the company and its shareholders and gate-keepers, as well as for Indian governance and regulation of companies and their auditors – the process to get there should be rapid.

The investigative work program to unpack such a charge could be written by a second-year auditor – once again exposing that the roadmapped mopping-up of “forensic accounting” relates to the challenges of contemporaneous financial auditing as does the slog of post-battle casualty clearance to the smoky uncertainty of real-time warfare.

Legitimate employees demonstrate their presence far beyond their ID numbers and payroll entries, however susceptible to manipulation those high-level records may be. There are company accruals and payment obligations for taxes, social charges, pensions and benefits. They create hiring and departure dossiers. They occupy real office space, work stations, telephones and computers – all requiring the documentation and outlay of considerable real sums. And as alleged, a 25% padding of their rosters would affect everything in a company environment from cafeteria turn-over to usage of paper towels to the frequency of parties for maternity leaves.

What would have been in it for Raju to bear the cost side of over-stating his employee head-count? All the associated expenses, if fictitious, could have been exposed by a walk through a job site or an expense ledger. While if real, they would have been an impossible drain on the company’s margins – not to mention requiring a team of co-fraudsters to dummy up the records.

Volume padding is one of the oldest corporate scams. Barry Minkow created bogus job locations in the 1980’s to boost the turn-over of ZZZZ Best – but that Ponzi scheme was aimed at inflating the public company’s stock price. And a decade earlier, the perpetrators at Los Angeles-based Equity Funding used the unusual device of over-stating liabilities (to pay death benefits on non-existent insurance policy holders) – but they found a way to extract a pyramid of real cash through the use of reinsurance.

So there was the rub for Raju, and the challenge to the prosecutor’s assertion: ghost employees don’t generate revenue.

Or do they?

Padded jobs rosters, inflated client billings and systematic over-charges are also devices as old as time, as any manager knows who has ever pushed back against a service provider’s generous billing.

To realize revenue on the scale alleged in Satyam, however, would require a massive fabrication of client billings, at the very least – even if disconnected from legitimate employee numbers and expenses – plus the possibility of warehouses full of bogus time records and other job-related footprints. Again, all of this was subject to ready exposure through the most elementary form of inquiry and verification – whether by a client, internal auditors or outside monitoring and scrutiny.

Or is it the case, despite the world’s largest companies on Satyam’s client roster, presumably exercising some level of due diligence in bench-marking Satyam’s staffing and employee productivity against its peers, that the entire Indian out-sourcing industry is so lacking in basic control and oversight mechanisms that irregularities so allegedly pervasive – and, necessarily, collusive – could escape detection for so long.

The implications of that speculation will await exploration when the post-battle forensic hyenas have finished their scavenging. For now, expect that the porous nature of the Indian investigative process, which has already furnished so much to chew on, will continue to serve up a buffet of future morsels.    

Thanks for joining this dialog. Please share with your friends and colleagues – and if not a subscriber, you’re invited to the Home page, where sign-up is easy, free and non-commercial.

The Conundrum of Audit Quality -- How to Know It, if You Saw It

Last Friday the US Treasury’s Advisory Committee on the Audit Profession served up its report – helpfully mapped on Edith Orenstein’s FEI blog for September 26. As I had predicted – here and here – the group failed to agree on the existence of catastrophic risk, or on anything like a set of achievable solutions.

With that opportunity now closed out, although the issues persist unsolved, it’s an open question where leadership may now migrate. Meantime, the public desire and expectation for high-quality assurance remain challenged – not least because that quality is so hard to identify. Here’s an idea:

There’s an odd but well-observed phenomenon -- highway drivers, asked about their skills behind the wheel, consistently rate themselves more highly than they deserve.

I am obliged to Tom Vanderbilt’s new book, “Traffic,” because it bears on a survival issue for the large accounting firms – their inability to persuade a hostile audience that they can meet the public’s expectations for quality work.

Despite the ruthless mathematical impossibility that most vehicle operators actually perform above average, the exaggerated self-evaluations rest on two doubtful supports:

•    First, both standards and expertise are weak and ambiguous. Herd behavior on the daily roadways is not a fair context by which to measure real skill, and in any event, a poor driver is not qualified to assess the extent of his own mediocrity.

•    Second, only a tiny fraction of “driver errors” have bad outcomes. The typical commuter commits routine violations without incident – speeding, lane cut-offs, distracted concentration while texting, even drinking. He usually gets home safely, despite bad habits and performance, with a subtle but erroneous endorsement of his adequacy. With a history that is unsafe, unrecognized and only unharmful due to good fortune, an at-risk driver suffers an “accident” only when his accumulated risk factors converge with, say, an icy patch or a darting child or another drunk crossing the mid-lane.

Having spent a career studying corporate malfeasance and failure, I’ve found it both puzzling and depressing that the large audit firms persistently fall victim to the same behaviors, decade after decade.

Vanderbilt’s approach to driver quality illuminates the similar disconnect in the audit context: The Big Four issue virtually identical proclamations of a commitment to do quality work. Yet their pleas for liability relief and their admitted exposure to more than $100 billion in litigation claims reveal the reality of grave performance concerns. 

So the auditors’ credibility gap may rest on their three-order resemblance to the cluelessly optimistic drivers:

•    First, the large firms – along with their critics and the surrounding community of regulators and financial statement users – have no real way to differentiate good work from bad. Auditors’ reports all look exactly alike, so as long as nothing catastrophic has happened to a corporate issuer, the reasons may lie as much with luck or circumstance as with a job well or poorly done.

•    Second, there’s nobody even trying to do contemporaneous audit quality assessment – a process not within the remit or the resources of the SEC, the PCAOB, or their counterparts. And the prospect of a robust and independent research body is one of the many ideas failing to emerge out of the Treasury Committee.

•    And at the third order: An audit engagement may have been rife with potential for break-down – of the types all too familiar to both the investor plaintiffs’ lawyers and the profession’s own defensive advocates. But only in the rarest cases do the conditions for failure actually ripen into disaster. As a result, the skewed bias of hindsight provides a steady but misleading stream of reinforced messages, that everything is cruising along without problems or concerns.

Vanderbilt describes the fundamental re-training needed to relieve the typical under-estimation of driver fallibility and culpability – namely, large-scale collection, scrutiny and discipline of the “near misses” – a program that would perhaps be familiar in the airline industry’s highly pro-active inquiries into incidents threatening air traffic safety.

But neither the accounting profession nor its regulators today possess the insight or the resources to search for, investigate and extract wisdom from the “crashes that didn’t happen.”

A one-day symposium of either audit critics or supporters alike could flesh out the catalog of factors that have contributed to the notorious audit failures – ranging from inadequate industry expertise at the partner level to pliant accommodation of aggressive accounting policies to the most basic break-downs in routine audit procedure execution.

Conceivably, these would form a template against which audit performance could be assessed – if only there were the will, the availability of competent evaluators, and the readiness actually to learn from the results.

But considering that the Treasury Committee could not even agree that there is a threat to large-firm survivability, such re-oriented leadership vision is unlikely to emerge any time soon.  

So it is probable that audit crashes will continue to claim reckless and over-optimistic victims, as well as innocent by-standers, for the same unexamined reasons that have recurred over and over for years, while the currently depressed level of insight and progress to quality remains unmoved.

Thanks for sharing in this dialog. I encourage your comments – your sharing with your friends and colleagues – and if not a subscriber, your signing up at the Home page, where it is easy, free and non-commercial.

Accounting and Audit Judgments -- Please, No More Standards!

A new one-liner in the cultural vocabulary was introduced when the hit comedy, “No Sex Please, We’re British,” opened in London in 1971.

Today’s plea – with the Securities and Exchange Commission’s proposal to inflict an analytic structure upon the making of accounting and audit judgments – would be “No Standards Please, We’re American.”

On February 14 the SEC presented for public comments the interim progress report of its Advisory Committee on Improvements to Financial Reporting – here – which among its suggestions was that the Commission should adopt a “judgment framework” in the accounting area, and that the country’s audit regulator, the Public Company Accounting Oversight Board, should do the same for audit judgments.

Responses to the SEC are due the end of this month. Meanwhile, the PCAOB sponsored a panel discussion on February 27 by its Standing Advisory Group – summarized here by Edith Orenstein of Financial Executives International.

The signal achievement of this day-long effort was that the competing interests in the debate managed at the same time to expose both the hazards and the vacuity of the whole idea.

As co-presented to the PCAOB group by a managing director of Moody’s – yes, the credit rating agency – the notion is this:

•    Preparers of financial statements would be assisted by yet more pages of codified bullet points, in choosing and applying among the myriad of alternatives for selecting and implementing accounting standards, quantifying estimates, evaluating evidence and all the rest.

•    Auditors, likewise, would be similarly enlightened across the spectrum of judgments required to choose audit procedures, to evaluate the likelihood and impact of fraud and other risks, to conduct audit sampling, to evaluate controls and – layering the irony – to assess management’s own judgments.

Wait.

In the century and a half since the emergence of independent accounting early in the Victorian era, preparers of financial statements and their auditors have been striving get their judgment processes right. So who are these bureaucrats, with their presumption of assistance?

This is, after all, the same SEC that was caught flat-footed over the pervasive extent of executive options back-dating. The same PCAOB that in its sixth year has no more than a pilot program for constructive engagement with non-US regulators and inspection beyond the samples taken within its own borders. And the same Moody’s whose involvement in the subprime mortgage fiasco, along with the other major credit ratings agencies, finds them to be central in the still-spreading credit markets turmoil.

Put another way, taking advice on the process for judgment-making from this crowd could be viewed like hiring Noah to give flood-control advice to the city of New Orleans.

As for the parody that passes for debate, the self-interested and antagonistic participants are circling the topic and each other like stray and wary dogs around a hydrant.

The accounting firms at the PCAOB’s table gave cautious endorsement to the framework idea, despite the obvious hazard: By getting it right they would obtain no more credit, safeguard or protection than is available today under existing guidance. Instead, they would only have one more procedure to get wrong, and therefore increase their already debilitating litigation exposure.

The large accounting firms remain muzzled on their fragile and threatened state, unwilling out of either fear or denial to acknowledge the shockingly low litigation impact that would cause their disintegration (which I've calculated and discussed here).

As a result, they are inhibited from insisting that the only realistic usefulness of yet more regulation on the exercise of their judgments would be under a “safe harbor” within which they could explore and apply new modes of working.

But on the other hand, investor advocates among the profession’s critics make plain the political reality that no adjustments in the American legal liability framework that entraps the auditors today are about to be forthcoming.

Exposing the sterility of the discussion, even the regulators themselves are in full self-protection mode, making clear that nothing in the application of the suggested framework process would inhibit the SEC or the PCAOB from examining and criticizing the judgments made by issuers or auditors.

For British theatre-goers the farce of “No Sex Please” ended when the nightly curtain came down. Because a new "judgment framework" would offer benefits that range from elusive to non-existent, would impose costs of extra work and documentation that are extensive, and would inflict potential litigation hazards that are considerable, the farce now playing out in Washington deserves a closing notice.   

For other aspects of the PCAOB’s meeting last week, see my friend Francine McKenna at Re:The Auditors -- here.

Societe Generale -- Of Internal Controls and Risk Management

Published in the IHT on February 1, 2008 (here)

SocGen: When Risk Management Fell Asleep at the Switch

Since the first story is seldom the whole story, it will take time and police work to get to the bottom of the €4.82 billion euros in financial trading losses racked up by the French bank Société Générale in unwinding unauthorized positions taken by a trader, Jérôme Kerviel.

Will Kerviel emerge as an evil genius disguised as a 30-something slacker? The ring leader of a clever gang of financial scamsters? Or, more likely, an average-to-dull employee who exploited the weaknesses of his employer's systems and the credulity of his overseers?

The answer to the question "How did he do it?" appears routine enough. Kerviel's exploits seem not very different from those of the wrong-way traders who have popped up like mushrooms in the back offices of trading institutions from Barings to Sumitomo to Allied Irish Bank to Penn Square.

The scenario is almost always the same: An early burst of irregular but winning trades, motivated by bonus envy or simple testosterone, later spirals the wrong way - briefly matched by a daisy chain of falsified counterdeals and an accelerating but ultimately futile concealment of old losses covered by new ones.

The more demanding question - "How did he get away with it?" - will become answerable only through SocGen's accountability to investigators; to President Nicolas Sarkozy of France, who is not amused; and to its shareholders.

Outside auditors have been summoned. But since there is no forensic process so banal as the after-the-fact sweeping of the dust off the wrong-doer's trail, the interesting question they will likely not address is this: "Where were the curious, persistent and demanding managers ahead of the wreck?"

It's too early to tell, but enough is knowable to suggest that a relative of Inspector Clouseau was seconded to the risk management and compliance function of the hapless bank.

My first and best mentor in the scrutiny of financial fraud made a point of extending his inquiry beyond the immediate problem. Called to investigate an irregularity in one corporate corner, he would search for other possible outbreaks. Instead of assuming a system to be foolproof, he would speculate about ways to stress-test it for vulnerabilities.

He had a first principle: Any system of recording and reporting transactions is suspect. As a product of human design and operation, it is vulnerable not only to simple error but also to deliberate subversion.
In the SocGen situation there are some basic risk management tools, implicated by Kerviel's apparent mode of operating.

First is the vacation rule: Everyone who processes transactions should be taken off his desk at intervals, so that a chain of successive falsifications, if one exists, can be discovered and broken. This has been an article of faith since long before it became the centerpiece of a landmark 1976 U.S. Supreme Court decision in the Hochfelder case. That case dealt with the right to sue under the securities laws, but it started as a dispute over the application of a simple tool in internal control: the realization that an employee who never takes a vacation may be hiding something.

A low-level French employee who declines to take his vacation entitlement is already an extraordinary anomaly, enough that Kerviel's superiors should have gone on immediate and full alert. As Kerviel himself acknowledged to French police investigators, "It's one of the elementary rules of internal control. A trader who doesn't take any days off is a trader who doesn't want to leave his book to another."

A second risk management premise is that you don't net positions before quantifying risk. The exposure in a portfolio with €50 billion euros of puts and €49 billion of calls is emphatically not limited to €1 billion. At least since the Continental Vending case in the 1960s, where criminality was charged over the improper offset of accounts receivable against payables before setting a reserve, "netting" has been recognized as a recipe for concealed disaster.

Especially in a trading environment, combining the ostensible effects of "buys" and "sells" subverts the very essence of safeguarding against the possibility that one leg or the other might somehow go wrong - or even, as here, be falsified altogether.

A third is that back-office compliance cannot be only a little bit broken. Whether Kerviel was known to take irregular trading positions as far back as 2005, as he says, or only starting in 2006, as the investigator suggests, either one indicates a tolerance at SocGen for a back-office error rate greater than zero. But as the effect of financial leverage in Kerviel's dealings makes clear, there is no such thing as small or controlled leakage in a commodities operation.

Back-office compliance does not work to the same margin of error as, say, audited financial statements, which need only be stated fairly within the broadly judgmental range of "materiality" - or, in laymen's terms, "close enough." For systems capable of going awry to the tune of billions of euros, that level of tolerance for error cannot pass a credibility test.

Finally, and indicative of the SocGen attitude of mind, is the report that Kerviel talked his way out of an external alert by producing falsified documents by way of excuse. Once the red flag is raised, going to the target himself for an explanation suggests a box-ticking mentality that is out of place in a compliance function.

"Rogue trader" is probably too colorful an epithet for Kerviel. For the functionaries in SocGen's risk management, "asleep at the switch" probably doesn't go far enough.