Re:Balance -- Jim Peterson

The PCAOB Asks the Auditors an Unanswerable Question: Do Company Controls “Work”?

“Measure twice – cut once.”

            -- Quality control maxim of carpenters and woodworkers

If there can be a fifty-million-euro laughingstock, it must be Guillaume Pepy, the poor head of the SNCF, the French railway system, who was obliged on May 21, 2014, to fess up to the problem with its € 15 billion order for 1860 new trains—the discovery after their fabrication that the upgraded models were a few critical centimeters too wide to pass through many of the country’s train platforms.

Owing evidently to unchecked reliance on the width specifications for recent installations, rather than actual measurement of the thirteen hundred older and narrower platforms, the error is under contrite remediation through the nation-wide task of grinding down the old platform edges.

That would be the good news – the bad being that since the nasty and thankless fix is doubtless falling to the great cohort of under-utilized public workers who so burden the sickly French economy, correction of the SNCF’s buffoonish error will do nothing by way of new job creation to reduce the nation’s grinding rate of unemployment. 

The whole fiasco raises the compelling question for performance quality evaluation and control – “How can you hope to improve, if you’re unable to tell whether you’re good or not?”

This very question is being reprised in Washington, where the American audit regulator, the Public Company Accounting Oversight Board, is grilling the auditors of large public companies over their obligations to assess the internal financial reporting controls of their audit clients.

As quoted on May 20 in a speech to Compliance Week 2014, PCAOB member Jay Hanson – while conceding that the audit firms have made progress in identifying and testing client controls -- pressed a remaining issue: how well the auditors “assess whether the control operated at a level of precision that would detect a material misstatement…. Effectively, the question is ‘does the control work?’ That’s a tough question to answer.”[1]

So framed, the question is more than “tough.” It is fundamentally unanswerable – presenting an existential problem and, unless revised, having potential for on-going regulatory mischief if enforced in those terms by the agency staff.

That’s because whether a control actually “works” or not can only be referable to the past, and cannot speak to future conditions that may well be different. That is, no matter how effectively fit for purpose any control may have appeared, over any length of time, any assertion about its future function is at best contingent: perhaps owing as much to luck as to design -- simply not being designed for evolved future conditions -- or perhaps not yet having incurred the systemic stresses that would defeat it. 

Examples are both legion and unsettling:

• The safety measures on the Titanic were thought to represent both the best of marine engineering and full compliance with all applicable regulations, right up to the iceberg encounter.

• A recovering alcoholic or a dieter may be observably controlled, under disciplined compliance with the meeting schedule of AA or WeightWatchers – but the observation is always subject to a possible shock or temptation that would hurl him off the wagon, however long his ride.

• The blithe users of the Value-At-Risk models, for the portfolios of collateralized sub-prime mortgage derivatives that fueled the financial spiral of 2007-2008, scorned the notion of dysfunctional controls – nowhere better displayed than by the feckless Chuck Prince of Citibank, who said in July 2007 that, “As long as the music is playing, you’ve got to get up and dance… We’re still dancing.”

• Most recently, nothing in the intensity of the risk management oversight and reams of box-ticking at Bank of America proved satisfactory to prevent the capital requirement mis-calculation in April 2014 that inflicted a regulatory shortfall of $ 4 billion.  

Hanson is in a position to continue his record of seeking improved thinking at the PCAOB -- quite rightly calling out his own agency, for example, on the ambiguous and unhelpful nature of its definition of “audit failure.”

One challenge for Hanson and his PCAOB colleagues on the measurement of control effectiveness, then, would be the mis-leading temptation to rely on “input” measures to reach a conclusion on effectiveness:

• To the contrary, claimed success in crime-fighting is not validated by the number of additional police officers deployed to the streets.

• Nor is air travel safety appropriately measured by the number of passengers screened or pen-knives confiscated.

• Neither will any number of auditor observations of past company performance support a conclusive determination that a given control system will be robust under future conditions.

So while Hanson credits the audit firms – “They’ve all made good progress in identifying the problem” -- he goes too far with the chastisement that “closing the loop on it is something many firms are struggling with.”

Well they would struggle – because they’re not dealing with a “loop.” Instead it’s an endless road to an unknown future. Realistic re-calibration is in order of the extent to which the auditors can point the way.

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are welcome, and subscription sign-up is easy and free, both on the Main page.

---

[1] Emphasis added.

The Rolls-Royce of Audit Reports Hits The Road: Test-Driving KPMG’s Latest Model

“So tell me what you want – what you really really want.”

            -- Spice Girls, 1996

“But if you try sometimes, you just might find, you get what you need.”

            -- Rolling Stones, 1969

Insiders within the accounting community are falling all over themselves in congratulatory admiration of the Independent Auditor’s Report signed in London on February 12, 2014, by Senior Statutory Auditor Jimmy Daboo on behalf of KPMG, on the financial statements of Rolls-Royce Holdings plc.

Running to six full pages starting at page 130 of the company’s 2013 annual report, single-spaced and double-columned, Daboo’s opinion implements with a vengeance the guidance published in June 2013 by the United Kingdom’s Financial Reporting Council, requiring auditors’ reports to describe the greatest risks to material misstatements, explain their application of materiality in audit planning and performance, and summarize their audit scope as responsive to the assessed misstatement risks.

This is not about motor cars. Rolls-Royce ranks number 28 on the FTSE 100 list of large UK companies, with £ 15.5 billion in 2013 revenue from its gas turbine and reciprocating engine sales to the civil and defense aeronautics sectors, along with marine, energy and power systems -- all spelled out in its report running a handsome 144 pages.

The interesting question is whether the world was really waiting for essays of 500-word-length on such eye-crossingly complicated topics as revenue and profit measurement, measurement of liabilities from sales financing arrangements, or the concept and presentation of non-standard “underlying” profit on foreign transactions. Or would information users have preferred the traditional, simple and comfortable anodyne opinion in the first paragraph, that a “true and fair view” was presented?

Early indications -- based on the conspicuous silence of the investor community and commentators outside the precincts of those with self-interest -- significantly suggest the latter. To be sure, the company’s stock was pounded by its largest price drop in thirteen years with the profit warning of its February 13 announcement of 2013 results, largely since recovered, but blame was placed on forecasted reductions in defense-related revenues, and the financial press made no connection with KPMG’s opinion, either then or since.   

If proved out over the rest of the annual reporting cycle for UK companies and their own broad adoption of the FRC’s requirements, the investor community’s “ho-hum” would implicate the long-running efforts to re-engineer the standard auditors’ report – by both the PCAOB in the US and the IAASB globally.

Not, as can be observed, that either of these bodies is proposing changes on the scale of the KPMG treatise – but have rather confined themselves to the identification of the kind of “critical” or “key” audit matters that may predictably elicit generic box ticking and boilerplate, rather than KPMG’s sophisticated mini-seminars delivered on Rolls-Royce.

Which would be unfortunate indeed, especially in the litigation-prone United States, the jurisdiction most likely among the world’s major large economies to inflict a death-blow jury verdict for an auditor’s “getting it wrong.” There, under the disclosure-based policies of the American securities laws, adoption of the emerging UK protocols for actually quantifying audit and reporting materiality, and for explicating the range and uncertainty of complex company decisions and judgments, would go far to draw the teeth of the beast lurking in the courthouse.

For this, those arguing for a sustainable model for privately-provided assurance could only be grateful.

But there being no sign as yet of any leadership or initiative in that direction, grounds for optimism are hard to come by.

Curious readers in the US are invited to have a look at the Rolls-Royce report including the KPMG opinion, and send in their reactions. Readers in the UK – especially actual or potential investors in Rolls-Royce, on whom the KPMG report may have made an impact or had any influence -- are invited to identify themselves and share their thoughts.

 

Thanks for joining this dialog. Please share with friends and colleagues. Comments are welcome, and subscription sign-up is easy and free, both at the Main page.    

 

 

Big Data: Can the Regulators Handle the Big Challenge to Big Audit

I yield to no one in my respect for the intelligence and dedication of Public Company Accounting Oversight Board member Lewis Ferguson – whose deep involvement with the accounting profession I have known for decades.

But Ferguson recently came wrong on an issue for all parties involved with large-company financial information, that threatens to contribute to a re-ignition of the 1990’s brouhaha over the permissible scope of services deliverable by auditors.

As an adjunct to his day job in Washington, Ferguson is chair of the International Forum of Independent Audit Regulators – a global collection of bureaucrats whose agencies sprouted around the world in the post-Enron aftermath of the 2002 Sarbanes/Oxley law.

In that capacity, Ferguson was quoted recently that the auditors’ search to acquire expertise in the rapidly-evolving field of Big Data and its applicability to the practice of auditing “is a source of great concern to all regulators around the world,” and “raises serious concerns about differential levels of profitability in these businesses, differential rates of growth, where the economic incentives are and to what extent does audit quality suffer as a result”(IFIAR press conference April 10, 2014, at minute 17).

For Ferguson to suggest that auditors should be either inhibited or constrained from fully realizing the opportunities presented by Big Data is to be on the wrong side of its evolutionary trajectory.

Looking ahead today, the availability of Big Data – and the ability of management, auditors and financial information users alike to grasp and analyze all and every part of the recording and reporting of an enterprise – will shortly re-work completely the way in which assurance is performed and delivered.

With search algorithms and comprehensive analytics brought to bear, the very notion of audit by sampling – bedrock of traditional audit practice since its Victorian origins – will be rendered obsolete. Whole teams of audit staff, along with their elaborate and costly testing methodologies, will have no more raison d’être than buggy whips on an automobile, as incisive programmers scanning for irregularities will search the entirety of a massive data set with the push of a button.

A friend on the board of a global public company recently gave me a beginner’s Big Data lesson: a fraud-detection team, newly empowered with access to comprehensive data on the activities of the company’s entire employee base world-wide, was enabled through exception-searching analytics to identify – and to refer for prosecution – a manager who was routinely submitting expense claims that were both randomly different in amount and just below the policy threshold for supporting documentation – a detection task essentially impossible by traditional forensic means.

That and other extended Big Data assurance opportunities are nearly too rich to grasp – when a retail transaction at the cash register generates a stock replacement purchase order and a shipping invoice – when the nation-wide spread of epidemics is predicted not by laboratory results at the NIH but by web searches for symptoms and cures – when traffic snarls are reported not by eye-in-the-sky helicopters but by the pace of cell-phones carried by car-bound commuters.

This would not, of course, be the first time a regulator was behind the transforming consequences of change. Examples in the last decade alone included the unrestrained excesses started in the sub-prime mortgage market, and the unobserved invasion by the Chinese-based reverse mergers beneath the radar of the Securities and Exchange Commission. Most recently, regulators have been wrong-footed by the legal skimming of the high-frequency traders so entertainingly mapped in Michael Lewis’s spring book, “Flash Boys,” and the market-moving impact of Bank of America’s multi-year inability to do the sums required in the complex accounting for its capital.  

The point missed by Ferguson’s suggested handcuffs on the auditors’ ambition is typical of those failing to appreciate the implications of inevitable change: the genie of Big Data is out of the bottle, and will not be returned. If the audit firms do not develop the models and methods for its deployment in the assurance process, and re-calibrate their business models accordingly, then new players in the market surely will, with existential consequences for the viability of the audit firms and their existing franchise.

Just because Ferguson takes a retrograde view of the future of Big Data in big-firm hands, however, does not mean that the accounting profession itself has it right. At the very least, there is a huge barrier of vision to overcome, as seen in the profession’s failure to evolve the basic and obsolete “pass-fail” reporting model into assurance that the markets will actually value and be willing to pay for.

And at worst, unless the profession gains credible and active engagement in the public dialog on the compelling case to acquire and deploy the skills and practices needed to bring Big Data to bear in the next generation of Big Audit, they will be setting the stage for a reprise of the disruptions of the 1990’s that saw their unfortunate capitulation on permissible scope of ancillary services, nowhere more unfortunately exemplified than in the avoidable debacle of the Andersen/Accenture divorce.  

Questions deserving debate here are deeper and more profound than those of a narrow-focused regulator. So PCAOB member Ferguson deserves appreciation for opening a door to their exploration.

Thanks, Lew.

And thanks for joining this dialog. Please share with friends and colleagues. Comments are welcome, and subscription sign-up is easy and free – both at the Main page.