Moral Hypocrisy: The KPMG / PCAOB Scandal

Auditors aren't that great at detecting fraud and sometimes claim their audits aren't designed to detect it. It looks like they may not be that great at committing it, either (though not for lack of effort).

PWC Held Responsible for Not Detecting Fraud

The Wall Street Journal published an article explaining that PricewaterhouseCoopers (PWC) was held responsible for failing to detect fraud in their independent audits of Colonial Bank. Colonial Bank collapsed in 2009 and, according to the Tampa Bay Times, was the sixth largest bank failure in history. The articles estimate that PWC may be responsible for damages totaling hundreds of millions of dollars.

This is an interesting case because the audit firm has had some individuals claim, in court, that auditors are not responsible to detect fraud. The court rejected this claim and said auditors who don't design audits to detect fraud are not following their own auditing standards. Here are some details from the FDIC order related to the case:

“While there are numerous auditing standards that are implicated in this case,...the overarching standard that governed the PWC audits is that: “[t]he auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatements, whether caused by error or fraud.” AU § 110.02; AU § 316. PCAOB Auditing Standard No. 2 states that “[a]lthough not absolute assurance, reasonable assurance is nevertheless a high level of assurance.” Id. at ¶ 17. To that end, a PCAOB 2007 release clarified that “[t]he auditor should, therefore, assess risks and apply procedures directed specifically to the detection of a material, fraudulent misstatement of the financial statements." (emphasis added). The Engagement Letters between PWC and CBG acknowledged this responsibility by stating that PWC would “design [the] audits to obtain reasonable, but not absolute, assurance of detecting errors or fraud.” See, e.g., A4 at 3. Indeed, Mr. Westbrook, one of the PWC audit partners, testified at trial that PWC had a duty to design audit procedures to detect fraud. Tr. 817:25-818:7 (Westbrook). He further testified that if PWC failed to design its audit procedures to detect fraud, it would be a violation of PCAOB standards. Tr. 822: 19-22 (Westbrook). 

However, PWC voiced a very different tune just a few years ago with respect to another lawsuit that stemmed from this fraud. TBW’s bankruptcy trustee also filed suit against PWC, alleging that PWC breached its duties when it failed to detect the fraud. That lawsuit proceeded to trial in August 2016 before it settled mid-trial. As part of that lawsuit, many of the same PWC engagement partners, audit managers, and audit staff who are involved in this case gave deposition testimony under oath in the TBW trustee’s case. During that testimony, these individuals repeatedly admitted that PWC did not design its audits to detect fraud. For instance, Mr. Westbrook testified that PWC “audits are not designed to detect fraud.” Tr. 358:6-7 (Westbrook) (quoting Westbrook TBW Dep. at 23:7-12). Likewise, Mr. Jackson, the PWC engagement partner, testified that “I would point out that our audit procedures were not designed to detect fraud.” Tr. 1027:1-10 (TBW Dep. at 31:17-20). Similarly, Wes Kelly, PWC’s audit manager for the 2003-2005 and 2008 CBG audits, testified that PWC “did not design audit procedures to detect fraud.” W. Kelly TBW Dep. 45:608 (Ex. P3120). Finally, Mr. Rivers, a PWC audit associate assigned to the CBG audit, testified that PWC had no obligation to look for fraud. Rivers TBW Dep. at 66:17-23. 

At trial, PWC attempted to explain away this testimony by arguing that these individuals simply meant that PWC was not a guarantor against the possibility of material fraud because the auditing standards recognize that “even a properly planned and performed audit may not detect a material misstatement resulting from fraud.” Ex. A400 at 7-8 (AU § 316.12); Tr. 821:25-822:24 (Westbrook stating that in order to provide a guarantee against fraud, auditors would “need a lot more tools like lie detector tests and subpoena power and guns and badges and all those kinds of things.”). This Court does not find this explanation credible, nor is it consistent with the previous testimony from the TBW trustee’s lawsuit. This Court heard Mr. Westbrook and Mr. Rivers testify for hours and is convinced that these gentlemen are more than capable of saying what they mean. If they had intended to say that PWC audits were not a guarantee against the possibility of material fraud, they would have testified accordingly. However, that was not their testimony. Instead, they clearly stated that PWC had no duty to detect fraud and did not design its audits to detect fraud. The Court concludes that PWC did not design its audits to detect fraud and PWC’s failure to do so constitutes a violation of the auditing standards. 

What I find interesting is that practicing auditors admitted that they don’t design their audits to detect fraud even though auditing standards clearly say that auditors are responsible to provide reasonable assurance that there are no material misstatements due to (error or) fraud. Over the past decade, including as recently as 2016, I’ve asked several audiences of auditors to answer the following true-false question: “Auditors have the responsibility to provide reasonable assurance that there are no material misstatements due to fraud.” These auditors range from staff to partners and, on average, about 50% incorrectly answer false. This is pretty disheartening to me...

Unfortunately, my experience suggests that most auditors don’t put in a lot of effort to detect material fraud. Fraud may be discussed briefly in the required brainstorming session but then quickly forgotten as the audit team gets focused on ticking and tying and trying to get some sleep during busy season. 

There are many things that auditors could do but, unfortunately, it's rare to find an auditor who is thinking beyond what they did last year. If I were king for a day, I would require auditors to do interviews with lower level people in an organization with the goal of discovering aggressive accounting or business practices. Combining interviews with strategic reasoning would potentially help auditors provide the reasonable assurance they are responsible for. For example, if strategic reasoning leads the auditors to believe revenue recognition and shipping cutoff is ripe for financial reporting fraud, auditors trained in interviewing could meet with shipping / warehouse personnel about the end of the year. Well designed questions could reveal information that could help identify control weaknesses and potential fraud. 

In any case, this case and other experiences with auditors reminds me of the 1980s when auditors put it in their engagement letters that they weren’t responsible for providing assurance for fraud. Back then, and now, the courts don’t appear to share that view. In the end, both the auditing profession and audit users end up suffering when auditors are weak in fulfilling this responsibility.

Advances in Technology for Auditing Firms: KPMG to Announce Deal with IBM Watson

A recent article in The Wall Street Journal discussed the technological improvements among auditing firms (KPMG in particular). KPMG is expected to announce an alliance with IBM to use their artificial-intelligence technology, IBM Watson, which will allow KPMG to audit all of the data for their clients rather than only samples of the data. The technology is not meant to replace human auditors, but will help them know where abnormalities may exist in the client’s books.

Doping in Sports and Financial Statement Fraud

I just read an interesting article titled: "Instead of punishing dirty cyclists, should we reward the clean?" The idea is to certify pro cyclists who are willing to be thoroughly tested for doping. The tests would go beyond what is currently used to look for drugs and involve many mechanisms to detect doping.

Regulating Audit Firms: News and a Short Wishlist

In the last week, some news agencies have reported that the PCAOB is investigating the role of auditors in the financial crisis. It appears that auditors have been able to avoid much scrutiny from the latest economic meltdown whereas when the dot-com/telecom meltdown took place around the turn of the millennium, auditors took much of the blame. Below is a rundown of the two recommended regulatory changes that are being talked about in the news followed by a short discussion of changes that I would make if I was in charge.

Lehman and EY: Maybe I spoke too soon...

In my Fraud Examination yesterday we talked about how the audit profession appears to have learned from the last economic crisis when it was heavily criticized for inadequate audit work in the frauds that came to light around the turn of the millennium. My comment was that so far, it appears that the fingers of blame for the fiascoes leading to the "Great Recession" were not pointing much toward the audit profession. Some potential exceptions include the Madoff feeder fund audits and the New Century/KPMG situation but I concluded that the auditor finger pointing is not nearly as serious this time as it was at the turn of the millennium.

Today I'm wondering if I should have waited a few hours to make such a comment since a new report was issued about the time I was in class yesterday. This report details the Lehman Brothers collapse and is very critical of EY's audits.

(You can read the 2,200 page report online; I've search for Ernst and found the examiner is very critical of the EY's audits. Also, there are numerous articles about the report and EY's role in the collapse including the WSJ and Huffington Post.)

Suffice it to say that this report says EY failed to meet professional auditing responsibilities. The issue revolves around inappropriate repurchase transactions, known as Repo 105 transactions, used to make Lehman look like it was in better condition than it really was. The report says that Lehman used these Repo 105

... transactions to temporarily remove $50 billion of assets from its balance sheet at first and second quarter ends in 2008 so that it could report significantly lower net leverage numbers than reality.

Lehman did so despite its understanding that none of its peers used similar accounting at that time to arrive at their leverage numbers, to which Lehman would be compared...

The examiner alleges that EY was told about concerns that these transactions were inappropriate but they failed to report the concerns to the Board or to adequately investigate the propriety of the transactions.

One of many damaging quotes from the report is:

There are colorable claims against Lehman's external auditor Ernst & Young for, among other things, its failure to question and challenge improper or inadequate disclosures in those financial statements.

The report explains:

In May 2008, a Lehman Senior Vice President, Matthew Lee, wrote a letter to management alleging accounting improprieties; in the course of investigating the allegations, Ernst & Young was advised by Lee on June 12, 2008 that Lehman used $50 billion of Repo 105 transactions to temporarily move assets off balance sheet and quarter end.

The next day ‐- on June 13, 2008 ‐- Ernst & Young met with the Lehman Board Audit Committee but did not advise it about Lee's assertions, despite an express direction from the Committee to advise on all allegations raised by Lee.

Ernst & Young took virtually no action to investigate the Repo 105 allegations. Ernst & Young took no steps to question or challenge the non‐disclosure by Lehman of its use of $50 billion of temporary, off‐balance sheet transactions.

Colorable claims exist that Ernst & Young did not meet professional standards, both in investigating Lee's allegations and in connection with its audit and review of Lehman's financial statements.

My guess is that now that the report has been out for more than half a day now, 25 or more class action lawsuits have been filed against EY. A report this critical is an invitation to file such lawsuits.

I was hoping that since these particular transactions were not part of last annual audit opinion (since Lehman imploded before the 2008 financial statements were issued), that EY's role may be limited. However, it appears that the transactions date back to the 4th quarter of 2007 and affected the amounts that were audited by EY (see chart at this link). In addition, quarterly 2008 filings that were reviewed by EY were involved. As such, the question to be resolved is what should EY have done when told about these transactions? Apparently, the examiner felt they didn't do their job.

This report is definitely unsettling and the ultimate responsibility of EY in the Lehman situation will likely take months, or even years, to determine. In the meantime, I'll be more careful with my comments about the audit profession's role when the next round of economic turmoil comes to light.

EY settles with the SEC

This week, the NY Times reported that the SEC reached a settlement with EY for its audits of Bally Total Fitness. The article reports that "Six current and former Ernst partners, including Randy G. Fletchall, the partner in charge of the firm’s national office, were ... sanctioned by the commission in one of its most sweeping actions against auditors involved in a failed audit." The SEC's $8.5 million settlement is reported as "one of the highest ever paid by an accounting firm.”
Here are a few quotes:

“It is deeply disconcerting that partners, even at the highest levels of E. & Y., failed to fulfill their basic obligations to the investing public by not conducting proper audits.”

“This case is a sharp reminder to outside auditors that they must carry out their duties with due diligence."

"Mr. Fletchall, who remains with Ernst, was in charge of resolving technical accounting issues in the United States ... was censured by the commission."
"A veteran S.E.C. official ... said he knew of no previous enforcement cases in which a partner of a major firm was cited for his actions as head of a national office."
"Ernst was reacting in 2002 to a growing number of accounting scandals, including Enron, and decided to get tough with clients who had previously been allowed to take aggressive accounting positions. The firm forced Bally to stop recording revenue in an improper manner that allowed it to claim earnings earlier than was allowed by accounting rule. But in doing that, the firm allowed Bally to not admit to having violated the rules in the past, an action that would have forced it to restate its accounts and admit that losses in previous years had been much larger."
"The case could provide support for reformers who have said companies should be forced to periodically change accounting firms, a change that Congress considered but rejected in passing the Sarbanes-Oxley law in 2002."

Tell us what you really think Harry...

Here's a juicy quote from Harry Markopolos regarding the SEC's ability to find fraud:

Harry Markopolos, the fraud investigator who brought his allegations to the S.E.C. about improprieties in Mr. Madoff’s business starting in 2000, testified that the agency’s staff “was not capable of finding ice cream in a Dairy Queen.”

I wonder what he thinks about the ability of independent auditors to detect fraud...I'm not trying to defend the SEC or disparage auditors but it might be interesting to evaluate the number of frauds detected as a function of resources devoted to auditing or detecting material fraud between these two institutions who are both charged with responsibilities for fraud detection: the SEC and independent auditors. Anyone have a guess as to which mechanism would have the best track record?

What do Bernie and Barry have in common?

Those of you who have studied famous fraudsters, you will know the name of Barry Minkow. Barry was the apparent whiz kid entrepreneur who started ZZZZ Best Carpet Cleaning in the 1980's. ZZZZ Best was a too-good-to-be-true business that ended up being one massive lie. A fraud that cost investors, banks and others millions of dollars when it came to light.

Enter Bernie Madoff on the scene in 2008 when the largest Ponzi scheme of all time comes to light due to the fact that the economic downturn led Madoff's investors to try to redeem too much of the $65 billion that Madoff said they had with him. Bernie could no longer find enough cash to provide the redemptions that were being requested so he confessed his crime and is now serving a 150 year sentence. Bernie's business was also one massive lie.

So what do these two fraudsters have in common? For one, they both have the initials of "BM." Interesting as it is and coincidental that this is a less than flattering acronym, that's not what I had in mind. It turns out that one key connection that they have is that the key to both these massive lies was there skill at being paperwork manufacturing machines.

This week, Madoff's top lieutenant, Frank DiPascali, admitted to creating the paperwork needed to fool about everyone but Harry Markopoulos. DiPascali provided some details to his job of "CPA" (Chief Paperwork Automator) when he admitted to his crimes this week by telling the judge: "I knew it was criminal, and I did it anyway."

Mark Morse was Minkow's chief lieutenant and once said that he could use a copy machine to create any document that anyone wanted. The key is, that's about all anyone wanted: documents.

It seems that for a truly outlandish fraud to survive, the fraudsters simply need to create paperwork. Many professions in our society put a lot of trust in seeing a document. Auditing is one profession that builds its foundation almost exclusively on paperwork.

The scary truth is that with computers and printers today, anyone with a high school education from Queens New York such as Frank DiPascali can be a paperwork manufacturing machine and create the illusion necessary to dupe so called sophisticated investors out of billions!

More on Satyam's Auditors

Following up on Satyam's auditors, the Times of India reports that Satyam was not audited by PwC (emphasis added):

The questioning of Ramesh Rajan, chairman and CEO of PricewaterhouseCoopers, India (PwC) by CBI last week, has revealed that the Satyam balance sheets were in fact audited by Lovelock & Lewes and not Price Waterhouse (PW). It is also learnt that the auditing fees, though deposited in the name of Price Waterhouse, Bangalore, was later transferred into the account of Lovelock & Lewes. "It is from here that the partners S Gopalakrishnan and Srinivas Talluri withdrew the money," sources involved in the investigation of the case told TOI.

Apart from Rajan, other senior partners of PW, from Delhi and Kolkata, were also summoned by the CBI last week. The partners denied any association with PW, Bangalore and said that Gopalakrishnan and Talluri were not entitled to sign any balance sheet on behalf of PW. "So as it turns out, the auditors who are partners with PW, Bangalore, wrongly signed under the name of PW, and also outsourced the work to Lovelock & Lewes," said sources adding that investigations confirm that the entire auditing team at Satyam is from Lovelock & Lewes.

I am left wondering how all of this could happen without the knowledge of PwC India...

Audit Quality and the PCAOB

The PCAOB, charged with oversight of public company audits, has received a great deal of criticism as of late. Clive Lennox and Jeffrey Pittman add to the debate with their paper, Auditing the auditors: Evidence on the recent reforms to the external monitoring of audit firms, which was recently accepted for publication in the Journal of Accounting and Economics (HT Harvard Law School Corporate Governance Blog).

The paper focuses on the value of PCAOB inspection reports, which have replaced peer review reports as the primary source of information about audit firm quality. The authors find that:

• PCAOB inspection reports are not a meaningful signal of audit quality to audit clients
• Peer review reports are less informative than they were prior to the initation of PCAOB inspections

These findings imply that we know less about audit quality under the current regulatory structure. This reduction in knowledge causes concern, as a strong, independent audit is a significant deterrant to fraud.

The full text of the paper can be found here.