One of the critical components of an effective internal control system is the elaboration and implementation of a structure which not only makes feasible, but also promotes, the immediate remedial actions which must
Senior Managemen t ResponsibHides 153 follow internal control findings. Only then can the risks encountered in the execution of a company's strategies and objectives remain under control.
Furthermore, the institution's internal control system needs to be frequently revisited to appropriately address any new or previously uncontrolled risk and/or sources of fraud.
Previously unknown sources of fraud come up all the time, particularly connected with new products and services. For instance, fraud with cards is not new, but in January 2000 in France developed a new species as the main three wireless companies offered the possibility to download credits from one's bank account to pay for telephone services - doing so without PIN protection. Because when one pays with a credit card the merchant's slip shows the card number and such slips are usually throw-away items, the fraud consisted in recovering these sales slips and using the credit card number for downloading. Such charges were evidently unknown to the card's legal owner. Some 50 000 card holders were taken to the cleaners with charges worth beyond Fr. 30 million ($5 million). For some people, the surprise bill run up to Fr. 13,000 ($2,150).
It is part of senior management's responsibility to see to it that the internal control system is regularly revamped to keep it up to date, reflecting product and process changes. Such a steady process of revaluation and restructuring has been made necessary because of financial innovation. Every dynamic organization has to reinvent itself in order to survive. Therefore, it needs to rethink its products, its markets, its structure, its systems, and its procedures as new business opportunities come onstream. Control processes are inseparable from the exploitation of market opportunities.
• A dynamic market does not present only opportunities but also a range of possible problems, from misunderstandings by customers to unwarranted exposure and operational failures.
• New risks can often best be comprehend when considering how various scenarios affect cash flow, earnings and different types of exposure, in the short and in the longer term.
The so-called "Asian Tigers' (Thailand, Malaysia, Indonesia, South Korea, among others) offer a good example of unwarranted exposure. To a very substantial measure, the 1997-98 crisis in East Asia was caused by inadequate internal control at both company and government level - and by
154 Management Appraisal and Accountability
substandard risk management tools and methods in the massive short-term bank-to-bank international capital movements. Because of their failure to match financial innovation with sharper internal control, many parties lost lots of money:
• Red ink flowed. The Japanese, European, and American banks which had unwisely lent huge sums to the Tigers' banks and companies, had to face hefty losses.
• The East Asian economies themselves were penalized by a gross devaluation of their currencies, a mountain of foreign debt, and sharp drop in their stock markets.
The magnitude of the downturn in Asia caught everyone by surprise because most people did not realize that today's global economy is more integrated than ever before. The freedom of capital and currency movement causes a great deal of volatility in the markets, and the main players have been exposed without appropriate internal controls which are established at the centre but must be present at every corner of operations.
One of the lessons to be learned from the Asian meltdown is that while each company must have first-class internal controls, the globalization of financial business creates a need for individual controls to work together as a system. Cross-border exposure increases not only because of deregulation but also because the products and services offered by banks are becoming:
• More complex
• More exotic and
• More universal.
Since supervisory authorities tacitly or explicitly approve dealing in high- risk financial instruments, it is part of everybody's duty to assure that internal controls are in place and that they have the sophistication necessary to immediately report exposure embedded in each and every financial transaction. If this calls for a thorough restructuring, so be it.
Organizational restructuring and a radical revamping of information technology should move in tandem. Intelligent networks, for example, magnify a bank's reach and make its business much more rewarding in terms of business opportunities. But technology should also be used as the mind's eye in risk management. It is unrealistic to expect that every single executive and every single professional will keep tags on every single
Senior Management Responsibilities 155 trade. Even if this were feasible, the global pattern would be missing.
Therefore, internal control must:
• Highlight every exception and provide documentation on every variance.
• Compute trends and patterns permitting us to judge individual and cumulative exposure.
• Make it possible for every manager to focus on detail, in order to evaluate outstanding risk or likelihood of fraud.
To improve accuracy in prognostication, we must focus internal control not only on foreground but also on background reasons; visualize results in a way that they become more comprehensible; and audit the way the system works to ascertain that it functions satisfactorily. A great deal of attention should also be paid to the synergy between internal and external controls - the former are exercised by top management, the latter by supervisors (see Chapter 14).
This emphasis on both foreground and background reasons for exposure is commensurate with the fact that the surge in interest for internal control in the late 1990s was a direct result of very important losses incurred by several companies during that decade. Many of these losses could probably have been avoided if senior management had established and maintained an effective system of internal controls enabling early detection of the problems being faced - and hence limiting the amount of damage.
In conclusion, thoroughly studied and properly established internal controls are the best guarantee that our company will sustain its profitability in the longer term, controlling risk by maintaining a rapid, reliable reporting system. A solution permitting interactive presentation of internal control intelligence also helps to assure that our organization complies with laws and regulations and that the risk of unexpected losses or reputational damages is minimized.
BEWARE OF CREATIVE ACCOUNTING: IT IS POISON TO INTERNAL CONTROL
Part 1 brought to the reader's attention the fact that even the most perfect internal control system is vulnerable two problems: obsolescence of the tools, procedures and systems on which it rests; and tinkering by insiders and outsiders, which creates temporary or permanent damage. The
156 Management Appraisal and Accountability
accounting system should be seen by everybody as a most critical element because in prudential management:
• It serves for both measurement and monitoring of exposure and
• It constitutes the basis of reliable financial reporting (Chorafas, 2000a).
But there is a catch. Not only accounting rules and regulations vary from one jurisdiction to another, as we saw in Chapter 3, but also sometimes these rules allow certain freedoms some companies are only too happy to exploit. There are also, so to speak, trends in business which create conditions inducing the board to lose control over what is going on.
'Years of rising land and commodity prices had distilled the idea that debt was a blessing,' says James Grant (1992), who cites the case of 37 primary banks of the Farm Credit System and their hundreds of outlets run by local boards elected by farmers. The farmers saw the riches inflation brought to their door but not the risks, and they borrowed in a big way. As part of this dreamland, 'Corners were cut, rules bent, and exemptions admitted . . . the system in 1986 was permitted to employ accounting techniques to postpone the recognition of loss.'
But the day of reckoning did come, as invariably always happens, and business failures hit the roof. The process James Grant describes is the so- called creative accounting, which specializes in money of the mind and has many tricks in its bag. Italy's Fininvest, for instance, concedes that from firms in which it has a 20-50 per cent share, it consolidates profits according to its proportion of the equity. But it does not consolidate their debts.
One of the areas where creative accounting biases facts and figures is in how the value of assets is computed. When in the late 1980s Credit Lyonnais went in a global buying spree and granted big loans left, right, and centre, its main shareholder (the French government) bloated the bank's balance sheet by transferring the equity of other nationalized companies valued at unrealistic prices. In Fininvest's case, too, analysts said that values of assets, particularly its television rights, were way too high. Although Fininvest reported that shareholders' funds were 1.5 trillion lire ($810 million), other information suggested that //'this were adjusted for Fininvest's:
• higher true debt and
• lower true book value for its assets,
Senior Management Responsibilities 157 then the true figure for shareholders' funds was not very positive. This is, of course, of concern not only to shareholders but also to other stakeholders like Fininvest's creditor banks, which included Banca di Roma, Banca Commerciale Italiana, and Cariplo. (The first two are closely connected with Mediobanca, Italy's major merchant bank.) Because Fininvest's debt was mostly in form of short-term loans with an average maturity of 26 months, the banks could exert continuous pressure on the company if they wanted to read what lay behind creative accounting practices:
• Creative accounting filters through the cracks of laws and regulations.
• In many cases, it is not illegal in the strict sense of the term, and it is rather widely practised.
Here is another example. On Wall Street, maintaining a high stock price is the key to corporate success. Aggressive accounting practices reduce the impact of a buying binge on earnings. For instance, in an act of creative accounting Softbank decided to write off $2.7 billion in goodwill from its Ziff-Davis and Comdex buyouts over 30 years rather than the more conventional 10-15 years. Tf they wrote off the goodwill over 10 years, they would barely be profitable,' Jonathan Dobson, a fund manager with Jardine Fleming Investment Management's OTC Fund, who in July 1996 dumped his $30 million stake, about 5 per cent of his total Japan holdings, figures (Business Week, 12 August 1996). It is therefore not surprising that many serious analysts and investors look at creative accounting as a source of unreliability in financial reporting.
These examples should ring a bell for the careful reader who will appreciate that there is a dual danger connected with internal control. The one comes from breathtaking complacency of boards of directors, CEOs and senior managers who operate through highly leveraged instruments without appreciating that exposure can bring the company to its knees - the LTCM-type risk. The other is putting creative accounting into the picture, which makes a mockery of internal control.
In conclusion, in terms of senior management responsibilities there is no substitute for internal control intelligence which is factual and documented.
A few of the executives I met in the course of my research said that they can move through phone calls a better supervision than any accounting figures would provide. This is not a serious argument, particularly for a big company. As the Romans proved over 500 years ago, the only way to
158 Management Appraisal and Accountability
defend a far-flung empire is to have a strong mobile force able to deploy rapidly, using internal lines to any threatened point on the perimeter:
• The mobile force is the internal auditors (see Chapter 1) and
• The internal lines are those provided by internal controls.
Fragmentation of effort and some phone calls now and then; interruption of the internal lines through creative accounting; patchy auditing; and a lack of real internal control intelligence lead to unmitigated disaster. Doing away with internal controls, or bypassing them where they exist, is dangerous nonsense. Sooner rather than later the company will pay dearly for this state of affairs and for mismanagement - which speaks volumes for the board's responsibilities, as Chapter 7 documents.
7 Internal Control
Implementation Must Focus on Core Functions
INTRODUCTION
Chapter 1 explained that auditing is a core function for any company, no matter the business it is in. Chapter 2 made the point that internal control, too, is core to any enterprise. It was also stated that fraud has been one of the first reasons why a company needed a reliable internal control system, but today a more important background reason is exposure to credit risk, market risk, operations risk, and other risks.
Chapter 1 insisted that internal control must be audited, and presented the requirements to be satisfied by a dependable auditing function. One of these requirements is internal discipline and self-appraisal. Whatever activities they undertake, companies run the risk of losses arising from failure to apply adequate internal control. In its more classical form its implementation includes the principles of:
• A dual control basis
• Separation of functions
• Establishment of exposure limits
• Internal auditing and
• Rigorous risk management.
The absence of self-discipline imposed by the board gives rise to the risk that the different layers of bank management do not exercise sufficient control over daily operations, and the auditors may not pay enough attention to whether the activities taking place comply with rules of governance and regulatory directives.
Chapter 2 made reference to the steps involved in internal control implementation. It also made the point that failure to apply an effective internal control system means that the board, CEO, and senior management have no sound basis for planning, monitoring, and controlling the different exposures to which the market subjects the bank. Nor are they informed about fraud in a timely manner, whether this originates from inside or outside the entity.
159
160 Management Appraisal and Accountability
Chapter 3 brought to the reader's attention the fact that dependable accounting systems must be in place to enable independent checking, reconciliation, and compliance procedures to be carried out with regard to the detection of potential losses. Without a system of checks and balances thoroughly studied and implemented, the risk of fraud and of inordinate exposure will increase as a function of time.
Bank boards and senior managers need both formal policies and timely controls to govern all trading, lending, and investment activities, particularly when the market demands quick decisions. For the same reasons, companies need to re-examine the structure of their internal control and accounting systems, as well as their information technology supports. The infrastructure must be evaluated to ensure that all information is in place for a decision to be taken, after due appreciation of risks.
These statements are valid for every company and every function, but it is no less true that one should not spread the human resources and technological supports too thin. Therefore, this chapter emphasizes the need to account first and foremost for core functions. The best bet is that core functions will be the first to suffer important damage from inadequate control.
The damage to a company's core business is bound to grow as the market becomes increasingly more demanding and complex. Therefore, appropriate internal controls and sophisticated information technology must be in place to ensure that the entity's core activities, whatever their nature, are properly kept within limits established at senior level, and that all actual and potential exposures can be measured and verified in real- time, and corrective action taken.