Auditing started as the systematic verification of books and accounts, including vouchers and other financial or legal records, of a physical or juridical person. The lion’s share in this work was in accounting, but over the past 10 years, this func- tion of verification has been extended to cover internal control (see Chapter 16), therefore organizational and operational issues. Auditing and internal control should not be confused even if, as Figure 17.1 shows, they tend to overlap in some of the notions and functions underpinning them.
Not only is auditing classically seen under the more confined perspective of books and accounts, casting upon itself the task of in-depth examination of accounts, in the most modern approach, this activity of thorough analysis also includes inter- nal control. By contrast, as the reader will recall from the previous chapter, internal control’s purpose is that of determining integrity and compliance of all activities, including matters connected to ethics limits, and risk management.
Within the perspective discussed in the preceding paragraphs, it is most impor- tant to appreciate that auditing is no general review and survey. Its mission is to
perform a detailed analysis of every book, and of every business transaction in it. While some experts say that an audit is completely analytical, the fact remains that it consists of both:
● Analysis of accounts, and
● Interpretation of facts and figures.
Subsequent to the audit, the audited entity receives a report that contains opin- ion(s) and analytical figures, as well as information and reactions that cast light on the firm’s accounts. These opinions may not be otherwise available, or they may not be duly appreciated at the level of the board, the chief executive officer, and his or her immediate assistants.
Put simply, the auditing process looks after presence or absence of what is ‘nor- mal’ and ‘expected’, and its negation. Is anyone deliberately suppressing control data? Is anyone falsifying records? Are the company’s financial reports depend- able? Is there any disaster brewing? How much may this harm the firm?
AUDITING INTERNAL
CONTROL
DISTINCT FUNCTIONS OF AUDITING
DISTINCT INTERNAL CONTROL FUNCTIONS
COMMON GROUND
Figure 17.1 The concepts underpinning internal control and audit tend, up to a point, to overlap
● If the audit is unqualified, this means that experts involved in the process did not uncover something wrong.
● By contrast, if the audit is qualified, then the company’s books and accounts aren’t working like clockwork.
The qualification attached to the audit tells its reader what is wrong with the accounts and how bad the case may be. Once this has been stated, rigorous measures must be taken by senior management to redress the situation, redo the accounts, and punish those responsible. This is part of the process managed by the Audit Committee, whose importance has been detailed in section 2.
Precisely because auditing offers top management and the regulators the benefits of an independent review, its principles and conduct have to be beyond reproach. This is a matter of virtue. And it is also an issue of skills, since the domain in which auditing is exercised has expanded past accounting statements and financial operations into other complex ramifications of management prac- tice, which itself has felt the impact of:
● Globalization
● Rapid product innovation
● Deregulation and reregulation, and
● The aftermath of a fast advancing technology.
Like all other professionals, auditors and their produce have to be regulated.
Almost all accounting firms that audit US companies quoted in the exchanges have been subject to self-regulation by the American Institute of Certified Public Accountants (AICPA), the auditors’ main professional body. AICPA has sensed that the debacle at Enron, Arthur Andersen (Enron’s auditors), and other cases are likely to lead to questions about whether self-regulation is effective in:
● Upholding audit standards, and
● Preventing conflicts of interest.
Shortly after Enron’s bankruptcy, the then Big Five (now Big Four) global audit firms, issued a highly unusual joint statement acknowledging that changes to the system were needed, but they also said self-regulation was ‘right for investors, the profession and the financial markets’. American supervisors did not think the same way.
In the United States, the auditing profession features many more firms than the big certified public accountants (CPAs). AICPA has been monitoring the quality of
audits by some 1300 firms through a programme of peer reviews every three years. It also inquires into cases in which lawsuits are filed alleging audit failure.
In 1999 and 2000 peer reviews covered 441 firms and led AICPA to issue 67 instructions for action to improve deficiencies. Recommendations have included:
● Education programmes
● Continuous monitoring of firms’ performance, and
● Employment of outside consultants to help in correcting outstanding auditing or procedural problems.
In the United States, this self-regulatory process is scrutinized from outside by the Public Oversight Board (POB), a five-member body set up in the late 1990s that theoretically is independent, but has been criticized as ineffective. Critics say that the POB, funded by the accounting firms, has been a weak supervisor and has hues of conflict of interest. Therefore, following the Arthur Andersen scam the government set up a new supervisory authority for accountants, under the authority of the Securities and Exchange Commission.
The first case the Public Interest Oversight Board (PIOB) – the new watchdog of the accounting and auditing profession – brought against CPAs came on 8 July 2005. This case, which has not yet been defined, concerns the Deloitte & Touche audit of Navistar accounts. (Navistar is a premier American agricultural equip- ment manufacturer.)
Between Enron and Navistar there have been many other cases involving the audit- ing connection. In December 2001, in the UK, the High Court approved an agree- ment for Coopers & Lybrand (now part of PriceWaterhouseCoopers) to pay £65 million (then $100 million) to KPMG, Baring’s new liquidator, which represented creditors claiming a total of £200 million (then $300 million). Ernst & Young, Barings’ liquidator until September 2000, had made a £1 billion ($1.42 billion) High Court claim against Coopers & Lybrand and Deloitte & Touche, the bank’s auditors.
The High Court has also been hearing the remaining case against Deloitte, which audited Barings’ Singapore subsidiary and, like Coopers, denied negligence.
Deloitte and Coopers argued that the blame for failing to spot the fraudulent trad- ing of Nick Leeson, a Singapore-based trader, lay with Barings’ management, not with the auditor. In reality, it lay with both.
Part of the problem with CPAs when acting as external auditors is that they make more money from consulting and tax advising than from accounting and auditing – with the same client. It is a human tendency, fairly easy to explain, to weight
one’s interests in relation to one’s income. How much each of these three functions represented as of December 2001 for the then Big Five, is shown in Table 17.1.
Because conflicts of interest have a nasty habit of growing as the business rela- tionship between auditor and audited company gets stronger, some experts advise changing the auditor firm every few years, so that it does not have the time to grow roots at the client’s site. Several companies have started doing so.
An interesting case pointing to the wisdom of such a policy took place in Brazil.
In 1999, Comissao de Valores Mobiliarios (CVM), Brazil’s securities commission, published a requirement that companies should change their auditors every three or four years. This ruling faced strong opposition in courts from the then Big Five accounting firms and its implementation was derailed. But there was a good reason for such a ruling, as has been revealed post mortem.
Brazil’s capital markets are tiny compared with America’s, but all capital markets face similar challenges, as José Luiz Osorio, Chairman Comissao de Valores Mobiliarios, stated in a letter to Business Week. Since the disasters from creative accounting have no frontiers, during the mid-1990s, two of the largest Brazilian banks required central bank intervention after serious accounting issues were uncovered. These had been going on for some time. On 14 May 1999, the CVM published Instruction 308, requiring that:
● Companies periodically change their auditors, and
● For any practical purpose, auditing be separated from consulting services.
The Brazilian accounting companies’ union challenged CVM in the courts and, in a separate action, a major public accountant also challenged CVM in court for the same reasons. At the time Enron was still a disaster waiting to happen but,
Table 17.1 The conflict of interest in consulting vs. auditing: breakdown of gross fees as of December 2001
Consulting (%) Accounting and auditing (%) Tax advising (%)
PwC 49 33 18
Deloitte & Touche 45 33 22
Ernst & Young 26 44 30
Arthur Andersen 22 46 32
KPMG 18 44 38
as we know today, that eventual debacle provided the best ever proof of the need for an arm’s length relationship between CPAs.
The creative accounting, and therefore trickery, with Enron’s financial state- ments is now a legend. As the statistics in Figure 17.2 show, income overstate- ments were not an accident but a policy executed year-after-year. Ironically, this policy of overstatements was rampant when things were going well. After that, financial reporting became more factual but it was too late to save the company and its stakeholders from the abyss.