The AGA Weblog

Audits by GAO Will Compromise Fed Independence

By: Christopher Hanks

Christopher Hanks is a mathematician and defense analyst. In his work at defense think tanks over the last 30 years, he has focused on logistics processes and models, revolving-fund operations and business reform efforts.

Triggered by the current economic difficulties, a debate is now raging about whether the Government Accountability Office (GAO) should audit Federal Reserve operations. The issue is whether GAO audits would compromise the Fed’s independence in setting and implementing monetary policy.

The Fed’s monetary-policy decisions influence the supply and flow of money in the economy. Usually the Fed is able to implement its decisions by taking actions—for example, adjusting interest rates and dictating capital-reserve levels—generally regarded as routine, even if they are not always popular. Sometimes however, as the economic developments over the two years have shown, the Fed finds itself taking highly non-routine actions—making large emergency loans to major financial institutions, for one—in order to prevent a total collapse of the economic system. As a result of actions the Fed has taken of the latter type, legislation is now making its way through Congress calling for the Fed to be audited by the GAO.

In order to decide whether GAO audits would compromise the Fed’s independence, it is first necessary to be clear about exactly what happens when the GAO “audits” a government agency. The GAO’s own website provides a commendably clear description:

“Our Work is done at the request of congressional committees or subcommittees or is mandated by public laws or committee reports. We also undertake research under the authority of the Comptroller General. We support congressional oversight by

·      auditing agency operations to determine whether federal funds are being spent efficiently and effectively;

·      investigating allegations of illegal and improper activities;

·      reporting on how well government programs and policies are meeting their objectives;

·      performing policy analyses and outlining options for congressional consideration; and

·      issuing legal decisions and opinions, such as bid protest rulings and reports on agency rules.

We advise Congress and the heads of executive agencies about ways to make government more efficient, effective, ethical, equitable and responsive.

Our work leads to laws and acts that improve government operations, saving the government and taxpayers billions of dollars.”

Bullets one and three in above description make it clear that when GAO  “audits” an agency’s operations, what it actually does are program evaluations —that is, investigations aimed at determining whether agency policies and programs are “meeting their objectives” and spending federal funds “efficiently and effectively” toward that end.

Actual financial audits, as opposed to program evaluations, did once represent the core of GAO’s work, but those days are long gone. Over the last 50 years a succession of Comptroller Generals (Elmer Staats, Charles Bowsher and David Walker )—all acting with the support of the Congress—have converted the GAO into something much more akin to a management-consulting agency rather than an accounting organization.

Indeed, as 40-year GAO veteran and director of GAO’s Office of Quality and Continuous Improvement Michael Motley noted in 2008: “At one time, GAO was mostly concerned with finances, but today only 7 percent of our work is solely financial.”

The fourth bullet in GAO’s work description above, however, is the one most critical for the current debate. As that bullet states, when GAO “audits” government agencies, it will do its own policy analysis and it will then make recommendations (“outline options”) to Congress about what needs to be done.

In other words, once it begins auditing the Fed, the GAO can be expected to begin making its own recommendations to the Congress—based on its own analysis, not the Fed’s—about what the Fed should have done (or should not have done, or should be doing) with regard to monetary-policy decisions and actions. If the Congress then enacts the GAO’s recommendations into law—as it has shown a ready willingness to do (some relevant examples are:  the FMFIA of 1982, the CFO Act of 1990, the GMRA of 1994, and the FFMIA of 1996)—control of monetary policy will have passed from the Federal Reserve to the Congress.

Given the Congress’ oft-demonstrated inability to take a disciplined approach to financial matters, that would be a disaster.

Now That The Audit Is Over, The Hard Work Begins!

By: Andrew Lewis, CGFM, CPA

Andrew Lewis is a senior manager with KPMG LLP’s government audit practice and a Fellow of the KPMG Government Institute. In addition, Andrew is president-elect of the Montgomery/Prince George’s Counties Chapter, and is an adjunct professor in the Masters of Accountancy program at The George Washington University.

For those involved in federal financial reporting, you’ve just recently or will soon complete your agency’s FY 2009 financial statement audit. And for those who perform  state and local government financial reporting, your agency’s Comprehensive Annual Financial Report (CAFR) audit and Single Audit are already in full swing or nearing completion. While many might think that the hard part is getting through the audit, they may find that the hardest part is after it is completed, when corrective actions need to be adopted.

Office of Management and Budget (OMB) Circular No. A-50, Audit Followup, provides guidance to federal employees as they’re resolving findings and implementing corrective action for most audits. Key steps for implementing corrective action required by this Circular include:

Establishing a System for Audit Follow-up:  Agencies “shall establish systems to assure the prompt and proper resolution and implementation of audit recommendations.  These systems shall provide for a complete record of action taken on both monetary and non-monetary findings and recommendations.” (Section 5)

Involving Senior Leadership of the Agency:  Agencies should designate “a top management official to oversee audit follow-up, including resolution and corrective action” and assure “that management officials throughout the agency understand the value of the audit process and are responsive to audit recommendations.” (Section 7.a)

Implementing Prompt Resolution:  Agencies shall “require prompt resolution and corrective actions on audit recommendations. Resolution shall be made within a maximum of six months . . .” (Section 8.a.2)

Looking for Trends in Audit Findings:  Agencies shall “provide for periodic analysis of audit recommendations, resolution and corrective action, to determine trends and system-wide problems, and to recommend solutions.” (Section 8.a.9)

Holding People Accountable:  Agencies shall “assure that performance appraisals of appropriate officials reflect effectiveness in resolving and implementing audit recommendations.” (Section 8.a.10)

Beyond the guidance in OMB Circular No. A-50, I would make several other recommendations: 

Hold the Process Owners Accountable:  Agencies should evaluate whether they’re holding the process owners responsible for implementing the corrective action.  For example, I’ve seen several instances in which the accountants designate themselves as the officials responsible for resolving the audit findings even though they don’t have the knowledge, authority or experience to resolve the issue. They are really serving as the liaison with the process owners, who are the only ones that can resolve the problem. Agencies should be sure to hold the process owners directly accountable for implementing corrective action.

Meet Frequently:  Frequent meetings with all of the people involved in implementing corrective actions keeps momentum going and helps ensure the right resources are focused on meeting deadlines in the agency’s corrective action plan.

Factor In Time For Training:  Sometimes agencies adopt a policy change to address a corrective action without factoring in the time it takes to train all the personnel involved in carrying out the new policy. Unfortunately, this can mean that the actual implementation of a corrective action occurs long after the policy change has been adopted. It’s better to factor in training time at the start.

Brief the Auditors Periodically:  Agencies should consider holding a forum with the auditors to explain how the agency is implementing changes to respond to the auditor’s recommendations. This would give the auditors an opportunity to explain their recommendations more fully—especially if the agency has interpreted a recommendation that differs from the auditors’ intent. 

Monitor the Effectiveness of Corrective Action Through the Agency’s OMB Circular No. A-123 Process:  OMB Circular No. A-123, Management’s Responsibility for Internal Controls, requires testing and monitoring of the operating effectiveness of the agency’s key controls. This testing and monitoring effort provides an excellent opportunity for the agency to determine whether the corrective action has been properly implemented and has effectively addressed the weakness. 

Questions for Discussion:  What other techniques do you use in your agency or have you witnessed that are effective in resolving audit findings? What are additional elements of a corrective action plan that you find effective? 

KPMG LLP, the audit, tax and advisory firm (www.us.kpmg.com), is the U.S. member firm of KPMG International. KPMG International’s member firms have 137,000 professionals, including more than 7,600 partners, in 144 countries.

This views in this essay are those of the author only, and do not necessarily represent the views or professional advice of KPMG LLP. 

Tennessee's ARRA Audit Efforts

By: Kathy Anderson, CGFM

Kathy Anderson is assistant director for communication and coordination for the Division of State Audit, Comptroller of the Treasury, State of Tennessee.

As I’m sure is the same in other audit organizations, we in the state of Tennessee have recognized the need to jump in and help ensure accountability regarding ARRA money. Now, not later. And on an ongoing basis. The expectation, not only from the federal government, but also from the citizens and from our own general assembly, is that the auditors will take extra care to ensure that internal controls are in place, ARRA funds are not misspent and that problems identified are reported immediately.

After Gov. Phil Bredesen set up the Office of Tennessee Recovery Act Management and established a czar, Comptroller Justin Wilson appointed a liaison from our office. This liaison has been largely responsible for keeping up with the centralized ARRA efforts and for updating the auditors on decisions made by the office. 

Education and Assistance

To help with accountability, the Office of the Comptroller of the Treasury is taking two approaches. We recognize the increased risks of noncompliance in the smaller governments. So we have increased our efforts to educate and assist those governments with ARRA grants to ensure the rules and expectations regarding these monies are reinforced. This educational effort has included coordination with local government assistance organizations, letters to local governments explaining expectations and available guidance, presentations, meetings and website links to appropriate guidance. 

We have continuing concerns about the money sent on to the municipal level. Our office does not directly perform the audits for municipalities. We would like to see some additional audit work and assistance at that level, but to require additional, real-time audit work from the CPA firms would inevitably result in increased audit fees—audit fees these municipalities can not afford. So we continue to strategize and to at least provide some educational assistance to the extent we have resources available.

Detection and Deterrence

Of course, nothing assists more with accountability than efforts to detect and deter. We quickly dispatched some small audit teams to look at expenditures on multiple levels. Auditors have done some quick reviews at the state level, the county level and the subrecipient level. These small audit teams are being “noisy” in their work. We want all Tennessee recipients to be on notice that we are out there looking to make sure these funds are spent appropriately and that they could be next up for a review.

These extra reviews, focused on ARRA funds, are in addition to our efforts to review internal controls and start examining compliance, largely in conjunction with the Single Audit work.  We have a very ARRA-centric approach to that work as well.

Questions

My point here is that we are pushing forward in our auditing efforts. The citizens are relying on us to do this right. The state of Tennessee is committed to compliance, and we think it is important to do what we can to assist in that effort.  And I know there is much more to be done. So my questions are:

To the government auditors—What steps are you taking to audit ARRA funds? 

To those charged to look over local governments—What steps are you taking to ensure proper accountability at the local level?

To all accountability professionals—Where are the biggest risks, in your opinion, or areas where you have already seen problems with ARRA funds? What are you doing to mitigate those risks?   

Maintaining Effective Relationships with Your Auditor

By: Andrew Lewis, CGFM, CPA

Andrew Lewis, CGFM, CPA, is a senior manager with KPMG LLP’s government audit practice and a Fellow of the KPMG Government Institute. In addition, Andrew is an adjunct professor in the Masters of Accountancy program at The George Washington University.

As we enter into the busiest months for federal financial managers and auditors, the deadline of Nov. 15 looms large before us. I know of several people in different agencies who proudly maintain a “countdown clock,” and freely remind us all of the number of days left until the end of this year’s audit and the submission of the departmental financial statements to the Office of Management and Budget (OMB).

Ahead of us are likely some long days that may include some tense discussions between auditors and management as the financial statement audits are concluded. Hopefully throughout the course of this year’s audit, your agency has developed a relationship of professionalism and rapport with your auditor. As you enter into the “busy season” for federal financial managers and auditors, I encourage you to take stock in the relationship with your auditor. Is it a healthy relationship? Is there a sense of mutual trust and respect? 

The following are just a few ideas for maintaining or improving your relationship with your auditor:

·      Do you approach the audit as a beneficial process to identifying areas for improvement? It is important to see the audit process as a step to enhancing internal controls and verifying the hard work and dedication of your agency’s personnel in maintaining accurate and timely financial information. If some in your agency approach the audit with negative perceptions, then this could impact the audit process in a variety of ways and might lead to an “overly defensive” attitude by your agency’s personnel. 

·      Do you notify your auditor of problems and issues before the auditor detects them on their own? Providing advance notice to your auditor as your agency works through key issues or encounters delays is a key attribute of an effective relationship with your auditor. In addition, be sure to invite them to briefings to explain or update them on situations that you’re actively working to resolve. 

·      Do you have a knowledgeable and capable liaison with your auditors? Your auditor does not likely have a strong grasp of the multitude of personnel who contribute to the accounting of your agency’s financial information. A key characteristic of an effective relationship with your auditor is having a knowledgeable and capable liaison who can point the auditor to the correct point of contact in your agency, and who can help “translate” the auditor’s request for information into terms or report titles that will help your agency’s personnel locate and provide the information to the auditor in a timely fashion.

·      Do you have a system or process to track requests from your auditors for documentation, meetings and information? Auditors ask a lot of questions and request a lot of information. It’s extremely helpful to have a process of maintaining control of this process through, as an example, a sequential numbering scheme of initial requests by the auditor, along with follow-on requests by the auditor. 

·      Do you have effective and worthwhile status meetings with your auditors?  I’ve heard of and witnessed audit status meetings that have gone from one extreme (over two hours long, and even discussed the debits and credits of individual accounting entries) to the other extreme (less than five minutes long, and seemed to develop into a “race” for how short the meeting could last each week). Obviously, the most effective and worthwhile status meeting is somewhere in the middle of the two extremes. In the end, do you and your agency’s senior executives walk away from each meeting with a clear and concise sense of the most urgent items that your agency needs to accomplish or provide, and the key issues that concerns the auditors to date in the audit?

·      Are key stakeholders in your agency’s audit results kept aware of issues and how they’re being resolved? Whether your agency’s stakeholders include personnel from your agency’s department-level leaders, OMB, the Government Accountability Office (GAO), congressional staffers or other partner agencies, are they kept abreast of key issues and concerns from the perspectives of both your agency’s senior leadership and your auditors? By this point in the fiscal year 2009 audits, those stakeholders should be keenly aware of the key issues that might impact their reporting processes or potential delays in your agency’s ability to complete the audit in a timely fashion.

By the way, there are 56 days (or eight weeks) until Nov. 16 (this year’s deadline to OMB since Nov. 15 falls on a Sunday). 

Questions for Discussion: What have I missed? What are some other ways that you’ve found to maintain or improve your relationship with your auditor?

KPMG LLP, the audit, tax and advisory firm (www.us.kpmg.com), is the U.S. member firm of KPMG International. KPMG International’s member firms have 137,000 professionals, including more than 7,600 partners, in 144 countries.

This essay represents the views of the author only, and does not represent the views or professional advice of KPMG LLP.

Outsourcing? How Much Do You Know About the Audit You Need?

By: Anna Miller, MA, MBA, CPA

Anna D. Gowans Miller, MA, MBA, CPA, is Director of Research for AGA. She was the researcher on a recent AGA study on the usefulness of SAS 70 audits. In a later weblog, James R. Merrill, Partner, AABS Advisory Services Ernst & Young, will discuss AICPA developments related to SAS 70. Merrill is a member of the AICPA Task Force on SAS 70 and helped Miller on the AGA research study.

In an era in which outsourcing has become an accepted and cost-conscious way to provide services such as payroll or IT support, the ability to ensure that the organization can rely on the information provided by the organization doing the servicing becomes ever more important. As long ago as 1992, the American Institute of Certified Public Accountants (AICPA) started to provide guidance for companies that outsourced their financial functions (user organizations) and companies that provided the services (service organizations) in the form of Statement on Auditing Standards (SAS) No. 70, Service Organizations. It is still the most commonly used guidance for preparing and using service organization reports and is also used in numerous countries outside the United States. 

The term “audits” in the title is a bit of a misnomer. The SAS 70 audits that service organizations contract for and that user organizations rely on are not audits as one generally understands them. The service organization decides those controls that are to be evaluated by the service organization’s auditor. Unless the organization using the services, known as the user organization, is proactive and takes an interest in the contract requirements in setting the scope of the SAS 70 audit before the SAS 70 audit is actually performed, the user organization(s) usually accepts the SAS 70 report even if it does not cover everything that may have been determined to be an important control by the user organization or its own financial auditor. Of course, the user organization could send its own auditors to the service organization to do additional work, but that costs money and time and usually the organization does not want to go that far.

Agencies of the federal government have for many years outsourced many functions. Therefore, the pace of outsourcing in the past decade has really taken off. An interesting twist is that many federal agencies provide services to other federal agencies, that is, they are the service organization for many other user organizations, which tend to be federal agencies. A service organization naturally wants to get just one SAS 70 report for its controls and hopes that all of its customer user organizations will accept the report as enough.

AGA and the Corporate Partner Advisory Group Research Program decided to look at how useful these reports are and what improvements would make them even more helpful to government entities. AGA Corporate Partner Ernst & Young LLP provided the support for the research. We interviewed many different entities and also conducted a written survey (administered online). Learn what we discovered by reading our report, SAS 70 Reports: Are They Useful and Can They Be Improved?

Work on making the SAS 70 audit product more useful has not stopped. Both the International Federation of Accountants and the AICPA have issued proposed new guidance in the form of drafts exposed for comment. One thing both have in common is that they split the overall guidance into two segments, one for the user auditor and one for the service organization and their auditor. The proposed guidance for the service organization and their auditor is slated to be under the AICPA attestation standards, which does make more sense, in my opinion. The proposed guidance for the user organization’s auditor is still under auditing standards. They can be found by going to the AICPA website.

If you have had experience with SAS 70 reports, either as a user or user auditor or as a service organization or its auditor, please tell me what you think and what improvements you would suggest.

Government Audit Committees

By: Irwin T. (Ted) David, CGFM, CPA

Irwin T. (Ted) David, CGFM, CPA, a member of AGA's Washington, D.C. Chapter,  is a retired partner with Deloitte and Touche (now Deloitte.) as well as a retired federal official. Most  recently he was Chief Financial Officer of NOAA’s National Weather Service and Acting Chief Financial Officer of NOAA. 

The private sector financial debacles of the early 21^st century resulted in sweeping corporate governance legislation known as the Sarbanes-Oxley Act of 2002 (SOX). One requirement of SOX is the expansion of audit committee responsibilities of publicly held companies.

Governments are not subject to SOX. Even so, many governments have effectively implemented audit committees. Since little is known of government audit committees, AGA has just completed a research project on the “Characteristics of Effective Audit Committee in Federal, State and Local Governments” (available from AGA).

Several organizations have published guidance useful to governments in establishing audit committees—the American Institute of Certified Public Accountants (AICPA) (for all government entities), Deloitte & Touche, LLP (for state and local governments), the Department of Defense Inspector General (for DoD entities), the Government Finance Officers Association (GFOA) (for local entities) and KPMG, LLP (one publication for state and local governments and one for federal entities). These publications reflect the diverse characteristics of government audit committees in practice.

Governments establish audit committees for many reasons, such as improved accountability and transparency, quality advice, “clout,” an independent forum for resolving issues, extension of the governing board, “a third set of eyes,” insulating the internal auditor from undue pressure, increased credibility for the internal audit and finance departments, and improved communications of financial information.

The diversity of practice provides a number of best practices and good ideas, transferrable to other governments. Perhaps the most important best practice is that governments adopt a well-thought out, complete charter for its audit committee. The most important elements of a charter relate to a clearly defined committee mission, committee responsibilities and committee membership: 

·       Generally, the mission of government audit committees falls into one or more of the following categories—Responsibility for, oversight of or advice relating to the external audit; responsibility for, oversight of or advice relating to the internal auditor; and/or advice for ensuring and/or maintaining auditable financial statements. Each potential mission includes some responsibility for internal controls and risk management.

·       The charter must also define the responsibilities or activities that the audit committee should undertake. Such articulation provides guidance for committee activities and a basis for self-evaluation.

·      Recommended committee membership and structure varies among the guidance documents and in practice. Each committee should include at least one financial expert and at least one individual who understands the audit process. Other skills may relate to particular industry or technical skills, understanding of the entity and/or presence in the community. In the government, independence of committee members is less critical than in the private sector, as demonstrated by the number of committees that include members of entity management among committee members.

Audit committee members must receive orientation and education as they assume their responsibilities. While relatively few committees provide sufficient initial orientation, several committees provide ongoing education for committee members.

Top management support is critical to the success of the audit committee. The CEO can demonstrate support by his or her presence (or that of a key aide) on the committee or as an invited guest at each meeting, by the qualifications and expertise of personnel appointed to the committee, by providing the committee with adequate resources and by implementing its recommendations.

Audit committees vary in their relationship with the external and internal auditors. Irrespective of the relationship, the committee should meet at least three times a year with the external auditor—at audit planning time, while the audit is being performed and at the conclusion of the audit. The committee should also assure continued independence of and review the external auditor’s peer review report.

The committee should review the annual audit plan of the internal audit department and may participate in the internal audit department’s risk assessment evaluation. The audit committee should review audit reports with each, or selected, auditees. Several audit committees have innovative techniques to ensure that corrective action plans are accomplished.

Some committees rely on the annual external audit and internal audits to test the adequacy of internal controls. Other committees require specific internal control reviews by entity staff and may participate in annual internal control, fraud or risk management workshops for the entity.

The research identified many other best practices, including member and chairperson recruitment, committee self-evaluation, a committee annual report, member compensation, committee letter in the entity’s annual report, fraud and ethics hot lines, enterprise risk management, access to people and data, outside consultants, executive sessions, the Annual Financial Report, the Federal Advisory Committee Act for federal executive agencies, visibility for the committee and committee meetings, among others.

Government audit committees provide valuable contributions to improving a government’s financial management and overall governance. Not all best practices or good ideas are applicable to or useful to every audit committee. Each government should evaluate the potential role of an audit committee in its environment and determine which practices and ideas may apply.

Read more about the research in AGA's Journal of Government Financial Management, Spring 2009.

 

How to Survive an IG Audit

By: Michael C. Kristek, CGFM, CFE

Michael C. Kristek, CGFM, CFE, a member of AGA’s New Mexico Chapter, retired earlier this year after 25 years of federal service and almost 70 audits. He worked most recently for the Office of Inspector General, U.S. Department of Energy.

During my 25-year auditing career I noticed that auditees often made tactical mistakes that only lengthened the audit and worked to their detriment. Of the approximately 70 audits I participated in, only one time did the auditee use the audit to improve the organization’s operations and not spend his time trying to make the audit go away. The auditee stated he knew there were problems with his organization’s operation and he wanted to find out how to fix them. We worked together and ended up with a product that was useful to both of us.

Almost directly opposite was the last audit I performed at a National Laboratory. This audit experienced resistance starting at the entrance conference. In the end, the audit still went forward and bad relations between auditors and auditee lengthened the audit. If there had been cooperation, much more could have been accomplished to benefit the American taxpayer.

To get the best possible results the auditee should follow these few simple rules:

• Accept the Audit. Federal audit organizations such as the Office of Inspectors General have their authority established in law or regulations.   They are also supported by the Obstruction of Federal Audit Act. (Title 18, Part 1, Chapter 73, Section 1516). This act states: “Whoever, with intent to deceive or defraud the United States, endeavors to influence, obstruct, or impede a Federal auditor in the performance of official duties relating to a person, entity, or program receiving in excess of $100,000, directly or indirectly, from the United States  … shall be fined under this title, or imprisoned not more than 5 years, or both.” In other words, be very careful if you fight the audit, you could be causing yourself more problems then you want and the fight may stretch out the audit longer than it would normally last.
• Don’t Play Games With Documentation. During my career I saw two different types of games—falsification of documentation and denying its existence. Both of these are major mistakes. If there are indications of falsification you may now have serious legal programs much larger than just an annoying audit.  Second, if an auditor asks for a specific document it is because they know it exists and that you should have access to it. They may already have a copy and are testing your honesty. Denying a document’s existence is not wise and will only lengthened the audit.  
• Don’t Try to Intimidate the Auditors. The auditee may attempt to control the location and time of interviews or try to over impress the auditor with his credentials. All this will do is ruin relations and lead the auditors to believe you have something to hide.
• Auditors Must Have Documentation. Often auditees have questioned why I did not just take their word for something. The simple answer is two-fold. First, my professional standards require me to have sufficient, competent and relevant information. Second, someone’s recollection or belief is not always correct and the auditor needs proof.
• The Auditors Are Not There to Get You. “Getcha” audits are a myth.  Auditors do not have the time or inclination to go after an individual. They have much more jurisdiction to cover than they could ever begin to attempt. Your program was chosen as the result of an arduous risk assessment. If the audit does not appear promising after a short time it will probably be killed. If it looks like there is an issue it will continue. Again, no one is out to get you.
• Auditors Have Different Personalities. Some auditors will be mild mannered (Clark Kent) while others will be Genghis Kahn. That is just their personality; the more aggressive auditors are no more out to get you than the milquetoast ones. They are both attempting to determine if there are problems in your operation that are significant enough to report. Don’t take any of their actions and questions personally.

The bottom line is that both sides need to cooperate. The auditors should work in an ethical manner ensuring they remain independent in all their actions while diligently examine all available documentation and information. The auditee needs to be ethical and provide complete copies of requested information. If the two parties work together then both will benefit, if they don’t the audit will take longer then necessary and the final product will not be as useful.

What is your experience?

Auditing in the 21st Century—Part II

By: Lealan Miller, CGFM

Lealan Miller, CGFM, a member of AGA’s Idaho Centennial Chapter, is a partner with Eide Bailly LLP, and a member of AGA’s National Executive Committee.

In a post on AGA’s blog  last April, I discussed a few of the issues I’ve experienced with auditing in the 21^st century. In that post I also referred to the fact that auditing in the 21^st century had significantly evolved since Rick Fair, AGA National President, presented the topic at the San Diego Professional Development Conference in 2006. Last April I could not have foreseen the developments that would continue to evolve over the past few months within this topic. It will be interesting to explore the effects the change in the financial markets, status of the economy, and the changes in the leadership of the federal government will have on auditors and their clients in the 21^st century but that will be at another time.

You will recall from my previous blog, and to be included in all future blogs, the following list of challenges and opportunities, which auditors and their clients are faced with regularly:

• Doing more with less
• Effective usage of both internal and external resources
• Creating the integrated auditor
• Adapting to new organizational environments
• “Tuning in” on an organization’s strategic relationships
• Auditing in a highly automated environment
• Effective usage of automation to audit
• Addressing management concerns with the cost and other effects of fraud
• Finding new tools to meet the audit challenge
• Meeting the challenges created by the new economy
• Generational differences (Baby Boomers, Generation X and Generation Y)

Last April I discussed the following items from the list above: “doing more with less,” “creating the integrated auditor” and “addressing management concerns with the cost and other effects of fraud.” Today I would like to address: “auditing in a highly automated environment” and “finding new tools to meet the audit challenge.”

Auditing in a Highly Automated Environment

I can honestly say that I do not have a single client that uses a paper-only financial accounting system. Further, the majority of our firm’s audit staff do not even know what green-bar paper looks like! We are not only working and auditing in a computerized accounting environment, but we are working and auditing in an environment in which many processes are becoming highly automated. The days of filing paper forms are long gone, with many local governments supporting online submission of paperwork including payments of water, sewer and trash, and requests for new service. These are only a few ways in which governments are becoming increasingly automated. The various automated systems are integrated with the accounting system, which posts the transactions to the various sub accounts, and posts the final entries to the general ledger. Gone are the days of massive paper trails, which as auditors, we were able to rely on in order to obtain sufficient evidence regarding the amounts recorded in the general ledger.

Auditors are now required to critically explore ways in which we can audit through the IT system, rather than auditing the paper trail around the IT system. IT audit specialists are now used to test IT controls and to ensure systems are integrating information and posting transactions correctly. IT audit specialists are necessary not only to document and appropriately test complex computer systems, but also in order to effectively communicate with the respective organization’s IT personnel.

As auditors in the 21^st century, it is critical that we maintain professional skepticism when dealing with automated systems, in order to not overlook risks that continue to evolve within this area. We as humans tend to get lazy, and at times are convinced that once financial information is in the IT system, the system is foolproof, and any required processing of that information will be performed properly. Unfortunately, we have all heard the stories where this is not the case; therefore, as auditors, and as government entities, we must continue to address the risks that continue to evolve within our increasingly automated accounting environments.

Finding New Tools to Meet the Audit Challenge

The previous discussion brings us to the second item, “finding new tools to meet the audit challenge.” The tools that I have found to be most effective are not necessarily new, and are highly available to auditors and government entities in order to meet the ever-evolving “audit challenge.” One tool of critical importance, and discussed in the previous topic is the use of IT specialists. IT specialists have the ability to effectively document and test transactions through the accounting IT systems, test security over the system, and to test hard and soft internal controls of the respective systems.

The amount of data that is available to auditors is becoming enormous. As a result, it is increasingly difficult to easily manage and disaggregate massive amounts of data. The use of software programs that specialize in analyzing data, performing fraud analytics and identifying transactions to be tested has provided significant assistance in auditing the data. However, as auditors we must understand the systems, and data sets to determine the appropriate methods in which to analyze data throughout the audit process.

Continuous auditing is another tool that could be implemented in the highly automated environment. This would allow the auditor to identify issues earlier, help the government entity correct internal control issues quicker, and reduce the amount of year-end audit procedures. 

This discussion is a high-level view of these topics, with many other aspects to be explored and discussed in greater detail. Unfortunately, there is neither time nor space to do so at this time.

As auditors and organizations in today’s changing environment, we experience many challenges, and I believe that these challenges are what make our jobs interesting and exciting. What are your thoughts?

Hands Free? Or Security Free? You Decide

By: Mark Abraham

Mark Abraham is an Information Technology Specialist II with the Network Security Unit, Division of State Government Accountability, Office of the State Comptroller, State of New York. He is DoD IACND Level III Certified.

The other day my father asked me to help him connect his new hands-free Bluetooth headset to smart phone so he could safely speak on the phone while driving to and from conferences. It only took a minute to get it connected and he thanked me and proclaimed, “Now I’ll be safe when I use my cell phone!” This made me think about the information security or “safety” of Bluetooth on cell phones and smart phones.

I agree that while hands-free is surely the way to go when it comes to driver safety, a few minutes on the Internet was all it took to reveal that there are a few “bugs” with Bluetooth. Within 30 minutes I had downloaded a few nifty little programs that lets me do almost whatever I want with YOUR cell phone from MY laptop, PDA, or even my own cell phone. Using freely available software, I was able to scan for and find my dad’s cell phone, bypass the password, and take complete control of his phone from outside the house. (Note: I asked his permission before “hacking” him; otherwise it would be illegal.)

Once I gained control of his cell phone I was able to see and copy his address book, view his recent call activity and text messages, and even make calls using his minutes. What are those phone companies thinking? A little more tinkering revealed that I could turn on his microphone and listen to everything that was going on in the room. The implications were nauseating. Not only can hackers steal your company’s information and your minutes, now they can eavesdrop on you too.

After a couple hours I had figured out how to extend this spy capability to the headsets themselves and I was even able to tap his car’s hands free system and listen to conversations taking place in the car. Here comes the scary part. There are freely available plans to make an antenna that will let you do all of these terrific things from up to a mile away. A MILE.

Naturally my next question was, how in the world can I prevent this? Well the two main things you can do are to disable Bluetooth until you really need it, and make sure to keep your phone software up to date.

Questions

Do you have good controls over who has access to your Bluetooth devices?

Have you audited your organization to see how Bluetooth security is being implemented?

Why Audits Fail

By: David R. Hancox, CGFM, CIA

David R. Hancox, CGFM, CIA, is director of State Audits in the New York State Comptroller's Office and on the faculty of Siena College. He is the co-author of two books on auditing and is a past president of AGA’s New York Capital Chapter, a Regional Vice President and a member AGA’s Financial Management Standards Board and its Emerging Issues Committee.

The auditing profession faces serious challenges that all of us in the accountability profession must confront and help solve.

In March 2003, the Department of Interior’s inspector general audited the Minerals Management Service’s (MMS) audit offices and discovered an organization challenged by both management and control issues. MMS auditors were responsible for monitoring the annual collection of $6 billion in royalties and fees for minerals produced from federal and Indian lands. In 2008, The IG found pervasive misconduct at one of the program offices. Nearly one-third of the 55-person audit staff accepted gifts and gratuities from oil industry officials with whom they did business.

On Sept. 14, 2008, Lehman Brothers filed for bankruptcy protection. It was the largest company failure in history—far exceeding WorldCom’s, the previous largest business failure. As of Nov. 30, 2007 though, the auditors were saying everything is fine—Lehman got a clean opinion on internal controls and on their consolidated financial position—despite the requirements of SAS 59 that auditors consider an entity’s ability to continue as an ongoing concern.

Repeatedly, auditors have failed to find the significant problems in organizations. According to the SEC, HealthSouth Corp., one of the nation's largest health care providers, overstated its earnings by at least $1.4 billion. As reported in the Wall Street Journal, Michael Vines, a bookkeeper in HealthSouth's accounting department, tried to alert outside auditors and others to the questionable practices in his accounting department, but his concerns fell on deaf ears.

Why aren’t we listening?

We haven’t been listening for years. In the famous Equity Funding fraud uncovered in 1973, the auditors didn’t detect 64,000 phony transactions with a face value of $2 billion, $25 million in counterfeit bonds, and $100 million in missing assets. What does this say about the competence of the auditors or of the credibility of the audit profession?

I’m convinced the auditing profession needs to rethink the way it does business if it is going to find the problems that exist in organizations and meet the needs of its stakeholders. Several challenges need our attention.

Auditor Independence
Most auditors argue that they are independent, but often that independence is impaired by a variety of factors that limit the ability to "call it like it is."

The decision to maintain a client because of the revenue the client's business can generate represents a subtle, but pervasive potential conflict of interest. It is a threat to auditor independence that afflicts all too many public accounting firms. It is a conflict inherent in the system we use to hire auditors.

Our independence also is affected when we allow management to sit in on interviews of agency staff or when we allow agency management to pull existing records from the files without the auditors being present. I have heard from auditors who say they are required to allow management extended time periods to pull records needed for the audit. When this happens, the auditors might as well pack up their bags and go home. Such a situation allows management to cull the records, add data that didn't exist, clear out data that is harmful, and generally sanitize the information going to the auditors.

Assessing Internal Controls
Auditors are very good at assessing control activities—the policies, procedures and segregation of duties that exist. They are reluctant to assess the control environment—including criticizing management’s attitude, philosophy, operating style and competence when necessary. Yet, most major frauds can be traced to the lack of a good control environment—not the lack of control activities. When management overrides the system of control, organizations can fail.

Although the nature of NASA's Columbia disaster and the WorldCom scandal were quite different, the root cause of each—the control environment—was remarkably similar. These events weren't caused by the lack of policies, procedures or segregation of duties. The failures resulted from a flawed control environment where management chose a certain course of action, including overriding otherwise effective policies and procedures.

Auditors’ Ethics
The auditors’ ethics are just as important as the ethics of management. We should be above reproach. In an audit the New York State Comptroller’s Office conducted of an $11 million fraud in a school district on Long Island, the partner of the CPA firm doing the financial statement audit was caught altering agency records to cover up a major scandal. He was trying to protect his reputation because he had been issuing a clean opinion on the financial statements.

When nearly one-third of the staff in the Minerals Management Service’s audit offices accepted gifts and gratuities from oil industry officials with whom they did business, there is a serious problem that affects the credibility of all of us in the accountability profession.

Verifying Transactions
We should never forget the basics of our profession. As we become more technologically proficient, it is easy to think of assets in terms of bits and bytes on a computer. Failing to verify the existence of an asset has been at the heart of many frauds that auditors missed.

In the Equity Funding case, auditors missed the ongoing fraud because they did not follow the basics of auditing. Beyond analytical reviews and examining documentation, a fundamental tenet of auditing is to verify the existence of the asset. If the auditors missed 64,000 phony insurance policies, $25 million in counterfeit bonds, and $100 million in missing assets, they simply weren't doing their jobs. In today’s environment with color copiers, color printers, scanners and access to corporate logos on the Internet, it is even easier to manufacture documents.

Questions
Are we really free from personal, external and organizational impairments related to our audit work, whether government or public? Do you think we too often forget the basics of our profession including assessing controls properly? Are we always verifying the substance of the transactions we review or are we focused on documentation?