The AGA Weblog

Maintaining Effective Relationships with Your Auditor

By: Andrew Lewis, CGFM, CPA

Andrew Lewis, CGFM, CPA, is a senior manager with KPMG LLP’s government audit practice and a Fellow of the KPMG Government Institute. In addition, Andrew is an adjunct professor in the Masters of Accountancy program at The George Washington University.

As we enter into the busiest months for federal financial managers and auditors, the deadline of Nov. 15 looms large before us. I know of several people in different agencies who proudly maintain a “countdown clock,” and freely remind us all of the number of days left until the end of this year’s audit and the submission of the departmental financial statements to the Office of Management and Budget (OMB).

Ahead of us are likely some long days that may include some tense discussions between auditors and management as the financial statement audits are concluded. Hopefully throughout the course of this year’s audit, your agency has developed a relationship of professionalism and rapport with your auditor. As you enter into the “busy season” for federal financial managers and auditors, I encourage you to take stock in the relationship with your auditor. Is it a healthy relationship? Is there a sense of mutual trust and respect? 

The following are just a few ideas for maintaining or improving your relationship with your auditor:

·      Do you approach the audit as a beneficial process to identifying areas for improvement? It is important to see the audit process as a step to enhancing internal controls and verifying the hard work and dedication of your agency’s personnel in maintaining accurate and timely financial information. If some in your agency approach the audit with negative perceptions, then this could impact the audit process in a variety of ways and might lead to an “overly defensive” attitude by your agency’s personnel. 

·      Do you notify your auditor of problems and issues before the auditor detects them on their own? Providing advance notice to your auditor as your agency works through key issues or encounters delays is a key attribute of an effective relationship with your auditor. In addition, be sure to invite them to briefings to explain or update them on situations that you’re actively working to resolve. 

·      Do you have a knowledgeable and capable liaison with your auditors? Your auditor does not likely have a strong grasp of the multitude of personnel who contribute to the accounting of your agency’s financial information. A key characteristic of an effective relationship with your auditor is having a knowledgeable and capable liaison who can point the auditor to the correct point of contact in your agency, and who can help “translate” the auditor’s request for information into terms or report titles that will help your agency’s personnel locate and provide the information to the auditor in a timely fashion.

·      Do you have a system or process to track requests from your auditors for documentation, meetings and information? Auditors ask a lot of questions and request a lot of information. It’s extremely helpful to have a process of maintaining control of this process through, as an example, a sequential numbering scheme of initial requests by the auditor, along with follow-on requests by the auditor. 

·      Do you have effective and worthwhile status meetings with your auditors?  I’ve heard of and witnessed audit status meetings that have gone from one extreme (over two hours long, and even discussed the debits and credits of individual accounting entries) to the other extreme (less than five minutes long, and seemed to develop into a “race” for how short the meeting could last each week). Obviously, the most effective and worthwhile status meeting is somewhere in the middle of the two extremes. In the end, do you and your agency’s senior executives walk away from each meeting with a clear and concise sense of the most urgent items that your agency needs to accomplish or provide, and the key issues that concerns the auditors to date in the audit?

·      Are key stakeholders in your agency’s audit results kept aware of issues and how they’re being resolved? Whether your agency’s stakeholders include personnel from your agency’s department-level leaders, OMB, the Government Accountability Office (GAO), congressional staffers or other partner agencies, are they kept abreast of key issues and concerns from the perspectives of both your agency’s senior leadership and your auditors? By this point in the fiscal year 2009 audits, those stakeholders should be keenly aware of the key issues that might impact their reporting processes or potential delays in your agency’s ability to complete the audit in a timely fashion.

By the way, there are 56 days (or eight weeks) until Nov. 16 (this year’s deadline to OMB since Nov. 15 falls on a Sunday). 

Questions for Discussion: What have I missed? What are some other ways that you’ve found to maintain or improve your relationship with your auditor?

KPMG LLP, the audit, tax and advisory firm (www.us.kpmg.com), is the U.S. member firm of KPMG International. KPMG International’s member firms have 137,000 professionals, including more than 7,600 partners, in 144 countries.

This essay represents the views of the author only, and does not represent the views or professional advice of KPMG LLP.

Outsourcing? How Much Do You Know About the Audit You Need?

By: Anna Miller, MA, MBA, CPA

Anna D. Gowans Miller, MA, MBA, CPA, is Director of Research for AGA. She was the researcher on a recent AGA study on the usefulness of SAS 70 audits. In a later weblog, James R. Merrill, Partner, AABS Advisory Services Ernst & Young, will discuss AICPA developments related to SAS 70. Merrill is a member of the AICPA Task Force on SAS 70 and helped Miller on the AGA research study.

In an era in which outsourcing has become an accepted and cost-conscious way to provide services such as payroll or IT support, the ability to ensure that the organization can rely on the information provided by the organization doing the servicing becomes ever more important. As long ago as 1992, the American Institute of Certified Public Accountants (AICPA) started to provide guidance for companies that outsourced their financial functions (user organizations) and companies that provided the services (service organizations) in the form of Statement on Auditing Standards (SAS) No. 70, Service Organizations. It is still the most commonly used guidance for preparing and using service organization reports and is also used in numerous countries outside the United States. 

The term “audits” in the title is a bit of a misnomer. The SAS 70 audits that service organizations contract for and that user organizations rely on are not audits as one generally understands them. The service organization decides those controls that are to be evaluated by the service organization’s auditor. Unless the organization using the services, known as the user organization, is proactive and takes an interest in the contract requirements in setting the scope of the SAS 70 audit before the SAS 70 audit is actually performed, the user organization(s) usually accepts the SAS 70 report even if it does not cover everything that may have been determined to be an important control by the user organization or its own financial auditor. Of course, the user organization could send its own auditors to the service organization to do additional work, but that costs money and time and usually the organization does not want to go that far.

Agencies of the federal government have for many years outsourced many functions. Therefore, the pace of outsourcing in the past decade has really taken off. An interesting twist is that many federal agencies provide services to other federal agencies, that is, they are the service organization for many other user organizations, which tend to be federal agencies. A service organization naturally wants to get just one SAS 70 report for its controls and hopes that all of its customer user organizations will accept the report as enough.

AGA and the Corporate Partner Advisory Group Research Program decided to look at how useful these reports are and what improvements would make them even more helpful to government entities. AGA Corporate Partner Ernst & Young LLP provided the support for the research. We interviewed many different entities and also conducted a written survey (administered online). Learn what we discovered by reading our report, SAS 70 Reports: Are They Useful and Can They Be Improved?

Work on making the SAS 70 audit product more useful has not stopped. Both the International Federation of Accountants and the AICPA have issued proposed new guidance in the form of drafts exposed for comment. One thing both have in common is that they split the overall guidance into two segments, one for the user auditor and one for the service organization and their auditor. The proposed guidance for the service organization and their auditor is slated to be under the AICPA attestation standards, which does make more sense, in my opinion. The proposed guidance for the user organization’s auditor is still under auditing standards. They can be found by going to the AICPA website.

If you have had experience with SAS 70 reports, either as a user or user auditor or as a service organization or its auditor, please tell me what you think and what improvements you would suggest.

Government Audit Committees

By: Irwin T. (Ted) David, CGFM, CPA

Irwin T. (Ted) David, CGFM, CPA, a member of AGA's Washington, D.C. Chapter,  is a retired partner with Deloitte and Touche (now Deloitte.) as well as a retired federal official. Most  recently he was Chief Financial Officer of NOAA’s National Weather Service and Acting Chief Financial Officer of NOAA. 

The private sector financial debacles of the early 21^st century resulted in sweeping corporate governance legislation known as the Sarbanes-Oxley Act of 2002 (SOX). One requirement of SOX is the expansion of audit committee responsibilities of publicly held companies.

Governments are not subject to SOX. Even so, many governments have effectively implemented audit committees. Since little is known of government audit committees, AGA has just completed a research project on the “Characteristics of Effective Audit Committee in Federal, State and Local Governments” (available from AGA).

Several organizations have published guidance useful to governments in establishing audit committees—the American Institute of Certified Public Accountants (AICPA) (for all government entities), Deloitte & Touche, LLP (for state and local governments), the Department of Defense Inspector General (for DoD entities), the Government Finance Officers Association (GFOA) (for local entities) and KPMG, LLP (one publication for state and local governments and one for federal entities). These publications reflect the diverse characteristics of government audit committees in practice.

Governments establish audit committees for many reasons, such as improved accountability and transparency, quality advice, “clout,” an independent forum for resolving issues, extension of the governing board, “a third set of eyes,” insulating the internal auditor from undue pressure, increased credibility for the internal audit and finance departments, and improved communications of financial information.

The diversity of practice provides a number of best practices and good ideas, transferrable to other governments. Perhaps the most important best practice is that governments adopt a well-thought out, complete charter for its audit committee. The most important elements of a charter relate to a clearly defined committee mission, committee responsibilities and committee membership: 

·       Generally, the mission of government audit committees falls into one or more of the following categories—Responsibility for, oversight of or advice relating to the external audit; responsibility for, oversight of or advice relating to the internal auditor; and/or advice for ensuring and/or maintaining auditable financial statements. Each potential mission includes some responsibility for internal controls and risk management.

·       The charter must also define the responsibilities or activities that the audit committee should undertake. Such articulation provides guidance for committee activities and a basis for self-evaluation.

·      Recommended committee membership and structure varies among the guidance documents and in practice. Each committee should include at least one financial expert and at least one individual who understands the audit process. Other skills may relate to particular industry or technical skills, understanding of the entity and/or presence in the community. In the government, independence of committee members is less critical than in the private sector, as demonstrated by the number of committees that include members of entity management among committee members.

Audit committee members must receive orientation and education as they assume their responsibilities. While relatively few committees provide sufficient initial orientation, several committees provide ongoing education for committee members.

Top management support is critical to the success of the audit committee. The CEO can demonstrate support by his or her presence (or that of a key aide) on the committee or as an invited guest at each meeting, by the qualifications and expertise of personnel appointed to the committee, by providing the committee with adequate resources and by implementing its recommendations.

Audit committees vary in their relationship with the external and internal auditors. Irrespective of the relationship, the committee should meet at least three times a year with the external auditor—at audit planning time, while the audit is being performed and at the conclusion of the audit. The committee should also assure continued independence of and review the external auditor’s peer review report.

The committee should review the annual audit plan of the internal audit department and may participate in the internal audit department’s risk assessment evaluation. The audit committee should review audit reports with each, or selected, auditees. Several audit committees have innovative techniques to ensure that corrective action plans are accomplished.

Some committees rely on the annual external audit and internal audits to test the adequacy of internal controls. Other committees require specific internal control reviews by entity staff and may participate in annual internal control, fraud or risk management workshops for the entity.

The research identified many other best practices, including member and chairperson recruitment, committee self-evaluation, a committee annual report, member compensation, committee letter in the entity’s annual report, fraud and ethics hot lines, enterprise risk management, access to people and data, outside consultants, executive sessions, the Annual Financial Report, the Federal Advisory Committee Act for federal executive agencies, visibility for the committee and committee meetings, among others.

Government audit committees provide valuable contributions to improving a government’s financial management and overall governance. Not all best practices or good ideas are applicable to or useful to every audit committee. Each government should evaluate the potential role of an audit committee in its environment and determine which practices and ideas may apply.

Read more about the research in AGA's Journal of Government Financial Management, Spring 2009.

 

How to Survive an IG Audit

By: Michael C. Kristek, CGFM, CFE

Michael C. Kristek, CGFM, CFE, a member of AGA’s New Mexico Chapter, retired earlier this year after 25 years of federal service and almost 70 audits. He worked most recently for the Office of Inspector General, U.S. Department of Energy.

During my 25-year auditing career I noticed that auditees often made tactical mistakes that only lengthened the audit and worked to their detriment. Of the approximately 70 audits I participated in, only one time did the auditee use the audit to improve the organization’s operations and not spend his time trying to make the audit go away. The auditee stated he knew there were problems with his organization’s operation and he wanted to find out how to fix them. We worked together and ended up with a product that was useful to both of us.

Almost directly opposite was the last audit I performed at a National Laboratory. This audit experienced resistance starting at the entrance conference. In the end, the audit still went forward and bad relations between auditors and auditee lengthened the audit. If there had been cooperation, much more could have been accomplished to benefit the American taxpayer.

To get the best possible results the auditee should follow these few simple rules:

• Accept the Audit. Federal audit organizations such as the Office of Inspectors General have their authority established in law or regulations.   They are also supported by the Obstruction of Federal Audit Act. (Title 18, Part 1, Chapter 73, Section 1516). This act states: “Whoever, with intent to deceive or defraud the United States, endeavors to influence, obstruct, or impede a Federal auditor in the performance of official duties relating to a person, entity, or program receiving in excess of $100,000, directly or indirectly, from the United States  … shall be fined under this title, or imprisoned not more than 5 years, or both.” In other words, be very careful if you fight the audit, you could be causing yourself more problems then you want and the fight may stretch out the audit longer than it would normally last.
• Don’t Play Games With Documentation. During my career I saw two different types of games—falsification of documentation and denying its existence. Both of these are major mistakes. If there are indications of falsification you may now have serious legal programs much larger than just an annoying audit.  Second, if an auditor asks for a specific document it is because they know it exists and that you should have access to it. They may already have a copy and are testing your honesty. Denying a document’s existence is not wise and will only lengthened the audit.  
• Don’t Try to Intimidate the Auditors. The auditee may attempt to control the location and time of interviews or try to over impress the auditor with his credentials. All this will do is ruin relations and lead the auditors to believe you have something to hide.
• Auditors Must Have Documentation. Often auditees have questioned why I did not just take their word for something. The simple answer is two-fold. First, my professional standards require me to have sufficient, competent and relevant information. Second, someone’s recollection or belief is not always correct and the auditor needs proof.
• The Auditors Are Not There to Get You. “Getcha” audits are a myth.  Auditors do not have the time or inclination to go after an individual. They have much more jurisdiction to cover than they could ever begin to attempt. Your program was chosen as the result of an arduous risk assessment. If the audit does not appear promising after a short time it will probably be killed. If it looks like there is an issue it will continue. Again, no one is out to get you.
• Auditors Have Different Personalities. Some auditors will be mild mannered (Clark Kent) while others will be Genghis Kahn. That is just their personality; the more aggressive auditors are no more out to get you than the milquetoast ones. They are both attempting to determine if there are problems in your operation that are significant enough to report. Don’t take any of their actions and questions personally.

The bottom line is that both sides need to cooperate. The auditors should work in an ethical manner ensuring they remain independent in all their actions while diligently examine all available documentation and information. The auditee needs to be ethical and provide complete copies of requested information. If the two parties work together then both will benefit, if they don’t the audit will take longer then necessary and the final product will not be as useful.

What is your experience?

Auditing in the 21st Century—Part II

By: Lealan Miller, CGFM

Lealan Miller, CGFM, a member of AGA’s Idaho Centennial Chapter, is a partner with Eide Bailly LLP, and a member of AGA’s National Executive Committee.

In a post on AGA’s blog  last April, I discussed a few of the issues I’ve experienced with auditing in the 21^st century. In that post I also referred to the fact that auditing in the 21^st century had significantly evolved since Rick Fair, AGA National President, presented the topic at the San Diego Professional Development Conference in 2006. Last April I could not have foreseen the developments that would continue to evolve over the past few months within this topic. It will be interesting to explore the effects the change in the financial markets, status of the economy, and the changes in the leadership of the federal government will have on auditors and their clients in the 21^st century but that will be at another time.

You will recall from my previous blog, and to be included in all future blogs, the following list of challenges and opportunities, which auditors and their clients are faced with regularly:

• Doing more with less
• Effective usage of both internal and external resources
• Creating the integrated auditor
• Adapting to new organizational environments
• “Tuning in” on an organization’s strategic relationships
• Auditing in a highly automated environment
• Effective usage of automation to audit
• Addressing management concerns with the cost and other effects of fraud
• Finding new tools to meet the audit challenge
• Meeting the challenges created by the new economy
• Generational differences (Baby Boomers, Generation X and Generation Y)

Last April I discussed the following items from the list above: “doing more with less,” “creating the integrated auditor” and “addressing management concerns with the cost and other effects of fraud.” Today I would like to address: “auditing in a highly automated environment” and “finding new tools to meet the audit challenge.”

Auditing in a Highly Automated Environment

I can honestly say that I do not have a single client that uses a paper-only financial accounting system. Further, the majority of our firm’s audit staff do not even know what green-bar paper looks like! We are not only working and auditing in a computerized accounting environment, but we are working and auditing in an environment in which many processes are becoming highly automated. The days of filing paper forms are long gone, with many local governments supporting online submission of paperwork including payments of water, sewer and trash, and requests for new service. These are only a few ways in which governments are becoming increasingly automated. The various automated systems are integrated with the accounting system, which posts the transactions to the various sub accounts, and posts the final entries to the general ledger. Gone are the days of massive paper trails, which as auditors, we were able to rely on in order to obtain sufficient evidence regarding the amounts recorded in the general ledger.

Auditors are now required to critically explore ways in which we can audit through the IT system, rather than auditing the paper trail around the IT system. IT audit specialists are now used to test IT controls and to ensure systems are integrating information and posting transactions correctly. IT audit specialists are necessary not only to document and appropriately test complex computer systems, but also in order to effectively communicate with the respective organization’s IT personnel.

As auditors in the 21^st century, it is critical that we maintain professional skepticism when dealing with automated systems, in order to not overlook risks that continue to evolve within this area. We as humans tend to get lazy, and at times are convinced that once financial information is in the IT system, the system is foolproof, and any required processing of that information will be performed properly. Unfortunately, we have all heard the stories where this is not the case; therefore, as auditors, and as government entities, we must continue to address the risks that continue to evolve within our increasingly automated accounting environments.

Finding New Tools to Meet the Audit Challenge

The previous discussion brings us to the second item, “finding new tools to meet the audit challenge.” The tools that I have found to be most effective are not necessarily new, and are highly available to auditors and government entities in order to meet the ever-evolving “audit challenge.” One tool of critical importance, and discussed in the previous topic is the use of IT specialists. IT specialists have the ability to effectively document and test transactions through the accounting IT systems, test security over the system, and to test hard and soft internal controls of the respective systems.

The amount of data that is available to auditors is becoming enormous. As a result, it is increasingly difficult to easily manage and disaggregate massive amounts of data. The use of software programs that specialize in analyzing data, performing fraud analytics and identifying transactions to be tested has provided significant assistance in auditing the data. However, as auditors we must understand the systems, and data sets to determine the appropriate methods in which to analyze data throughout the audit process.

Continuous auditing is another tool that could be implemented in the highly automated environment. This would allow the auditor to identify issues earlier, help the government entity correct internal control issues quicker, and reduce the amount of year-end audit procedures. 

This discussion is a high-level view of these topics, with many other aspects to be explored and discussed in greater detail. Unfortunately, there is neither time nor space to do so at this time.

As auditors and organizations in today’s changing environment, we experience many challenges, and I believe that these challenges are what make our jobs interesting and exciting. What are your thoughts?

Hands Free? Or Security Free? You Decide

By: Mark Abraham

Mark Abraham is an Information Technology Specialist II with the Network Security Unit, Division of State Government Accountability, Office of the State Comptroller, State of New York. He is DoD IACND Level III Certified.

The other day my father asked me to help him connect his new hands-free Bluetooth headset to smart phone so he could safely speak on the phone while driving to and from conferences. It only took a minute to get it connected and he thanked me and proclaimed, “Now I’ll be safe when I use my cell phone!” This made me think about the information security or “safety” of Bluetooth on cell phones and smart phones.

I agree that while hands-free is surely the way to go when it comes to driver safety, a few minutes on the Internet was all it took to reveal that there are a few “bugs” with Bluetooth. Within 30 minutes I had downloaded a few nifty little programs that lets me do almost whatever I want with YOUR cell phone from MY laptop, PDA, or even my own cell phone. Using freely available software, I was able to scan for and find my dad’s cell phone, bypass the password, and take complete control of his phone from outside the house. (Note: I asked his permission before “hacking” him; otherwise it would be illegal.)

Once I gained control of his cell phone I was able to see and copy his address book, view his recent call activity and text messages, and even make calls using his minutes. What are those phone companies thinking? A little more tinkering revealed that I could turn on his microphone and listen to everything that was going on in the room. The implications were nauseating. Not only can hackers steal your company’s information and your minutes, now they can eavesdrop on you too.

After a couple hours I had figured out how to extend this spy capability to the headsets themselves and I was even able to tap his car’s hands free system and listen to conversations taking place in the car. Here comes the scary part. There are freely available plans to make an antenna that will let you do all of these terrific things from up to a mile away. A MILE.

Naturally my next question was, how in the world can I prevent this? Well the two main things you can do are to disable Bluetooth until you really need it, and make sure to keep your phone software up to date.

Questions

Do you have good controls over who has access to your Bluetooth devices?

Have you audited your organization to see how Bluetooth security is being implemented?

Why Audits Fail

By: David R. Hancox, CGFM, CIA

David R. Hancox, CGFM, CIA, is director of State Audits in the New York State Comptroller's Office and on the faculty of Siena College. He is the co-author of two books on auditing and is a past president of AGA’s New York Capital Chapter, a Regional Vice President and a member AGA’s Financial Management Standards Board and its Emerging Issues Committee.

The auditing profession faces serious challenges that all of us in the accountability profession must confront and help solve.

In March 2003, the Department of Interior’s inspector general audited the Minerals Management Service’s (MMS) audit offices and discovered an organization challenged by both management and control issues. MMS auditors were responsible for monitoring the annual collection of $6 billion in royalties and fees for minerals produced from federal and Indian lands. In 2008, The IG found pervasive misconduct at one of the program offices. Nearly one-third of the 55-person audit staff accepted gifts and gratuities from oil industry officials with whom they did business.

On Sept. 14, 2008, Lehman Brothers filed for bankruptcy protection. It was the largest company failure in history—far exceeding WorldCom’s, the previous largest business failure. As of Nov. 30, 2007 though, the auditors were saying everything is fine—Lehman got a clean opinion on internal controls and on their consolidated financial position—despite the requirements of SAS 59 that auditors consider an entity’s ability to continue as an ongoing concern.

Repeatedly, auditors have failed to find the significant problems in organizations. According to the SEC, HealthSouth Corp., one of the nation's largest health care providers, overstated its earnings by at least $1.4 billion. As reported in the Wall Street Journal, Michael Vines, a bookkeeper in HealthSouth's accounting department, tried to alert outside auditors and others to the questionable practices in his accounting department, but his concerns fell on deaf ears.

Why aren’t we listening?

We haven’t been listening for years. In the famous Equity Funding fraud uncovered in 1973, the auditors didn’t detect 64,000 phony transactions with a face value of $2 billion, $25 million in counterfeit bonds, and $100 million in missing assets. What does this say about the competence of the auditors or of the credibility of the audit profession?

I’m convinced the auditing profession needs to rethink the way it does business if it is going to find the problems that exist in organizations and meet the needs of its stakeholders. Several challenges need our attention.

Auditor Independence
Most auditors argue that they are independent, but often that independence is impaired by a variety of factors that limit the ability to "call it like it is."

The decision to maintain a client because of the revenue the client's business can generate represents a subtle, but pervasive potential conflict of interest. It is a threat to auditor independence that afflicts all too many public accounting firms. It is a conflict inherent in the system we use to hire auditors.

Our independence also is affected when we allow management to sit in on interviews of agency staff or when we allow agency management to pull existing records from the files without the auditors being present. I have heard from auditors who say they are required to allow management extended time periods to pull records needed for the audit. When this happens, the auditors might as well pack up their bags and go home. Such a situation allows management to cull the records, add data that didn't exist, clear out data that is harmful, and generally sanitize the information going to the auditors.

Assessing Internal Controls
Auditors are very good at assessing control activities—the policies, procedures and segregation of duties that exist. They are reluctant to assess the control environment—including criticizing management’s attitude, philosophy, operating style and competence when necessary. Yet, most major frauds can be traced to the lack of a good control environment—not the lack of control activities. When management overrides the system of control, organizations can fail.

Although the nature of NASA's Columbia disaster and the WorldCom scandal were quite different, the root cause of each—the control environment—was remarkably similar. These events weren't caused by the lack of policies, procedures or segregation of duties. The failures resulted from a flawed control environment where management chose a certain course of action, including overriding otherwise effective policies and procedures.

Auditors’ Ethics
The auditors’ ethics are just as important as the ethics of management. We should be above reproach. In an audit the New York State Comptroller’s Office conducted of an $11 million fraud in a school district on Long Island, the partner of the CPA firm doing the financial statement audit was caught altering agency records to cover up a major scandal. He was trying to protect his reputation because he had been issuing a clean opinion on the financial statements.

When nearly one-third of the staff in the Minerals Management Service’s audit offices accepted gifts and gratuities from oil industry officials with whom they did business, there is a serious problem that affects the credibility of all of us in the accountability profession.

Verifying Transactions
We should never forget the basics of our profession. As we become more technologically proficient, it is easy to think of assets in terms of bits and bytes on a computer. Failing to verify the existence of an asset has been at the heart of many frauds that auditors missed.

In the Equity Funding case, auditors missed the ongoing fraud because they did not follow the basics of auditing. Beyond analytical reviews and examining documentation, a fundamental tenet of auditing is to verify the existence of the asset. If the auditors missed 64,000 phony insurance policies, $25 million in counterfeit bonds, and $100 million in missing assets, they simply weren't doing their jobs. In today’s environment with color copiers, color printers, scanners and access to corporate logos on the Internet, it is even easier to manufacture documents.

Questions
Are we really free from personal, external and organizational impairments related to our audit work, whether government or public? Do you think we too often forget the basics of our profession including assessing controls properly? Are we always verifying the substance of the transactions we review or are we focused on documentation?

Proving Efficiency in Governmental Audits

By: Kathy Anderson, CGFM

Kathy Anderson, CGFM, is the assistant director for Communications and Coordination, Division of State Audit, Office of the Comptroller of the Treasury, State of Tennessee

Are government auditors overauditing our governments’ financial statements? If we aren’t, do we still look like we are? Do we look inefficient to others? If that is the perception, perhaps we can tackle it by accepting more risk concurrently with making some other changes to better demonstrate how efficient we already are.

Back to the basics—the acceptable level of audit risk is inversely related to the expected reliance on the financial statements by financial statement users. In other words, the less the financial statements are used to make decisions, the more audit risk we can accept. The real “users” appear to be the bond rating agencies. Management and citizens typically use other information, like revenue projections, budget documents and news reports to make their decisions. And the types of decisions made are very different from the stockholder-type situation where users are trying to determine how to invest their savings. While we are all concerned about our governments, I can’t think of too many people who have looked at a CAFR and decided to change states. Other available information seems to feed the real decision-making regarding policy issues and day-to-day financial matters. So we all need to keep the amount of expected reliance on the statements in context, and examine the amount of audit risk that we are accepting on these engagements to create more efficiency on the financial statement audits.

I’m certainly not suggesting you issue unqualified opinions without appropriate work, but we do need to stay cognizant during the planning process that the risk of fraudulent financial reporting is minimal in governments with decent internal controls simply because of the lack of motivation for the persons who prepare the financial statements. What do they have to gain from misstating the numbers? Sure there might be political pressures to adjust a fund balance figure one way or the other, and we can factor those into the equation, but the pure financial motivation and opportunity to commit financial statement fraud is usually not there in large governments with adequate controls.

We have recognized here that government is fundamentally different when it comes to financial reporting. It wouldn’t be wise, though, to fail to recognize another way government stakeholders are different. And that is expectations. Public company shareholders are often most concerned with the bottom line. If there was some loss or waste, it can be perceived as the cost of doing business. They invested in these companies for the profits and as long as the company is performing and making them money, all is well. Government citizens, on the other hand, have a much lower tolerance for fraud, waste and abuse. And they want to know about it. They did not make a decision to invest in the state—their money is taken from them without their consent each time they make a purchase or as they earn their salaries. They demand that auditors are checking for misdeeds, and when something goes wrong, they ask where the auditors were. So in any decision about risk acceptance, we have to bear this in mind.

But the financial statement audit process is intended to find material levels of these frauds and material misstatements, and quantitative materiality is so high in large governments, that it far exceeds the expectation of the citizen as to what should be looked at and examined. So do we automatically make the leap that because the citizen expects to know more than just what is quantitatively material, that we have now established that the smaller issues must be qualitatively material and audit accordingly? Is that what the CPA firms do in the states where this type of work is contracted out?

Or should we handle it differently? Should we recognize that the citizens need to know more about internal control, fraud, waste and abuse in governments, but then address that need separately—away from the financial statement audit? There is undeniably an increased level of coverage expected of the government auditor. Over the years, we have had to look at the smallest of issues and have had to expend resources to draw conclusions to meet the demands of the governing bodies for which we work. And we willingly do that work to provide the citizens the information that they need. But when we tie that work to a financial statement audit, it could make us look less efficient than our competitors. Now, now, I know that we have to obtain an understanding of internal control, and we need to consider what controls we are relying on and test them accordingly on a financial statement audit. But there is a big difference in the extent of work that we would perform when looking at the CAFR purely from a materiality viewpoint and what we would perform if we went down to the citizen or legislator expectation level.

Once we whittle our financial audit work down to the basics, we can take our remaining staff and resources and assign work using a government-wide, risk-based approach. We can look at the smaller financial risks, internal control risks, fraud, waste and abuse, and performance separately from the financials in a coordinated approach that really allows us to prove our efficiency in our financial audits and our effectiveness throughout all of our work. We can still audit the government’s financial statements at the appropriate level for the users, and concurrently provide more information to the citizens about how their government is performing.

I recognize that auditors of smaller governments with limited internal control, lower materiality levels and frequent frauds could not adopt this approach. However, for larger governments with more controls, do auditors accept as much audit risk as they should? And are they appropriately distinguishing between the financial statement work and all of the “extra” things they do to enable them to prove their competitiveness? What are your thoughts?

Monitoring Controls: Whose Job is it?

By: Steve Biskie

Steve Biskie is Best Practice Program Director for ACL Services Ltd.

The roles of internal audit and inspectors general’s offices are changing. Leaders in audit-type roles in both the government and private sector must work as strategic partners and trusted advisers to senior management—while simultaneously maintaining and upholding their critical independence. And it’s not always an easy balance.

So if both internal audit and management understand the inherent value of monitoring business activity on an ongoing basis, and controls are put into place by management to prevent or detect problems, why doesn’t management get more involved in monitoring controls? Chief audit executives and inspectors general view continuous monitoring and the supporting technologies as a significant industry trend. Yet, in many organizations, audit must implement, maintain and report on these valuable continuous monitoring technologies with little input from senior management.

In my experience, when the internal audit function pinpoints errors, fraud or control weaknesses and takes them to a business process manager, the manager usually responds by saying, “Where did you get this? How did you do this? This is really interesting.” In some cases, management indicates that they’ve asked IT to investigate such a report and been told that it’s not practical given IT resource constraints, while in other cases they didn’t even know such a report was possible from their systems.

Highlighting control gaps generally promotes overall process improvements, so it follows that management would want to see these findings on a regular basis. It raises the question: If management believes that the internal audit role should continuously monitor transactions, why isn’t management equally compelled to implement and perform these tests instead of waiting for audit to bring them the results? Is it a matter of time? Disinterest? Is it a lack of technical proficiency or understanding?

Prioritization is one key challenge. Audit and management often have a different sense of what should be monitored and what’s most important. Fundamentally, however, management could and should be more engaged in the continuous monitoring process. So where does that leave us?

Again, I’d like to emphasize that some organizations have excellent and open working relationships between the audit role and management—with senior managers who take responsibility for implementing and continuously monitoring organization-wide controls. For everyone else, it’s up to audit or the inspector general’s office to help management feel more invested in the continuous monitoring process. Audit can more clearly communicate the possibilities by showing management there is useful information to be found, and by saying to management, “Hey, you can do this too.”

Clearly, auditors must be careful to maintain independence and objectivity. But audit can also work proactively to show management what’s possible. With deeper visibility into underlying business processes (which often crosses departmental boundaries), solid technological understanding, and day-to-day exposure to control testing, auditors can often highlight the most effective monitoring opportunities for senior management.

In the end, it’s a two-way street. Auditors must present the full range of possibilities, while management must be more receptive to investment that continuous monitoring will require. And while some managers do understand the value of continuous monitoring and take full responsibility for owning and managing these processes, most often, internal audit must champion continuous monitoring and insist on implementing this best practice.

What do you think? I’d love to hear your thoughts and experiences.

Keep That Opinion!

By: Andrew C. Lewis, CGFM, CPA

Andrew C. Lewis, CGFM, CPA, is a senior manager with KPMG LLP’s government audit practice in Washington, D.C., and is an adjunct professor at The George Washington University. Mr. Lewis has also been on the board of the Montgomery-Prince Georges’ County AGA chapter for the past nine years.

Since the inception of the statutory requirements for federal agencies to prepare financial statements and subject them to audit, the quest for an unqualified audit opinion has been at the forefront of federal agencies’ financial management agendas. With two exceptions (the U.S. Departments of Defense and Homeland Security), all agencies that are significant to the Financial Report of the United States Government have successfully obtained an audit opinion (either qualified or unqualified) at least once.

However, history has shown that without sustained attention to developing an effective financial management infrastructure and maintaining strong financial management, an agency can lose the ability to prepare reliable financial statements. Further, the oversight by the U.S. Office of Management and Budget (OMB), along with the very public nature of the President’s Management Agenda (PMA) and the associated PMA Scorecard, has helped to drive some agencies from the sidelines and on to the field.

It’s important to point out that this discussion is not just limited to members of the federal community. State and local government personnel encounter the same obstacles and triumphs faced by their peers in the federal community.

So, after all of the long days of meetings to discuss policies and procedures, after chasing paperwork and documentation far and wide, after the countless weekends in the office surrounded mostly by financial management personnel and auditors, and after responding to the auditors’ questions (and questions and questions), what else have you achieved along your agency’s quest for an unqualified opinion?

In summary I ask, what good is a clean opinion?

What are the best ways to keep that opinion?

What are those significant risks and issues that could threaten your agency’s opinion?

MONDAY: Marie Force, AGA Communications Director, on "Do You Trust Your Government?"