Why Audits Fail
By: David R. Hancox, CGFM, CIA
David R. Hancox, CGFM, CIA, is director of State Audits in the New York State Comptroller's Office and on the faculty of Siena College. He is the co-author of two books on auditing and is a past president of AGA’s New York Capital Chapter, a Regional Vice President and a member AGA’s Financial Management Standards Board and its Emerging Issues Committee.
The auditing profession faces serious challenges that all of us in the accountability profession must confront and help solve.
In March 2003, the Department of Interior’s inspector general audited the Minerals Management Service’s (MMS) audit offices and discovered an organization challenged by both management and control issues. MMS auditors were responsible for monitoring the annual collection of $6 billion in royalties and fees for minerals produced from federal and Indian lands. In 2008, The IG found pervasive misconduct at one of the program offices. Nearly one-third of the 55-person audit staff accepted gifts and gratuities from oil industry officials with whom they did business.
On Sept. 14, 2008, Lehman Brothers filed for bankruptcy protection. It was the largest company failure in history—far exceeding WorldCom’s, the previous largest business failure. As of Nov. 30, 2007 though, the auditors were saying everything is fine—Lehman got a clean opinion on internal controls and on their consolidated financial position—despite the requirements of SAS 59 that auditors consider an entity’s ability to continue as an ongoing concern.
Repeatedly, auditors have failed to find the significant problems in organizations. According to the SEC, HealthSouth Corp., one of the nation's largest health care providers, overstated its earnings by at least $1.4 billion. As reported in the Wall Street Journal, Michael Vines, a bookkeeper in HealthSouth's accounting department, tried to alert outside auditors and others to the questionable practices in his accounting department, but his concerns fell on deaf ears.
Why aren’t we listening?
We haven’t been listening for years. In the famous Equity Funding fraud uncovered in 1973, the auditors didn’t detect 64,000 phony transactions with a face value of $2 billion, $25 million in counterfeit bonds, and $100 million in missing assets. What does this say about the competence of the auditors or of the credibility of the audit profession?
I’m convinced the auditing profession needs to rethink the way it does business if it is going to find the problems that exist in organizations and meet the needs of its stakeholders. Several challenges need our attention.
Auditor Independence
Most auditors argue that they are independent, but often that independence is impaired by a variety of factors that limit the ability to "call it like it is."
The decision to maintain a client because of the revenue the client's business can generate represents a subtle, but pervasive potential conflict of interest. It is a threat to auditor independence that afflicts all too many public accounting firms. It is a conflict inherent in the system we use to hire auditors.
Our independence also is affected when we allow management to sit in on interviews of agency staff or when we allow agency management to pull existing records from the files without the auditors being present. I have heard from auditors who say they are required to allow management extended time periods to pull records needed for the audit. When this happens, the auditors might as well pack up their bags and go home. Such a situation allows management to cull the records, add data that didn't exist, clear out data that is harmful, and generally sanitize the information going to the auditors.
Assessing Internal Controls
Auditors are very good at assessing control activities—the policies, procedures and segregation of duties that exist. They are reluctant to assess the control environment—including criticizing management’s attitude, philosophy, operating style and competence when necessary. Yet, most major frauds can be traced to the lack of a good control environment—not the lack of control activities. When management overrides the system of control, organizations can fail.
Although the nature of NASA's Columbia disaster and the WorldCom scandal were quite different, the root cause of each—the control environment—was remarkably similar. These events weren't caused by the lack of policies, procedures or segregation of duties. The failures resulted from a flawed control environment where management chose a certain course of action, including overriding otherwise effective policies and procedures.
Auditors’ Ethics
The auditors’ ethics are just as important as the ethics of management. We should be above reproach. In an audit the New York State Comptroller’s Office conducted of an $11 million fraud in a school district on Long Island, the partner of the CPA firm doing the financial statement audit was caught altering agency records to cover up a major scandal. He was trying to protect his reputation because he had been issuing a clean opinion on the financial statements.
When nearly one-third of the staff in the Minerals Management Service’s audit offices accepted gifts and gratuities from oil industry officials with whom they did business, there is a serious problem that affects the credibility of all of us in the accountability profession.
Verifying Transactions
We should never forget the basics of our profession. As we become more technologically proficient, it is easy to think of assets in terms of bits and bytes on a computer. Failing to verify the existence of an asset has been at the heart of many frauds that auditors missed.
In the Equity Funding case, auditors missed the ongoing fraud because they did not follow the basics of auditing. Beyond analytical reviews and examining documentation, a fundamental tenet of auditing is to verify the existence of the asset. If the auditors missed 64,000 phony insurance policies, $25 million in counterfeit bonds, and $100 million in missing assets, they simply weren't doing their jobs. In today’s environment with color copiers, color printers, scanners and access to corporate logos on the Internet, it is even easier to manufacture documents.
Questions
Are we really free from personal, external and organizational impairments related to our audit work, whether government or public? Do you think we too often forget the basics of our profession including assessing controls properly? Are we always verifying the substance of the transactions we review or are we focused on documentation?