Regulating Derivatives to Protect the Public

An Interview with GAO's Donald H. Chapin
By James L. Craig, Jr.

The General Accounting Office, through its spokespersons, Comptroller General Charles A. Bowsher and Chief Accountant Donald H. Chapin, has been a vocal proponent of the importance of a strong and viable internal control structure to protect the interests of the public. In recent years the GAO has been concerned with the risk of catastrophic financial losses that may occur because of the proliferation of exotic and new forms of financial instruments that have earned the tag of derivatives. The CPA Journal spoke with Donald Chapin to discuss the GAO's activities with regard to derivatives and to learn of the GAO's other concerns and activities of interest to the accounting profession.

The CPA Journal: What has been the interest of the GAO in derivatives?

Donald Chapin: In 1994, the GAO issued a report, "Actions Needed to Protect the Financial System," which has become known as the "bible" on financial derivatives. Our report will be updated later this year so that we can continue to provide perspective as the situation changes.

In the corporate governance area, our report recommended that the SEC act to insure oversight of the public sector of derivative activities and controls by independent and knowledgeable audit committees, and also that the SEC require public reporting on internal controls over derivatives risk-management systems, with independent auditor attestation. Our report also recommends that FASB consider adopting a market value accounting model for all financial instruments, including derivatives. FASB now seems to be moving in this direction.

But the SEC has had some problems with our recommendations, especially in the area of auditor reporting on internal controls. We worked with the then chief accountant Walter Schuetze and had a dialog with Chairman Arthur Levitt. As a result of these conversations, we made a shift in our recommendations in this particular case, with the emphasis away from the role of the independent auditor to the board of directors.

What we have on the table now for SEC consideration is a proposal for public reporting by major end users of complex derivatives that would include a description of derivatives policies, risk limits, and related controls. As an alternative to auditor attestation, we are suggesting that the SEC issue guidelines for director responsibilities with respect to those policies, limits, and controls.

I should emphasize that the GAO's primary concern in the corporate governance area is with major end users of financial derivatives. The Federal Deposit Insurance Corporation Improvement Act (FDICIA) made a major contribution in improving financial controls and reporting of derivatives by financial institutions. It established a specific role for audit committees and called for public reporting on internal controls, including controls for safeguarding assets. Also a number of banking regulators have established guidelines for directors' responsibilities with respect to derivatives.

As a result, we feel fairly comfortable that depositors and others are reasonably protected from undue exposure from derivatives as far as Federally regulated banks are concerned. Major derivatives dealers, except for the insurance companies, have voluntarily adopted an approach similar to the banks and to what we recommend for major end users.

Therefore, our concern is more with the end users of derivative products--such as Proctor & Gamble and some of the early publicized losers from derivatives. And we shouldn't overlook Orange County and other local government users of the products. I think the involvement of all these institutions with derivatives at this level may represent a systemic risk that could lead to wide-spread and severe losses. While we have had some major financial losses, so far nothing has happened to cause a breakdown in the financial markets.

CPAJ: Under your recommendations to the SEC, there would be no external auditor involvement?

Chapin: That's correct. There doesn't seem to be any substantial support for requiring an auditor's attestation. However, we do believe that, by placing the responsibility on directors, they may, and probably will, in carrying out their responsibilities, seek assurances from independent auditors about the effectiveness of the controls to assure that the reported derivatives policies and risk limits are being observed.

CPAJ: Then market forces would begin to operate and set the requirement rather than the regulators?

Chapin: Yes. By pulling the directors into the process, we believe this will activate the corporate governance system and get it appropriately involved in safeguarding the marketplace.

CPAJ: With a year's experience under your belt with FDICIA, are there lessons to be learned?

Chapin: Many of the banks are quite satisfied with the controls review required by the Act. I do not believe they feel quite the same about the external auditor involvement. The banks are concerned about the added cost of the auditor's review. If the regulators do an adequate job of considering management's review of internal controls during the bank examination, then the auditor's review is of less significance. Currently, there is legislation being considered by Congress to eliminate the required auditor's report.

CPAJ: To bring about what the GAO recommends for public companies, will that require an amendment to the Securities Acts?

Chapin: I think the SEC could accomplish what we believe is necessary through the issuance of a combination of regulations and guidelines.

CPAJ: Who would have the authority to issue regulations or guidelines for local municipalities, such as Orange County?

Chapin: I am not sure. The SEC possibly could do it through its role in regulating the secondary markets. Our recommendations should also work for municipalities. Instead of directors, there are elected officials, who seem to have similar governance responsibilities. If the elected officials of Orange County, with the help of their independent auditors and others, had undertaken an evaluation of the county's risk management policies, limits, and controls and publicly reported on that, I don't believe the huge losses would have occurred.

CPAJ: Is this a place for the GAO to step in and issue guidelines? Local governments are cash cows in a lot of ways, and always looking to invest and make that extra basis point or two.

Chapin: Ample guidance has been developed both domestically and internationally for companies to voluntarily adopt. The Committee of Sponsoring Organizations (COSO) of the Treadway Commission has been working on derivatives risk assessment guidance which should be available later this year.

Newspaper headlines can put pressure on elected officials to examine the policies and controls. But publicity about the cost of failures such as Orange County is a blunt instrument approach to getting public officials to focus on proper controls. Sharper tools are needed. But publicity about failures has tended to increase directors' concerns about their companies' use of derivatives.

But even the combination of voluntary guidance and publicity about losses has its limitations. It won't do the job universally and over time it becomes less effective. I don't think it will fully protect the financial system against systemic failure.

Also, you are right about the behavior of some local governments. Some just can't seem to get it into their heads that with a higher rate of return usually comes a higher investment risk.

CPAJ: The Kirk panel on "Strengthening the Professionalism of the Independent Auditor" puts emphasis on the auditor making the board of directors the client--bringing the board into the decision-making process related to the audit. But its recommendations are strictly a matter of conscience and voluntary adoption. Is that likely to work?

Chapin: I don't think exhortations calling for voluntary behavior can be fully effective. I think you have to set forth specific steps and procedures that boards or elected officials need to follow. It's a matter of setting forth what the good practices are that should be adopted and how responsible boards should act to assure that they are actually in place. Some authoritative figure has to set forth what those responsibilities are.

CPAJ: You would hope that boards and managements would learn from the experiences of others and voluntarily adopt good practices.

Chapin: Some of them will. But going back to your earlier question, auditors will have a hard job making the board of directors their client. It has to come from the other way. Boards need to take the lead; they need to be motivated or tasked so that they, not management, become the auditor's client. Auditors cannot, by themselves, make this happen, but they can help.

In my personal opinion, a financial report is not complete without a report on controls, but we are a long way from that becoming the standard of reporting in the private sector. That is so, despite the fact that financial reporting and proper and effective internal controls are inseparable, especially in light of the rapidly changing balance sheets of today and the increasing risks being taken by American businesses.

Under the Single Audit Act, every report on financial status by a state or local government includes a report on internal control. The Federal government, in advancing funds, must have some comfort that there are procedures and policies in place that assure that the money will be used as intended. Further, the Federal Accounting Standards Advisory Board has stated that financial statements for the Federal government should include reporting on financial management systems and controls.

In contrast, when the AICPA's AcSEC issued an SOP on disclosure of certain significant risks and uncertainties, it left out controls weaknesses--to me the biggest exposure that businesses face. In my view, more companies get into trouble because their internal operations are unsound than because of the outside risks and uncertainties that may affect their businesses. Regrettably, the AICPA Special Committee on Financial Reporting under the leadership of Ed Jenkins passed off internal controls to another special committee dealing with assurance services issues.

What amazes me is the fact that the auditing profession is not pushing FASB and the SEC to make internal control reporting an integral part of financial reporting. Pushing audit services is not the way to go.

CPAJ: If the profession were to push harder for this, some would say it was doing so to feather its own nest by creating another area to provide services. Also, the profession has feared that reporting on controls would create a whole new level of liability exposure. We also know the preparer community is vehemently opposed to auditor involvement in internal control reporting.

Chapin: Someday, the world will recognize the importance of informing third parties--investors, creditors, the SEC, and others--about controls. To me, the benefit is so obvious. In my opinion, the tactic the profession should adopt is to stress the importance of controls and users' needs for full information about the control system in this rapidly changing world where balance sheets are almost irrelevant to future success.

CPAJ: What about the special committee looking into assurance services? Is the GAO involved in its work to see that internal control reporting receives its fair evaluation?

Chapin: The GAO has a representative on the committee. But that's an auditing services body. I consider internal control reporting an essential element of financial reporting. It is not primarily an audit issue. First, the story of the controls must be reported. The auditing of the report is a secondary issue. I think that some users of financial statements‹maybe many unsophisticated users‹believe internal controls are already being dealt with as part of the financial statement audit. Silence by the auditor means to some that the control system is in fine shape. Little does the public understand that, in fact, less and less is being done by the auditor to verify that internal controls are sound.

CPAJ: Why aren't users crying out for internal control reporting? Why isn't the marketplace demanding it?

Chapin: I don't know the answer. One of the things the GAO is looking at is the extent to which users are being properly involved in the standard setting process. Some critics of the Jenkins Committee have commented that the user groups which the Committee spent most of its time with‹investment analysts, bankers, and the like‹did not fully represent all user needs.

Part of the problem also may be the type of audit report that existing professional standards prescribe. It tells nothing of the findings of the auditor. It's more of a letter of general assurance. Any specifics the auditor finds tend not to be "material" and are therefore not revealed. Right now it is just boilerplate.

If the audit included opinion level internal control work and all significant weaknesses were reported, I think we would see a great demand for this work. That has been our experience in auditing the Federal government. Our internal control findings and related comments on operations are viewed by users as essential information. So this may be a chicken and egg situation.

CPAJ: Did the GAO let an opportunity get by in the Jenkins' committee to make more of the importance of internal reporting?

Chapin: We raised the point with the Jenkins Committee and in commenting on the AICPA SOP on risks and uncertainties, without success. We now have another window of opportunity, somewhat more narrow, in getting reporting on the control issues in the derivative area. I'll have to admit, however, that the SEC's response to date has been disappointing.

We are looking for a report by the major end users of derivative products as to their policies for the use of derivatives, what risk limits have been established, what control structure exists to monitor the limits and policies and procedures, and the degree of board of director oversight and involvement. That type of report would be very useful for stockholders and other third parties seeking an understanding of and assurances about the reporting entity's uses of derivatives. As a result of this kind of reporting, it is likely that companies would appropriately deal with derivatives and not take on unjustified and unwarranted exposures which result in losses to stockholders and other stakeholders.

CPAJ: Moving away from the derivatives and internal control issues, what are some of the other projects the GAO is working on that bear on the profession?

Chapin: This is somewhat related to the issues faced by Orange County and its loss from derivatives. We are looking into the issue of reporting by state and local governments and the related accounting and reporting standards established by the Government Accounting Standards Board (GASB). Without getting into the details, the present reporting scheme does not provide a consolidated financial picture of the governmental unit on a full accrual basis.

There is an abundance of information in a government's comprehensive annual fiscal report (CAFR); but you have to be someone immersed in this lore to take all the pieces and figure out what the consolidated net assets of the government are and what the results of operations have been. We spent a lot of time with the District of Columbia's CAFR. I have to admit that I reached some erroneous conclusions after a period of study. I needed to consult another professional who had worked extensively with these kinds of statements to help me figure them out.

As a result of our review of the District of Columbia government financial crisis, we have identified a number of issues that we feel need to be addressed for state and local governments. Some of them are‹

* the need for a consolidated report on a full accrual basis.

* an indication of fiscal solvency. The case in point is the CAFR of the District of Columbia that preceded the establishment of the D.C. control board. Nowhere did it mention the fact that the District was insolvent. There was a lot of data for Congress to digest, but nothing about the District's inability to pay its bills.

* an integration of the liabilities of the government with the expenses and charges in the statement of operations. Under existing GAAP for governments, liabilities can appear in the general long-term debt account group without being an expense or expenditure of the entity.

* a meaningful depreciation system to charge operations with the cost of capital items used to operate the entity.

* disclosure of whether or not capital facilities are being maintained in reasonable working condition.

* the inclusion of some form of reporting on internal controls of the government.

In light of the derivatives disaster in Orange County, we would hope that the standard setters--in this case GASB--will be looking at internal control reporting as part of financial reporting. As I said earlier, internal control reporting is not an auditing issue--it is a financial reporting issue.

We will be writing to the Government Accounting Standards Advisory Committee (GASAC) setting forth our concerns with the present reporting system. (That letter addressed to the Honorable Earle E. Morris, Jr., was issued on June 8, 1995.)

CPAJ: One of the current projects of the GAO is to formally classify and catalog the recommendations made by various groups‹the Cohen, Anderson, and Treadway commissions; the Public Oversight Board of the SECPS; various AICPA special committees; the SEC; etc.‹to improve the performance of the accounting profession in serving the public interest. How is that project proceeding?

Chapin: This particular project involves a review of all the reports and recommendations that have been made over the past two decades, the responses to those recommendations, and the significance of the outstanding issues. We have an advisory committee of high-level people who use the services of the profession working with us. As a result of the first phase of our work, we have grouped the recommendations into the following areas:

* Setting accounting and auditing
standards.

* Maintaining auditor independence.

* Detecting fraud and illegal acts.

* Evaluating accounting measures.

* Risks and uncertainties.

* Audit quality.

* Boards of directors/audit committees.

* Internal control reporting.

* Corporate accountability.

* Auditor's communication with users.

* Expanded financial reporting and the auditor's role.

We are now following up on what appear to be open issues with interviews and other types of research. Our report will be fact based, and we expect that we will be able to add perspective to some of the major issues facing the profession.

CPAJ: When do you expect your report to be completed?

Chapin: At the end of 1995 or early 1996. We have a lot of information to deal with. For example, we have significant information from directors. We will use a survey that we made of audit committees and how they function. We are looking at how the profession performs in other countries. We are making other types of studies and inquiries.

CPAJ: I understood this project was undertaken in response to a request from a Congressional committee looking at liability reform for the profession. But in the meantime, we have two liability reform bills passed respectively by the House and the Senate. Is your work still needed?

Chapin: We did embark on this latest project in response to a Congressional request. But we have confirmed that our work is still desired. All concerns about the profession have not been laid to rest. As I said before, our work is a broadscale inquiry that may be relevant to these reform bills, but is not focused on the issue of liability.

CPAJ: What other profession has been subject to so much oversight, hindsight, self-regulation, special committee review, and the like? And clearly these reviews and recommendations have benefited the profession and those that use its services.

Chapin: The profession is strong and useful to society. It is key to the functioning of our economic system. But can it be more effective? That is a legitimate question. We hope that our report will be viewed as helpful and constructive.

CPAJ: Are we making any progress toward financial statements and an audit of the Federal government?

Chapin: We have legislation that calls for an audit of the consolidated financial statements of the Executive Branch for fiscal year 1997. The GAO will do the audit. We are presently working on opening balances. Additionally, the 24 largest departments and agencies are required to have audited financial statements beginning for fiscal year 1996.

CPAJ: Is there a role for the private sector auditing profession?

Chapin: They will be involved with the units whose Inspectors General choose not to do the work themselves. This could be a large body of work. The GAO will conduct the actual audit of some major components, such as the IRS, with the IGs and independent CPAs doing the rest.

As a related point, this fall we should have all the basic accounting principles in place for the Federal government, which, with its ability to tax and do other things, has some unique aspects that require unique principles. The Social Security obligation is such a unique animal. There is no one answer, and different groups have strong and different feelings about how that obligation should be measured and reported.

CPAJ: Do you have enough manpower to handle all that is on your plate?

Chapin: Like all of government, we are under pressure to reduce our size. But it will be dependent on the users of our services--Congress and the people--as to what size we remain and the projects we continue to pursue. We hope that our users fully understand the benefits of the projects we have underway, such as the financial audit of the Federal government.

CPAJ: What other projects of interest to the profession has GAO been working on?

Chapin: We are continuing our series of reports on high-risk areas to help Congress and managers in the Federal government consider and address problems and situations that have, in our view, the greatest risk of having major impact on the future operations of the government. There are so many problems in government that this is the only way to get some focus on the matters that require serious attention.

We need to go after the high-risk, high-cost areas. This work can help set the agenda for hearings and legislative solutions. Audits of Federal entities by the accounting profession can help to identify problems and possible solutions if the audit scope is made broad enough.

We are making a major effort to support the Congress by looking at budget issues. Where can money be saved? In this respect, we have also been asked to look at the administrative structure of the Federal government. How much are we spending on administration? Where is there duplication? Congress is obviously looking at this to find areas where it can make cuts in spending by streamlining this aspect of government. The profession has professional competence in process redesign and could be very helpful in this area.

CPAJ: Thank you very much, Don, for meeting with us. *

OCTOBER 1995 / THE CPA JOURNAL