Rebuilding Public Confidence in Auditors and Organizational Controls

By Allan M. Rabinowitz

Well publicized events have led to an erosion of public confidence in the ability of organizations to control themselves and internal and external auditors to effectively monitor them. What are the root causes of these events? And what can be done to correct them so as to restore public confidence. An important aspect in restoring confidence is the relationship between the auditor and the management of the entity being audited.

The widespread news of scandal, unauthorized securities trading, and falsified financial reporting has cast organizational controls and auditors‹external and internal‹in a poor light. Common questions include‹"How could one person cause such a huge loss to occur?" "Where were the controls?" and "Where were the auditors?" Almost as frequently, there is an embarrassing and almost tangible silence or a halting and inadequate response.

Little note is paid to contentions that controls, no matter how sound, can never prevent or completely limit persons in high places from circumventing controls or prevent or detect all fraud or that auditors do not guarantee discovery of all fraud but provide only reasonable assurance of the absence of material fraud.

There have been too many instances of fraud, transactions in excess of authorized limits, and other negative events while controls were thought to be in place or auditors present to permit acceptance of these contentions. Many factors have created the current quandary. They require clear understanding and careful response for auditors and organizations they serve to rebuild the level of public confidence previously enjoyed.

Significant activity has taken place over the years to cope with the increasingly evident crisis in auditing and organizational controls and to improve these processes. This activity has included efforts of the National Commission on Fraudulent Financial Reporting (Treadway Commission) and its sponsoring organizations, the Public Oversight Board (POB) of the AICPA SEC Practice Section of the Division for Firms (SECPS), and the AICPA itself. The so-called "expectation gap" standards issued by the ASB in the late 1980s were an attempt to respond to the changing needs of users. The accompanying sidebar details some of the activities of these groups.

These efforts are notable and extensive. But there are other issues and relationships that need to be understood and perhaps factored into any plan to improve the effectiveness of organizations and the auditing function. High on the list is the fundamental relationship between management and auditor. Not too much farther down the list is the question of the ability of the auditor‹working under very tight time constraints‹to understand and grasp the complex operations of today's typical client. There are other similar issues. The question arises as to whether structural change‹makeup of audit committees, better internal controls, more effective audit procedures‹can compensate for these deficiencies or whether healthy skepticism, a better informed and more active corporate governance function, and intensified auditor awareness will be sufficient. In any event, these issues are real and effective auditing and organizational controls must give consideration to them.

Auditor-Management Interaction

In many organizations‹more often those with operating and financial difficulties‹breakdowns in meaningful and effective communication between auditors and executive management can occur. An entity begins to experience severe operating problems that management fails to candidly and openly discuss and the auditors fail to recognize or identify. An entity is being plundered or grossly mismanaged by certain of its executives and senior managers, but those with the ability to do something about it never notice, take corrective action, or say anything to the auditors until the damage has been done. Is there no ongoing dialogue of consequence between top executives and auditors, no commonality of interest, no trust of or reliance upon auditors to link the efforts of these parties during critical times?

What Group Is at Fault? The lack of communication may stem from either group. Auditors can get so caught up in their work (which most likely follows a traditional and previously sound pattern) that they do not perceive and react to some newly present conditions when planning their current audit programs. They continue to rely on approaches that served well in the past and are heartened by the continued presence of employees, managers, and executives with whom they never experienced serious problems.

Managers and executives are usually action-oriented, dislike being asked to explain and justify actions, particularly to auditors, and want to get on with pursuing their goals. They rarely initiate exchanges with auditors since they see little or no value to their own central purposes. Such an attitude is heightened when operations begin to deteriorate or if management feels it is a party to the waste, loss, or impropriety that threaten the entity's financial position.

The Game. Occasionally auditors get wind of something awry and seek to discuss it with management. Managers grow quite adept over time at self defense and parrying auditors' questions‹it is just part of the "game." Executives can turn resentful if their decisions, actions, or lack thereof, are questioned by auditors. They generally possess the mental and strategic skills to extricate themselves from the sometimes loosely cast nets of the auditor.

The Management Letter. Auditors regularly prepare comments to management. Many are findings and recommendations concerning present and potential problems, urging management action. If management sees fit, for whatever reason, not to act, it can usually gracefully refrain. Auditors may choose to repeat unattended comments or refer those more consequential to senior management or the audit committee. But if strong support and a loud voice from those in high places do not back the auditors' comments, they will generally fade quietly over time.

A great danger to any entity's welfare is the relative ease for managers to override controls, with the danger quotient rising as the position approaches the top of the organization chart. Here a single executive can do devastating harm before being discovered, as has been demonstrated repeatedly. Sufficient controls, namely checks and balances, are often lacking. Even if a reasonable system has been established, the executive can disregard it or work around it without any loyal, subservient, or unsophisticated subordinates seeking to dissuade them.

Challenges in Understanding the Organization

Auditors are at a disadvantage in evaluating an entity; they are on the outside, looking in. Far too often, auditors lack thorough insight into the entity's workings. The increase in size, diversity, complexity, and geographical spread of entities has aggravated the auditors' ability to cope.

The frightening truth of this hits home dramatically when a former public accountant is hired by the client he or she used to audit. Things within that entity now take on new shapes and meanings; matters are now seen and understood as never before. The former auditor may feel a sense of uneasiness as the entity's problems and flaws become evident.

Managements can prove elusive when dealing with auditors who do not possess their same level of insight into an area. Managements and their staffs often respond to auditors' requests as simply and directly as permitted by the auditor, thinking this approach produces the fewest problems. An auditor's question may be responded to in a sincere manner, but the response may be precisely to what was asked and not one whit more. An auditor generally feels comfortable about this exchange, not conceiving what was left unsaid.

Some managers responding to auditors' questions gild their performance by making fleeting but skillful reference to things going well in their areas, thanking auditors for past suggestions successfully implemented, and telling auditors their presence is valued. Most auditors respond by forming good impressions, and yet important matters may remain hidden.

Unfortunately, auditors are advised to be wariest of those being audited who were previously auditors, since they comprehend both sides of the audit process and the dependence of the auditors on honest and complete responses to their questions.

How Auditors Work

Another issue affecting the audit process goes directly to the way today's audit is conducted. Much routine audit work is relegated to staff auditors, possessing less than two years of auditing experience and generally no other applicable work experience. An argument supporting this practice is that good supervision is a professional auditing tenet. A retort is that though these less-experienced people are well supervised, they themselves do the work and evaluate what they see.

While these staff auditors may be basically intelligent and diligent, they may still overlook problems or be easily convinced of the absence of impropriety by a savvy employee. The finest supervision cannot sufficiently counteract these absences, and supervisory time is inherently restricted.

Lack of Experienced Supervisors. Larger CPA firms have traditionally placed a heavy focus upon hiring and retaining partnership track personnel. They feel this approach has produced good results, but there have been sizeable costs entailed. Some large audit staffs periodically lack senior auditors and managers with extensive experience, since their ranks may have been thinned by those not deemed partner material.

Mental Attitude. Wherever employed, most new staff auditors have for many years viewed their largely routine and seemingly basic work as a necessary evil and rite of passage normally preceding responsible and interesting assignments. Most believed the tasks they handled were beneath their ability and could barely wait for their allotted servitude to end, freeing them to go on to the bigger and better things for which they were certainly destined. Usually, the better the auditor performed in college, the stronger were these convictions. Some auditors felt detail work was not for them and quickly escaped from auditing to something they deemed more worthy of their talents and perhaps a bit more glamorous. As a result, staff assigned to perform essential tasks, who are the principal eyes and ears of the audit team, may lack the commitment to delve into and properly comprehend the transactions and events occurring in the audited entity.

Budget Restraints. Auditors usually work under time pressures and restraints. Some time budgets are unrealistic, and yet a widely accepted measure of auditor competence is their ability to complete audits within budget. This standard has been elevated to such an extent in many CPA firms that the drive to meet budgets has become an increasingly faulty goal as client organizations grow and become more complex.

Ethical Behavior. Entry-level auditors are often ill equipped to deal with the shades of ethical behavior they encounter. Management may enter a transaction the auditor may view as borderline to his or her own ethical standards. The young auditor may see those supervising him or her make judgments that seem to reflect a bending of the principles learned so well just the year before in the classroom or ingrained from childhood. The pressures against being critical of the management or client that pays the fee are enormous.

Proposed Solutions

There are solutions to compensate for these deficiencies.

Enhancing the Control Structure. Closer study is warranted of control structures surrounding top managers and executives because of the great damage they can cause either deliberately or inadvertently. Controls for all management positions should be carefully designed, put into writing, and firmly established as important matters of policy. Any override of controls by these parties should not be tolerated but reported immediately to senior executives, the audit committee, or the board of directors.

A policy statement endorsed by the audit committee should be circulated throughout an entity asserting that controls put into place for every position are considered inviolable and no employee is above the controls applicable to their position. Periodic reviews of all managerial positions should be made to ascertain compliance with established controls.

Each employee should completely understand the control concept as it applies to his or her position and its functions. Control elements should be identified in writing for all positions in contemplation of potential risks. Every employee must realize they cannot be directed by their supervisor or any manager or executive to disregard controls in place.

Making Behavioral Advances. Auditors require greater skill in dealing effectively with people whose work they audit. Unfortunately, college audit courses spend too little, if any, time discussing behavioral issues, because technical matters are considered central.

Auditors should be properly matched in terms of experience and training to the entities being audited as much as is feasible. Matching is crucial because younger and inexperienced auditors are not the equals of seasoned staff who know the ins and outs of their areas. If those being audited have greater people skills than the auditor, the disparity between the two mounts as does the chance for effective cover-up. Rapport is harder to attain between mismatched parties, reducing the chances for a successful audit.

The Nature of Auditor Education. Increasing use of computers in performing audits has lessened what might be viewed as the psychological problems faced by new auditors when dealing with the detail work assigned to them. Often still, they inadequately appreciate the full significance of audit procedures--especially those that are seemingly menial. Audit efforts must not deteriorate due to new auditors' attitudes and perceptions. Reinforcement of audit objectives should be commonplace, and the link between each work assignment and those objectives carefully demonstrated to new auditors along with possible pitfalls.

Greater emphasis on practical considerations is warranted when educating auditors in college, graduate, or professional settings. This means devoting more extensive attention to behavioral aspects of auditing; internal controls in operational areas outside of finance and their impact; events or conditions that have troubled organizations; sound relationships among the audit committee, external auditors, and internal auditors; the need for adequate checks on and audit review of top executive and managerial functioning; and critical issues facing the auditing establishment.

Increasing Internal-External Audit Interaction. External and internal auditors must take every opportunity to cooperate and share all that is pertinent as full partners on an ongoing basis; they are both too much at risk when negative events occur. The days are gone when CPA firms could justifiably limit their reliance on internal auditors because of the latter's apparent lack of education, sound functional management, or independence. Internal auditing has become a distinct and true profession with strengths deserving admiration by external auditors, especially its broad insights into entities.

Outside auditors must adequately recognize the extent of their vulnerability, since denial is a self-destructive delusion. When internal auditors exist in client organizations, outside auditors must seek maximum benefit from them, not viewing them as potential competition or a threat to their fees. When an internal audit function does not exist in a client organization and is warranted, either on a full- or part-time basis with even a single person, the outside auditors should propose its creation.

Revising Employment Practices. The internal and external auditing professions may do well to reexamine their employment practices. Among other things, they need higher personnel retention rates. These can result from encouraging certain auditors to stay with CPA firms and internal functions although they will not attain top ranks. Seasoned or career auditors can supply a hands-on expertise, sense of judgement, and audit experience invaluable in filling existing vacuums. Some auditors are detail oriented, possess lesser people skills, and are perfectly happy handling work shunned by their peers. If they do so capably and can effectively present their findings, they are jewels in the rough and should be treasured. If they are able to provide some training and supervision for other auditors, their value is further enhanced.

There has long been a movement of auditors from public accounting into internal auditing, greatly benefiting that emerging profession. Movement of auditors from internal audit into public accounting seems well warranted, for substantial contributions could be made to CPA firms' understanding of particular industries and entities, their formal and informal ways of operating, and the vulnerabilities they create for external auditors. Similar benefits can accrue from hiring well experienced organization accountants to serve as public auditors.

Universal Early Training in Ethics. Ethical considerations should come above all in the workplace. The overdue attention now accorded them by entities, professionals, and colleges is most welcome. However, ethical issues should be formally encountered by all individuals long before they enter college or the workplace. They must be stressed in the home, preschools, grade schools, religious institutions, entertainment, the media, and everywhere else young children and teenagers can be influenced. We may need to undergo costly cultural shifts to bring this about, but the alternative is dreadful to contemplate and much more costly.

The benefits of universal ethics training should instill auditors with a stronger commitment to the public interest and managements and their staffs with a stronger propensity to tell the truth and the whole truth. While this stronger commitment to ethical principles can never be measured or quantified in reaching audit conclusions, it is fundamental to a healthy capitalistic system.

Development of More Effective Audit Procedures. Accounting firms and auditing standards setters are continually seeking to make the audit process more effective. A task force of the Auditing Standards Board is drafting additional guidance to the auditor in the detection of fraud. Whether the solution will be some new audit procedures or approaches or just guidelines to help carry out existing standards remains to be seen. In the meantime, a professional issues task force of the SECPS of the Division for Firms, established as a result of recommendations by the POB report, In the Public Interest, continues to consider practice issues that appear to present audit concerns for practitioners. The 10-member group has identified 15 contentious practice areas and will seek to give guidance to practitioners through the issuance of practice alerts.

Another aspect may be to reexamine the assignment of work among the audit engagement team. Some work traditionally performed by the least experienced members may be more appropriately performed by more experienced auditors.

Allocating Sufficient Time to the Audit Process. Allocating the right amount of time to audit engagements and to specific tasks within the engagements is a major challenge to accounting firms. Today's competitive environment makes the profitability of audit engagements dependent upon doing no more work than is necessary to reach appropriate conclusions about the absence of material misstatements. Some time pressure increases effectiveness of those performing the work. Excess pressure can be disastrous. The tone must come from the top of the audit organization, audit steps are to be completed to the extent required to reach the appropriate conclusion, and time pressures cannot compromise that objective. A possible solution is to have peer evaluations by otherwise uninvolved parties as to the adequacy of time budgets.

Take Full Advantage of Technological Advances. We are in the age of information technology. The quantity of information available and the ability to process it are beyond comprehension. The thinking auditor must tap the capacity of computer-assisted procedures and techniques to make the audit more effective and efficient. Accounting firms are developing artificial intelligence to assist in decision making, using computers to screen and stratify events and transactions that may be of particular interest, and using the power of the computer and statistical models to predict probable outcomes. All auditors must also avail themselves of technological enhancements to be effective and remain competitive. Those that cannot develop the techniques themselves must turn to professional organizations and third-party developers.

Strengthening Audit Committees. Most of the recommendations for improved audit effectiveness, in one way or another, point toward the audit committee, comprised of outside or independent directors. One of the audit committee members should preferably have audit work experience, with an external and internal combination being most desirable. When so many audit committee concerns and organizational trials and tribulations relate to internal control and auditing, it seems essential that people with suitable backgrounds be secured for committee service. This would permit structuring a truer and more informed partnership among the audit committee, external auditors, and internal auditors, each equipped to play a full role in safeguarding the entity.

A 1991 General Accounting Office report, "Audit Committees: Legislation Needed to Strengthen Bank Oversight," stated that a survey of 40 of our nation's largest banks, each with assets of $10 billion or more, indicated that even the audit committees of 35% of these prominent institutions did not include a member with auditing or accounting expertise. The FDIC Improvement Act of 1991 provides that large banks and savings institutions must now have audit committee members with banking or related financial management expertise.

A new method of nominating outside candidates for director slots appears increasingly advisable, one that would remove the process from top executive influence and result in the appointment of directors to audit committee service who bring more objectivity. In larger entities, nominations might be solicited from major lenders or pension funds and institutional investors having significant stock holdings.

It's Time to Begin

Only by focusing upon all of these issues, and others, in a widespread fashion can we even hope to begin resolving them. These issues need to be addressed publicly by writers and speakers and sufficiently explored to ensure appropriate action. It is essential that all interested parties--most prominently directors, executives, auditors, investors, and educators--prepare to act and then act swiftly to put an end to this current discomforting climate. *

Allan M. Rabinowitz, CPA, has served as a public accountant, internal auditor, financial executive, audit committee chairman, and president of The Scribner Book Companies. He has taught accounting and auditing at Pace University since 1962, currently on a full-time basis.

THE PROFESSION RESPONDS AND SEEKS
NEW SOLUTIONS

In 1987, the Treadway Commission made financial reporting recommendations for public companies and their top managements about their control environments, internal accounting and audit functions, and audit committees; for independent public accountants relative to the detection of fraudulent reporting, audit quality, clear communication of their audit missions, and improving the setting of auditing standards; for public- and private-sector bodies, including the SEC, to improve the regulatory and legal environment; and for education to properly shape business and accounting curricula, CPA exams, and CPE.

In 1992, the Committee of Sponsoring Organizations of the Treadway Commission (COSO--consisting of the AICPA, AAA, IAA, IMA, and FEI) issued the study, Internal Control-Integrated Framework. This study defined internal control, described its components and provided criteria and materials for evaluating control systems.

In March 1993, the POB issued a report, In the Public Interest--Issues Confronting the Accounting Profession, dealing with litigation, self-regulation, standards, public confidence, and professional practice. Recommendations were also made on Congressional legislation, SEC requirements, and audit committees in order to improve financial reporting.

In May 1993, the AICPA endorsed the Federal Financial Fraud Detection and Disclosure Act and, in June 1993, announced its intent to combat fraud, enhance financial reporting, assure public auditor independence, reform the professional liability system, and strengthen the profession's self-regulation.

In September 1994, the POB issued a report, Strengthening the Professionalism of the Independent Auditor, that presents the recommendations of a three-member advisory panel formed by the POB to respond to questions of auditor objectivity raised earlier in 1994 by then SEC Chief Accountant Walter Schuetze.

In September 1995, the POB issued a report directed to directors, management, and auditors entitled Allies in Protecting Shareholder Interests, which gives interpretive guidance to those three groups by implementing the recommendations of the September 1994 report. *

JANUARY 1996 / THE CPA JOURNAL