Reporting by independent auditors on internal controls. (excerpt from Walter P. Schuetze speech) (Transcript)
According to the SEC's Office of Public Affairs, more than 13,400 public companies and 4,000 investment companies file various reports with the SEC. The SEC requires most of these reports include audited financial statements and those financial statements be made available to investors. The audit reports attached to these entities' financial statements enhance the public's confidence in the reliability of these statements, lessen the public's fear that the financial statements are incomplete or biased, and encourage the public to invest in securities issued by public companies and investment funds. This concept of an independent audit of the financial statements of enterprises that seek to raise money from the public is one of the cornerstones of the Securities Act of 1933. Significantly, under the Securities Act, an enterprise wishing to offer its securities to the public need not engage counsel or have an underwriter, but it must have an independent auditor. That independent auditor must audit and report on the registrant's financial statements and consent to the inclusion of his or her report in the offering document.
The Commission requires audited financial statements for other purposes as well. For example, some 8,200 broker/dealers file reports with the Commission. More than half of these reports include audited financial statements, which are required to be mailed to the broker/dealers' customers. Audited financial statements in this situation increase customers' confidence in the creditworthiness and solvency of the entity that holds their funds and securities and transacts their business.
The auditing function thus is of great importance to investors, the commission, and the general process by which corporations raise capital and conduct business affairs.
Our capital market is the best in the world. I never cease to marvel at the capital-raising and capital-allocation capability of our debt and equity markets. And audited financial statements and related disclosures are the lubrication that allows the capital market engine of this country to turn at very high RPMs. So, when the Public Oversight Board says the auditing profession is threatened by a lack of public confidence, litigation, or other risks, I am concerned, and when the profession makes recommendations for improvements in financial reporting, I consider those recommendations seriously.
I am not a lawyer, however, so I cannot speak to the legal issues raised by the profession, the Public Oversight Board, and others, such as joint and several liability versus proportional liability, how contribution works or ought to work, or when or how Rules 9 and 11 of the Federal Rules of Civil Procedure work or ought to work.
I am an accountant-auditor. So I want to address one aspect of the proposals made by the Public Oversight Board and the AICPA's Board of Directors that concerns auditing and accounting, namely, auditor reporting on registrants' internal controls related to financial reporting to the public. I am particularly interested in statements these bodies have made about how such auditor reports relate to what is commonly referred to as "fraudulent financial reporting." In addition, as I will discuss later, I am concerned that investors and others may overrely on such reports.
Who Wants It?
The AICPA and the POB would have the Commission put in place a mandatory reporting system so that the 13,400 public companies would have to state publicly whether their internal controls over financial reporting are effective and their independent auditors would have to opine, publicly, on that assertion by management. I think most public company registrants would be opposed to such a requirement. When the Commission exposed that idea for comment in 1979 and again in 1988, the Commission received substantial adverse comment. More recently, public company registrants formally or informally, (mostly informally) have said they oppose the idea of public reporting on internal controls by registrants' independent auditors. The registrants are saying the additional costs involved would outweigh the benefits. Indeed, I have heard some of those registrants say, informally, that there would be no benefit whatsoever to the registrants or to investors. As well, I have not heard any private user group arguing for public reporting on internal controls or indicating concern over the magnitude or level of fraudulent financial reporting. For example, in its July 1992 Position Paper entitled Financial Reporting in the 1990's and Beyond, the Association for Investment Management and Research does not mention public reporting on internal controls or the issue of fraudulent financial reporting.
Is There a Cost Benefit?
On the cost side, I have heard, again informally, that public reporting by independent auditors on the effectiveness of registrants' internal control systems over financial reporting will involve additional costs to registrants. For smaller companies, I have heard the cost might be substantial, relatively speaking. So, if one is favorably disposed toward such reporting, the age-old cost-benefit tradeoff would have to be considered.
One could argue that management and auditor reports on the quality of a registrant's internal control system are desirable for two reasons: One, to prevent fraudulent financial reporting and, two, to improve financial reporting in general. I have not heard much argument in favor of the second reason, namely to improve financial reporting in general. The POB asserts, on page 53 of the Special Report, that requiring auditors to assess management reports will lead to improvements in systems, and I suppose that could improve financial reporting generally. Auditors now are required to gain an understanding of the registrant's internal controls, so what the POB literally suggests is not new in that sense. Public reporting on those controls would be new, however. The more registrants and their external auditors think about, talk about, and work on improving internal control systems the better those systems probably will become.
Aside from the POB's statement and the position of the General Accounting Office that led to the requirements for management and auditor reports on internal control as part of the Federal Deposit Insurance Corporation Improvement Act of 1991, I have not heard any recent argument that public reporting by public companies and their independent auditors will improve financial reporting in general. I question whether the financial reporting by honest managements, who run the vast majority of public company registrants, is going to be improved significantly by public reporting on internal controls. I will, however, reserve judgment on that reason for public reporting on controls until I see or hear more evidence or argument.
Will it Prevent Fraud?
The other reason for public reporting on internal control is to prevent or deter dishonest management from "cooking the books." The AICPA has stated quite plainly and directly that it is the independent auditor's responsibility to detect such fraud. The AICPA says, on page two of the White Paper:
Fraudulent financial schemes are the stuff of headlines and spicy news reports. Fraud justifiably engenders public outrage. While few business failures involve fraud, their corrosive effect on public confidence is widespread. The public looks to the independent auditor to detect fraud, and it is the auditor's responsibility to do so.
The only argument by the Board of Directors of the AICPA for reporting on internal controls over financial reporting is that it would reduce fraudulent financial reporting. On page four of the June 1993 White Paper, the AICPA says, "The internal control system is the main line of defense against fraudulent financial reporting," and "The investing public deserves an independent assessment of that line of defense..." The POB agrees. It says, on page 53 of the Special Report, that "...improved systems will make management fraud and manipulation of financial reporting more difficult."
After considerable informal discussions with practitioners, preparers of financial statements, and other regulators, and a year and a half of reviewing accounting and auditing enforcement cases as they wind their way to the Commission, I question whether public reporting on internal controls over financial reporting by registrants and their independent auditors would reduce so-called fraudulent financial reporting and litigation against external auditors.
The Treadway Commission found, in 1987, that fraudulent financial reporting arises primarily because management is "cooking the books." The POB, on page 49 of the Special Report, made a similar finding, to wit, "every fraudulent financial statement for which an |independent auditor has been held responsible was prepared by executives who were intentionally committing a fraud, not only upon their shareholders, investors and the markets, but also on the auditor as well."
I agree fraudulent financial reports arise principally when management of an enterprise deliberately has falsified the facts by misstating assets, liabilities, equity, or income. For example, management may report bogus receivables or nonexistent inventory as assets, or it may overprice existing inventory, or omit liabilities from the balance sheet. These kinds of irregularities--namely lying and cheating by "cooking the books"--may be difficult to identify if there is wide- spread collusion, but a well-designed and well-executed audit provides the best means of detecting these frauds. Indeed, the White Paper, as noted above, says auditors have the responsibility to find such fraud. No amount of reporting on internal controls will ferret out any more fraud or provide any better techniques to find it than the audit of the financial statements should have done in the first instance. Some argue that, although reporting on internal controls may not uncover fraud, it will deter fraud by having management and auditors focus on the internal control system and the checks and balances placed on each management employee by such a system of controls. I question, however, how reporting on internal controls by independent auditors is going to deter fraudulent financial reporting resulting from "cooked books" when management was not deterred by the requirement for an annual audit and was able in the first instance to conceal the fraud from the auditors during the audit.
The Problem of Ambiguous Accounting Principles
Another, and more prevalent, cause of improper financial reporting is the use of ambiguous accounting principles to overstate assets, equity, and income. Some registrants use the lack of specific guidance in some accounting standards, or the absence of a standard that directly addresses the registrant's situation, to argue for the presentation of uncertain facts in their most ambitious and favorable light, instead of presenting the facts in the financial statements in a neutral and objective way. Auditors suggest they cannot stop this kind of misconduct because, under existing accounting principles, assets may be recognized even though there is no way to audit or verify, with reasonable assurance, that any future benefit exists or that the asset amounts will be recovered or realized. This kind of improper reporting occurs, therefore, not because of a failure of auditors to discover crooked schemes, but because of a failure in the way accounting principles are written. No amount of internal controls reporting can cure this problem.
The S&L crisis provides a prime example. The savings and loan crisis and certain bank and insurance company failures went undetected, or at least unreported, by the auditing profession because of such a failure of accounting principles. S&Ls recognized interest income and fee income and related assets on acquisition, development, or construction loans because revenue-recognition standards were so general, so vague, and so judgmental that they amounted to no standards at all--and this problem continues today. Even with SFAS No. 91, adopted in 1986, there is no truly objective standard in place for recognition of fee income, or interest income for that matter. In Statement 91, the FASB stated, "Deferred net fees or costs shall not be amortized during periods in which interest income on a loan is not being recognized because of concerns about the realization of loan principal or interest." The phrase "concerns about realization" is not a standard that can be applied objectively. How can anyone audit the results of its application?
If it is believed the practice regarding the recognition of fee and interest income that went on in S&Ls no longer is going on, that belief is wrong. Insurance companies that hold payment-in-kind (PIK) bonds or PIK preferred stocks, today, with the blessing of their auditors, are recognizing interest or dividend income on those assets even though no cash is being received and even though the market value or fair value of the PIK bond or PIK preferred stock may be less than the cost plus the amount of the so-called accrued interest or accrued dividend.
Observers of this scene also should not be lulled into believing the newly issued SFAS No. 114, which deals with loan impairment, necessarily will improve the matter. Unfortunately, the new standard suffers in some respects from the same lack of bright lines as the previous practice. For example, in SFAS No. 114, the FASB states that loan impairment should be recognized when it is probable that contractual principal and interest will not be collected as stipulated in the loan contract. While Statement 114 is, in certain other respects, a significant improvement over the prior literature, the probable standard in Statement 114 for the identification of impaired loans is the same standard as was in effect when the S&L problems arose. The probable standard is too judgmental and leads to wide non-comparability among issuers' financial statements.
By like token, under new SFAS No. 115, companies that invest in marketable debt and equity securities are not required to write down the cost of their impaired investment through income until any decline in value below cost is "other than temporary." Unfortunately, the standard does not define "other than temporary," so it is left to the judgment of the issuer of the financial statements. Auditors are not able to enforce that standard, or at least haven't enforced it, until the investee company is draped in black crepe.
There is no written accounting standard at all for identifying and then measuring impairment of cost of fixed assets and intangible assets. In practice, companies may look at the undiscounted cash flows of assets to identify and measure impairment. That seldom leads to write downs of fixed assets or intangible assets short of a decision to sell or abandon the asset. The cost of plant and equipment can sit in the balance sheet for years even if fair value is below cost, even far below cost, because management of the enterprise can assert, and generally does, that the state of the world surrounding the assets is only temporarily depressed, that markets for the company's products will improve, or that the company over time will be able to reduce its costs and that margins of course will improve. Thus, cash flows will improve, and no write-down is necessary.
I have suggested the auditing profession go to the Financial Accounting Standards Board and encourage them to write standards that provide numbers that can be tested, verified, and reported on with a true sense of objectivity and reliability.
Reports by auditors regarding registrants' internal controls, therefore, would not address what I believe to be the basic cause of fraudulent financial reporting, relentless, dishonest managements, or the application of subjective accounting principles.
The Potential for Over Reliance
In addition, there is a more fundamental concern I have with auditor reporting on internal controls, which is the potential for over reliance on the reports by investors and the public generally. I have heard investors, and even members of Congress, say that if a bank or savings and loan had better internal controls, they would not have made loans that went bad. I also have heard some say effective internal controls result in more effective decision-making by management, and others have gone so far as to state that effective internal controls may prevent bad business decisions.
Unfortunately, the truth is that even companies with good internal controls make mistakes. Internal controls related to financial reporting typically relate to the recording of transactions, the authorization of transactions, and the safeguarding of assets. No amount of internal controls will keep banks from making loans that later go bad, prevent managements from entering into contracts that become loss contracts, or make each decision to fund research and development pay off. Investors will be disappointed. And, in their disappointment, investors and others may point to the "clean" audit report on the effectiveness of the issuer's internal controls and ask, "How could this happen?" Proponents of auditor reporting on internal controls should make sure there is an obvious and readily understandable answer to this question before asking the Commission staff to consider the imposition of more, costly reporting requirements on public companies.
Not a Solution
I believe auditor reporting on internal controls will not stop the crooks of the world who are going to make the financial statements say what they want them to say regardless of the facts and that auditor reporting on internal controls will not solve the more pervasive and more important problem of managements pushing pliable accounting standards. Further, while I believe the proposition has yet to be proved that auditor reporting on internal controls would result in a significant improvement in financial reporting in general, I am certainly willing to have further discussions on the issue.
Walter P. Schuetze, CPA, is Chief Accountant to the Securities and Exchange Commission. The Securities and Exchange Commission, as a matter of policy, disclaims responsibility for any private publication or statement by its employees. The views expressed in this article are those of Mr. Schuetze and do not necessarily reflect the views of the Commission or the other staff of the Commission.
The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.
©2009 The New York State Society of CPAs. Legal Notices
Visit the new cpajournal.com.