Detecting fraud: will the new rules help? Sarbanes-Oxley compliance is raising questions about the relationship between internal and external auditors and increased audit costs, Financial Executives Research Foundation (FERF) finds.

On Dec. 9, 2003, Parmalat Finanziaria S.p.A.'s founder Calisto Tanzi and his son Stefano told executives from private equity fund Blackstone that the Italy-based international food products company's financial accounts were inaccurate. Before the end of the month, Tanzi admitted to diverting 500 million euros (about $640 million) from Parmalat's funds to finance other parts of the business controlled by his family. Assets of Bonlat, a Parmalat subsidiary, were said to include a $4.6 billion Bank of America account, but it was later discovered that the account did not exist. With that, Parmalat became the latest corporate fraud to make the headlines, with its chairman allegedly the chief perpetrator.

This newest headline-grabbing fraud, like others of its ilk, involves senior management. These days, a fraud has to be really noteworthy to garner headlines; after all, it's competing with wars, terrorists and tragedies. But there may be some statistical rationale to the link with senior executives. An academic paper published in the June 2002 issue of Critical Perspectives in Accounting notes that the CEO was involved in 70 percent of the 276 frauds that took place between 1987 and 1999, based on an analysis of enforcement actions taken by the Securities and Exchange Commission, and another 20 percent of the frauds (for a total of about 90 percent) involved other members of senior management. The paper, "Defrauding the Public Interest: A Critical Examination of Reengineered Audit Processes and the Likelihood of Detecting Fraud," was authored by Charles P. Cullinan and Steve G. Sutton.

"Senior management is responsible for establishing a reliable system of internal controls. Either management or internal audit can detect the small, 'petty cash' frauds, but frauds by senior management are a different problem," says Ellen H. Masterson, global leader of Assurance Methodology for PricewaterhouseCoopers LLP. Masterson referred to a July 2002 article in The Wall Street Journal, "Auditors' Methods Make It Hard to Uncover Fraud by Executives," which cited the results of the Cullinan/Sutton academic paper. "The gist of the article," she says, "was that external auditors' methods were not designed to detect financial reporting fraud committed at the executive levels in an organization."

The apparent surge in executive-level fraud has raised key detection questions. If auditors--both internal and external--are expected to discover such fraud, how much more should be spent to ensure they can find it? In virtually all recent scandals, the external auditors have claimed that management effectively hid the problems from them. If that's true, is it realistic to expect auditors--even given far more resources--to find fraud? Many executives argue that the scenario simply gives outside auditors reason to levy higher fees, whatever the result.

External Auditors

In the past, external auditors were not supposed to specifically design their audit procedures to detect fraud, but if they did find fraud, they were expected to report it. However, they did have to evaluate a company's system of internal controls in order to determine how reliable they were, and thereby limit the amount of additional testing that would be required. Then came the Enron and WorldCom debacles. The Sarbanes-Oxley Act of 2002--the U.S. legislative response--was signed into law on July 30.

"Management fraud is a relatively recent phenomenon, and everybody's role has changed," Masterson says. "The audit committee is now more 'hands on,' internal audit reports to the audit committee rather than the CEO or CFO, and the external auditor must become less transparent to those whose reports they are auditing."

By "less transparent," Masterson explains, "In the past, in an effort to drive down audit costs, clients often required that auditors review our audit plans with management, including details such as which sites we would visit, to justify our fees. This was being transparent. Now, we have to be much more skeptical and less predictable--we cannot be as open with those whose work we are auditing. In other words, we have to be less transparent with management."

Section 101 of Sarbanes-Oxley calls for the establishment of an independent, non-governmental accounting oversight board to oversee the audit of public companies in order to protect the interests of their investors. To comply, the Public Company Accounting Oversight Board (PCAOB) was established, and by last October, PCAOB released an exposure draft of a proposed auditing standard, An Audit of Internal Control Over Financial Reporting Performed in Conjunction with an Audit of Financial Statements. (Although comments on this proposed standard were due Nov. 21, 2003, the standard had not yet been finalized when this article went to press.)

Both The Institute of Internal Auditors (IIA) and Financial Executives International's (FEI) Committee on Corporate Reporting (CCR) have expressed various concerns about this proposed standard in their respective comment letters to the PCAOB.

[ILLUSTRATION OMITTED]

Internal Auditors 

IIA's primary--and predictable--concern with the proposed standard is that it does not place enough emphasis on the work of internal auditors. "The PCAOB may have gone overboard on the amount of work expected of the external auditors," says IIA President William G. Bishop III. "The inability to rely on the work of others is a problem. The effect will be to drive up external audit fees. We believe that there is room for more reliance on internal audit. Sarbanes-Oxley should foster a greater working relationship rather than less."

This concern is echoed by FEI's CCR, whose primary concern with the standard is that it creates a situation where the costs of implementation will far outweigh the benefits. As stated in CCR's comment letter: "Given the limited level of reliance that the external auditor can place on the work of others, the resultant level of duplicative testing will cause numerous interruptions to the operations of our businesses. These interruptions alone are very costly; however, when coupled with the cost of internal and external resources to support management's assertions and the fees associated with the increased work to be performed by the external auditor, the costs are far beyond the benefits attained. Most CCR companies estimate an increase of approximately 30 percent to 50 percent in audit fees as a direct result of the required audit of internal control over financial reporting."

[ILLUSTRATION OMITTED]

Dennis R. Beresford agrees that the potential costs of compliance with the proposed auditing standard may exceed the potential benefits, at least to the companies being audited. Beresford is the Ernst & Young executive professor of accounting at the Terry College of Business of the University of Georgia. (He joined the University of Georgia after serving two terms as chairman of the Financial Accounting Standards Board from 1987 to 1997.) He is also the chairman of the audit committees (and "financial expert") for three corporations: MCI (the successor to WorldCom), Legg Mason Inc. and Kimberly-Clark Corp.

As a member of the Special Investigative Committee of the board of directors of WorldCom, Beresford says, "I saw the terrible financial reporting fraud, and I helped the company try to determine what happened and how to prevent reoccurrences." (However, it was "after the fact," since Beresford joined WorldCom's audit committee almost a month after WorldCom first reported a financial statement fraud.) The Special Investigative Committee's final report can be found in the SEC Edgar system. On pages 223 through 263 of that report, the committee discussed the work of Arthur Andersen.

[ILLUSTRATION OMITTED]

On the report, Beresford notes, "Without going into great detail, it is fair to state that Andersen had evaluated WorldCom's internal controls as being very strong, although this review was done before Sarbanes-Oxley was enacted, and rather than reporting on the system of internal controls, they simply reviewed them. I fully recognize that an accounting firm's evaluation of internal control for purposes of planning the audit is nowhere near the same as an audit of internal control. However, I submit that if Andersen could have been so off-base with respect to the general quality of internal control under the old rules, there is no assurance that they would have caught the problems under the new rules."

Beresford maintains that either sloppy auditing and/or extremely well-designed frauds may still permit some frauds to go undetected." Is it necessary for all public companies to undergo chemotherapy because a few may develop cancer?" he asks.

Masterson says that the external and internal auditors will each play a role reporting to the audit committee to address the risk of material misstatements due to fraud, but the job is not complete. "We don't think the right formula for the relationship of the external auditor and the internal auditor has been established yet," she argues.

"However, our number one concern is a quality audit, and we will dig deeper to detect material misstatement in the financial statements due to management fraud." Both Masterson and IIA's Bishop agree that management and the external auditors play a part in this search.

So while Sarbanes-Oxley audit requirements were a dramatic step--though not without controversy and "what-if" scenarios (see box)--ongoing dialogue and continued evaluation of the legislation and practices need to be part of the continuing efforts to combat fraud.

RELATED ARTICLE

Can internal and external auditors, working as a team, detect and eliminate financial reporting fraud?

Philip D. Ameen, Vice President and Comptroller of General Electric Co., offers this hypothesis: Regulation and auditing are capable of eliminating financial reporting fraud.

[ILLUSTRATION OMITTED]

In a sense, Ameen says, "We're testing this hypothesis with Sarbanes-Oxley. Consider how we would react to either of two possible future outcomes:"

1. We don't see any more financial reporting frauds. In that case, we will have succeeded, but an extremely important question will be unanswered--whether we're imposing too much cost to achieve the benefit. That is, we know there's no reason to add regulation, but we don't know whether we could have achieved the same result at lower cost, thus relieving funds so they can be invested productively to earn returns; or

2. We experience another major financial fraud, even with the full Sarbanes-Oxley provisions in place. In this case, we will have failed, but will know nothing about what corrective action to take. The data may actually be showing us that no level of auditing can actually eliminate fraud--a counterintuitive but possible result. And, if auditing is simply incapable of eliminating fraud, then the mandatory audit effort needs to be reduced to the point that it becomes cost-beneficial. This answer, while clearly better for the total economy, is extremely difficult because it tolerates financial misstatements.

William M. Sinnett ([e-mail]) is Manager of Research for Financial Executives Research Foundation Inc. (FERF). A wide variety of publications on governance, internal controls and Sarbanes-Oxley, are available at FERF's bookstore: www.fei.orglrfbookstorel.