Mergers & Acquisions: Beyond due diligence.

APPROACHES TO MERGER AND ACQUISITION (M&A) transactions can vary greatly from one organization to the next. Specifically, management philosophy often differs regarding who should be involved in the process and the scope of each participating group's activity. Despite these differences, however, most would likely agree that, before the ink is dry on the contracts, it is critical for the company to "know what it's buying" and to ensure that surprises are minimized. Because internal auditors are uniquely qualified to help the organization in these areas, their assistance in the M&A process can be invaluable.

Since 1987, Wells Fargo has completed more than 200 acquisitions, as well as numerous purchases of assets and portfolios. All of these transactions were completed with the help of our department, Wells Fargo Audit Services, and our approach to the process has proved extremely beneficial to the organization.

Our involvement in M&A activity begins prior to the due diligence stage and extends beyond legal close of the transaction. Because we often receive little advance notice of an upcoming deal, preparation time can be very limited. Therefore, our ability to respond quickly to M&A audit requests is crucial. Without establishing specific roles, expectations, and deliverables, our department could find itself fighting a losing battle. For this reason, Wells Fargo Audit Services has created a formally documented audit program that clearly defines our responsibilities at each stage of the M&A process and helps us accomplish objectives in a timely, efficient manner. Our approach may be helpful to those looking to enhance their contribution to M&A activities, or to auditors seeking to participate in these capital transitions for the first time.

BEFORE DUE DILIGENCE

We begin our review of the M&A process by examining project management. When notified of an upcoming deal, we try to learn as much as possible about the target company and identify any unique products, services, delivery channels, lines of business, or events that may warrant special consideration during due diligence. Information about the target company can come from a variety of sources, including the company's Web site; informational packages prepared by our corporate development group or investment bankers; and annual reports, earnings statements, and news releases, all of which are publicly available on the Internet.

As we sort through collected information, our group develops a "hit list" of issues that should be addressed during due diligence. We then examine this list against the teams that are expected to participate in the process to determine whether all the right people are involved. Our assessment takes into account the careful balance that must be maintained between representing as many areas of the organization as possible and adhering to the strict confidentiality requirements usually associated with due diligence. If the list falls short in any areas, we recommend additions to corporate development.

Next, our group determines whether each team's role, list of objectives, and scope have been clearly defined. We ensure that each team has created a written information request list that outlines the specific items they will be reviewing, as well as a formally documented due diligence program. If any of these tools are missing, we often help the team develop them.

The importance of these preliminary efforts should not be underestimated. Just as planning is the key phase of an internal audit, preparation is the key to successful due diligence.

DURING DUE DILIGENCE

When due diligence begins, our group assumes numerous responsibilities. We perform functional due diligence if the target organization has an internal audit or security function and evaluate the company's control environment and overall level of compliance. Additionally, we provide oversight services by conducting an audit of the due diligence process while it is occurring.

Sometimes, we are asked to aid other teams in their discovery efforts by tracking down documentation, holding discussions with counterparts at the target company, or assisting on selected steps of the other groups' due diligence programs. Primarily, however, we participate in an assurance capacity.

EVALUATING THE INTERNAL AUDIT FUNCTION

We evaluate the target company's internal audit function for two main reasons: to determine the extent of reliance we can place on their work and to ascertain how best to integrate their function into our own if the transaction is consummated. To assess the quality of the audit function, our group examines the following areas:

* The department's organizational structure, responsibilities, and management reporting relationships.

* Risk assessment, audit planning, and administration processes.

* Audit policies, procedures, and workpapers from a sample of audits.

* Staff members' qualifications, including educational background, experience, and professional certifications.

If quality is assured, then the function's previous audit results can serve as an excellent resource for due diligence research. This information can also help other due diligence teams expedite identification of issues and weaknesses as they perform their own functional reviews.

EVALUATING THE OVERALL CONTROL AND COMPLIANCE ENVIRONMENT Most of our due diligence projects need to be completed within a very short time frame. In addition, because of confidentiality requirements, our access to information and people is often limited. These constraints can make assessments of the control environment and level of compliance quite challenging.

The key to obtaining required information quickly is knowing in advance what documents to request and making sure that these items are available upon arrival at the target site. The following types of documentation have proven valuable in our assessments of compliance and control.

* Regulatory examination results. Depending on the target company's type of business, it may be subject to regulatory reviews by one or more government agencies. Reviewing results from prior regulatory examinations can help auditors identify any potential "weak spots" at the target.

* Internal audit results. If reliance on the target's internal audit function has already been established, previous audit results should be reviewed to identify any significant or systemic weaknesses.

* External audit results. Reports from external audits and consulting engagements -- such as efficiency, systems, and operations reviews -- should be examined. In addition, internal auditors should try to obtain workpapers supporting the external auditor's most recent financial statement audit, as these documents can provide insight into any significant control weaknesses, as well as "passed" and "proposed" adjusting entries. The workpapers should also include attorneys' letters, which will help in identifying past and present litigation activity.

* Pending and threatened litigation records. Auditors must understand the nature of any past or pending investigations, as well as any pending or threatened litigation. These types of activities may be indicative of systemic control weaknesses in the target organization. Additionally, any potential losses associated with pending investigations or litigation will have a financial impact and should be factored into the pricing of the deal.

* Internal compliance/quality assurance reviews. Depending on the type of organization, compliance and quality assurance functions may be in place. Reviewing reports from these functions can help identify areas of weaknesses or inefficiencies.

Our goal is to review and summarize these documents as quickly as possible to form a preliminary assessment of the overall control and compliance environment. We then distribute summaries of key findings to the other due diligence teams to help them determine the current status of weaknesses previously identified at the target company.

PROVIDING OVERSIGHT During our involvement both prior to and during due diligence, Wells Fargo Audit Services provides oversight that may be best described as a real-time audit. Our oversight role enables us to deliver value to both management and shareholders by ensuring the M&A process is functioning as intended. To accomplish this, we provide full discovery and appropriate disposition of risks and issues.

If any "breakdowns" within our own due diligence process occur, we coordinate and communicate with our corporate development group to ensure these issues are escalated, addressed, and resolved with the appropriate participants on site. Our oversight role then continues beyond the on-site review, after the due diligence process is complete.

AFTER DUE DILIGENCE

After we have finished the "fieldwork" phase of our work, we prepare a due-diligence report, as do each of the teams that participated in the review. The report includes our overall scope and objectives, as well as conclusions regarding the target company's control environment, overall compliance, and audit function. We also estimate M&A-related financial impacts specific to audit and investigation activities, such as transition expenses, reserves for potential losses, any expense-save opportunities, and the incremental cost of providing audit coverage for the acquired organization after the merger takes place. Additionally, if we identify any unique items during due diligence, we recommend that appropriate representations and warranties and pre-close conditions be included in the definitive agreement.

Once our report is complete, we receive copies of all other teams' due diligence reports. With this information, we help to ensure appropriate disposition of issues by preparing a document that summarizes all significant items identified by the due diligence teams. We group items into four categories:

* Open issues: Items that could not be fully resolved in the field prior to completion of the due diligence reports. Open due diligence issues are unacceptable in our organization and must be resolved before signing a definitive agreement. However, there are certainly justifiable instances in which additional time may be necessary to finalize discovery efforts. By capturing any open issues in our summary document, we are able to help management track these issues and ensure they are appropriately resolved before the agreement is signed.

* Financial impacts: Issues that need to be considered from a deal-pricing perspective, including any required reserves; anticipated write-offs; revenue enhancement opportunities; expense-save opportunities; transition, integration, and conversion expenses; and growth assumptions.

* Definitive agreement issues: Items that we expect to see resolved or addressed by verbiage in the definitive agreement. Issues may include team requests for specific representations and warranties, pre-close conditions, and indemnification.

* Transition issues: Items that need to be addressed during transition. These are usually differences in methodology and procedure at the target company, such as systems used, products and services offered, accounting policies and operations, and employee benefits. These types of issues are identified during due diligence, but will only need to be addressed if the deal is consummated.

We distribute the report-issues summary to corporate development, our legal department, and line management and then track the resolution of all presign issues -- except for those relating to transition -- to ensure appropriate disposition before the company signs a definitive agreement. Specifically, we track issues by reviewing selected financial models and projections to assess assumptions, validate expense saves and reserves, and ensure internal rate-of-return requirements, as well as reviewing and critiquing all draft definitive agreements and schedules. Our summary list and follow-up work has proven highly useful to management, as well as other key participants in the due diligence process.

PRE-CLOSE TRANSITION

After our company executes a definitive agreement, the transition or integration phase begins. The first portion of this phase, pre-close transition, spans from agreement signing to deal consummation. The length of this period can vary greatly depending on the industry and companies involved.

Pre-dose transition is an extension of due diligence, and it provides our group with an opportunity to fully dimension the target company's organizational structure, administrative processes, management hierarchy, and audit processes. Similar to our role during due diligence, we provide oversight during the transition period, in addition to facilitating the process. Our high-level oversight objectives include:

* Assessing project management and organization.

* Evaluating the adequacy of all transition plans.

* Reviewing plans to implement corporate policies, standards, and procedures.

* Ensuring resolution of transition issues identified during due diligence.

* Verifying that transition plans are executed.

* Ensuring issue escalation.

* Confirming satisfaction of pre-close definitive agreement covenants and conditions.

To further support the pre-close transition process, we also provide the following services in conjunction with our oversight responsibilities:

* Tracking satisfaction of buyer and seller covenants, as well as closing conditions, and reviewing the status of these items periodically before close to ensure adequate progress. We also make sure that these items are completed prior to the close date and confirm that any waivers of conditions are properly approved.

* Determining existence of transition planning and management processes, assessing factors such as organization, accountability, and appropriate involvement by all disciplines.

* Ensuring that transition leaders establish and communicate the goals and objectives of transition, including an appropriate emphasis on control.

* Attending transition-planning meetings and helping to focus participants on controls, coordinating issues where necessary.

* Reviewing and critiquing individual teams' transition plans to ensure reasonableness, expected action steps, assignment of responsibility, key contacts, and reasonable target dates.

* Confirming that all transition-related items from due diligence reports are included on the appropriate teams' transition plans by cross-checking each team's plans against due diligence exam reports.

* Examining delineation of activities and timing and ensuring that plans are date-specific.

* Ensuring specific individuals have been assigned responsibility for individual transition tasks.

* Identifying interdependencies between teams.

In addition, our group ensures communication is occurring between the right individuals at our company and the target and evaluates and recommends internal controls as requested by management.

POST-CLOSE TRANSITION

After the deal has been consummated, we begin the post-dose transition phase of the M&A process. During this period, our department performs several value-added activities.

INTERNAL CONTROL AWARENESS TRAINING As soon as possible after legal close, we offer internal control training for members of the acquired company. The objectives of our training sessions are to:

* Provide an understanding of internal control and its importance in our organization's culture.

* Explain the relationship between internal control and managing risk.

* Heighten awareness of our organization's code of ethics and its importance to a strong control culture.

* Provide a clear understanding of internal auditing's role in our company.

* Discuss current control issues.

The session is intended for managers and supervisors and typically ranges from three to four hours. In addition to familiarizing the target with our company's practices, the session also serves as an opportunity to introduce our audit services group, answer questions about ourselves and the company, and receive feedback on the transition process from their perspective.

INITIAL CONTROL REVIEWS Shortly after legal close, we also perform initial control reviews (ICRs) of the acquired business units. ICRs are similar to an audit, except that the extent of detailed substantive testing is much more limited. The objective of these reviews is to identify any significant areas of control weakness and to assist management in implementing policies, standards, and procedures.

Realistically, an ICR is a "free" audit. When the process is complete, we issue a report, although we do not provide formal ratings of the control environment for the audited units.

READINESS REVIEWS Our team performs "readiness reviews" to help management determine whether the organization is ready for a systems conversion and/or consolidation of operational activities. The reviews are conducted with sufficient lead-time to ensure our results are communicated at least 30 days before a planned event date. Areas that we examine include:

* Staffing.

* Equipment and facilities.

* Production.

* Reconciliations.

* Transaction flow analysis.

* Customer impacts analysis.

* Operational workflow analysis.

* Communication to customers and employees.

* Effectiveness of training.

* Systems readiness.

At the end of the review, we issue a report that includes an opinion on our organization's preparedness to complete the event as scheduled. The "ready" or "not ready" opinion is based on our assessment of the status of required actions in each of the areas examined. Management has found our report to be invaluable in assessing whether adequate conversion and consolidation preparations have been made.

MAKING A DIFFERENCE

Our M&A efforts have been consistently well-received by Wells Fargo's corporate development group, as well as other participants in the company's due diligence projects. In fact, we are seen not just as a service provider but as a partner in the M&A process. The recognition we've received from these projects has lead to requests for our services in other areas, including divestitures, special projects, and advisory work.

Our experience demonstrates that internal auditors are uniquely positioned to support organizational M&A efforts and can add considerable value to the process. Auditors who don't yet participate in their company's M&A activities should give thoughtful consideration to becoming involved. Although M&A audit services may require initial selling, most audit departments should quickly be able to demonstrate their ability to facilitate and enhance the process, and convince management that internal auditing's assistance can be key to the effort's success.

LEIF B. NYGAARD, CIA, CBA, CFSA, CFE, CRP, is a technical audit consultant at Wells Fargo Audit Services in Minneapolis, Minn.

To comment on this article, e-mail the author at [e-mail].