Who's minding the store?

Another suggestion for improving audit committee oversight

Why have so many companies recently been blindsided by serious financial problems that went undetected until it was too late for meaningful corrective action? Many cases stem from employee fraud or falsification of financial reports. Others occur when expensive, cutting-edge computer systems fail to live up to expectations - or fail altogether.

Thus, many professionals are asking, "Who's minding the store?" since it appears that - in addition to management - external auditors, internal auditors and audit committees may all have dropped the ball.

As a result of this apparent gap, audit committees are being urged to become stronger and better equipped. The recent guidance prepared by a Blue Ribbon Committee on Improving the Effectiveness of Audit Committees is a good first step. [See page 57 for a summary of the committee's work.] The New York Stock Exchange and National Association of Securities Dealers created this committee in response to concerns about breakdowns in the financial reporting process expressed by SEC Chairman Arthur Levitt, leaders in the investor community and others.

Such believers in the importance of audit committees are on target: Now's the time to improve audit committees' performance. This can only benefit the companies, their audit committee members jointly and individually, directors' and officers' liability insurance carriers and the investor community.

We see two ways to do this. Interestingly, the seeds of these suggestions are visible in work done by the Treadway Commission, FEI, the IIA, the AICPA and others. First, firms should design and implement company-specific cash flow controls as part of the oversight and control structures available to audit committees. And, second, they should use professional - not peer - reviews to strengthen audit committees.

Turn Up the Audit Committee

Because of their critical role, audit committee oversight and control structures must be analyzed on two levels. On the primary level, properly functioning oversight and control structures allow audit committees to monitor activities effectively and continuously, and to exercise control commensurate with their role as the chief stewards of reporting processes and internal controls. They give audit committees a flow of necessary information (agreed to up-front by management) and establish communication with other appropriate parties, including staff and contracted professionals. Importantly, correctly designed oversight and control structures facilitate the flow of recommendations among various players and let the audit committee (as well as other board members and senior management) address the challenges that continually surface.

Audit committees must ensure that these primary oversight and control structures also are comprehensive and flexible enough to address potential hazards to organizational stability - including global competition, deregulation, transformations (flattenings or re-engineerings that change the fundamentals of the way a firm is organized and operates), transitions (hostile takeovers, friendly acquisitions, mergers, etc.), the need to face poor earnings or insufficient capital, and Y2K issues. These challenges can affect both healthy and troubled firms - and can stress an existing oversight and control structure to a point where it must be radically redesigned to function properly. In such cases, audit committees have a responsibility to monitor these often complex redesigns and their implementation.

While it's clear that primary oversight and control structures are the main line of defense for the audit committee and the firm, their complexity and breadth make it difficult to use them for a "quick look" at the company's health. The audit committee needs something easier to get its hands around.

Enter the secondary level: carefully designed, company-specific cash flow controls. Second-tier structures must provide a clear picture of ongoing operations, undistorted by events in which the firm is enmeshed. The secondary structure's basis should be cash receipts and disbursements, with thoughtfully developed cash flow forecasts for all business units. Actual vs. projected cash flows should be reported quarterly (or as appropriate). These reports should tie into actual cash on hand, and all variances should be explained to fully satisfy the audit committee.

The beauty of cash flows lies in their clarity. Senior management, stag and the audit committee can easily see that a company can't survive with an empty wallet. Cash flows are simply there or not. With cash, it all comes out in the wash. Also, cash flows can be reported quickly and independently of other oversight and control structures. This should ensure that the audit committee is well positioned to monitor the viability of the firm's business units, and quickly deal with issues that will affect cash. Further, the requirements for these controls don't burden the firm, as they should be in place to support its short-term cash management and longer-term financial planning.

The cash flow controls set out here differ from "Sources and Uses of Funds," and focus on several key value drivers of operations. They keep everyone focused on fundamentals, and warn of increasing inventories, bloated receivables, revenues without cash and other events. Again, board members, senior management and staff can easily grasp a basic cash flow forecast - and all have a vested interest in the outcomes. The information they glean helps them understand the business units and measure progress toward meeting company objectives. Perhaps the real proof of the basic value of cash flow controls is that, when a company is in financial trouble, it considers little else as it struggles to right itself.

The requirement that audit committee members be independent distinguishes them from management, creating a "them" and "us" mentality. This is amplified by the audit committee's responsibility to be informed, vigilant and effective in overseeing the firm's reporting processes and internal controls. In this role, the audit committee at least indirectly assures the entire board of directors of the reliability of the management information it uses to meet the board's responsibilities. Anyone familiar with public companies knows this role isn't lost on senior management.

Seasoned Professionals

Another fact: Audit committee members need information, training and updates. While the recommended sources of assistance are management, internal auditors and external auditors, its defined roles make it awkward for the audit committee to ask for and receive help from those for whom it has oversight responsibility. But if these needs were assessed in a professional review of committee activities by a small team of independent senior financial executives - perhaps made up of moonlighters or of retired members of FEI or the Institute of Internal Auditors - such tensions would largely dissipate. No inferences would be drawn, facilitating relationships between the audit committee and its related parties.

Direct contact with company staff, particularly internal audit, could be handled similarly, as could involvement with the external auditor. The professional review team would examine existing guidelines and relationships, and work with the audit committee to modify them as appropriate. And it would take the same approach to internal controls and major systems design, implementation and redesign.

The professional review team has allegiance only to the audit committee. It is independent, objective and experienced. And it brings a hands-on sensitivity to the requirements of corporate oversight as well as to any tensions between audit committees and related parties.

H. Stephen Grace, Jr. is president of Grace & Co. Consultancy, Inc. John E. Haupert and Robert S. Roath are members of the board of advisors of Grace & Co. Prior to their respective retirements, Mr. Haupert was treasurer of The Port Authority of New York and New Jersey; Mr. Roath was CFO of RJR Nabisco Holdings Corp.