Future Students, Alumni & Visitors





Archive for the ‘Audit Committee’ Category

Twenty Anti-Fraud and Corruption Governance Red Flags

The following reflect my work in assisting regulators and enforcement authorities, and research on governance in companies that have been accused of fraud, bribery, corruption, and other malfeasance such as harassment, nepotism, expense reporting, and excessive compensation. I also draw on my interactions with, and guest lectures by, fraudsters who are currently in prison or who have served time in prison, and experts such as forensic accountants.

Here are the red flags, as I see them, in problematic companies and boardrooms that may contribute to fraud and other malfeasance going undetected or undeterred. Drawing on a speech I gave this month to a bribery and foreign corruption conference, and an earlier speech to corporate directors, the red flags are, in no particular order:

  1. Independent oversight functions (audit, compliance, risk) either non-existent or reporting to senior or operating management.
  2. A board lacking in risk, international and relevant industry expertise, and paucity of audit committee know how of how fraud is or may be committed.
  3. A whistle blowing procedure that is neither anonymous nor protected.
  4. A board that does not believe it sets tone at the top. A tone that is not equal and consequential.
  5. A focus on rule and legal correctness, not spirit and intent. Failure to account for exogenous shock, stress, and a different frame of analysis. Directors not speaking up.
  6. Complex design being approved by directors. Directors approving when management does not fully tell them the counter-argument, and directors do not ask (know), or press.
  7. Captured, conflict-seeking, self-dealing, over-compensated, over-tenured directors and gatekeepers who are not objectively independent.
  8. Immature risk management, non-investment in information technology, and defective or non-existent controls, particularly non financial, reputational and behavioural.
  9. Defective, non-existent, or dominated internal audit function.
  10. Lack of culture and reputation control assurance to the Board. No understanding of tone in the middle, or toxic or bullying work culture.
  11. Non-audited compensation, and improper incentives (quantitative, financial, short-term) that incent risk-taking behaviour. Unconstrained risk-takers and a complacent board.
  12. Clawbacks not at correct threshold of ethics or risk. Lack of risk-adjusted compensation.
  13. Charismatic, dominating, and/or stretched CEOs and CFOs, including distracting external activities, personal issues, living beyond their means, not tasking vacations, and undue attention to accounting.
  14. Ethical code poorly designed, controlled, monitored, enforced, assured and reported to the board.
  15. Lack of documentation with explicit limitations and thresholds for material risks, cascading to emerging markets and key suppliers.
  16. Lack of executive sessions, with only independent directors, and with only internal oversight functions (audit, risk, compliance).
  17. Lack of due diligence and integrity controls at the hire or contract stage. Lack of integrity controls over senior management, and capacity for over-ride.
  18. Non-zero tolerance of facilitating payments. Mixed message sent by the board.
  19. Lack of independent, expert validation (board, risk, controls) reporting directly to the board.
  20. Weak or corrupt host country auditors not vetted or overseen by the audit committee, and lack of availability and translation of documents.

Do you recognize any of the above red flags? On a board or in a company of which you serve? Allegations of wrongdoing can put assets and reputation at risk. Regulators have enormous power, and are focusing their sights much more on the role a board plays, or does not play, in overseeing the affairs of the company.

Mandatory Tendering of UK Audits – A Better Approach Was Missed

Last week, the Competition Commission in the UK issued a provisional decision requiring audit committees of large companies to tender bidding for the external audit every five years, among other reforms (see here).

Make no mistake: this is a major change and will shake up the cozy relationships some audit firms may have with their clients. Even this change is more significant than what was expected (I would have predicted 9-12 years). The Competition Commission is serious.

Here is what listed companies and the big 4 audit firms will argue: Five-year tendering is a one-sized fits all approach that does not address audit quality and imposes high switching costs. And there are unintended consequences.

They are entirely correct, and there would have been a better approach.

First, why are they correct? The academic evidence is that auditor rotation (assuming a good tendering process results more often than not in a different firm doing the audit) likely does not improve audit quality. Second, five years is therefore arbitrary. Third, a new auditor will need to climb a learning curve, and this is a costly investment for a company, not to mention the actual audit committee time in overseeing the tendering process. Fourth, a company will be forced to tender when they may be very satisfied with the auditor’s independence and quality of their work and reporting.

A far better approach would have been to address the heart of the issue: assess audit quality and act on the results.

An objective, robust annual evaluation of the external auditor, involving a 360 review by the board, the audit committee, and reporting senior and financial management of the company, with results disclosed to shareholders, would have been a much better approach.

The reluctance by boards to assess auditors in this fashion essentially forced regulation.

We see the same reluctance by boards to assess directors, act on results, and report to shareholders. Regulators in Europe and Asia are therefore imposing term limits on directors, at about 9 years. This is also arbitrary and can force a good director off a board or keep a poor director. Term limits may even come to North America. There are articles in the mainstream press about “zombie” directors and directors whose terms exceed 40 years.

Boards need to step up and address their own performance and that of their advisors. Regulators have shown they will act in the absence of self-governance and boards may not like it when they do.

Does your Audit Committee Need a Reset?

I was recently asked to speak to audit committee members in Niagara-on-the-Lake on best practices for audit committees. See my slides here. I was particularly critical of how audit committees and boards oversee risk. Risk systems in many companies are immature. Look at BP, Wal-Mart, JP Morgan, HSBC, News of the World, Barclays, SNC Lavalin and MF Global. These are all risk management failures, which are turn are governance failures.

There is good reason for risk management failure.

Proper risk management requires internal controls to mitigate risk. (Internal controls are processes and procedures such as segregation of duties, documentation, authorization, supervision, physical safeguards, IT security and prevention of management override.) No one likes to be controlled. Risk management is not intrinsically profit-making. Therefore there is an inherent aversion to risk management by management.

This is why regulators now are targeting boards with greater risk governance obligations because only the board has the authority to control management. Recent bank governance guidelines in Canada require much stronger risk oversight by boards and audit committees. Recent Ontario Securities Commission guidelines offer advice to boards and audit committees with operations in emerging markets, coming out of the Sino-Forest debacle.

There is a strong bias for audit committees to oversee many risks, not just financial. No regulation mandates this however. Audit committees should not oversee risks that they are not qualified to oversee.

Here are a dozen broader questions to determine whether your Audit Committee needs a reset.

1. Do your board and board committees have coordinated coverage, assurance and reporting over all material enterprise risks, both financial and non-financial?

2. For any non-financial risks that your Audit Committee may oversee, do the skills and experiences on the committee match the oversight?

3. Has the Audit Committee proposed a written risk appetite framework, approved by the board, which translates into explicit limitations and thresholds throughout the organization?

4. Are there any acute risks that you do not understand, or over which management is capable of overriding existing controls?

5. Do all Audit Committee members have tenure on the board for fewer than nine years? (Exceeding nine years is a red flag for lack of independence.)

6. Does your independent external audit firm have tenure for fewer than nine years? (This is also a red flag for lack of independence.)

7. If your company operates in an emerging market, do you have one Audit Committee member with direct experience operating in this market?

8. If your company has over 300 employees and it is a financial institution, or over 600 employees for any other type of company, do you have an effective internal audit function reporting directly to the Audit Committee?

9. Has your Audit Committee benchmarked the company’s risk management and internal control framework against best practices, using an independent external advisor?

10. Do you have an effective risk function that reports directly to the Audit Committee or board of directors?

11. Does your Audit Committee understand fraud implications of accounting policies, methods for making estimates, and compensation metrics?

12. At each Audit Committee meeting, do you meet separately with each of: the CFO; the internal audit function; the risk function; and the independent external auditor, without any member of management present?

When I asked for a show of hands during my lecture, not a lot of hands went up for many of the above types of questions.

If you answered yes to all questions, or even almost all, you likely have a truly outstanding audit committee. You may even wish to apply for a governance award, here.

If you cannot answer yes to the majority of these questions, you have work to do.

Join me in my next blog where I will ask if your Compensation Committee needs a reset.

Regulators turning up anti-bribery heat on corporate boards: But will practices change?

Russia is one of the most corrupt nations in the world (see a recent anti-corruption story on Russia by the New York Times). It ranks 143rd of all 182 countries on Transparency International’s corruption perception index, with a score of 2.4. Canada ranks the 10th least corrupt country in the world with a score of 8.7. New Zealand is the least corrupt country globally, ranking first with an overall score of 9.5. The US ranks 24th and the UK 16th, with scores of 7.1 and 7.8 respectively. See the “Full Table and Rankings,” where countries can be searched via the table. Lower rankings and higher scores mean the country is perceived as being less corrupt.

Prime Minister Harper visited China, India and Brazil to enhance trade with these countries, which are also some of the most corrupt nations in the world, ranking in at 95th, 75th and 73rd respectively. Libya, which involved the alleged Montreal-based SNC Lavalin bribes of some $56 million, comes in at 168. Within these countries, the governments themselves are the net beneficiaries of much of the corruption, so these politicians are far from motivated to impose reform.

Is it realistic to expect that Anglo-American nations, such as the US, UK and Canada, can impose “Western” will on the very way business is done, and has been done, in some countries for centuries? And if things will not or perhaps cannot change, should home country boards of directors be held responsible for systemic local corruption that may be beyond their control?

Regulators are taking corruption and the role of boards and senior management very seriously. The Securities and Exchange Commission and Department of Justice recently released 130 pages of guidance (see the PDF and other coverage here and here) on the Foreign Corrupt Practices Act (“FCPA”). The US has had the FCPA since 1977. Enforcement and penalties have gone up dramatically in recent years. The UK Bribery Act, from 2010, has some of the most stringent bribery laws in the world. In Canada, we have The Corruption of Foreign Officials Act (since 1999) and the recent guideline from the OSC for issuers operating in emerging markets (see the PDF).

Emerging economies are future markets for Canadian companies. The Prime Minister has a vision for Canada to be an energy supplier superpower. For this to happen, Canada will shift its trade to markets with 100s of millions or billions of consumers and much higher growth rates than our current major trade partner, the US, which could be coping with austerity due to its debt for years to come. Harper was in India last week to boost trade.

What is clear is that there is an enormous disconnect between the home country regulations now being imposed, and host country actual practices on the ground.

What should boards that have operations in emerging market jurisdictions do? Six things. First, if you are doing business in such a market, you need a director with extensive on-the-ground experience at the board table, who can tell you and management what the hotspots are. You should move a board meeting to the jurisdiction once a year so directors can get a first hand look. Second, boards must make it crystal clear to management that if the company is not going to bribe, management must walk away from certain business. And the board must support this and not have incentives that promote bribery. Third, the internal controls over financial reporting must be as strong in the emerging market as it is in the home market. Investment and resource commitments need to be made. Fourth, boards must have their own experts to scrutinize off-balance sheet and related-party transactions and complex structures; validate and assure internal controls; and provide foreign language document translation. Fifth, local auditors should have the same oversight, scrutiny, and as necessary direct contact with the audit committee that the home auditors have. Lastly, there needs to be zero tolerance by the board communicated to each employee and supplier. The UK is even banning facilitating payments, which are regarded as a “tip,” as these may be bribes in disguise.

Companies and politicians are feeling the pain, including on Canadian shores. The Wal-Mart bribery probe has widened beyond Mexico to include China, Brazil and India. The RCMP is investigating the SNC Lavalin bribery allegations, on which I advised a law firm suing the company. I blogged about Sino-Forest, a case of alleged Chinese fraud by a Canadian-listed company. In Quebec, the corruption inquiry has cost the Mayors of Montreal and Laval their jobs and this is only the beginning. There are allegations of kickbacks in cash that may reach other more senior politicians. And Ontario is not immune either. A senior Canadian director remarked that Ontario has a reputation for being “the best place to carry out a stock fraud in the industrialized world.”

Clearly, more work needs to be done. Canada’s corruption ranking on Transparency International may go down in 2012 instead of up.

Bribery, Cyber-Security and Derivatives: Is Internal Audit up to the Task?

Do internal auditors have the resources, skills and authority necessary to do their job? I wonder. I was asked recently to be an expert witness in an alleged bribery case. Internal audit is one of the first places I look to when assessing governance failure because they are the eyes and ears of the board.

I asked a question recently at two auditing conferences I spoke at. How many auditors use Twitter? In both cases, only one hand went up. Yet we know cybercrime is widespread, is under-reported, and management may not even know it is happening. It is a top concern of boards. How can internal auditors assure internal controls – not only over cyber-security but social media – when they themselves may be technically illiterate? IT literacy and data mining were two of the top skills required by internal auditors in a recent survey.

What about derivatives used by traders? How many auditors understand the use of derivative products such that they can attest to the internal controls over their use? The responses I received from my audiences were not encouraging.

What about corruption risk? How do auditors treat working notes, delegation to foreign auditors, language barriers, and do they even understand foreign practices? Do they visit the jurisdiction or audit from an office in Canada? The OSC came out with a scathing report recently about emerging market risks, chastising not just boards but the audit and underwriting professions.

What about fraud? Evidence from the conference board is that many whistle-blowing programs don’t work and aren’t used. Now whistle-blowers can go directly to the SEC in Washington, completely by-passing possible retaliation, flawed investigations or toxic workplaces.

Auditors cannot choose which internal controls they validate. Regulatory authorities are clear: every activity of every entity should fall within the scope of the internal audit function. This includes compensation structure of risk-takers. Combined assurance over all material risks should be undertaken.

Management may have vested interest in starving internal audit or compromising their objectivity with management responsibilities. Regulators have been clear here also: auditors, both internal and external, must maintain their independence from audited activities. They cannot assess their own work.

If the internal audit function is weak, or the chief audit executive does not have the experience or stature, or management disregards internal audit findings, this is the fault of the audit committee and the board. The audit committee should approve the head of internal audit, his/her compensation structure, the budget, work-plan and most of all the independence of the internal audit function. If the audit committee and ultimately the board does not ensure this, it is not doing its job. When or if governance failure happens, scrutiny will follow.