In the course of being cross-examined by Counsel for a Big-4 firm, I was accused of repeatedly attacking big-firm auditing and one of my articles was cited as evidence. I replied that I was implacably against bad auditing in general, not against big firms in particular.
I should have added that some years earlier the Bank of England unfairly attacked that same firm over its failure to issue a warning on a crooked bank it had audited. I promptly wrote an article stating that the Bank of England was blaming the firm while dodging its own supervisory failures. The senior partner must have agreed: a grateful letter plus a box of golf balls, carrying the firm’s logo, arrived in the next post. Sadly, the balls now languish in some unfriendly rough.
The profile of top firms and their clients guarantees that serious failures are publicised. But it is a mistake to exempt smaller practices. Audit methodology everywhere has distanced itself from the action, and this generalisation applies to firms of all sizes. The result is a fatal shift in focus: indispensible procedures, requiring direct contact with client records, have lapsed in favour of the protective veneer of compliance.
Needed: inquisitive scrutiny
Such a change is always evidenced by a proliferation of regulatory bumph (“guidance”) from one or other of the faceless acronyms, via the Institute, in turn via the firm’s technical department, whilst audit teams struggle against an unforgiving cost-clock. And then some hapless auditor clicks his paperless mouse, just to “get the job done”.
This focal shift robs the audit of its chief weapon: spontaneous recognition that what you are looking at does not make much practical sense. A checklist-audit may require you to report analytical variances by exception, but what if the perennial consistency is itself based on falsely contrived data? What if the total wages figure looks “about right” but, because the computer doesn’t ask, no one spots that the proportion of wages paid in cash has doubled?
consistency is itself based on falsely contrived data?
With notable exceptions, this lack of inquisitive scrutiny is widespread. Auditors blind themselves to reality by preferring to trust the directors – to do so is cheaper. All firms use the basic risk matrix. They categorise risk as “low” when there is a high level of management involvement and supervision, ignoring the fact that those very features warrant “high” as the risk factor because of management’s ability to by-pass controls. If, however, the risk is recorded as “high”, the materiality threshold will fall, which means more work. That cost may prove irrecoverable.
Accounting flaws exposed
The performance of big firms on bank audits was the subject of a House of Lords Select Committee’s recent report. The auditors’ evidence claimed it was not their job to vet the sustainability of the client’s business model, yet the Lords stated: “In the light of what we know now, that defence appears disconcertingly complacent.” (Para 142)
In 2006 the auditors of Northern Rock saw no need to alert shareholders to going concern worries – after all, the company was “profitable” and had access to funds. The Lords, however, “find this complacency disturbing” given that the Rock’s business model was “dangerously risky”. (Para 145)
As it happens, the profitability that provided such comfort didn’t exist. Accounting rules allowed bank directors to give current assets a “market” value that included unrealised profits, and to estimate debt failures on an “incurred” rather than an “expected” loss basis. This made no sense to independent observers – and, if nothing else, auditors are supposed to be independent. But because the rules allowed it, they ticked it. Some auditing.
No wonder we now have a Bill that will require bank directors to publish parallel accounts that, at last, re-instate the key principle of prudence.
Sir David Tweedie instructed us on the meaning of “fair value” back in April 2008: “No entity is ever allowed to disclose assets valued at more than their recoverable amount in its financial statements.”
Maybe something got lost in translation.