Tuesday, September 14, 2010

Who Audits the Auditors?


A great deal of reliance is placed on auditors by Boards, regulators and the providers of debt and equity capital.   But how can these parties know the quality of the auditors' work?  Particularly, those not inside the firms being audited?

Understanding What Auditors Do and What They Don't

The first step is understanding precisely what is the role of the auditor.  A "clean" audit opinion does not mean that there was no fraud in the company.  Nor is it a guarantee that the financials are 100% correct.  If you think about it, to get to that level of certainty, the auditor would have to be present at every business discussion and follow each transaction at the company from "cradle to grave".

What the auditors' work should mean ("should" because it doesn't always) is that the auditor has determined that there is a proper system in place that is functioning reasonably.  That includes determining that  proper accounting principles are applied on a consistent basis, that the assumptions and estimates which affect preparation of the financials are reasonable and that a check of assets and transactions (on a sample basis) doesn't raise any red flags.  And finally that the results of operations (income, assets etc) are reported fairly in sufficient detail.

Several factors influence the performance and results of an audit:
  1. Interpretation of accounting standards and principles:  strict, moderate or lax
  2. Level of skill, experience, knowledge of the partners and staff
  3. Management of the audit process, e.g., audit plan design, management of staff and workflow, quality of the review process
  4. Ability and willingness to challenge management's assumptions and estimates
  5. Ability and willingness to stand-up to pressure from the client or outside parties
  6. Ethics
The second is understanding that the international firms are structured as partnerships, generally at the country level.  So Firm XYZG in the UK is not exactly Firm XYZG in Bahrain.  For one thing each has its own dedicated staff with their own level of skills, knowledge and experience.  What that means is that there can be differences between one office and another of the same firm.  

Auditing the Auditors

So, how can an outsider audit the auditors?

Three ways:
  1. Use the work of regulators and others who review auditing firms' work.
  2. Review the end product (the financial report) for quality.  While management is ultimately responsible for the content of financials, the auditors have a role to play as well.  Is the report clear?  Or is the true nature of transactions difficult or impossible to figure out?  Does the auditor seem to be condoning presentation at the edge or beyond in terms of accounting for transactions?  Do you see a repeated pattern of "easy audits"?
  3. Prepare a list of auditors for distressed firms.   Then identify those companies where the problems were outright fraud, improper valuation of assets, aggressive booking of profits.  You're looking for  major occurrences and a repeating pattern. 
Let's turn to these examples one by one.

Using Regulatory Reports

Unfortunately, such regulatory or other review reports aren't available for every country.  To a large extent that limits the utility of this method.    But where they are available one may gain some insights.  While firms are separately incorporated national partnerships, there is some level of quality control, sharing of expertise among offices as well as tone setting from the top.

It's important to know that public reports of this nature are written in diplomatic language.  So it's important to understand the "code" used.  The concept is similar (but not identical) to that in the IMF Public Information Notices.   It's also very important to understand the basis for the reports conclusions.  In some cases the sample of audits reviewed is small in terms of the total number of audits done.  And may not have been selected using statistical sampling techniques.   In such cases one has to be careful not to draw a conclusion about just how widespread a failing is.

Reviewing the specific issues for a firm can give an idea of that firm's overall approach and perhaps pinpoint particular areas of concern.  One can usually classify the shortcomings as due to (a) lax interpretations of accounting principles, (b) staff inadequacies, (c) work process failures (design, implementation, monitoring and review of the audit), etc. 

This exercise can provide another level of insight.


Besides information on a specific firm, these reports may also disclose common problems.   If the reports on almost or all of the firms repeat the same themes, this can indicate both the relative frequency and severity of a problem.  So, for example. if all firms are being criticized for  audit failures on revenue recognition,  that's a much different situation than if only one firm is. 


On this topic today the UK's Financial Reporting Council, Professional Oversight Board released its  annual public reports on the audit work four major international accounting firms in the UK.  There's a very important word in that last sentence:  "public".  We can infer from this that there were private reports.  No doubt much more direct and to the point.

One firm has been singled out in the press.  But if you look at the individual reports you'll see shortcomings in such central areas as:
  1. Obtaining audit confirmations for assets (one would think in the post Parmalat world this wouldn't be occurring)
  2. Failure to attend the physical count and inspection of inventory - a very key step in understanding the financials of a manufacturing or retailing company.  If inventory is overstated so are profits.  
  3. Technical issues such as going concern qualifications
  4. Failure to complete partner performance/competence reviews
But note that the sample of audits reviewed was not chosen according to statistical sampling techniques.

What's potentially disturbing here is that these sort of things are being discovered in the UK.  One might assume that with the existence of the FRC POB, a legal system that makes it easy for lawsuits, the firms would be on their best behavior.  If this is the case, and it may well not be, what then is the standard in other less regulated more opaque markets like the GCC?

Reviewing the Financials Yourself

The second method, reviewing the financials yourself, is admittedly tricky.  You've got to have a bit of knowledge about accounting standards and presentation.

Here by way of example are some things that caught my eye.  And which two different observers might draw different conclusions.
  1. The 2009 report of an investment bank in Bahrain.  Late in 2009, in what some might see as a vindication of its proven business model, it announced the successful issuance of a US$100 million convertible murabaha.  It's only when one reads further into Note 16 that one learns that the murabaha was issued at a discount, though you won't see that word used in the financials.  Nor was it in the press release.  It's only at the end of Note 16 we learn that proceeds were only US$80 million.  Technically, is the information there? Yes.  But it must be teased out of the Note.   Like that table you bought from Ikea, some assembly is required.  Is this really in the spirit of  شفافية ?  Isn't this material information important to the readers of the financials, particularly shareholders? Shouldn't it be disclosed in plain unambiguous language?  Apparently, management and the bank's auditors thought otherwise.
  2. The 2009 annual report of a conventional investment bank in Bahrain, who some might describe as the grande dame of the industry.  During the year, it issued some US$500 million in preferred equity which is duly reflected in its books as of the end of its fiscal year.  But a look at Note 6  (Cash and Banks) shows that some US$381 million of that amount is as "cash in transit".  What this means is that the funds were received after the statement date.  They were not in the bank on the statement date.  Reflecting the full US$500 million as paid in equity seems a bit premature.  Perhaps this post balance sheet event is more properly reflected in a "Subsequent Event" Note.   Note 7  (Receivables) discloses that another US$110.5 million of the US$500 million was also not yet received.  So paid in equity has increased by US$500 million but only 1.7% of the amount was received by the statement day.  As in the case above, management and the auditors agreed on this presentation.   
  3. The 2006 annual report of the same investment bank.  A change in IAS #28 led to a US$354 million charge to retained earnings which dropped from US$528 million to US$170 million.  Previously, the bank had valued some of its investments in associates at "fair value" using only comparable transactions using an exemption for assets held for sale in the "near term".   The bank noted that "near term" was not precisely defined in the Standard.  It reasoned  that since private equity and similar investments are held for three to seven years, that period  must be what was meant by "near term".  Like the cash in transit  treatment above this seems a rather conveniently elastic determination.  The firm's auditors apparently had no real problem with this approach because they countenanced it for years.   But there's more.  With that exemption no longer applying, the assets became Fair Value Through Profit and Loss with the methods for determining fair value now also including comparable market values (not just actual transactions).  The result of this additional method?  A US$359 million charge (68% of 2005 retained earnings).  Whether this was properly classified as a prior period adjustment (direct to equity by passing the income statement)  statement) is a matter of debate.  But the size of the required adjustment does suggest that tests for impairment may also have benefited from generous assumptions.   You'll recall that when the restatement occurred (June 2006) macro economic conditions were not particularly depressed.  And that over the next two years (a relative boom particularly in the markets where the investments were concentrated) there was no subsequent write up of these assets, lending further credence to the adjustment being more of an impairment.
Involvement in Distressed Situations
  1. This is fairly straightforward.  The initial list can be compiled from the well known names in distress.  
  2. One then looks for cases where there was particularly egregious behavior.  And then sees if the same firm's name is turning up repeatedly. 
  3. Two very important points. 
  4. First, firms get into financial distress without their being any defects in audit or any unethical behavior on the part of management.  Bad things do happen to good people.   
  5. Second, everyone makes mistakes.  It's when one makes a lot of them that the red flag should go up.
  6. Over the past few years, we've seen some spectacular falls from grace.  While some of these were due to (a) poor management or (b) the global economic crisis (lower case "g", please), in others there was apparent manipulation of financials.
  7. In some of these cases, there have been allegations that loan portfolios were fictions of the imagination, that outside parties controlled the entities over riding what is described as a compliant/supine management, that internal documents, loan files,  minutes of board meetings were forged, etc.  If these allegations are true, there was massive sustained fraud.  Financial institutions may have been run as criminal enterprises.
  8. In other cases fair values turned out to be vanish with astonishing rapidity.  Often in  companies that engaged in a high volume of obviously dubious transactions with related parties - buying and selling stock in one another, playing musical chairs with assets.  On a scale to suggest that this behavior was the usual mode of conducting business.
  9. In some other cases, companies abused positions of trust and expropriated client and investor funds for their own use, stuffing those unfortunate parties with the losses or using assets of uncertain quality to extinguish amount certain liabilities.  Yet, the audit reports solemnly aver "We are not aware of any violations of local laws".  Though perhaps to be fair in some countries local law may not prevent such behavior.  It may instead be a sanctioned national sport as some of my "Southern" GCC friends claim is the case in one "Northern" country.
All of the above are of course indirect and not conclusive proof.  

But like the mosaic theory of research analysis (in which a bright analyst takes lots of little bits of information about a company to develop a powerful insight into its value), one can potentially do the same here.  And a sense of the quality of financials and audits can be a powerful (though not sole) input to an investment decision.

In the process one also has to apply appropriate weights to behavior.  So, for example, one might be more forgiving of  some shortcomings than others.  It's a bit easier to "understand"  an auditor  letting some window dressing pass than countenancing related party schemes to pump up investment values.  Though it's probably a good idea to be a bit more wary of an auditor who repeatedly demonstrates a "flexible" or "accommodating" approach than one that does not.  Each crossing of a "line" makes the next easier.

6 comments:

The Rageful Cynic said...

A belated Eid Mubarak!

Outstanding post, AA! Really exceptionally well done. This is a topic about which people in the region are woefully uninformed so its great to see you shedding some much needed light on this.

In my mind, its really a case of "well, if we can't trust the auditors work, then we're pretty much flying blind..." I've done a lot of analysis whereby I've needed to weed through annual reports and the lack of cohesion, standardization and clarity are appalling. Now, granted I've never really delved into foreign entities' reports (like in the US or Europe) so I'm not really sure how deficient GCC reporting is, but its very clear that there is a large gap in the reporting of info.

At this point, I pretty much take everything in the report with a large pinch of salt, especially when it comes to valuation of assets. If you look at the change in valuations from 2007 to 2008 and then from 2008 to 2009, its really quite remarkable.

Who do you think is to blame for this disconnect? Is it the auditors for letting certain things slide? or is it the country's regulator for allowing such misrepresentations and not taking, what I think are, common sense steps towards rectifying the situation?

For example, the Central Bank of Kuwait announced its new regulations for the investment sector back in June, one of which was that foreign debt exposure should not exceed 50% of equity. The CBK was specific in saying that the foreign debt should be measured by origin of debt rather than denomination. Now, shouldn't the CBK issue a concurrent mandate or regulation requiring firms to disclose foreign debt (by origin) in their reports? I mean, its not rocket science.

I think there's a massive failure on all sides when it comes to transparency, accuracy and consistency of reporting. I don't know if its that auditors are too cozy with firms or if the regulators just flat out don't care, but it is certainly dragging down performance and creating an atmosphere of uncertainty.

Ok, I'm done rambling :) kudos again on such a great post. It was thoughtful, concise and unbiased (excellent job not naming names, I'm sure that was difficult for you :P)

P.S. "The bank noted that "near term" was not precisely defined in the Standard. It reasoned that since private equity and similar investments are held for three to seven years, that period must be what was meant by "near term"." << That is incredible... whoever thinks that "near term" means 3-7 years needs their head examined...

Abu 'Arqala said...

TRC

Part 1

Thanks for the greetings and comments.

From the latter it's pretty clear you're not only extremely intelligent but also possess very good taste. :)

Some reactions to your comments.

First, problems with financial reporting and auditing are a worldwide phenomenon.

After all it's the Developed West ("DW") which gave the world Enron, WorldCom, et al.

In general the difference might be characterized as one of "level of skill" in manipulating numbers.

The DW has less rookie manipulation. Some of the stuff in the GCC is truly laughable. It's also very apparent - at least to me.

And while it's not uncommon for folks to avoid bad news or try and spin bad news away, again the GCC takes the cake for silly practice.

That being said, it's fairly clear that financial journalists in the area don't even have the basic skills. Press releases are quoted with no analysis. The most absurd things are repeated.

One of my friends was interviewed some "financial journalists" from a very large Kuwaiti newspaper. His opinion - they didn't know a debit from a credit.

And investors don't seem to have a clue. I met one guy at a shareholder annual meeting who didn't not understand the fundamental difference between equity and a bond. And who had invested his entire retirement fund in one company listed on an exchange where daily liquidity is like oases in the desert largely a mirage.

The point of all this that such tactics might work.

There are also other constraints.

One guy I know at a local research firm told me in effect "Our reports on domestic companies are constrained. We cannot tell the whole truth".

But to be fair, I've had discussions with staff from the major rating agencies about specific issuers. They either didn't know or didn't want to know some fairly obvious things. Like Bank X has no real cashflow. There's a strong case that Bank X cooked its private equity valuations because IAS #39 forced it to mark to market its listed portfolio. Bank X by the way had an investment grade rating. It took me all of 15 minutes to spot this.

Abu 'Arqala said...

Part 2

There are two reasons why firms engage in accounting manipulation.

(1) To save the franchise.
(2) To create the franchise.

The first occurs when a firm gets itself into trouble or where trouble befalls it. Then the question is whether a lie or two is justified to save the firm. So, for example, when the Latin sovereign debt crisis hit and all the major banks in the USA were technically insolvent, they pretended they weren't. Lots of jobs were saved. A systemic financial crisis was averted.

Or when not much later on, the two major banks in NYC were insolvent from stupid real estate lending, both pretended they were still solvent.

So one might see window dressing of capital increases as one of the things that a firm in this position might do.

The second reason is that the manipulation is an integral part (sometimes major) of the firm's value creation strategy. Asset values are "pumped". Income manufactured. Customers defrauded.
That is, it is Day #1 (or Day #3) behaviour.

Sometimes it's done to cover up misdeeds. I recall one firm where a major shareholder had "borrowed" some money - you might call it an "undocumented" withdrawal if you were the Flying Abdullah Brothers.
Though it did appear in the books as a rather peculiar receivable.

Abu 'Arqala said...

Part 3

Regulators

Why don't they catch all this?

(1) The Human Condition
While hindsight is 20;20, at the time one has to take an action, one's vision isn't always clear. Folks make mistakes.

(2) Sheer Incompetence.
Often mixed with laziness. Sometimes lack of knowledge is a key culprit and the unwillingness to admit one doesn't understand something.

(3) Policy Reasons.
Let the small sin go to prevent a larger problem. Systemic problems a la the Latin Debt Crisis. Reputational problems (important for countries where banking is an important industry). And there's more. The GCC countries are largely in a bad zip code (political risk wise) so there's an even greater "need" to prevent bad news.

(4) Influence.
A big fish in a country has an interest in seeing the bank protected.

(5) Country Culture
There's an interesting book on the Philippines "Booty Capitalism" - which analyzes the banking system in the ROP. It basically postulates that the political and legal systems in the country were designed to facilitate corruption. But even if the system hasn't been rigged, if the culture is short term - make the fast buck now, who knows what tomorrow brings, there can be a similar attitude.

(6) Crackpot Political Theories
Naive belief in the magical power of the "free" market to self-regulate is a major contributor to the recent Almost a Depression. While one might expect the partisans of industries to advocate such views (even if they didn't believe them), it just boggles the mind that regulators fell for this fairy tale.

Abu 'Arqala said...

Part 4

So what does one do?

Well, the first step is a solid grounding in accounting and financial analysis.

(1) Step #1
Look at the macro environment: What's the macro big picture on laws and regulations, ability to enforce in court, quality and power of the regulators, how many big fish are there who can influence things, state of local accounting standards, quality of auditing firms, corporate governance and ethics, etc. etc.

For a foreign firm, the decision can be quite easy (intellectually) but hard for a variety of reasons (all my competitors are doing it). We're not going to do business in [X].

For a local firm, the usual response is (a) get real and solid collateral, (b) watch like a hawk for signs of problems and (c) redline certain industries, groups and individuals.

(2) Step #2

Look at the specific client.

Do the financials give the info you need to do a proper analysis? Does the client employ aggressive or questionable accounting? Are estimates and assumptions incredible (meaning not credible)?
Are notes written to elucidate or obfuscate? Is a spade called a spade?

If the client doesn't pass this test (along with the ethics/morals test) you cross him off the list. And no it doesn't matter that everyone else is lending.

(3) Step #3
Is financial performance incredible (same definition as above)? If it's too good to be true, it probably isn't.

Then there are the obvious things.
Is income largely fair value? If so, how are values determined?

What's cashflow (gross operating cashflow = before changes in working capital) to net income look like? Is there a recurring pattern?

How much of labelled "operating cash flow" (net operating cashflow) is due to working capital changes? And what's going on with WC components like inventory (investments), receivables and payables?

Anything lurking in those wonderful categories of "Other Assets" and "Other Liabilities". I glance at OA and the cashflow statement showed Bank X that I referred to earlier had almost no cashflow from operations. It was borrowing money to pay dividends and bonuses on changes in fair value - where those changes suggested manipulation. GFH buried a US$137 mm provision in OA just recently.

Then of course more of the usual financial analysis.

The trick is being able to say "no" and stick one's ground. Easy to say. Hard to do.

The Rageful Cynic said...

thanks for the reply,

I suppose if one puts a fair amount of effort into it, then the red flags will present themselves in any report. However, my concern is with general lack of apathy in the region (and really on a global scale, although regulators in Europe and the US endeavor to, at least, make it look like they give a damn); the GCC regulators and government bodies shout about increased oversight and the like, but I have a sneaking suspicion that it will all fly out the window once the next boom sets in. It is inevitable I suppose.

What I'm trying (and I suspect failing) to articulate is that investors, especially institutional ones, tend to ride the waves of the market with little-to-no connect with the actual fundamentals of the business... which is fine, an investors objective is to make money, which you can do in an inefficient and under-regulated market.

But the lack of urgency on the part of regulators and governments is troubling since its not a matter of "losing one's shirt" if, say the Kuwait investment sector implodes, but that such an event would prove systemic to the country's welfare, costing about 2% of GDP to rectify (according to the IMF), with a fallout that would easily engulf the banking system..

It seems to me that quite a bit of urgency might be called for on their part instead of this laissez-faire, if-they-don't-get-it-together-by-2012-we'll-deal-with-it-then attitude...

Also, you can't honestly expect financial journalists to be abreast of this , most of it is just blind repeating of one other like some vicious, endlessly droning merry-go-round....

Thanks again :)