“What were your procedures for this? I imagine when you are in the fraud realm, standard audit procedures don’t apply. Forged documents would probably be provided.”

I agree. In our case we went one level beyond the small investment advisor and confirmed information with the custodian, a publicly traded financial institution subject to an independent audit. The relative size of the investment advisor to the institution was tiny so the chances of the advisor’s ability to influence the custodian were minimal. The few million dollars invested was large relative to our client but was miniscule relative to the balance sheet of the custodian institution. The additional steps taken weren’t complicated, didn’t take much additional time but would theoretically provide us with a high degree of comfort about the reliability of the response. Ultimately, it also alerted the institution to improprieties taking place involving customers in its trust department.

In the Madoff situation, since he was both advisor and custodian, my sense is that we would have attempted to do something more formal to confirm the credibility of his firm. This could have included such things as getting a copy of his audited financial statements, which would have led to further questions and concerns. IMHO it’s the same logic (if not the same rules) that underlie the reasoning for requesting copies of SAS 70 reports.

Then, if we’d gotten the same canned responses from Madoff’s firm as he gave most everyone else, I’d like to think that we would have disclosed the situation in the financials and formally recommended that the client terminate the investment relationship and move its funds elsewhere.

“We had concerns with the size of the investment advisor company so we arranged to confirm the existence, ownership and terms of the CD assets directly with the custodian (a large regional financial institution).”

What were your procedures for this? I imagine when you are in the fraud realm, standard audit procedures don’t apply. Forged documents would probably be provided.

I stand by my original statement. The Maddoff investment would have to be pretty big for me to go real in depth.

Isn’t it true that Mr Madoff wasn’t even registered as an investment advisor until 2006? How does that happen? Why didn’t that cause auditors at the lower tier to ask questions? What CPA works on an audit like this and does ask questions about the reasonable probability of generating these kinds of returns? Have we lost any ability to set aside a checklist and ask a REAL question?

When I audit a balance sheet and the investment accounts are material to that statement don’t I have an obligation to make sure that I send out a confirmation of the account AND to make sure that the confirmation I receive back is worth something? Even where an account is held by a national bank we still verify that the confirmation has some relationship to the bank statement issued on that date.

What Mr Madoff did was analogous to the diligent employee who refuses to take a vacation. He controlled every aspect of the investment transactions and all of the reporting related to them. This sounds like a concentration of risk issue. Further, Mr Madoff trying to skip registering in order to remain outside SEC scrutiny is another audit flag. Finally, when some investors tried to bring accountants in to perform due diligence and were denied access that is a huge flag. All of these issues should have been considered by the auditor as a reflection of management of the lower tier investor.

Large CPA firms don’t necessarily do a better job. They have more resources, but I have seen abysmal work that passes their review process come to my desk.

“Bankers said they had done everything they could, including checking the auditor and regulatory reports, and could not have been expected to spot a fraud.”

There was a funny comment on NPR this weekend about he surprise of many Madoff investors that they were ripped off when they had thought he was only ripping off other people. I think that many people probably expected something was going on, but hoped that they weren’t the “bigger loser” in the pyramid.

In terms of the accountants specifically, I think that at least part of it has been the lower standards of regulation. Many clients, especially in good times, would probably complain about the cost of extra audit procedures that might have uncovered something and without a regulatory requirement and in a competitive audit environment the firms may have been hard pressed to argue that such procedures were called for.

Misleading analogy! Some years ago we had an audit client that invested with a small investment advisor. Our client was invested allegedly 100% invested in FDIC insured CD’s. We had concerns with the size of the investment advisor company so we arranged to confirm the existence, ownership and terms of the CD assets directly with the custodian (a large regional financial institution). It turned out that the custodian didn’t have all the assets that the investment advisor claimed were held. Fortunately, custodian made the client whole.

Madoff was both the advisor and custodian which (a highly unusual situation). Auditors usually have an obligation to at least consider the financial wherewithal of custodians in this situation. The investors’ audit firms should have at least requested copies of the audit report for Madoff’s company(wonder how many of the investors’ audit firms requested that?) A quick examination of the report and a few telephone calls would have identified the small size and scale of Madoff’s auditor. A followup call to the AICPA to confirm the peer review status of Madoff’s auditor would have quickly uncovered that firm’s true status.

Fornelli’s statement is misleading in that whether the auditors were or were not responsible to audit the underlying investments is not relevant. Rather, based upon these facts the investors’ auditors should have done something to satisfy themselves as to the viability of the custodian(Uncle Bernie’s Pancake Investment Shop). It will be interesting to hear them tell us exactly what procedures they did perform.