Loaning, assigning, or “seconding” tax or any “bookkeeping” staff to an audit client is prohibited by the Sarbanes-Oxley Act of 2002 and by regulations that precede Sarbanes-Oxley. It looks like a regulator got to both KPMG and GE, but quietly. I doubt we’ll ever see a public sanction or fine from the PCAOB or the SEC for KPMG.

My story exposing this prohibited activity by an auditor for an audit client was published in Forbes last March.

KPMG has been GE’s auditor for more than 100 years. Former SEC Chief Accountant Lynn Turner was surprised and quite angered at my revelation. In addition, Turner commented in his newsletter on an email I received from the Carpenters Pension Fund after my column appeared at Forbes.com. The pension fund sought to hold GE and KPMG accountable for auditor independence and have a discussion at the annual meeting about auditor rotation. They were blocked by GE and the SEC:

KPMG has been the auditor of GE for over 100 years.  In light of that,  I understand the Carpenters Pension Fund submitted a auditor rotation shareholder proposal for shareholder consideration to GE and about 45 other large cap companies with audit firm relationships that exceeded 10 years. GE and numerous other companies requested that the SEC issue a no-action letter that would allow them to omit the proposal from their 2012 proxy statement.

Despite the fact that GE had not changed auditors for over 100 years, and auditor rotation had not been “normal business” for GE, and despite the fact that according to reports KPMG was not independent of GE due to non compliance with the SEC’s own independence rules as a result of loaning staff to GE, similar to acts in Australia where the SEC sanctioned KPMG with an enforcement action, the SEC staff obliged, agreeing with the companies’ argument that the issue was “ordinary business.” I understand the Carpenters Pension Fund  requested that the SEC staff take the no-action issue to the full Commission for a decision, but that the staff rejected that request. As a result, the SEC staff denied shareholders – the owners of GE - the opportunity to vote on a non binding shareholder proposal raising the issues of auditor independence and firm rotation.

Rather the SEC staff have apparently chosen to allow a non independent KPMG to remain as the auditor, according to reports.

My story at Forbes, with all the details is here.

These disclosures were a result of pressure brought to bear by Congresswoman Maxine Waters and several other congressional members who sent a letter to the OCC and the Fed on October 28. This letter expressed the legislators’ displeasure with the way the OCC and the Federal Reserve Bank had so far run the “independent” foreclosure review process that is intended to overhaul mortgage-servicing processes and controls and to compensate borrowers harmed financially by wrongdoing or negligence.

Congresswoman Waters cited my October 6 column for American Banker in this letter to the OCC and Fed when demanding that the regulators manage conflicts of interest in the foreclosure review process as well as make a full disclosure of vendors and their engagement letters with the banks.

On December 6, I wrote again in American Banker after I reviewed the engagement letters that were posted by the OCC. I had several concerns. Congresswoman Waters did, too.

“[The OCC] issued a report on the actions of a dozen national bank and federal savings association mortgage servicers aimed at complying with the consent orders issued in April 2011 to correct deficient and unsafe or unsound foreclosure practices. (The two remaining consent order recipients — GMAC/Ally and SunTrust — have not yet finalized their terms with vendors and as a result their overseers, Fed Chairman Bernanke and the Federal Reserve Bank, have not yet responded to the request for full disclosure, according to the Water’s office.)

Waters was less than impressed with what she saw and so am I.  She told me, “My letters specifically asked for information on conflicts of interest between the banks and the consultants — which is precisely what the OCC redacted in the information they released last week. A cursory look into the banks and their consultants indicates that in some cases, there are substantial pre-existing relationships between the firms.”

Redacted is an understatement.

Here’s what was redacted, according to OCC spokesman Bryan Hubbard:

Limited proprietary and personal information has been redacted from the engagement letters including, but not limited to:

• Names,titles and biographies of individuals;
• Proprietary systems information;
• References to specific bank policy;
• Fees and costs associated with the engagement;
• Specific descriptions of past work performed by the independent consultants.

So what’s left? It’s interesting enough, as a start, to look at which consultants and law firms were selected by which servicers. It’s also interesting to look at the scope of services to be performed and the time and volume estimates for project activities where they were not redacted.

From my December 6 American Banker column:

The disclosure of the consultant engagement letters for each servicer has already had a huge impact. The Financial Times reports that the New York Attorney General “launched an investigation into possibly unlawful foreclosureson the mortgages of active-duty members of the US military.” The foreclosure review engagement letters posted by the OCC included estimates prepared by the banks and their consultants suggesting, according to the Financial Times, that 10 leading lenders may have seized the homes of about 5,000 service members in violation of the Servicemembers Civil Relief Act, which restricts foreclosures on the homes of active duty members of the U.S. armed forces.

There’s also the issue of attorney-client privilege:

Some of the engagement letters invoke attorney-client privilege and attorney work product privilege over the whole process and confidential treatment of engagement letter itself. It appears all the servicers used their general counsel’s office to engage the consultants and outside counsel and some name their general counsel as project lead. Some servicers engaged additional outside legal counsel for the review directly rather than through the primary consultant.

OCC spokesperson Hubbard says, “although some of the engagement letters make claims of attorney-client privilege, these claims are by statute inapplicable to the OCC and FRB, which have complete access to all documents produced by the independent consultants and servicers as part of the independent foreclosure reviews required by the Consent Orders.

I certainly hope so.

I was the first to report on December 6 the irony of Deloitte having been selected by, of all banks, JP Morgan Chase. The high likelihood of a conflict between the bank and the audit firm, and possibly the individual Deloitte partners assigned to the JP Morgan Chase review, should have been obvious to anyone at the OCC. I said on December 6 that it would be great if we could see the names of the partners and staff assigned to the engagements and check their credentials and prior client work for conflicts.

It would be enlightening, for example, to see whether any of the Deloitte partners proposed as consultants as part of the foreclosure solution at JP Morgan/EMC, were previously part of the mortgage origination/securitization problems as auditors at Bear Stearns or Washington Mutual.

Bear and Washington Mutual, both former Deloitte audit clients, are now part of JP Morgan Chase, and Deloitte is defending lawsuits over alleged audit failures at those firms.

Lo and behold, partner Ann Kenyon of Deloitte, who testified at a December 13th Senate hearing on the issue, said under oath that she is the engagement partner on the JP Morgan Chase foreclosure review. An internet search revealed a conference biography that suggests that amongst Kenyon’s representative clients was Washington Mutual, now owned by JP Morgan Chase and a significant part of the review. This would be a clear conflict with her role as engagement partner for the review.

Ms. Kenyon [who leads Deloitte's Securitization Advisory practice] works with issuers, comprised of both attest and non-attest clients, who have encountered difficulties in accounting for and reporting on their securitizations.

At the 126:20 mark of the archived webcast of the Senate hearing Kenyon describes the organizational structure, level of experience and source of professionals for the Deloitte JP Morgan Chase review team. (She says it’s all Deloitte staff.) She also says that a large team of Deloitte partners who are subject matter experts report to her and are leading each team.

Someone should check their conflicts, too.

Two of the other three Big Four audit firms were selected for multiple review assignments. KPMG, auditor of Citigroup, New Century, Countrywide, Wells Fargo, and Wachovia, is conspicuously but thankfully absent from the list of consultants.

Examples of firms involved in multiple reviews include Ernst & Young (involved in three reviews as both a primary consultant and subcontractor), PricewaterhouseCoopers (involved in two reviews as a primary consultant), and Promontory Financial Group (involved in three reviews as primary consultant). Law firm Gibson Dunn is legal counsel for three reviews (retained by the consultant in two cases and by the bank directly in one).

For example, one firm could be charging different rates to different banks for what is supposed to be a consistent review across servicers. That not only indicates banks can leverage their influence with vendors to get the review they want (and the monetary exposure estimate) at the price they want to pay, but that we may not get consistent results for borrowers that were harmed by multiple servicers.

Some of the concerns I mentioned in my December 6 column were pursued by Senators at the December 13 Senate Committee on Banking, Housing, and Urban Affairs hearing: Helping Homeowners Harmed by Foreclosures: Ensuring Accountability and Transparency in Foreclosure Reviews.

Some additional interesting interchanges during the hearing:

At the 45:30 mark of the archived webcast, Senator Reed asks the OCC’s Julie Williams why the OCC and Fed could not select and contract with the consultants directly. Williams says that would have been difficult because it would have necessitated the regulators to use a “procurement process” that included consistent “standards” for selection.

That sounds to me like a Request for Proposal process and a vendor selection process that is in place  - for many of these same vendors already – as a result of the finical crisis. Instead the OCC and Federal Reserve bank abdicated the vendor selection process to the services and, therefore, will reap the numerous potential conflicts they have sown.

At the 49:00 mark, Senator Reed asks a critical question, perhaps thinking about the Deloitte/Bear Stearns-EMC/Washington Mutual issue with regard to a JP Morgan Chase review. If a consultant runs across a set of transactions that the firm or those consultants had direct involvement in is the consultant obligated to report that conflict to the regulator?  Williams says that they would expect to hear about such a conflict.

Reed presses to ask if there is an “obligation” versus an “expectation”.  Williams sounds evasive in her answer, implying that this specific obligation is not explicit in the engagement letters.  I sure didn’t see it.

My December 6 column, in particular the parts regarding the Deloitte conflict and the attorney-client privilege issue were mentioned in the written and oral testimony by Alys Cohen, Staff Attorney  at the National Consumer Law Center.

With regard to the attorney-client privilege potential issue, the OCC and the Federal Reserve Bank should make sure all legal counsel that is intended to be part of the foreclosure review team should be retained by the consultant not the bank.  Otherwise, I see an assertion of attorney-client privilege by the outside legal counsel for the reviews as inevitable.

Some additional areas where strong monitoring by Congress and the OCC/Fed might be helpful going forward include:

• Checking consistency of level of effort estimates across project plans for each consultant’s proposal. Estimated hours for each task may vary based on the size and complexity of servicer, difficulty of obtaining information, and level of cooperation in resolving issues. But consultants will bill on a “time and materials” basis and variations in length of time estimated, for example, for each initial loan review and the quality assurance process could make millions of dollars of difference in fees given the tens of thousands of documents to be reviewed.

• The complaints process, managed as a coordinated approach for all servicers by Rust Consulting, needs to be synchronized with each servicer’s plan for their reviews. Although the OCC strongly influenced the design and implementation of the “coordinated” process, Rust Consulting signed a contract each servicer, risking the possibility of some servicers skimping on the effort or being unprepared based on their lack of progress in other dependent activities.

On October 28, Congresswoman Maxine Waters and several other congressional members sent a letter to the OCC regarding the “independent” foreclosure review process intended to overhaul their mortgage-servicing processes and controls and to compensate borrowers harmed financially by wrongdoing or negligence.

Congress insisted on more disclosures and assurances of independence and monitoring of conflicts of interests during the “independent” foreclosure review process.

Congresswoman Waters cited my October 6 column for American Banker in their letter when demanding that the OCC manage conflicts of interest in the foreclosure review process as well as make a full disclosure of vendors and their engagement letters with the banks.

On November 22, 2011, the Office of the Comptroller of the Currency (OCC) issued a report on the actions by 12 national bank and federal savings association mortgage servicers to comply with consent orders issued in April 2011 to correct deficient and unsafe or unsound foreclosure practices.

“The report, “Interim Status Report: Foreclosure-Related Consent Orders,” summarizes progress on activities related to the independent foreclosure review announced November 1, 2011, as well as other activities to enhance mortgage servicing operations, strengthen oversight of third-party service providers and activities related to Mortgage Electronic Registration Systems (MERS), improve management information systems, assess and manage risk, and ensure compliance with applicable laws and regulations…

In addition to the interim report, the OCC also released engagement letters that describe how the independent consultants, retained by the servicers, will conduct their file reviews and claims processes to identify borrowers who suffered financial injury as a result of deficiencies identified in the OCC’s consent orders. The letters identify the names of the independent consultants conducting the reviews and include language stipulating that consultants would take direction from the OCC throughout the reviews…”

I’ve been following the subprime crisis that morphed into a credit crisis and eventually the full-blown financial crisis since almost the start of this site in late 2006.

The first blog post on this site to use the word “subprime” was about New Century Financial, a KPMG client, mortgage originator, and one of the first failures of the coming crisis.

In August of 2007, I wrote about the irony of Senator Charles Schumer, one of the accounting industry’s favorite pet politicians, calling on the auditors to gut check the sincerity of the mortgage servicing industry about loan modifications.

Senator Charles Schumer has a lot of nerve. He also has a strong belief that the US public is naive and gullible. At best, it’s comical that Senator Schumer is demanding action on the sub prime crisis from the accounting firms. After all, they pay him to protect their interests, not the other way around. Where did he get the idea that they’re part of the solution? I wouldn’t be surprised to find out that Deborah Harrington wrote the press release.

Sen. Schumer urges Big 4 on mortgage accounting

“U.S. Senator Charles Schumer has asked the big accounting firms what steps they are taking to inform investors holding securitized mortgage assets that they can modify home loans and refinance them, according to a letter obtained by Reuters on Friday.“One of the most promising solutions to the anticipated foreclosure crisis is the voluntary modification by lenders of existing unsustainable subprime loans,” the New York Democrat said in a letter to the heads of Deloitte and Touche USA, KPMG, Ernst & Young and PricewaterhouseCoopers.

Not sexy enough, I guess.

Then they asked me for a catchy lede. That’s journalism-speak for the part at the beginning that grabs your attention, summarizes the gist of the story, and pulls you in.

I’m not good at titles and I have to be in the zone – read: highly caffeinated – to make plays on words.

I suggested:

The column, with a different title, “Banks Hire Friendlies for ‘Independent’ Foreclosure Reviews”, and lede is on line now at American Banker’s BankThink. Everything but that first line is mine, of course.

Can you count on the emperor’s handpicked ministers to tell him when he’s naked? Banking regulators seem to think so.

The April consent orders against mortgage servicers let the companies pick one or more professional-services firms to review their foreclosure actions for abuses and report the findings to the agencies.

Allowing the banks to choose their own judge, jury, and jailer presents almost untenable conflicts of interest. All of the consulting firms that were initially being considered to do the work serve the banks already. The banks, and their mortgage servicing operations, are existing or prospective clients…

I guess American Banker prefers to picture their readers naked rather than lobbing grenades.

I’m happy to have a patient editor with a sense of humor.

Please read the rest at American Banker.

You may remember earlier this year when The New York Times broke a little story about General Electric’s tax savvyways and the best tax law firm the universe had ever seen (aka the GE tax department).

The report caused more than a few people to get bent out of shape because the Times said GE was enjoying $14.2 billion in profit while “claim[ing] a tax benefit of $3.2 billion.” What that “benefit” really entailed was a mystery but many people jumped to the conclusion that it was a “refund” andProPublica (possibly a little peeved that they got scooped) tried to set the record straight on the Times story.

Despite all the back and forth, everyone was pissed at GE. The company lost aTwitter joust with Henry Blodget and then a bogus press release went out claiming the company was returning the “refund” of $3.2 billion and the Associated Press ran it. Slightly awkward.

Francine McKenna also did a write-up on KPMG’s role in this little soap opera, as the firm has been the auditor for GE since Bill Taft was maxing out the White House bathtub.

The latest twist comes from a tip we received earlier about a “Preservation Notice” sent to all KPMG employees yesterday from the firm’s Office of General Counsel (“OGC”).

URGENT TARGETED PRESERVATION NOTICE: GENERAL ELECTRIC’S LOAN STAFF ARRANGEMENTS

Please be advised that until further notice from KPMG LLP’s (KPMG or firm) Office of General Counsel (OGC), you are hereby directed to take all steps necessary to preserve and protect any and all documents created or received from January 1, 2008 through the date of this Notice relating or referring to the loaning, assignment or secondment of tax or other professionals to General Electric Company and its direct and indirect subsidiaries, affiliates and divisions (collectively “General Electric’s Loan Staff Arrangements”).

Last March, I wrote the story that highlighted this arrangement. The preservation notice refers to tax and “other loaned staff arrangements” so there may be more like this at GE.

Uh oh.

Based on my reading of the rules, loaning, assigning, or seconding tax or any “bookkeeping” staff is not allowed for the auditor. What’s worse is that KPMG had been sanctioned recently for a similar issue in Australia. I guess they thought the SEC/PCAOB would never go after them in the U.S. and never for trying to “please” such a high-profile client.

The Sarbanes-Oxley Act of 2002 started out tough on tax. The rules regarding prohibited activities by the auditor, intended to preserve their independence, scared the living daylights out of the largest firms. It appeared initially that the SEC would prohibit the tax side of the firms from providing highly lucrative tax advice to their audit clients. Many of those professionals started planning an exit from their firms so they could continue working with long time clients.

A compromise was reached. The result is one of the loosest and most generous exceptions to auditor independence rules on the books.

The Commission reiterates its long-standing position that an accounting firm can provide tax services to its audit clients without impairing the firm’s independence. Accordingly, accountants may continue to provide tax services such as tax compliance, tax planning, and tax advice to audit clients, subject to the normal audit committee pre-approval requirements under 2-01(c)(7).

The Sarbanes-Oxley Act of 2002 also prohibits an auditor from providing “bookkeeping” services to its audit clients.

The rules utilize the previous definition of bookkeeping or other services, which focuses on the provision of services involving: (1) maintaining or preparing the audit client’s accounting records, (2) preparing financial statements that are filed with the Commission or the information that forms the basis of financial statements filed with the Commission, or (3) preparing or originating source data underlying the audit client’s financial statements. Our experience with this definition demonstrates that the concept of bookkeeping and other services is well understood in practice.

In defiance of these provisions, KPMG – GE’s auditor – provides “loaned staff” or staff augmentation to GE’s tax department each year. These “temps” perform tasks that would be otherwise the responsibility of GE staff. Sources tell me KPMG employees working in GE tax have GE email addresses, are supervised by GE managers – there is no KPMG manager or partner on premises – and have access to GE employee facilities. They use GE computers because the software required for their tasks is GE proprietary software.

This type of “secondment” to an audit client is never allowed. KPMG should know better. KPMG was recently sanctioned by the SEC for a similar transgression involving their Australian office.

KPMG Australia and at least one other KPMG member firm outside Australia seconded non-tax professional staff to work at each client’s premises, under the supervision and direction of each client, doing the same types of work that each client’s own employees or managers ordinarily would perform, in violation of the prohibition under Rule 201(c)(4)(vi) against “[a]cting, temporarily or permanently, as a director, officer, or employee of an audit client, or performing any decision-making, supervisory, or ongoing monitoring function for the audit client.”

KPMG earns approximately 10% of their total fee from GE for tax services not connected to the audit directly or indirectly. GE’s policies state that these engagements, if for more than $1 million dollars, must be pre-approved by the GE Audit Committee. However, these services should never have been provided at all per SEC independence rules -rules that pre-date Sarbanes-Oxley.

KPMG is well known for supporting, as an auditor, aggressive tax strategies.  Recent controversy over long-time audit client Citigroup’s use of deferred tax assets to pump up its profits is one example.  KPMG also once flew too close to the flame as a tax shelter provider. Its advice to private clients on how to pay less to the IRS almost got the firm taken out of the game completely.

So why, for a measly $8-10 million a year, is KPMG playing with fire in providing these low value, low margin, low status services to GE?  It may be that KPMG wants to hold on to the relationship at any cost.

Read the rest of my original story at Forbes.

Read the rest of the Going Concern story here.

That’s ok. I like seeing viable alternatives to the Big Four audit firms – the firms whose primary focus should be external auditing not growing their consulting businesses. Again.

Remarks Before the 2010 AICPA National Conference on Current SEC and PCAOB Developments

by James L. Kroeker, Chief Accountant, Office of the Chief Accountant, U.S. Securities and Exchange Commission on December 6, 2010 (Emphasis is mine.)

In vesting in the accounting profession such an important public trust, a system predicated upon auditors adhering to strong standards to ensure that financial statements are properly presented is crucial. Accountants should not take their position for granted; the role that auditors play was not put in place without considering the alternatives.

Just as I encourage auditors to stand firm and to maintain quality and credibility in their audit work, I also encourage leaders of audit firms to ensure that the audit is never again treated like a commodity. The auditing function should be the very soul of the public accounting profession – never again as a foot in the door for higher-fees related to services from their multidisciplinary firm.

The public – and those who act in the public’s behalf, such as the Commission – need to be assured that audit firms will continue to make the necessary investments over time to ensure that audit quality is not compromised, and that auditor performance will continue to meet public expectations. While I have heard recently about the rebuilding of the consultancy practices within large accounting firms, I trust that the profession will not need to re-learn lessons of the past on the serious, adverse effects of under-investing in the quality or failing to strictly maintain the independence of their audit process. I am likewise hopeful that if significant investments are being made to pursue other lines of business within a “multi-disciplinary” firm, the potential impact on public trust and public perception of the audit practice is being considered.

I interviewed Protiviti Executive Vice President Bob Hirth in January as they rolled out the survey. The Protiviti report had a few surprises for me – well, maybe not – about who’s doing the work of Sarbanes-Oxley within companies.

For the most part it’s still internal audit.

I asked Richard Chambers, the CEO of the Institute of Internal Auditors (IIA), an international professional association for internal auditors in industry and in the firms, what he thought of that:

“While nothing about that contravenes our professional standards, the best role for Internal Audit to play in Sarbanes-Oxley compliance initiatives is to provide overall assurance on the effectiveness of the organization’s documentation and testing of internal controls and Section 302 certification process, rather than to be down in the weeds doing the actual documentation and testing of controls instead of management.”

Truly surprising was that the authors of the Protiviti report had to warn some small company responders that outsourcing Sarbanes-Oxley to the external auditors is a no-no.

I wrote about the survey last week at Forbes.com.  You can find that story and additional comments and quotes here.

Protiviti has a nice webinar on their site that goes though their whole report.

Download the survey report here.

]]> http://retheauditors.com/2011/06/26/the-state-of-sarbanes-oxley-compliance-the-protiviti-survey-results/feed/ 14 http://retheauditors.com/2011/03/30/an-honest-services-crisis-professional-poison-and-a-chicago-connection/ http://retheauditors.com/2011/03/30/an-honest-services-crisis-professional-poison-and-a-chicago-connection/#comments Wed, 30 Mar 2011 22:07:04 +0000 Francine http://retheauditors.com/?p=6676

“Where do bad folks go when they die?  They don’t go to heaven where the angels fly.”

This guest post is by Mark O’Connor, CEO and Cofounder of Monadnock Research.

Phyllobates Terribilis, the golden poison dart frog (not to be confused with, or metaphorically associated with Nectophrynoides Deloittei), is the second most toxic creature on earth. Hold him in your hand and you’ll barely feel he’s there. But touch him and your heart will stop within minutes. This little guy normally sports a coat of batrachotoxin, an alkaloid neurotoxin, sufficient to quickly kill up to 10 mature adults. But take him out of his element and he’s just a cute harmless yellow frog – a frog with a latent capability to process poisonous plants and insects, and secrete deadly neurotoxins.

Things are not always as they appear.

Every time I hear allegations of professional services misconduct involving a Chicago accountant, consultant, or lawyer, I send Francine McKenna an email. The title of my first missive on the subject in August 2009 was, “Are You Living at Ground Zero for Criminals in Suits?”

It appears to be a worry that Francine and I share. There also appears to be no other metro area on earth with such a high concentration of associated indictments and lawsuits in the last 10 years. We can only hope it’s an aberration. In Chicago’s defense, the city is also within an hour’s flight of a corporate headquarters concentration that has few rivals. Professional services is big business in Chicago. I would expect it to be one of the profession’s most active news hubs. I just wish it was better news for clients and the consulting profession.

Our interest at Monadnock Research is primarily consulting and advisory services. The Big Four, off and on, have had some of the largest global consulting practices across most categories. Later I’ll share our view of the unique operational and strategic levers of the Big Four firms. But first I’d like to provide some background on the numbers from a recent piece of our research (Vol IV, No 9), and what I would characterize as today’s “honest services crisis.”

Fiscal 2010 Big Four Consulting and Advisory Services Revenues

Global non-audit advisory services reported by the Big Four firms, including tax, again broke the $50 billion (USD) mark in fiscal 2010 after retreating briefly in 2009, a 3.23 percent increase. Total non-tax advisory services of Deloitte, KPMG, PwC, and E&Y were $27.8 billion, an increase of 8.1 percent over ‘09. Deloitte tops the rankings as the largest global provider of advisory, including tax, with $14.9 billion, edging out PwC’s at a little under $13.3 billion. E&Y was third with $11.19 billion and KPMG finished its fiscal year with $10.72 billion.

PwC led the group in Tax advisory with $7.09 billion, or close to one-third (31.78 percent) of total Big Four Tax. Ernst & Young ranks second, with $5.671 billion, or 25.42 percent of client revenues. Deloitte ranked third with $5.4 billion and a 24.2 percent share, with  KPMG fourth at $4.15 billion globally and an 18.6 percent share. Excluding tax advisory, Deloitte leads the consulting and advisory services segment among the Big Four with $9.5 billion, followed by KPMG at $6.57 billion, PwC at $6.2 billion, and E&Y at $5.52 billion.

Big Four audit services were around $44.84 billion in Fiscal 2010. So with advisory services now a little more than $50 billion, how much advisory is too much? I will address that later. But first, I’d like to explore the risk posed to clients and firms by the crimes of wayward professionals, including bribes, kickbacks, fraud, and undisclosed self-dealing, and conflicts of interest, our present-day honest services crisis.

Chicago: A Culture Predisposed Toward Corruption?

Readers of re: The Auditors would likely agree that firms providing public accounting services are at most risk. This is why the topic of auditor-provided advisory services is relevant and so important. But it’s also important for management consulting pure-plays like McKinsey.

Whether it’s a Big Four firm or McKinsey, isn’t it really about the professionals providing clients with those services, and their leaders? Here is a sampling of the latest in a string of professional services sector embarrassments in the nine years since Chicago-based Arthur Andersen surrendered its licenses to practice as an auditor in 2002.

• The SEC charged Deloitte’s former vice chair Thomas P. Flanagan with insider trading, and violating auditor independence rules in August 2010, and simultaneously settled. Deloitte itself sued Flanagan and received a summary judgment in January 2010 on charges of breach of fiduciary duty, breach of contract, common law fraud, and equitable fraud after filing suit in November 2008.
• Former McKinsey Senior Partner and capital markets practice lead, Anil Kumar, was the first McKinsey principal in its history to be criminally indicted. Kumar pled guilty to fraud and conspiracy in Manhattan Federal Court in January 2010, admitting to selling confidential client information to Raj Rajaratnam, of the now- defunct hedge fund, Galleon Management (wiretap recording here).
• Even more disturbing, 3-term McKinsey Managing Director Rajat Gupta, has also been civilly charged in the scandal, and there is at least one wiretap of Gupta sharing confidential information about Goldman Sachs where he served as a board member, after leaving McKinsey. Gupta was the Chicago office leader at the time of his appointment to lead McKinsey in March seventeen years ago. McKinsey itself was founded in Chicago in 1926 by James McKinsey. Another former affiliate, McKinsey Kearney and Company, was later renamed A.T. Kearney and continues to be based there.
• Chicago-based Huron’s CEO, CFO, and Chief Accountant were forced out after financial improprieties were disclosed in August 2010. One of Galleon’s largest investments at the time the Hedge fund was shut-down was Huron.
• Canopy Financial in Chicago used fraudulent audit reports, purportedly from KPMG. That scheme was orchestrated by two of the company’s Chicago-based co-founders.
• Chicago’s International Profit Associates and its CEO John R. Burgess were sued by the Illinois Attorney General in April 2009 for alleged deceptive practices affecting hundreds of small-business clients, where fraudulent claims were alleged for failing to deliver on promises to boost client profits.
• A number of senior leaders from BDO Seidman and Jenkins & Gilcrist (J&G) in Chicago were indicted in 2009 on charges of conspiracy to defraud the IRS, tax evasion, and perjury related to fraudulent tax shelter schemes offered to clients. Those charged from BDO included Denis Field, former CEO and Chairman and tax partner Robert Greisman and Paul M. Daugerdas, the former head J&G’s Chicago office and tax practice, and Partners Erwin Mayer and Donna Guerin. Those that pled guilty included Vice Chairman and board member Charles W. Bee Jr.; Michael Kerekes, a principal and former member of the Tax Opinion Committee; and Adrian Dicker, also a former Vice Chairman.

There are scores of cases globally over the same period where providers of professional services have been charged civilly or criminally. There does, however, appear to be a disproportionately large share of U.S. and global cases involving allegations of misconduct with a Chicago connection, according to our research on consulting sector litigation.

The Audit/Advisory Conundrum: How Much is Too Much Consulting?

What does any of this have to do with the Big Four? I would argue that it’s all about risk, and mitigating that risk. And the Big Four, among professional services firms, have more risk than anyone.

What Warren Buffet said in his July 2010 biennial letter to Berkshire Hathaway CEOs on reputation and ethics, republished in its 2010 Annual Report, is even more relevant to each of the Big Four. I include the relevant excerpt below for context.

Warren Buffet on ethics and protecting reputation, from pages 105 and 106 of the 2010 Berkshire Hathaway Annual Report:

The priority is that all of us continue to zealously guard Berkshire’s reputation. We can’t be perfect but we can try to be. As I’ve said in these memos for more than 25 years: ‘We can afford to lose money – even a lot of money. But we can’t afford to lose reputation – even a shred of reputation.’ We must continue to measure every act against not only what is legal but also what we would be happy to have written about on the front page of a national newspaper in an article written by an unfriendly but intelligent reporter.

Sometimes your associates will say “Everybody else is doing it.” This rationale is almost always a bad one if it is the main justification for a business action. It is totally unacceptable when evaluating a moral decision. Whenever somebody offers that phrase as a rationale, in effect they are saying that they can’t come up with a good reason. If anyone gives this explanation, tell them to try using it with a reporter or a judge and see how far it gets them.

If you see anything whose propriety or legality causes you to hesitate, be sure to give me a call. However, it’s very likely that if a given course of action evokes such hesitation, it’s too close to the line and should be abandoned. There’s plenty of money to be made in the center of the court. If it’s questionable whether some action is close to the line, just assume it is outside and forget it.

As a corollary, let me know promptly if there’s any significant bad news. I can handle bad news but I don’t like to deal with it after it has festered for awhile. A reluctance to face up immediately to bad news is what turned a problem at Salomon from one that could have easily been disposed of into one that almost caused the demise of a firm with 8,000 employees.

Somebody is doing something today at Berkshire that you and I would be unhappy about if we knew of it. That’s inevitable: We now employ more than 250,000 people and the chances of that number getting through the day without any bad behavior occurring is nil. But we can have a huge effect in minimizing such activities by jumping on anything immediately when there is the slightest odor of impropriety. Your attitude on such matters, expressed by behavior as well as words, will be the most important factor in how the culture of your business develops. Culture, more than rule books, determines how an organization behaves.

It’s one thing to make a bold and inspiring statement like that. But it’s another to back it up. With Warren Buffett, I believe he would stand behind that message. And I think it’s a safe bet his operating company CEOs and their employees believe it too. How many companies can make that statement, with confidence that employees will believe that it’s genuine? I bet it’s less than 50 percent. And likely a lot less than that.

Unlike firms that provide other categories of services, firms that also provide audit services encounter a unique set of marketplace dynamics. I would argue that the Big Four, like insurance carriers, face a dilemma of trading risk for cash flow. In the insurance business it’s called cash flow underwriting vs. underwriting for a profit. The prudent long-term decision for insurers is to maintain a focus on underwriting profit, even in a soft market, and not trade increases in claims tomorrow for today’s premiums on an increasingly risky book of business.

This may seem obvious but, without fail in competitive times, insurance carriers are drawn into competing for business where they must either cede share to imprudent carriers, or maintain share at the expense of profitability. This type of inappropriate decision is the source of many historical insurance industry failures, where management did not understand the delicate balance, or chose to ignore it with tragic consequences.

Firms that provide audit and non-audit advisory services are faced with similar dilemmas. As with the insurer, a firm providing audit services can relax its standards for accepting new non-audit business that might be demanded by clients. But doing so may ultimately compromise the firm’s auditor independence. The risks are both real and perceived and must be acknowledged.

The Big Four maintain systems for tracking and navigating conflicts posed at the firm and professional levels throughout their networks of firms, within a complex labyrinth of global legal and regulatory environments. The audit committee and client signatories, under Sarbanes Oxley, have the responsibility to assess auditor independence annually. But, realistically, clients look to their auditor to bring conflicts and potential conflicts to their attention, so the client can make its own assessment of auditor independence and the associated risks.

Hiring a Big Four firm to provide advisory services has additional value (real and perceived), outside the obvious scope of an engagement, in terms of quality, integrity, and competence. If a trusted relationship already exists with a firm as auditor or advisor, channeling more work to it reduces project failure risk, brings projects to completion more quickly, and decreases cost.

Similar quality services are available from other firms that have strong reputations and may not be one of the Big Four, and may not even provide audit services. Working with a Big Four firm, however, also carries weight with a client’s investors, regulators, customers, employees, board members, and virtually every client stakeholder. So, increasing the volume of client work directed to one or more Big Four firms may appear to make business and financial sense, especially for the world’s largest publicly traded entities. But there are many risks and opportunities that need to be properly assessed by the firm and the client prior to engaging one of the Big Four, and many of these risks involve subjects not easily broached.

Big Four firms stand alone in many ways, and play a unique role in the marketplace for advisory work. Their services are so highly demanded that they are often in the enviable position of assessing whether they are able to (or should) accept work that may be presented. The rigorous controls maintained by the Big Four increases their cost of providing services. That cost, however, is largely offset by lower business development expenses associated with the engagement opportunities presented to them simply because they are a Big Four firm.

Same “Shtick,” Different Century

Last week there was a meeting to discuss U.S. auditor reporting changes being considered by the U.S. Public Company Accounting Oversight Board (PCAOB) in Washington DC. This would affect public companies trading on the $15 trillion U.S. capital market. To put this in perspective, China, the next largest single market, is just $5 trillion. Reporting standards for companies trading on U.S. capital markets, however, have been largely unchanged for more than 50 years.

James Doty, PCAOB Chairman, noted (recording) that within this market, we must address the largest number of disbursed owners of public companies and institutions trading with broad participation among individual investors. This will require a clarity and consistency of reporting that assures auditor statements are not only transparent, but when compared to those of other companies by different auditors, the reports themselves must consistently and accurately portray what is real, and not simply differences of auditor standards of quality, interpretation, and detail.

PCAOB Board Member Steven B. Harris commented on investor concerns:

“Most investors responding to [our] survey found that the current auditor’s report does not provide valuable information that is integral to understanding the financial statements. Investors want auditors to discuss their estimates and judgments, and how the auditors arrive at that assessment. And the majority of investors would like more information on audit risk, unusual transactions, the quality of an issues’ announcing procedures and processors.”

Balancing the dual auditor/consultant role, and the overall impact on the mix of advisory business to audit and attest work, is a challenge that firms have struggled with for decades, and has been the subject of much debate. James Kennedy, who launched the Consultants News (CN) publication in 1970, was among the first to criticize the large accounting firms about their inherent conflicts of interest.

Kennedy was also not shy about criticizing management consultants with conflicts. His first issue of Consultants News in August 1970, led with another McKinsey scandal. At that time McKinsey Principal Carter Bales was moonlighting as a New York City Assistant Budget Director, while the firm was being awarded contracts worth at least $1.5 million, without competitive bidding.

A quote from Kennedy at the time:

“Mostly everyone ranks McKinsey as No. 1 in the profession, and its high-level ‘positioning’ via contact with leading business schools, its Foundation and other awards, etc. … all of its ‘non-selling’ selling has been superb … but continued vigilance is the price of such leadership. Whether proved factual or not, the charges have not only hurt McKinsey, but all of consulting.”

Another quote from that same 1970 issue, from an unnamed McKinsey consultant:

“Consultants are entirely client oriented. They are not oriented toward solving the problem but toward pleasing the client. When a political executive retains a consultant, he can be pretty sure they’re not going to do anything to upset him and if they do upset him they can change it. The work that we do is helping the executive maintain and consolidate his position, not help solve the problem.”

Kennedy’s response:

“Even the most junior junior would not even think such thoughts, much less express them to an outsider!”

Consultant conflicts are clearly nothing new. We have not, however, made much progress toward addressing conflicts in the last 40 years. In fact, with the admissions of McKinsey’s Kumar, where I applaud his candor and only wish Gupta would provide more of the same, we have taken a big ethical step backward, in my view.

James Kennedy passed away in 2006. At that time, I was running Kennedy’s consulting research group and co-wrote his obituary in CN with the assistance of his daughter, the firm’s former Executive Vice President, Kathleen Kennedy Burke. She shared that her father was particularly critical of conflicts of interest posed by auditor work in the area of financial systems over the years.

The number of public accounting firms was then much larger in number, and the regulatory environment had fewer controls. But the problem is no less urgent today. With only four firms doing most audits of public entities, it is significantly harder for firms and their professionals to avoid conflicts, and to identify high-risk staffers that may even view conflicts as opportunities for personal financial gain.

Audit: Advisory Ratios

Given the issues and the circumstances faced by the Big Four, their clients, and stakeholders of those clients and firms, it appears reasonable to contrast the full range of each firm’s professional services practices to one another. The exhibit below illustrates this for Big Four firms across five categories of metrics. The first measures the firms’ audit revenues as a percentage of all fiscal 2010 non-audit work. The second compares audit revenues to non-tax advisory work. The third combines audit and tax, and draws a ratio between that and all other advisory work. The fourth category contrasts audit and tax. And the fifth compares advisory to tax.

PwC has the largest audit practice in relative proportion to its advisory groups. Since PwC also has the largest proportion of the Big Four audit market at 29.53 percent, it has more areas of potential conflict to police. So we would expect its advisory practice to be smaller in relative size, and it is. PwC also has the largest global tax practice at $7.09 billion, compared to the second largest practice, Ernst & Young, at $5.67 billion. Deloitte follows close behind E&Y in tax at $5.4 billion, followed by KPMG with $4.15 billion.

A comparison of the advisory categories to the median and mean across all ratios and firms shows that that Deloitte, who never sold its consulting business as the others did, has the largest proportion of non-tax advisory business to audit relative to its peers at $9.5 billion. KPMG is a distant second at $6.57 billion, followed by PwC at $6.206 billion, and E&Y at $5.523 billion.

I present these statistics, not to propose a correlation or causal link between specific independence or objectivity conflicts and a particular firm. There is simply not enough insight into the actual conflicts, or frankly agreement among experts on what actually constitutes a conflict. But it is clear that conflicts increase for auditors when they do non-audit work for clients, and these ratios highlight the relative risk that certain firms face.

Deloitte has the second largest audit practice among the Big Four at $11.7 billion, a little over 26 percent of the group’s $44.94 billion in global fiscal 2010 audit revenues. Deloitte also has the largest advisory business at $9.5 billion excluding tax. We propose that tax advisory presents the least of all risks to an auditor’s real or perceived independence, so we treat it separately, as each of the firms does.

Deloitte has the lowest ratios among its peers for Audit: Advisory at 1.232 and Audit+Tax: Advisory at 1.8. So Deloitte has the most exposure to conflict risk in its current client relationships across the service categories presenting the most risk. In our assessment, PwC, who is essentially the same size as Deloitte, has the lowest apparent overall level of conflict risk, with an Audit: Advisory metric of 2.139 and an Audit+Tax: Advisory ratio of 3.281.

This is not to say that Deloitte does not have the capability to mitigate its larger risk more effectively than other firms. Deloitte clearly has more years of uninterrupted experience than the other three in managing that risk. And it has one of the best histories of not being sanctioned for conflicts. Deloitte, however, has had some very public embarrassments at the Partner-level in 2010, including Flanagan, that highlight it has far to go in policing its compliance at the professional-level. This is particularly challenging for acquired companies.

We also highlight that while PwC finished its fiscal 2010 with the most favorable ratios of the group, its stated strategy is to aggressively expand the very advisory practice areas with more acquisitions that, like Diamond, raise conflict risk. So PwC’s status may be in transition depending on how aggressively the firm carries out its strategy. KPMG’s recent acquisition of Equaterra is another example.

Back-Door Compliance Issues

Even the best-intentioned firms can find themselves conflicted. The issue of what I will term “back-door compliance issues” presents latent risk, even when a Big Four firm does everything by the book. With more than 610,000 staff among them, the sheer size of each firm and aggregated percentage of the total global audit revenues controlled by such a small number of firms presents risk. Mergers, acquisitions, and failures of client organizations, create conflict in and of themselves.

PwC, for example, has such a high concentration of clients in financial services, it is very difficult for any industry event to not affect the firm. Deloitte has an historically high concentration of work in financial and ERP system implementations. If nothing changed, how could a stringent regulatory standard be imposed limiting involvement of firms with accounting system implementations from participating in audits for firms where they were involved in the financial system development work? Most financial systems remain in-use at companies for more than 10 years, and often much longer than that.

There is also the issue of firms growing their advisory and accounting businesses, and the conflict risks posed by integrating those acquisitions and on-boarding acquired talent in a way that conflict is minimized. These professionals must become proficient with honoring regulatory standards that can be complex and are likely foreign to most. We may now be at the point where these four firms are so large that one could not be allowed to fail, as many have argued. Many regulatory actions of late appear to bear that out, including the 2005 KPMG Deferred Prosecution Agreement.

Simply keeping track of these potential conflicts is a monumental task. While enforcement of legal compliance has been lax, building a business and network of relationships that is predicated upon a lack of compliance within the spirit and letter of the law is imprudent, at best.

Again, it is our intent to introduce these metrics to raise awareness of the practice levers that create and reduce conflict exposure, and we strongly urge clients and firms to innovate in this important risk mitigation domain. The consequences, as with insurers, for not doing so in a single instance, can have dramatic implications fiscally and from a reputation perspective for both the client and the firm.

Professional Poison

The larger an organization gets, the more its staff takes on the average characteristics of individuals within the markets it serves. So, it makes sense that to maintain rigorous standards for competence and ethics, firms find themselves working disproportionately harder, the larger they become, to mitigate the increased risk posed by not maintaining those standards.

And on the issue of maintaining ethical standards, a common myth is that unethical behavior is the exception and not the rule in business. Not only is this not true, it has never been true. Two recent studies from Harvard Business School and from Deloitte itself explore the reality of questionable preferences and how individuals that otherwise appear to be pillars of business and society are often the moist egregious violators.

The Harvard study, Justifying and Rationalizing Questionable Preferences, cites research going back decades that indicates this is nothing new, and little has changed. That paper examines numerous studies that found people behave in ways that are selfish, prejudiced, or perverted, and tend to engage in a host of strategies designed to justify these questionable preferences with rational excuses.

The Deloitte study, Managing the Bad Apples and Protecting the Barrel, profiles the behavior of professional services firm executives, and identifies the conditions under which inappropriate behavior takes root and thrives. According to Deloitte, organizations need to guard against the segment of habitual amoral actors. But that action, while necessary, is insufficient. Evidence indicates that the vast majority of people aspire to do the right thing, but they too can slip into behavior that they know is wrong, becoming occasional immoral actors. Organizations need to anticipate and manage the risk posed by both hazards.

OK, It’s a Problem. But What Can I Do About It?

Chances are, if you’re reading this, you agree we have a problem. The moral hazards presented to professional services practitioners and the professionals they serve, and those they serve with, are enormous. And make no mistake, the attractant they pose to dormant and seasoned criminals is a professional poison that can take them down, and take the honorable among us down in the process.

I suggest these 7 recommendations would be a good start:

1. Take a step in the right direction. We need to take the right steps by sponsoring organizations, individuals, and legislation that will do the right thing. But just as importantly, we need to block actions that, essentially, grease the skids for people like Anil Kumar and organizations that stand in the way of providing honest services, or that shield them from liability when they get caught. By creating a system with great rewards for inappropriate behavior, lax enforcement, and virtually non-existent penalties for non compliance, what do you think you’ll end up with? Hint, look around. You have it today.
2. Trade secrecy for transparency. It’s amazing what affect the truth has on strangers to it. To them, disinformation is king, or information known only to them. When you listen to the recorded conversations between the McKinsey and Galleon executives, its not simply a question of whether or not confidential client information is being disclosed. It’s being disclosed as a form of currency, and the ability to control its selective disclosure is most valuable. We will always have the Anil Kumars that somehow penetrate our defenses, and the Raj Rajaratnams that seek them out, no matter what we do. Vigilance in combination with transparency is the answer.
3. Turn them in. It’s obvious to say, don’t stand idly by and watch it happen, but we all know that’s easier said than done. Show me a whistleblower and I’ll show you someone with professional scars for doing the right thing. Even organizations that claim to have programs where such inappropriate actions can be reported, often fail to meet the standard claimed by their existence. Organizations that truly want to root out inappropriate conduct should institutionalize examples of what Warren Buffett describes as his policy, on reputation and ethics featured earlier, on page 106 of Berkshire Hathaway’s 2010 annual report.
4. Shun them. Stop working for the bad guys and stop associating with them. Just being connected with them is poison. For Anil Kumar’s charade to have gone on as long as it did, he needed to be associated with perceived good guys with integrity, which transferred to him by association. McKinsey was his mark. Now he has the honor of being the first McKinsey Director to ever be criminally charged for his actions as a consultant since the firm’s formation in 1926. And McKinsey’s professionals now need to deal with the consequences of being guilty by association.
5. Stop feeding them. Stop doing business with them. Bad guys don’t patronize providers of honest services, so why should honest people and organizations support them? It’s better to support an organization that will always tell you the truth, than one that will tell you what you want to hear for the right price. Feed that beast, and you’ll be feeding it forever. Money is the oxygen in business and life. Shut it off, walk away, and don’t look back.
6. Trust, but verify. As America’s 40th President, Ronald Reagan, once said in speaking of relations with the Soviet Union near the end of the Cold War, we must trust, but verify. Don’t accept the status quo of an auditor’s sworn attestations to a company’s financial results, or those of the client in SEC filings. Urge the adoption of standards and legislation that requires those statements be verified using the latest deception detection technologies for the entire team doing the audit. If we can admit as evidence secret recordings of conversations between parties because of their importance to the stability of the world’s largest securities market, we can certainly require that the entire audit engagement team have verified sworn confirmation of audit opinions, along with the client’s senior management team for their assertions about what has been presented to auditors. This one simple change would likely address most of the disclosure problems, since comprehensive voluntary disclosure would become an outcome of that process. In the U.S., verification may even fall within existing regulatory guidelines, given the potential financial impact on markets and individual investors of not requiring it.
7. Just say no. Don’t play any role in their schemes. And if you know, or should have known, and do nothing, you are likely complicit and can be charged civilly or criminally. There can be no agreement that binds you to commit a crime, or to maintain information about a crime because it’s supposedly confidential. As you can see in the wiretaps of Rengan Rajaratnam, it’s the strategy of these sleaze bags to make you “a little dirty.” When you do that, they own you. Then you’re stuck in their world, and your only relief will be when it’s time to bare your soul to investigators, as McKinsey’s Kumar ultimately did. Picture the effect of that on you, your family, and every relationship you’ve ever had. That should be sufficient motivation to make the other recommendations sound like a walk on the beach.

Recognition of Good and Bad Behavior

A case study of good behavior is Willis Group Holdings. This firm has done more than any other organization during 2010, in my view, to advance the cause of providing clients with associated honest services. Despite the actions of its chief competitors, MMC and Aon, to reverse course on government-mandated actions that reduced potential for conflict in the area of insurer contingent commissions, Willis has held its course.

Willis did this even after relaxation of regulatory restrictions in New York, which were likely the most restrictive in the world related to this alternative fee remuneration category. Granted, Willis has less at stake in terms of potential forgone profit by refusing to accept contingent commissions. This is a type of alternative fee arrangement that is tied to recommending specific insurance products to clients that may carry higher compensation tied to client premium volume increases and lower client loss ratios. But what is lost to Willis by taking the ethical high-road is proportionately equivalent in relative terms to that of its competitors.

According to Willis CEO, Joe Plumeri, “A regulatory arrangement built around minimum disclosure requirements tends to result in just that: minimum disclosure.”

Willis stands apart in recognizing its advisory duty to the client, which is “to provide independent objective advice.” Monadnock Research recognizes Willis for these efforts and choices. Clients should keep Willis in mind when considering recommendation 5 above.

We will also recognize three professionals that exemplify the “Professional Poison” that has impacted the credibility of consultants and firms in profoundly negative ways during 2010. Allegations do not make it so, but each of these three individuals has been recognized by his organization as an example of what not to do. We concur.

So we would like to recognize the behavior of these three consulting and advisory services industry leaders as the Professional Poison that must be addressed.

1. Former McKinsey Director, Anil Kumar, has probably done more harm to the profession than any individual in its history. Kumar’s unethical trifecta has simultaneously brought shame and disrepute to himself, his colleagues at McKinsey, and to every consultant in the world. Kumar’s escapades are so well known I won’t repeat them.
2. Thomas Flanagan comes in a close second. Flanagan’s actions as an advisory services senior Partner and former Vice Chairman of Deloitte, while trading on information he learned while serving on client boards, show Deloitte has far to go in policing internal conflicts. Deloitte’s high levels of risk for potential conflicts presented above show that it needs to be particularly vigilant to identify and deal with its own bad apples, and before regulators give them a heads-up.
3. Former EDS CRM practice Managing Director, Joe Galloway, is in a category of his own. Galloway was found by a court in January 2010 to have lied to win an IT consulting project from the U.K.’s Sky Broadcasting. Like a bad seed Galloway moved from SHL Systemshouse to EDS, and later to HP, all though acquisitions. He lied about his credentials, claiming even to have an MBA. Galloway was then caught committing perjury at trial, which finally gave HP cause to fire him. HP ultimately settled with Sky in June 2010 for £318 million in damages.

To Him that Will, Wais are Not Wanting

The stakes are high and there is much riding on a solution to this honest services crisis. There are those among us that sit on a house of cards and have much invested in the status quo. It’s a mess of our own making that we’ve allowed to fester far too long. Sometimes it’s just easier to push problems along, rather than deal with them. This approach is particularly vexing within the consulting and advisory services marketplace, since its services are essentially discretionary and a loss of confidence can be devastating.

My examples may have been focused geographically for presentation. But this is a global problem, and remains an opportunity for the Joes, Toms, and Anils among us. Perhaps what I believe is a well-reasoned argument may just wind up with all the past arguments of this ilk, as whispers in the wilderness.

As Welsh poet George Herbert said centuries ago, “To him that will, wais are not wanting.”

There may or may not be a will today. But my sense is the timing is right, and that a well-connected group of like minded passionate people could set a will on its way.

Mark O’Connor, CEO of Monadnock Research, put together a research note for his subscribers that gives us the details of the accusations. He also provides new insight into why a guy like Gupta may have committed these alleged crimes.

Gupta is alleged to have tipped Galleon’s Rajaratnam, a friend and business associate, providing him with confidential information learned during board calls and in other aspects of his duties on the Goldman and P&G boards. Gupta reportedly made calls to Rajaratnam “within seconds” of leaving board sessions where market-moving information was discussed.

The complaint alleges that Rajaratnam then either used the inside information on Goldman and P&G to execute trades on behalf of some of Galleon’s hedge funds, or shared it with others at Galleon, who then traded on it ahead of public disclosure. The SEC claims the insider trading scheme generated more than $18 million in a combination of illicit profits and loss avoidance.

The SEC also says that Gupta was, at the time of the alleged disclosures of confidential non-public information, a direct or indirect investor in at least some of Galleon’s hedge funds, and had other business interests with Rajaratnam.

Gupta, as a McKinsey veteran, embodied the “trusted advisor” consulting ethos and personified the McKinsey “advisor to CEOs” business strategy and brand. The firm’s value to its clients and its effectiveness as an advisor requires knowing their secrets and holding them close to the vest.

Gupta was McKinsey & Company’s worldwide Managing Director for 9 years from 1994 through 2003…Gupta, now 62, stepped down as a McKinsey partner in 2007, and has since served as Managing Director Emeritus, according to his profile at the Indian School of Business (ISB). Gupta was instrumental in co-founding ISB in 2001, and continues to serve as its current Governing Board Chairman and Executive Board Chairman. He is also a current or former board member (or trustee) of AMR Corp., the parent of American Airlines; the Rockefeller Foundation; the University of Chicago; Harman International Industries; Genpact India; the World Economic Forum; the International Chamber of Commerce, World Business Organization; New Silk Route and New Silk Route Private Equity; and the Emergency Management and Research Institute. Galleon’s Rajaratnam was also associated with the New Silk Route ventures, where Gupta continues as Chairman. Rajaratnam is no longer associated with those entities.

Several media commentators have openly wondered whether the accusations against Gupta, and earlier accusations in the same scandal against McKinsey senior partner and Gupta protégé Anil Kumar, strike a deadly blow to McKinsey.

Will Rajat Gupta Destroy McKinsey? John Carney, NetNet, March 2, 2011

McKinsey’s clients are attracted by its reputation for excellence and discretion—and its stellar network of alumni. Its consultants often refuse to even disclose who their clients are.

If the charges against Gupta prove true, it could be a mortal threat to the firm. Even if there’s no evidence that confidentiality was breached while Gupta was at the firm, being led by a man who would later leak insider information would be devastating. If Gupta is shown to have engaged in similar actions while he was at McKinsey, that could be the end for the Firm.

“At that point, I think we go the way of Arthur Andersen,” another former McKinsey consultant said, referring to the once-prestigious accounting company brought down by its connections to Enron.

Loose Lips, Reuters BreakingViews, Robert Cyran and Rob Cox, March 3, 2011

McKinsey’s reputation rests on its ability to keep secrets. Consultancies, unlike investment banks, don’t provide access to financial markets.  All they offer is counsel, which relies partly on confidences revealed by their clients. According to McKinsey, “Our clients should never doubt that we will treat any information they give us with absolute discretion.” The allegations against Gupta make it hard for clients not to wonder.

It’s understandable that, in the heat of this moment, some might naïvely compare the consequences of the criminal indictment of an audit firm with civil charges against an individual, albeit one who trades on – pun intended – his association with a prestigious professional services firm.

It’s not the same thing.

Extrapolating Gupta’s behavior to McKinsey as a whole is a stretch. I’m no McKinsey apologist but one man, even a former Global Managing Director, does not make this firm.

On the contrary. The firm made him and he’s the one whose currency is now worth less.

Let’s look at a few similar examples from the world of the Big 4 audit firms. The accounting firms are actually regulated and they’re still around in spite of inside traders inside of them, trading on their client confidences more than once.

A Deloitte active-duty Vice Chairman, Thomas Flanagan, was accused and settled with the SEC this past summer over insider trading charges related to several Fortune 500 companies. Auditors have a public duty to shareholders and a legal obligation under federal securities laws to maintain engagement confidentiality, in addition to their contractual obligation to do so.  Directors have a duty only to the corporation. And yet, the Flanagan story captured only momentary media attention and no one claimed Deloitte was going down as a result. In fact, the SEC never even charged Deloitte. It was somehow acceptable to the regulator when the firm said they had been duped by their own senior leader.

Closer to the kind of work McKinsey’s Gupta did for clients, we have another senior Deloitte partner accused of insider trading, Arnold McClellan. He advised private equity firms about the tax implications of proposed acquisitions. The level of trust  – and consequences of a betrayal of that trust  – in M&A advisory is akin to the level of trust expected of a company director. Interestingly, the two cases have a company in common – Kronos.

The McClellan case is pending but, in spite of being the second one for Deloitte in such a short time and with allegations of tipping others for profit that covered the same time period as the Flanagan case, Deloitte is still kicking consulting ass and taking names, including for the federal government.

And finally, but certainly not meant to complete an all inclusive list of auditors accused of betraying client confidences in service to insider trading, we have the poor Ernst and Young Tax partner James Gansman. He was lured by the bad, bad internets into a debauched life of inside trading and an illicit love triangle.

In the fall of 2004, a forty-something investment banker named Donna Murdoch logged into Ashley Madison, the discreet dating website married people visit “when divorce is not an option,” and introduced herself to James Gansman, a partner at Ernst & Young in New York. The two struck up a relationship, meeting occasionally in hotels in Philly, New York, and California, and talking on the phone about their lives: James told Donna about how he was kicking ass at work, Donna told James about how she was struggling with her subprime mortgage.

Eventually the two settled into a comfortable day-to-day routine in their respective offices in New York and Philadelphia, staring at the same Yahoo Finance screen.

{…}

Eventually, their conversations about business grew more specific.

Mr. Gansman led Ms. Murdoch in a guessing game about which deals he was working on, she said. “The game was that I wouldn’t be looking and he would give me hints: The market cap of two billion or market cap of 400 billion, and here’s what they do, and he’d read it to me, and ultimately make sure I guessed,” Ms. Murdoch testified. Before long, the guessing game fell away. Mr. Gansman told her more directly about upcoming deals of Ernst clients, she said.

She made $400, 000 off the deal, and the SEC noticed. He made nothing, and now he’s going to jail. The end.

Ernst & Young survived the embarrassment of one of their partners being an inside trader. Even worse, the firm was mentioned in the same news stories as swinger cheater site AshleyMadison.com. Ernst & Young is still working for the federal government and several Fortune 500 clients as an auditor in spite of also being accused of complicity in the failure of Lehman Brothers.

You may wonder why Gupta, a rich and successful businessman, would risk everything to pass inside information to friends. He didn’t need the money. We have not seen any evidence he profited personally from the trades, unless Galleon’s Rajaratnam sent profits to him indirectly through other business interests in India, for example. Monadnock Research’s O’Connor gives us a clue into the gargantuan ego and pure pathology which might help someone like Gupta rationalize the behavior of which he is accused.

Just after starting his third term as McKinsey’s Managing Director in May 2001, Gupta did an interview with Wharton Professor Jitendra Singh for the Academy of Management Executive. [i] The interview was wide-ranging and retrospective on the subject of Gupta’s contributions to McKinsey since his appointment as its leader in 1994, with a special emphasis on his contributions toward policies, processes and systems to support enterprise knowledge innovation at McKinsey.

Monadnock Research co-founder, Mark O’Connor, interviewed Brook Manville, McKinsey’s Chief Knowledge Officer, four years into Gupta’s terms and featured many of the firm’s innovative efforts in his Yankee Group report, Knowledge Management: People and the Process.

Gupta closed the 2001 interview with the following quote, when addressing the question of what advice he would give to young men and women just starting their business and public service careers.

Gupta: “Oftentimes many of us get tied up in what is good for our careers, how to get ahead, what’s the best career to pick. More important is, I think, to develop as a professional, to have a learning mindset, to always learn from every experience and to become a richer human being. If you concentrate on that, then career success automatically follows. If you make career success an over-arching objective, you’ll not become a full human being, a rich human being, a great professional, or a great leader.

The second piece of advice I’d give is that I think it is vitally important to make other people successful. If you have a mindset of always trying to make other people successful, they will in turn make you more successful that you ever dreamed-of. So, I really believe that it’s not about getting ahead at the expense of others, it is getting ahead because lots and lots of people are helping you achieve it.

Singh: “Perhaps together with others.”

Gupta: “Yes. The last thing I’d say is that you have to have a set of values and principles that you really believe in that is your moral compass. Avoid the temptations of doing the politically right things, because the person you have to live with the most in your life is yourself. You have to always be true to your own set of values and principles, even though there may be temporary costs to that.”

McKinsey had that interview posted on its Web site at the time of this writing. Certainly there are many interpretations of Gupta’s words in this passage. The irony of it in support of the SEC’s allegations will almost certainly not be lost on government prosecutors.

What hangs in the balance, beyond the obvious allegations, is what Gupta truly meant philosophically with his advice to our next generation of business and government leaders. The best and worst examples of ethics are evident in his words. Clearly no reader of this interview would have had any question of its meaning in 2001. But there is a clear foundation for questioning it today.

Statement of Gary Naftalis, Counsel for Rajat Gupta

These allegations first made by the SEC are totally baseless. Mr. Gupta’s 40-year record of ethical conduct, integrity, and commitment to guarding his clients’ confidences is beyond reproach. Mr. Gupta has done nothing wrong and is confident that these unfounded allegations will be rejected by any fair and impartial fact finder.  There is no allegation that Mr. Gupta traded in any of these securities or shared in any profits as part of any quid pro quo. In fact, Mr. Gupta had lost his entire $10 million investment in the GB Voyager Fund managed by Rajaratnam at the time of these events, negating any motive to deviate from a lifetime of honesty and integrity.

Main page art is from Damien Hirst’s Sotheby’s sale, “Beautiful Inside My Mind Forever” described here.

Update:  See bottom of post for update and comments from KPMG International re: their engagement with Siemens in South Africa.

Big 4 audit firms are focusing on growth in their global consulting businesses. But the conflicts that drove three out of four of the firms to sell those consulting businesses after Enron are a bigger problem than ever before. Deloitte was the only Big 4 firm that held on to its consulting arm after all the large firms abused the privilege of providing consulting services to clients. In that latter role, they abdicated their public duty to be  financial auditors first in favor of higher consulting fees. And it was because of the obvious conflicts of interest when an audit firm “does it all” for an audit client  like Enron that the Sarbanes-Oxley Act of 2002 limited the scope of services auditors could provide.

Between 2000 and 2002, in response to the new rules, the IT consulting practices of four of the Big five accounting firms were either sold to public companies or spun off and IPO’d.

- In February 2000, Ernst & Young Consulting was sold to Cap Gemini.

- In February 2001, KPMG Consulting (later BearingPoint, Inc.) was floated with an IPO. (This IPO was delayed and re-priced several times in order to wait until more favorable market conditions after the millennium change, but finally took place and then went nowhere.)

- In July 2001, Accenture (known as Andersen Consulting before its split from Arthur Andersen) also went through an IPO.

- In October 2002, PricewaterhouseCoopers Consulting was sold to IBM. (They failed on their first attempt to sell to HP.)

Only Deloitte Consulting did not, in the end, separate from Deloitte & Touche.

Since the end of 2006, however, the audit firms have been rebuilding their consulting businesses. All the largest accounting firms, including Deloitte, are making acquisitions and hiring to expand consulting practices. Fee increases from advising companies on Sarbanes-Oxley started slowing down significantly in 2006 and other regulatory changes such as IFRS and XBRL mandates have seen repeated delays. M&A went into a slump that only now looks to be recovering slightly and the financial crisis caused significant contraction in the population of large financial services audit clients.

Global highlights via CPA Trendlines and International Accounting Bulletin

The report found that fee pressure is still widespread, but easing, and this has hit the audit sector hardest. However, revenues from audits have actually increased for most networks, with PwC taking the lead and Deloitte following.

Tax was the strongest performer, buoyed by a strong demand in transfer pricing work and international tax advice and PwC led the way in this sector too. The mid-tier are starting to make more noise in the sustainability services market, which continues to grow, but corporate finance, IPO services and transaction support remain flat

• Only four networks failed to grow revenue, a complete turnaround in fortunes from last year
• Deloitte takes the mantle as the world’s largest professional services network for the first time in history
• Deloitte reports $9 million more global revenue than PwC, the slenderest margin
• Consulting growth alone (12%), including major acquisitions in the US (Bearing Point) and UK (Driver’s Jonas) help propel Deloitte to top spot

• PwC is still the largest global audit firm and has the largest tax business. The steady growth in these core businesses in comparison to Deloitte places the network in a good position for 2011

Service lines

• Fee pressure still widespread in the developed economies although it is easing
• Audit the hardest hit by fee pressure although audit revenue from most networks increased. PwC is the top audit firm followed by Deloitte
• Tax was the strongest performer, buoyed by a strong demand in transfer pricing work and international tax advice. PwC leads tax followed by E&Y
• Advisory/consulting was a mixed bag with some networks growing particularly well and others losing out. There is healthy demand for risk management, internal audit and due diligence services
• Sustainability services continues to grow and the mid-tier are starting to become more involved

One of the selectively booming non-audit businesses has been workouts or bankruptcy advisory. PwC’s huge long-term engagement with the Lehman bankruptcy in the UK is a prime example. Some of PwC’s financial services audit clients JPMorgan Chase and Bank of America also grew because of acquisitions during the crisis. Combined with their audit of Goldman Sachs and involvement in Treasury TARP activities,  non-audit revenues are growing for PwC. But revenues and profitability are distributed unevenly by geography and service line in all the firms. Although Deloitte overtook PwC as the largest global firm in revenue this past year, those rankings are not only based on the firms own un-audited, self-reported figures, but show a definite emphasis on consulting and advisory services as a growth engine versus audit.

The financial crisis and companies concerns over costs have driven audit fees to flat or down in all the firms, on average, worldwide. However, the independence issues that led three of the four to sell their consulting businesses by 2002 still exist, even more so with the contraction in the number of firms available in many markets to take on larger and more complex non-audit projects and engagements.

At the same time, the audit firms are behaving as if the requirement to be independent at all times is an annoyance rather than an impediment. That may be because auditors are not strictly prohibited from consulting in the UK, for example, as long as the company isn’t listed in the US. But since the PCAOB only recently gained inspection access to UK firms, we may find lax compliance once they catch up on inspections. For non- Sarbanes-Oxley companies, UK firms accept consulting engagements for audit clients at will and with only honor to guide them.

In the United States, in spite of prohibitions on a list of advisory services that can be performed by auditors of companies subject to Sarbanes-Oxley, the level of enforcement of these independence prohibitions is practically nil. Not only are the regulators loathe to single out a firm for large transgressions, they have limited time and budgets available to track them down at all, especially because of new the volume of matters generated by the financial crisis.

We only have to look at the spate of insider trading cases involving Big 4 partners to see that even though individuals who have crossed the line in an egregious way are eventually caught, the firms themselves, even when there are repeat transgressions by senior professionals such as in the case of Deloitte, are being let off the hook.

Services such as internal audit, one of the first to be put on the prohibited list for a company’s auditors under Sarbanes-Oxley, have more frequently been proposed by the external auditors in the UK.  It’s as much the fault of the clients themselves, more focused on cost savings from “integrated audits” – a term used to justify the Arthur Andersen service model at Enron  – than on independence, objectivity, and controls.

In India, for example, the Satyam’s internal auditor is accused of being complicit in the fraud perpetrated by executives and allegedly supported by external auditors PwC. But in their misplaced desire to strengthen controls in Indian companies…

The Economic Times of India, July 9, 2010: Accounting regulator ICAI has asked the government to make outsourcing of internal audit functions mandatory for companies to prevent a Satyam-like fraud from happening again.

The suggestion is part of the recommendations by a high- powered committee of the Institute of Chartered Accountants of India (ICAI) to the Corporate Affairs Ministry in the aftermath of a Rs 10,000-crore scam in Satyam Computer and is intended to strengthen the internal audit system of companies.

"We have recommended that internal audit should be outsourced rather than in-house because internal audit in-house is always dependent on the management of the company. Internal audit from outside will always be better, and then it should be given to chartered accountants," ICAI President Amarjit Chopra told.

The large audit firms in India and the UK, as well as in the US, would like nothing more than to add stronger mandates for internal audit functions and additional mandates that require provision of these services by an outside firm. Even better, eliminate any prohibitions on having the external audit and the internal audit functions performed by two separate firms. There is sensitivity worldwide to the cost of excessive regulation and mandates and audit firms will be able to sell this “integrated audit” easily in this economic environment.

Just like Arthur Andersen did at Enron.

The hunger for more consulting revenue also causes the audit firms to forget they are audit firms first and foremost.  Aggressive sales activities and “relationship building” tactics common in the systems integrator business are tolerated by the audit firms for the sake of winning major long term engagements with prestige clients and realizing the return on big acquisition and practice-building investments.

Outside the US, the prohibitions in some countries on foreign ownership of their audit partnerships is breaking down and the international firms are taking control of everything else away from local partners who “cannot realize the growth potential.”

PwC’s purchase of BearingPoint’s commercial business and heavy emphasis on reestablishing their SAP and Oracle implementation business once the non-compete with IBM expired in mid-2007 has led, according to sources, to a “winning is everything” attitude. That attitude, in turn led to mistakes like using the firm’s relationship with Satyam, an audit client, as a selling point for its outsourcing and systems intergration services. It’s also led to the scathing indictments of selling practices found in a recent United nations Inspector General’s report of PwC’s win of a multi-year, multi-million dollar SAP engagement.

“…Van Essche and UN procurement officials committed “serious breaches” of UN rules to favour PwC over other bidders, the report says.

The report says PwC’s approximately $16m contract bid was nearly $11m higher than the lowest bid and exceeded the $11m the UN had allocated for the project, a redesign of the UN procurement, human resources and financial management computer systems.

PwC wasn’t awarded the contract on its overall financial bid but on a proposed day rate. But PwC procurement files do not show the final agreed number of days needed to complete the project, making it impossible to determine the estimated cost to the UN, the report says.

“It is inconceivable that the estimated duration of a project should not be factored into the commercial evaluation of a proposal to determine the projected cost,” says the report.

In violation of UN rules, PwC was given more time to study the proposal request than other bidders, including one with a higher technical score than PwC. This resulted in a “material alteration” of the UN’s proposal request that favoured PwC, according to the audit…The U.N. has hired PwC numerous times in past years. In 2007, the firm was employed to confidentially review the financial disclosure statements submitted by U.N. staff. In 2005, the company donated 8,000 hours of staff time to investigate any abuse of donor aid following the Indian Ocean tsunami of the previous year.

Sources have told me that this UN procurement is used as a case study to train PwC consultants on “how to win an engagement”.

Another recent case, Deloitte’s consulting work at Kabul Bank in Afghanistan, shows how the consulting side of the house can divorce themselves from the reality of massive fraud and corruption while charging millions of dollars to implement the systems and controls that will supposedly prevent such waste, mismanagement, and illegal activities.

The New York Times, January 30, 2011: While Afghan and U.S. officials depict a crisis far worse than has been made public, State Department cables released by WikiLeaks show that Afghan and Western regulators were aware of many of the problems, but were most focused on the problem of terrorist financing, rather than the elaborate fraud scheme that was the main problem at Kabul Bank.

A stream of complaints about the bank’s practices – many of them the problems that now threaten the bank’s survival – are dutifully recorded in the cables, but diplomats, at least in 2009 and early 2010, seemed not to have realized the profound effect they could have on the financial system as a whole.

Although other banks here have had questionable loan practices, so far it is only Kabul Bank where what amounts to an enormous fraud scheme was conducted over a period of years and whose troubles are sending tremors through the Afghan business community and worrying Western donors.

Deloitte, a top U.S. accounting firm that had staffers in the Central Bank under a United States government contract over the last several years, either did not know or did not mention to American authorities that they had any inkling of serious irregularities at Kabul Bank. Deloitte was not responsible for auditing the bank’s books; a spokesman for Deloitte did not respond to requests for comment.

All news accounts clearly state that Deloitte was not the external auditor of Kabul Bank, but isn’t an audit firm always an audit firm, first and foremost, even when consulting? Doesn’t the client expect a higher level of quality, expertise, and ethical conduct from an audit firm, especially when implementing financial systems and controls? Shouldn’t all of the firms’ employees and contractors have to perform to a higher level of standards and care?

Finally, in South Africa we have the case of a project gone wrong by Siemens, a systems integrator that works often in conjunction with the Big 4 firms like Deloitte to implement software such as SAP for government agencies. I raised the issue a few years back regarding Deloitte’s independence with regard to Siemens when they helped Debevoise conduct an investigation of their massive bribery scandal. I questioned Deloitte’s independence because they were an alliance partner with Siemens and a joint project had gone wrong with South Africa’s port authority.

This time it’s South Africa’s Department of Labor that’s upset with Siemens and their performance on a long term project to implement SAP. They’d like to end that relationship and, possibly, recoup overbilling and the costs of project delays. But which firm did the South African government ask to review the project and Siemens performance?

KPMG, Siemens’ former auditor during the period of the bribery scandal.

KPMG was relieved of their duties as auditor in 2008, as a result of preliminary accusations of possible negligence in preventing or mitigating the scandal. The attorney who conducted the internal investigation on behalf of Siemens, Bruce Yannett of Debevoise, had this to say regarding the results of their investigation of KPMG and any ongoing matters between KPMG and Siemens:

“We looked at KPMG’s role over the years in question and reported our findings to the Supervisory Board.  Those findings are not public.  Siemens’ public statement at this time is that certain investigations are ongoing and Siemens will not comment.”

So why did KPMG take on this investigation of Siemens given the obvious conflict? Who anywhere in the world in KPMG would not have known their firm was the infamous auditor of Siemens during the scandal?

KPMG’s proprietary system, Sentinel™, facilitates compliance with these policies. every engagement entered into by a KPMG member firm is required to be included in the system prior to starting work. the system enables lead audit engagement partners to review and approve, or deny, any proposed service for restricted, publicly traded, and certain other audit clients and their affiliates wherever in the world the proposed service is to be provided and wherever the member firm is based.

There is no enforcement of the engagement acceptance and continuance policies the firms are so proud to publish in their new global transparency reports. If a local member firm, South Africa in this instance, either ignores, lies, or acknowledges but does not seek higher approval when a conflict such as this presents itself, neither the global firm nor a regulator will likely catch it.

Certainly given how ravenous they all are for revenue, no self-respecting local partner will turn away work unless he has to.

KPMG’s US spokesperson was seeking a response from their EMEA counterpart at the time this was published.

Update March 1, 2011: KPMG South Africa and KPMG International responded to my queries for comment on the decision to accept an engagement from Siemens in South Africa given their history with Siemens.

My concerns were that the client acceptance and continuance process did not go far enough – or outside the borders of South Africa – to determine whether there may still be an open issue with Siemens that could present the appearance of a conflict of interest either to their client, the South African National Treasury who engaged Siemens as part of a long term public private partnership, or to the public.

One of the beneficiaries of this partnership was the Department of Labor. The Department of Labor became dissatisfied by Siemens project delays, apparent overbillings, and use of subcontractors, according to sources. KPMG was engaged to investigate the overbilling, use of subcontractors and options for ending of the contract.

A KPMG South African spokesperson told me that that the member firm followed all internal policies correctly and that the engagement was approved within South Africa. South Africa is now part of the KPMG EMEA business unit and I wondered why, for a global client such as Siemens where everyone in the firm must be aware of KPMG’s history, the member firm would not go outside the boundaries of South Africa and make sure thee were no ongoing legal matters, adverse interests, or other conflicts that would inhibit independence and objectivity on this engagement. Just checking a database and confirming Siemens was no longer an audit client, given the history with Siemens, did not seem to be to be enough. I was as surprised as they may be to see that Siemens attorney did not close the books on further findings definitively, in my opinion, in his statement to me regarding KPMG.

A KPMG International spokesperson gave me this statement in response to my concerns:

· There has been no determination following any investigation in relation to the Siemens audit work carried out by KPMG member firms that such work was performed other than in accordance with the appropriate auditing standards.  Statements which suggest otherwise are false and misleading.

· KPMG has a global system that facilitates compliance by member firms with auditor independence requirements. This system is also used to identify potential conflicts of interest and is required to be used by all member firms across the network.

· We believe our system is adequate. In addition, we have no reason to believe the decisions made by KPMG South Africa were not appropriate.

· KPMG’s engagement as auditor to Siemens AG ended in 2008. Importantly, this fact was disclosed by KPMG South Africa to its client.

Ryan Buckner is a Shareholder at BrightLine CPAs & Associates Inc. With over 10 years of experience in the fields of public accounting and IT auditing, Ryan is responsible for leading SAS 70 and SSAE 16 assessments, AT 101 examinations, and Trust Services certifications throughout the southeastern United States. He is also a leader in the development of the company’s methodologies.  After beginning his career at Arthur Andersen, Ryan joined SAS 70 Solutions in 2003.  He maintains the professional designations of CPA, CISSP, CISA and CIA.

Founded in 2002 as SAS 70 Solutions, BrightLine CPAs & Associates Inc. was the first CPA firm established specifically to provide audit services in accordance with Statement on Auditing Standards No. 70 (SAS 70). Over the years, its service lines have expanded to include other complementary audits and assessment services. The company provides SAS 70 and SSAE 16 assessments, PCI DSS validation, ISO 27001 and 27002 assessments, and AT Section 101 attestation services, including WebTrust and SysTrust certification to hundreds of clients worldwide. BrightLine is a licensed Certified Public Accounting firm and is registered with the Public Company Accounting Oversight Board.

********************************************************************************************************************

What is XBLR?

For those who haven’t heard of it, XBRL (eXtensible Business Reporting Language) is an open standard for exchanging business information between systems. It is based on the open XML standards, which involves the tagging of data elements.  Converting financial statement data into intelligent and interactive fields allows for applications and systems to more quickly analyze that data.

Today, all US-based publicly traded companies are required by SEC mandate to provide XBRL versions of their financial statements, during a three-year phase-in period. The largest companies were required to do this starting in June 2009. The remaining companies are required to file interactive data on a phased-in schedule lasting through mid-2011. Other regulators, such as the Federal Deposit Insurance Corp. and the U.S. Office of the Controller, have been requiring XBRL for the filing of call reports for some time.

The technical process of converting financial data into XBRL relies on a taxonomy of accounting terms and the matching of Generally Accepted Accounting Principles (GAAP) “element” to an XBRL “tag”. The current US GAAP taxonomy has approximately 15,000 distinct elements. Early adopters of XBRL had could map and tag the data in-house or outsource the effort. While some of the larger companies performed the work internally, a recent survey by the AICPA and XBRL.org indicates that outsourcing has been a popular choice for cost purposes.

What are the Risks?

Regardless of whether the company chooses to outsource the conversion or not, the company whose financial statements are being converted to XBRL is still responsible for the accuracy of the output data. In addition, the introduction of a third party performing this work introduces the risks from errors and omissions to operational errors such as missing a filing deadline, sending the wrong file, and data security breaches.

Many companies do not have the formal reconciliation and approval processes in place with XBRL vendors as they normally have for a payroll vendor, for example, who files tax reports and makes payments on behalf of the company.

One speaker at the Financial Executives International (FEI) Current Financial Reporting Issues Conference this past November, the Chief Accounting Officer at a Fortune 500 pharmaceutical company, described an incident where their vendor sent the wrong file to the SEC. This necessitated a subsequent filing to correct the erroneous data. In this case, the company caught the erroneous filing, not the vendor.

Current Audit Practices

Today, there is a concern that XBRL is not being thoroughly reviewed by external financial auditors. The Public Company Accounting Oversight Board issued guidance in 2005 on external auditor engagements regarding XBRL, which relies on the auditor agreeing on a paper-only versions of the XBRL-related documents to the information in the official filing.

The PCAOB rules allow an auditor to perform an examination under attestation (AT) Section 101 that would include:

• XBRL data agrees with the official EDGAR filings, and
• XBRL-Related Documents are in conformity with the applicable XBRL taxonomies and specifications, as well as with the SEC requirements for format and content.

For larger companies, reviews of XBRL have been performed under the framework provided in the AICPA for Agreed Upon Procedures (AUP) otherwise known as AT section 201. AUP engagements are specific between one company which engages the audit firm, and another company to be audited, in this case the vendor and would generally be specific to the company’s specific data, and the two or more companies specifically agree to have the audit firm perform certain procedures. AUP reports are not shared reports and can only be used by companies specific to that agreement. These reports are mainly seen as an extension of the financial statement audit.

Alternative Approaches and the Path Forward

It would seem that the more appropriate and cost effective path would be to have these third-party vendors be examined or reviewed under an attestation following the AT section 101 framework. One benefit of using this framework is that the report could potentially be made available for use by multiple companies. In addition, the Trust Services frameworks fall within AT Section 101 such that a third-party provider could obtain a SysTrust® certification for their services.

If history remains consistent, the combination of a compliance requirement for XBLR and the desire to do so at the lowest cost will result in increased outsourcing. With this comes increased risk of a provider’s technologies and processes inaccurately reflecting the financial position of the company. Like any outsourcing, companies looking to outsource this function should inquire about the provider’s processes and controls as well as the types of audits and certifications it has undergone to validate those controls.