IT IT
CAE - The Institute Of Internal Auditors  

IN THIS ISSUE

PUBLISHED BY THE INSTITUE OF INTERNAL AUDITORS
December 7, 2001
printPrint Article

Enron: Lessons from the External Auditors

In the wake of the Enron debacle, we might catch a glimpse of how to keep our own organizations safer.

By now, everyone has heard that Enron Corporation is in the middle of the biggest corporate bankruptcy in history. The Enron debacle has raised serious questions about the company's management and about why the board of directors didn't see problems earlier. The SEC has announced that they will investigate the problems at Enron. The press is widely questioning Arthur Andersen's role as the external auditor, and Enron employees have launched a $1 billion suit against Andersen. But while the public is speculating that there may have been an audit failure by the external auditors, internal auditors also need to take a sharp look at how they can help prevent similar problems at their own organizations.

Enron is the most notable example in an alarming string of recent earnings restatements, misleading pro formas, and unexpected financial failures. Often the restatements raise questions about whether there might have been a failure in the external audit function. But with every new restatement, we are also reminded that a restatement can sometimes be a failure not only of the external audit function but of internal auditing as well. As internal auditors, we pride ourselves on being the eyes and ears of the board and senior management, and we consider ourselves to be experts in risk management. Management and boards have ultimate responsibility to keep their organizations financially solvent and to determine acceptable risk levels — but it is our role to help ensure they are well informed about potential risks.

Unfortunately, the risks are increasing. Difficult economic times and pressure to meet earnings estimates have always been incentive for some organizations to apply "creative" accounting techniques. In his short tenure as SEC chairman, Harvey Pitt has made the misuse of pro forma results a major accounting issue. According to Reuters, Pitt stated last week that in cases where pro forma statements change a loss into a profit, in his view there was "almost a 100 percent chance that a company that is capable of doing that without appropriate disclosure will have defrauded or confused its investors." One may assume that attorneys who make a living suing corporate boards on behalf of investors greeted this statement with glee.

When asked how internal auditors can best add value to audit committees, one of the most frequently heard responses is, "Internal auditing helps us avoid surprises." In the case of Enron, it looks like at least some members of management and the board got some big surprises indeed. We might never know the entire story of what happened within the internal audit function at Enron, but we can try to strengthen our own internal audit functions by thinking about each new restatement or audit failure and how similar problems might happen at our own organizations. Could we be overlooking some of the same danger signs that might have been missed at Enron or other companies that have made recent headlines? Have we warned of significant risks and potential problems over the last several years — but the warnings were ignored? Have we performed enough follow-up activities to ensure that control problems were addressed adequately? In the long run, it doesn't matter whether an audit failure occurs primarily because problems are overlooked, because of a communications breakdown, or because of a lack of follow-up on audit findings. The end result can be the same: an audit failure of spectacular proportions.

The Enron failure should also make us stop to reflect about non-audit fees paid to our external auditing firms. According to Enron's proxy statement, Enron paid Arthur Andersen, its auditor, $27 million in fees unrelated to auditing and $52 million in total fees last year. Auditors have sometimes received performance evaluations or compensation based on how much other business they win from their audit clients. Arthur Levitt Jr., the former chairman of the SEC, has argued that such incentives could tempt accountants to go easy on an audit.

How much should we be willing to pay in non-audit fees to our own external auditing firms? Obviously there is no one correct answer. The real question in our minds should not be whether Enron's non-audit fees were too high — but whether our own organization's non-audit fees might lead to questions about independence or the appearance of independence.

If there is any silver lining in the cloud of the Enron bankruptcy, it lies in the fact that it might cause us to stop and reflect on many of the possible causes for audit failures. Arthur Andersen will get plenty of help with its own reflections — in addition to the SEC probe, the AICPA is looking at a new standard for detecting fraud, and the Big 5 firms have issued a press release pledging to deliver proposals to improve audit quality. Andersen is in the middle of a peer review, being performed by Deloitte & Touche. According to several accounts, the review is being extended to include review of Andersen's audit of Enron. Similar to the quality reviews required in the Standards for the Professional Practice of Internal Auditing  for internal audit shops, the peer review will examine Andersen's quality control procedures in performing the Enron review.

If the quality review indicates that Andersen's audit was deficient, a qualified opinion could be issued and various suggestions might be made for improvement in audit quality. If Deloitte issues a qualified review, it would be the first one ever since the review process began in 1978, according to a report by CFO.com. And while this would be bad news for Andersen, the accounting profession might actually benefit if the peer review program occasionally results in qualified opinions. It is only when we are unafraid to issue negative opinions that any type of audit function can be fully effective.

Regardless of the result of the Andersen peer review, we are once again reminded of the importance of our own quality assurance programs. Are we in compliance with Standards for the Professional Practice of Internal Auditing in areas such as coordination with external auditors, scope of work, and monitoring progress? Have we striven so hard to add value in new, creative ways that we might have lost track of some of the fundamentals?

In the wake of Enron and other audit disasters, we can catch glimpses of how to improve our own internal and external audit functions. Some lessons are obvious: Be careful about public disclosures of financial information and about aggressive accounting techniques. Beware of pressure to meet earnings estimates. Be careful about pensions funded solely in company stock. Keep in mind that the very managers who are noted for creativity are often the managers who take the biggest risks. Don't shy away from risk management issues or written findings, and follow up on your audit findings after they are issued. Determine whether financial controls are weak or whether management can override controls.

Enron, Cendant, Xerox, Sunbeam, and other recent failures remind us only too clearly of the importance of quality of earnings issues.  These notable failures remind us that management, the board, and internal and external auditors must all continue to focus on the underlying processes behind our financial statements.  They make us sensitive to aggressive accounting approaches and issues such as revenue recognition, "cookie jar" reserves, inventory valuation, reengineering, relationships and transactions with subsidiaries, legal obligations, and mergers and acquisitions.  Each audit executive who follows the Enron story might also find other, subtler, lessons that might apply only to a few organizations or industries.  

As the SEC investigation continues and the Enron story unfolds, new lessons may come to light that can help all auditors to improve the quality of their work. And, here and there, there will probably be a few organizations that learn the hard way that if you don't take the time to learn from others' mistakes, you may be doomed to repeat them.

Click here to view a related PowerPoint® presentation.