Archive

Posts Tagged ‘Auditing’

Response from Senator Bob Menendez to the “Dumb Auditor” Article

Bob_Menendez_2

Senator Bob Menendez

Dear Mr. Font:

Thank you for contacting me to express your opinion on banking reform.  Your opinion is very important to me, and I appreciate the opportunity to respond to you on this crucial issue.

I appreciate you taking the time to provide your ideas on how we can make changes to the banking industry to improve its efficiency and transparency.  Every day New Jerseyans are working very hard to provide for their families, but current market conditions have made it difficult for families to save or access credit.  The financial collapse last year demonstrated the need for increased transparency to protect investors and consumers from fraud and irresponsibility.  Americans simply cannot afford the risks associated with widespread economic instability such as losses of jobs, savings, and benefits.  I am committed to ensuring that our financial markets are fully regulated and operate in the best interest of the American people.

As a member of the Senate Banking Committee, I have long stood for financial reforms that promote smart, healthy, and sustainable development. I rely on the important communications I receive from my constituents to guide my work in the United States Senate.  On this, as with any issue, there are many different view points, but please rest assured that I will continue to work diligently to respond to the many valuable insights I receive from New Jerseyans like you.

Finding solutions to the issues you raise is what drives me to keep standing up for New Jersey families.  Again, thank you for sharing your thoughts with me.  Please do not hesitate to contact me if I may be of more assistance.

I invite you to visit my website http://menendez.senate.gov to learn of other important issues in New Jersey.

Advertisements

Response to Comments from the “Dumb Auditor” Article

Old Compass
Image by Sebastian Niedlich (Grabthar) via Flickr

To all the readers who left comments regarding the “Dumb Auditor” article.   Thank you for visiting the blog and taking time to share your excellent ideas with the group.  The “Dumb Auditor” article has been read by thousands of interested people from around the world, indicating that the issues discussed are of serious importance to our profession.  Most of your comments clearly show “battle scars” resulting from real life work situations,  making them more valuable than I ever expected.

It is also clear from your comments that auditors would like some resolution to these problems. Or, at least some structural changes in the industry that lead to diminishing auditor exposures, while they do their jobs protecting shareholder interests.  Although, many in the business world share similar situations, risks and moral dilemmas, it is the auditor who is expected to uncover fraud and other illegalities with few or no legal and financial protections for themselves.    And, few are similarly bound to maintain confidentiality about their work and the very things that often get them fired.   It is not unusual to hear Internal Auditors tell of stories where they “uncovered to much” and got fired for it, but can’t talk about it!   What does this tell us from a legal, societal and ethical perspective, and where does it put the professional organizations that are supposed to provide guidance and protections for the profession?

From the more than 30 comments left in the blog by readers to date, I am particularly impressed and grateful for the following:

1) From Felix, on November 30th.

Excellent proposals with excellent potential.  Felix discusses four items that  should be considered at the highest levels.  Item # 4 on his list is something I had thought about in the past (and, I suspect other auditors have as well), dealing with Professional Liability Insurance “provided by the PCAOB (or other body holding CFO’s/auditors to ethical/moral standards) for auditors and CFO’s. If a CFO or auditor is fired due to claimed unethical reasons, they are eligible to receive 100% of what they were making.”

There are countless types of liability insurance for professionals, such as errors and omissions for attorneys and accountants and medical malpractice.  Why not develop one that insures against wrongful dismissal of auditors, specially when the dismissal involves a dispute with management due to the normal performance of the auditor’s duties, ethical or fraud related matters?

2) From Mark Pennington, on November 30th.

I was impressed with the brevity, the directness and the underlying picturesque quality of Mark’s comments.

Disregarding his tone….  I think he is correct in that there is a very large segment in management that does not care.  Why should they?  They do not perceive to be negatively affected, and their personal bank accounts keep increasing instead of decreasing with the status-quo.

3) From Rodney Kocot, on December 2nd.

I think Rodney’s comment is the most eloquent posted in terms of describing a situation where auditors get fired for trying to do the right thing.  I think that everyone who has been an auditor for several years recognizes this type of story, either from first hand experience or because it has happened to a peer.  Unfortunately, because of confidentiality agreements and fears of being black listed, these stories rarely get out to the public or beyond auditor circles.

4) From Adis Vila, on December 5th.

I appreciate the visit from Adis, a person that has done a great deal of work in the corporate governance and ethics areas, as well as in government.

The need for “Ethics Training” is clear and I am glad someone with a strong background in this area brought it up.  However, my sense is that ethics training yields future results and it’s something that impacts entrants to the business world, with limited impact on the “old dogs” running lose right now in positions of authority.  Training someone like a Bernie Madoff in “Values” and “Ethics” would be an interesting effort probably yielding few good results.  We auditors are in the trenches dealing with societal and organizational challenges as they are now, not as they should be.  Most auditors I know view compliance training as something that goes hand in hand with ethics.

I agree with Adis that we should concentrate more on a “Values-Based” ethical culture, because I believe that as a society we dropped the ball on this one a long time ago.  I will refer to a few comments posted by Felix on November 30th which reflect my views on this issue:

“What is for sure is also that some crooks would not be crooks if society would not accept as “good” many things that are NOT good. The unfortunate relativism that we live in now a days is contrary to how the United States was founded. It was founded on deep moral principles and as a result there was a key ingredient that was not there in many other countries or societies throughout history: trust. Trust can only exist when the society is a morally correct society that has not transformed values. In other words when a bad act is considered OK by many and vice versa. The problem we are facing in the United States of today runs deeper than audits and rules.

The problem goes to the core of the humanity of our country.”

5) From Ben, on December 8th.

Ben’s comments are well thought out and clearly come from experience.   His suggestion that auditors take a more careful and inquisitive approach during their job interviews in order to improve their chances of accepting jobs in organizations that more closely reflect their ethical values, is excellent.

I also agree with Ben regarding the approach with mid-level management and the need to invest time educating folks in Risk Management.  His humorous call for prayers, relaxation and meditation techniques during audits of sales functions is also unique and worth considering!

Prior to the popularity of “Social Media,” blogs, Twitter and the web, most controversial issues impacting an industry or profession remained in a semi-secret state.  Today, they can be known to thousands of people instantly.  The power of knowledge or as they used to call it, “The Pen” is stronger than the “Sword,” and in most cases it is also stronger than the “Dollar.”  Because of this, I believe that the “Dumb” auditor article will make a positive contribution to the efforts being made to resolve the issues cited in the article.  At minimum, there will be more awareness of the problems from the perspective of the auditor.

Thank you again for visiting, reading and leaving your comments.

Enhanced by Zemanta

Auditing Career: Do “Dumb Auditors” have more Professional Longevity than “Smart” ones?

Thanksgiving Day
Image via Wikipedia

Two days ago I attended a nice Thanksgiving party given by a CIO friend, who like in previous years, had invited several CFO‘s, corporate attorney’s and high level management people from high profile Fortune 500 companies in the New York region to his house.   After a few drinks and delicious turkey, conversations about the state of the economy, technology and the headaches of regulatory compliance ensued.   There where two auditors in the group and it felt as if we where the only ones who did not feel regulatory compliance is a headache.    My Merlot and turkey friends, perceiving that they had numerical superiority over us, went on to a typical “we hate the auditors” discussion, where we had the “pleasure” of hearing every criticism launched against auditors since the time of Heraclitus.   Thank goodness I too had access to the Merlot.   One of the discussions that has stayed in my mind is one about how “well appreciated” dumb auditors are.   And, this I’ve decided to share with you.

Most auditors learn early in their careers that auditing is not a popularity contest.  As a result they adjust to the fact that they are paid to investigate, search, test, snoop around, and in many cases confirm the existence of wrong doing and mistakes by members of the organization at all levels.    The auditor is usually the person who has ulterior motives for asking questions, and the one who usually does not bring good news.    The auditor by his/her simple presence disrupts the “normal order” of things, makes the staff feel uncomfortable and require that all evidence be double checked for accuracy and legitimacy.   Often, when those being audited most want the auditors  to “go away,” some action or words  deep in the crevices of the organization send a message to the auditors to dig deeper or further expand their questions.   In common language, auditors are a pain in the neck.

The intensity of hatred or dislike towards the auditor however varies depending on his/her ability to understand what he/she is testing or investigating.    The smart, experienced auditor tends to ask deep, relevant and timely questions, often not found in a strict audit script or checklist, which can open the doors to problems and issues hidden just below the surface.   The smart auditor is happy when he/she finds problems, because he/she sees himself as a solution or insurance policy against risk exposures to the company.  However, this feeling is not shared by those who “own” the problems and depending on company politics, the reactions can range from lukewarm admission, challenges bordering threats from some levels of management, to a long term stealth campaign against the auditor leading to his/her dismissal for supposedly  “unrelated reasons.”  Like a Whistle-blower, the good auditor walks a dangerous road.    During difficult times, the good auditor has few or no allies.

The dumb auditor on the other hand, usually sticks to a rigid script or checklist, and is not likely to expand his questions beyond the “scope” of the audit, preassigned or created with the approval of management.  The audit process of the dumb auditor tends to be quick, rarely discovering problems and always neatly on time.   His reports usually sound like this:  “We tested A, B, and C and found no exceptions.  Managements’ controls are working according to established policies and guidelines and” (here is the mandatory recommendation for improvement – so it looks like some work was done),  “we believe the Segregation of Duties process in AP can be tightened by implementing the following…..  Otherwise all is well.”   This cookie cutter report, used by both Internal and External auditors, is the type that makes its way to most audit committees today.    This is also the type of report, according to my friends at the Thanksgiving party, that management wants and pays handsomely for.   I found myself looking at the other auditor and realized that we where both nodding in agreement.    My friends in the party, all experienced dealing with auditors, pointed out that “Smart” auditors, or auditors with independent minds can not last long in a typical organization, because the very act of following their ethical, inquisitive and legalistic mentalities gets them into serious conflicts with management and they end up fired after short tenures. Also, good auditors have few champions in the organization who see value or gain in “protecting” someone who is serious in his/her responsibility to investigate or test anyone (including them) in the future if they have to.   This is simple human nature.    A “Dumb” auditor on the other hand, creates few waves, does not offend or criticize too much, uses neutral and complimentary language in reports, and keeps to his/her “scripts” as planned by management.   By playing dumb, this type of auditor is indirectly “winning friends and influencing people.”   His/her back is covered because he/she is needed by those who need coverage.  The dumb auditor has allies.

In light of current scandals, like the Bernie Madoff case, and the mortgage meltdown, it has become common for many to ask:  “And, where were the auditors while all this was happening?”  My answer has to be that most of the auditors involved where diligently doing their jobs as good “dumb” auditors do, so they can stay employed.   That is, they where auditing every nick and cranny that was within scope and within the “Risk Appetites’ of their organizations, as set by “management.”   But, what about the codes of conduct, the audit charters, the PCAOB, the SEC, the GAAS‘s, ISACA and the IIA‘s.   Don’t these organizations have some level of control over how auditors should conduct themselves and how they should investigate and follow up on questionable activities?   Are all of these structures useless? My answer is no.  These are not useless organizations, and without them, the problems cited by my friends in the Thanksgiving party would be much worse.   The codes of ethics, guidance documents, audit frameworks and standards created by these organizations are the only line of defense we auditors and audit committees have against the many Barbarians who dwell in the halls of corporate America today.    But, are these standards  and frameworks sufficient?  My feeling is that they are not, and here is why.   Money corrupts as every auditor knows.  When you follow the money you find the power.   Organizationally, there is an imbalance between the auditor and those he/she audits.  On the one hand you have a well meaning, ethical person who wants to do the right thing, making an average mid-level management salary, tasked with uncovering wrong doing among those at levels that can crush him/her with ease, and whose interests are the maintenance of the status-quo, a low profile and making sure the company’s stock value is not disrupted by doubtful auditor reports.   In most companies, those in the Director, V.P. and “C” levels (usually persons with net worth’s in the millions of dollars and stock holders in the company) can easily muster the resources of the organization whenever they raise a red flag regarding a “trouble maker.”   The controlling factor here is not bribery, but the threat of dismissal.   So, in my opinion things boil down to a primal level for the auditor.   Ethics, integrity, morality, legality and professionalism on one side,  versus no job on the other. Unemployment, inability to pay the mortgage, damaged credit rating, children without college tuition’s, etc.   How many good auditors can consistently afford to be martyrs, and when it happens, who shows up at their door to help them pay the mortgage?   The fact that the majority of auditors are good, ethical, law abiding and take their oath’s of conduct and ethics seriously is a reflection of the social, religious and cultural values they share with the greater society, and less so on other types of controls  promoted by various groups.   As these cultural, religious and social values erode,  resulting from poor education, dysfunctional families, media aggrandizement of thieves, the belief that the  “bad guys” win and little understanding of civics, I suspect we will see more problems relating to poor auditor ethics and values.   In general, auditors are still good because they perceive that the society provides more positive reinforcements for good behaviors than bad ones.

In addition to the money and power challenges I noted above, there are issues dealing with the “Culture of Auditing,” which most of us are familiar with.    In my opinion, many of these favor the “Dumb Auditor.”   Some of these also help explain why many Madoff type schemes go “Undetected.”  Here are the top fifteen that come to mind.  I am sure there are others:

  1. Auditors are taught to find ways to give bad news in a positive manner.  Avoid bad news as much as possible.
  2. Auditors should avoid using the words “Failure,” “Problems,” or naming specific individuals who fail or pose problems.  Instead they should call these things “Exceptions,” or “Positive findings Needing Improvement.”
  3. Even when management has repeatedly ignored auditor recommendations and warnings, auditors are expected to be “flexible” and at best point out the issues as “still needing some levels of improvement.”
  4. Auditors are bound by extreme discretion and confidentiality.  They are to be like flies on the walls.  Rarely seen and not too vocal on any subject or occasion.
  5. Management has the last say in terms of what is possible by way of solutions to issues raised by audit.   The “Business” is the key determinant in whether a risk gets addressed as recommended by audit.
  6. Auditors work on behalf of management, and are not to be seen as impediments or obstacles to managements’ decision making.   Aggressive auditors can inhibit management’s entrepreneurial spirit.
  7. The auditor is there to protect the business from outside risks.
  8. Management sets the “Risk Appetite” for the company.  Auditors work within those parameters.   Even when the parameters are not well defined (on purpose).
  9. Auditors are supposed to uphold the utmost ethical standards, but often their superiors lie, cheat and have no scruples.   Some times the code of Ethics, zero tolerance statements, and even the Audit Charter are disregarded at higher levels, while zealously enforced at the lower levels.
  10. Auditors are supposed to remain positive and un-moved, even when those audited usually assassinate their character, create rumors and gossip about their professionalism, plant fake or doctored evidence against them, and call for their dismissal.
  11. Auditors are supposed to maintain meticulous notes and documentation, while many of their superiors rarely answer  email requests for clarifications, or document an opinion.
  12. Auditors are supposed to advocate for and practice “meritocracy” being on a constant race to obtain and maintain professional certifications.   While it is not unusual to see many of their superiors having reached positions of authority because they have either slept, drank, bought or strong armed their way up the ladder.
  13. When the Chief Audit Officer is weak, unstable and/or indecisive, audit work is reactive and there is unusual turn over in Internal Audit.   Expertise, maturity and professionalism has little time to take root.   “Dumb Auditors” flourish in these environments.
  14. In a recession and during cost cutting, some Audit departments let go of their “expensive” talent, keeping lower paid less experienced staff on hand until better times (and budgets) return.    “Dumb Auditors” flourish in these environments also.
  15. When the “C” level executives have been around for 10, 15 or 20 years and their “old boy” culture does not care about “irritants” such as “compliance,” or “industry best practices,” or “well designed controls,” and the head of compliance and legal counsel are never in the mood to “disturb” the old boys, smart auditors often become dumb by way of necessity.

As I prepared to finish this article, I discussed it with my friend, the other auditor at the Thanksgiving party, and he felt many of the issues tackled here are highly controversial and uncomfortable.   He said I make many generalizations  like what constitutes “Dumb” or “Smart.”   He said that what I call here the “Dumb Auditor” may really be the “Smart” one.  Every person faced with the sorts of challenges I mention has a huge reservoir of personal, professional and family reasons for taking one or another path, and those are known only to that person.   Passing judgment as I appear to do in this article may be too insensitive and simplistic.   The issues are just too complicated to put them in simple moral boxes.

I admit that my friend makes good points here, and I can only say that in this article my intent is to shed light on what is clearly a serious challenge with ramifications that go far above those of individuals.   This is a serious systematic problem  in the business world and many good minds in government and in professional organizations worldwide are working hard to find the right solutions.   In an ideal world, the typical auditor should not have to spend sleepless nights wondering whether he/she should play “Dumb” or “Smart.”

I  personally do not have a clear answer on how to solve these dilemmas for others.  I only know what my ethical, moral and social values are and I have first hand experience on the high costs and frustrations of being a “Smart” auditor.

If you are a new auditor, I hope I’ve alerted you to issues that may come your way sooner or later.   If you are an experienced auditor, I hope that by reading this you realize that you are not the only one who has seen these things.

To all readers.  I will appreciate it very much if  you left  your comments on this subject, so we can make this a more diverse  exchange.  Do you believe that “Dumb Auditors” indeed have a longer professional longevity than “Smart” ones?

Enhanced by Zemanta

New from DRII – Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA)

Atlantic_City_02

Atlantic City, New Jersey

New Audit track for Business Continuity Professionals and IT Auditors. If you are an experienced Auditor or Business Continuity Planner, this is your opportunity to get certified as a Business Continuity Auditor by the leading BCP organization in the USA.   DRI International will be offering training in Atlantic City, New Jersey this coming April.    For more information on this course, see the notice from DRII below:

Two opportunities for the training you want!

The National Fire Protection Association (NFPA) and the Disaster Recovery Institute International (DRI) have joined forces to create an education and certification program that will qualify participants to audit disaster/emergency management and business continuity programs against existing standards and regulations. Certifications available are: Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA).

Through this program, participants will be able to apply the key components of disaster/emergency management and business continuity, the relevant standards, laws and regulations, the process of risk assessment, vulnerability analysis, loss prevention, risk mitigation, and develop, implement, test and maintain their plans and procedures.

The course will cover existing legal and regulatory requirements by industry and country, as well as emerging requirements, including  BS25999, SS540, US PL 110-53 (PS-Prep), NFPA 1600, ASIS, DRI International’s professional practices, financial services, insurance, healthcare, utilities, public sector guidance and a host of others will be explored.  It will also cover the processes by which disaster/emergency management and business continuity programs are initiated with an eye toward corporate governance, policy, and procedures.  More in depth emergency and disaster management will be provided by NFPA.

At the end of the course, a unique. audit track, qualifying examination is conducted and individuals who have passed will be eligible to apply for certification as a Certified Business Continuity Auditor (CBCA) or Certified Business Continuity Lead Auditor (CBCLA). The certification level (CBCA or CBCLA) will be granted based upon the amount of demonstrated audit experience of the applicant. Those seeking the CBCLA designation will be required to provide references to verify that they have at least five years of active audit experience.

For course and education related questions please call the DRII Education Department on:    Toll free numbers: 866-542-3744 and 866-535-3744

This course is designed for novice & experienced corporate planners, internal & external auditors…

Course Name: BCLE-AUD

Start Date : 04/26/2010

End Date : 04/30/2010

Course Cost: $2900.00

Instructor: Not Specified

Location:

Atlantic City Convention Center

1 Miss America Way

Atlantic City, NJ  08401

DRII The Institute For Continuity Management.

This was not a paid promotional announcement.

Enhanced by Zemanta