The full text on this page is automatically extracted from the file linked above and may contain errors and inconsistencies.
IHE ROLE OF OUTSIDE AUDITORS IN TODAY'S BANKING INDUSTRY, An Address By L. William Seidman, Chairman Federal Deposit Insurance Corporation Washington, D.C. Before The West Michigan Accounting and Auditing Symposium, (q Grand Rapids, Michigan, June 19,1986, I. Introduction Good morning. I'm delighted to be back in Grand Rapids, my home town. It’s a special honor to address a conference cosponsored by a school I helped found. Grand Valley State College has made major strides since its establishment in I960. Although I haven't been around to participate in Grand Valley's development, I've been cheering it on from afar. As an old accountant, I'm pleased that "my" school has had the wisdom to host a meeting of Michigan CPAs. It's good to be back with practicing accountants -- though I must admit the accountant's job is much tougher today than it was twelve years ago when I was in the business. II. Discussion As a bank supervisor, I am particularly interested in how information .gathered by bank auditors can help simplify the lives of government bank - P 2 - examiners. Although bank auditors and bank examiners both share the common goal of a strong financial system, their roles in the past have differed. Bank auditors were the "eyes and ears" of the board of directors and the shareholders of a bank. Bank examiners, on the other hand, were looking after the interests of the depositor and the general public. Auditors reviewed financial records to see, if in their opinion, financial statements were fairly presented. Examiners tried to maintain public confidence in our banking system by detecting deteriorating bank conditions early enough to allow time for correction. These traditional roles are now blurring. Auditors and examiners more and more have the same audience. Not only do auditors have a responsibility to the board of directors and shareholders, but many people now claim that their audited financial statements are also for use by the public, analysts, and government officials. We at the supervisory agencies also are increasingly looking at our role in assuring proper disclosure by the banks. -3In these days of limited resources, we are placing more emphasis on planning examinations by targeting our resources to those banks and areas of a bank that exhibit the greatest risk potential. We are therefore relying more on our offsite monitoring system, which depends largely on financial information provided by the Call Reports. Audits and accounting assistance to banks and thrifts provide us with greater assurance that Call Report information is reliable. Accordingly, the FOIC is encouraging, but not reguiring, banks to have an independent audit. Audited financial statements can be presumed to more fairly present an institution's financial position than unaudited statements, thereby enabling depositors and creditors to better judge a bank's performance. Ihe CPA provides help to management in dealing with the accounting treatment for the complex transactions and intricate financial deals made by banks today. The audit also provides assurance to the board of directors that they are well-informed about the condition of the bank, that management is complying with their policies, and that internal controls are strong. -4I will not presume to lecture you on how to do your business. I would, however, like to share with you the FDIC's thoughts about matters that deserve special emphasis in outside bank audits -- thoughts those of you who are bank auditors might wish to ponder when you come knocking at a bank's doors. Specifically, I will focus on (1) control systems and fraud detection, (2) the loan portfolio, (3) the reserve for loan losses, (4) legal considerations, and (5) communications. Control Systems and Fraud Detection From the FDIC's standpoint, the most important role the outside auditor has in a bank is confirming the strength of its control systems - both internal controls and management controls. Although our examiners have always scrutinized this area, the increasing importance of sound control systems for the prevention of insider abuse, fraud, and embezzlement warrants greater attention. John Kenneth Galbraith described embezzlement in his book, The Great Crash, 1929, by stating that it: -5. . . varies in size with the business cycle. In good times people are relaxed, trusting, and money is plentiful. But even though money is plentiful, there are always many people who need more. Under the circumstances the rate of embezzlement grows, the rate of discovery falls off, and (em)bezzle(ment) increases rapidly. In depression all this is reversed. Money is watched with a narrow, suspicious eye. The man who handles it is assumed to be dishonest until he proves himself otherwise. Audits are penetrating and meticulous." Needless to say, we cannot wait until there is a depression for audits to become more critical and discerning or for insider abuse and fraud to cease. An PDIC survey of insured banks that failed from 1980 to 1982 found fraud and embezzlement by insiders were a major factor (but not necessarily the primary factor) in 15 percent of the failures. Credit losses on loans to insiders were a major factor in 21 percent of the cases. All told, fraud and insider abuse contributed to over 40 percent of all failures. - 6 - Insider fraud usually involves making loans to fictitious borrowers, withdrawals from inactive accounts, issuing checks on accounts opened under false names and cycling overdrafts between them, as well as various other ploys. Often correctly, insiders reason that their embezzlement can be easily "buried" in the high volume of transactions handled daily by a financial institution. Insider abuse, another major problem, usually involves a waiver of proper credit standards or a failure to follow established loan procedures. There are a variety of ways in which employee fraud and embezzlement could be detected at an early stage, or avoided completely. One area of concern is mandatory vacations and segregation of duties. Not only should outside auditors confirm that the policy of mandatory vacation is being enforced, but freguent rotation of duties -- particularly where segregation of duties is not practical -- is also a good suggestion as a preventive measure. The independent review of transactions posted to employees' accounts, the review of suspense and inactive accounts, and the investigation of unusual items in clearing accounts can also limit cases of fraud. Banks should be advised to clearly explain each employee's responsibilities for various document approvals so that an employee does not indicate approval carelessly or simply sign because he is told to do so. Many of these measures would also be helpful in preventing insider abuse. Management controls must still be carefully reviewed. Budgeting and financial reporting is an important area to check to determine whether controls over management are adequate, and whether stated policies and procedures are being followed. Even the "corporate culture" of a bank is important. Does top management expect appropriate behavior from employees and managers? Do they encourage it by their planning, training, hiring, and organizational policies? What degree of oversight does the bank's board of directors -- particularly outside directors provide over management controls? Management itself is a great part of this evaluation. The competence of management is important in determining the reliability of information provided. The independence of the manager to take action indicates - 8 - whether the auditor's recommendations can and will be implemented. In small banks, this may be of particular importance because a single owner or manager may have the power to set the policies and the ability to override them. Of course, the outside auditor can do only so much. A bank's internal audit department is its first line of defense against fraud and insider abuse. No bank is too small, in our opinion, to have an adequate system of internal controls even if it does not rise to the level of a separate "department." Preferably the department reports to the board of directors or the audit committee of the board. It should never be a part of the finance and accounting function of a bank, and even reporting to management should be discouraged for good management controls. lesting the strength (or weakness) of this department merits the outside auditor's priority. External fraud is usually less sophisticated, but detection and prevention measures are still needed. In the deposit area, customers sometimes use forms of check kiting, such as using several accounts to -9"cover" overdrafts by flowing funds through them. When applying for loans, unaudited financial statements may include company or individual assets actually belonging to shareholders or related companies. In addition, assets may be listed at values far in excess of their real market value on financial statements filed with banks to support increases in credit limits. Needless to say, obtaining audited financial statements and title searches would greatly limit this type of fraud. We are stressing fraud detection with our examiners, and believe it is an area in which outside auditors and bank supervisory agencies can work together to strengthen the banking system. The Loan Portfolio Although evaluating credit risk is still a major part of our examination process, and will continue to be so, outside auditors may wish to ■strengthen their review of asset quality. We have seen evidence in one highly publicized bank failure where independent auditors apparently ignored questionable loans cited in earlier work by the bank's internal audit staff. - 10 - The problems in the agricultural and energy segments of our economy demonstrate why industry diversification is more important than ever when reviewing a loan portfolio. In addition, the auditor should be highlighting any concentrations of loans by geographic area, by borrower, and by types of borrowers. Loan participations, particularly when the total loan is large, should also be reviewed. It is not enough to just emphasize the loans that the bank examiners have previously cited, or the past due loans. These problem credits should be reviewed, of course, but not to the exclusion of all others. In addition, check the loan documentation. It is often a symptom of far greater problems, and more often than not, the absence of documentation means the absence of quality. Please do not overlook the loan approval process and compliance with the bank's written lending policy. Any deviations from this policy or weakness in the approval process may indicate future problems in the portfolio or even problems with insider abuse. Ihe written lending policy and all written board policies should be reviewed for compliance by the auditors. Insider loans should be scrutinized carefully by tbe auditors. Certainly tbe Butcher dealings in United American Bank and other Tennessee financial institutions provide a convincing example of the importance of reviewing insider loans and transactions. Reserve for Loan Losses An understated reserve for loan losses is one of the more frequent deficiencies found by our examiners. Remember, an adequate loan loss reserve is not the percentage the IRS will allow (and we certainly hope they will continue to allow a loan loss reserve under any new tax bill Congress may pass), but is the amount that, in management's opinion, adequately reflects possible losses in the loan portfolio. This amount should be the estimate that will provide for losses in the period when they become apparent, not just when the charge-offs are directed by our ■bank examiners. - 12 - Our examiners often find that they have to press management to reassess the allowance for loan losses realistically. The independent review of this reserve and management's assessment process could greatly reinforce our efforts. After all, an inadequate loan loss reserve overstates earnings and capital, provides false and misleading financial information to the public, and ultimately may threaten the soundness of the bank. Legal Considerations While I am not here to scare anyone, you are probably well aware that the FDIC in its role as receiver of a failed bank has and will continue to review the work of any prior outside audit to determine whether there is a cause of action against the auditor. Unfortunately, there have been some cases where, in our opinion, action was clearly appropriate. Currently we are involved in three lawsuits against independent auditors of failed banks. While there was some degree of fraud involved in two of - 13 - these cases, none of our claims is based solely upon the failure of the audit firms to detect and report fraud. In fact, our claims are based principally upon the audit firms' failures to adequately review credit files. Those failures led auditors to sign off on financial statements containing inadequate loan loss reserves, and to fail to detect and report to the banks serious conditions in the loan portfolios. If the auditors had reported the poor portfolio conditions, it is likely that the banks would have conducted further investigations to determine why certain credits were being extended. Outside auditors also need to be aware of the possibility of private litigation. Recently.the New Jersey and Wisconsin Supreme Courts held that an accountant owes a duty of due care to all persons whose reliance on his report was reasonably foreseeable. New York law is a bit less severe. In 1985 the New York Court of Appeals held that an accountant 'holds a duty of due care only to its clients and to those persons whose reliance upon the accountant's report was both specifically foreseen and -141 acknowledged by the accountant. Under Texas law accountants owe a duty of due care to persons whom the accountants knew were relying on their report. In short, while the law differs somewhat among the states, courts in several major jurisdictions have held that accountants can be liable for negligence to third parties. Every independent auditor should keep that fact in mind when carrying out his duties. Communications The last, and certainly not least important, point I would like to make is that good communications are essential. Following proper auditing procedures and emphasizing the evaluation of internal controls, asset reviews, and loan loss reserve adequacy will be of little value if the findings are not adequately communicated to the board of directors. The independent review of a bank's operations is one of the most important .tools the board of directors has to recognize potentially serious problems and correct them before they become a threat to the bank. - 15 - Outside directors, in particular, often rely on the outside audit for much of their information about the bank. The importance of communicating with the board of directors in a clear, explicit, and timely manner cannot be overemphasized. We would also like to encourage improved communications between the bank examiners and the independent auditors. We are hopeful of having a bank's outside CPA play a greater role in our examination process. Our goal for the future is to identify and effectively use all available supervisory tools, whether they be found in the public or private sector. To do this, we need better communications with outside auditors. FDIC policy permits a bank to allow its outside auditors to review our examination reports and any correspondence between the FDIC and the bank about that report. With the prior approval of the bank, our examiners are authorized to exchange information with the independent auditors when they are in a bank at the same time. If the audit does not coincide with a regular examination, our regional offices are authorized -16to cooperate with a bank's outside CPAs. We have no objection to the auditors attending, as observers, the examiner's exit interview with management and meetings with the board of directors at the bank's invitation. In the interest of pursuing dialogue, I recently suggested that it would be to the benefit of all if the independent auditors were under an obligation to notify the supervisory authorities when they uncovered a major fraud or evidence of insider abuse. This may represent a change in the traditional lines of responsibility of the auditor and the examiner, but it is a change we should continue to at least consider. He at the FDIC believe that our whole financial system would be strengthened through closer cooperation between independent auditors and the FDIC. III. Conclusion Than you very much. As Charles Lindbergh remarked as he approached Paris near the end of his historic flight, "I have some gas left, but I think I'll stop here."
@FedFRASER