THE INSIDERS
Do internal auditors have a bigger role to play in ensuring the integrity of financial reports?
By David M Katz

The latest rash of high-profile accounting scandals is adding fuel to the debate over reporting relationships in the finance department. No longer satisfied with financial audits controlled exclusively by senior corporate executives and accounting firms, regulators and institutional investors in the US are now insisting that publicly traded companies reorder some of those reporting relationships.

Under a recent proposal by a New York Stock Exchange (NYSE) committee, for example, board audit committees would have more power over external auditors. Among the audit-committee powers being championed: sole hiring and firing authority over a company's independent auditor. Internal auditors, who until recently have typically slaved away in anonymity, focusing mostly on broad corporate controls and risk-management programs, are also being asked to take on added responsibility. But in the wake of Enron, Xerox, and WorldCom, internal auditors at some large companies - JC Penney, for instance - have begun playing key roles in setting audit-committee agendas. "I write the agenda for the audit-committee meeting," says Howard Johnson, senior vice president and director of auditing at Penney.

At other corporations, internal auditors have been asked to pore over financial statements, assuring the soundness of the numbers - or ferreting out mistakes. Indeed, management at WorldCom claims that internal auditor Cynthia Cooper uncovered the accounting ploys that ultimately forced the company to lower its stated earnings for 2001 by billions of dollars.

Remarkably, WorldCom management says Cooper and Glyn Smith, another member of the internal audit staff, directly contacted the chairman of the board's audit committee, Max Bobbitt, to discuss what they had found (see "WorldCom: The View from Inside,"). Bobbitt later had Cooper and Smith interview David Myers, then WorldCom's controller, about the company's treatment of payments to third-party vendors as expenses.

A Nose for Numbers

Some finance chiefs see internal audits as something of a sniff test for overly sophisticated accounting schemes. "If a corporation is engaging in activities beyond the understanding of the internal audit department, that's a warning sign," says Richard Marsh, CFO of FirstEnergy, a US utility holding company. "If there's that kind of a disconnect, it really weakens the control function."
To beef up the function, reform advocates (among them, William Bishop of the Institute of Internal Auditors; David Richards, director of FirstEnergy's internal auditing department and immediate past chairman of the IIA; and Dorothy Heyl, senior trial counsel for the Securities and Exchange Commission) say internal auditors must have direct links to audit committees. That way, they can report concerns without fear of reprisal from their bosses.

Of course, some companies have always allowed the head of internal audit a private audience with the audit committee. Members of the NYSE's corporate accountability and listing standards committee think that the practice should be universal. In a June 6 report to the exchange's board, the committee said internal auditors should meet separately with the audit committee at least every quarter.

And the SEC is forcing those relationships on some companies. In a settlement this past May, the SEC ordered Edison Schools, based in New York, to improve its financial controls by creating an internal audit department. Edison Schools also agreed to promptly hire an internal audit director, who would periodically report to the audit committee. In its order, the SEC found that Edison, a for-profit manager of public schools, violated federal record-keeping laws by, among other things, failing to properly accelerate its recognition of losses relating to agreements with certain school districts. But the SEC also found that the company did not have "an adequate accounting system to bill [school] districts," and that its inability to address the system's weaknesses stemmed from its lack of an internal auditor. "We found the lack of an effective audit function to be a problem [at Edison]," says the SEC's Heyl.

Edison does have a CFO, Chris Scarlatta, as well as a fairly famous chairman, Benno Schmidt Jr, the former president of Yale University. But company management adhered to the SEC's request to hire an internal audit director by June 14.

The company hired an Edison employee to direct the newly created internal audit department before the deadline, according to Adam Tucker, vice-president of communications and advocacy for the company. "To maintain the independence of the internal auditing role, the Edison internal audit director reports directly to the audit committee of the board of directors of Edison Schools, and not to senior management," says Tucker..

Function at the Junction

At most large public companies, however, the issue isn't whether there is an internal auditor, but who the auditor's boss should be. It's one thing for regulators and investors to say the internal audit department should get its general marching orders from the board audit committee, but internal auditors usually report to the CFO.

The most popular solution, according to the IIA, is to provide auditing executives with two masters: the audit committee for policy-making and a senior corporate executive - usually the CEO - for more routine work.

On "functional" matters (general direction and policy-making), about 50 percent of internal audit executives report directly to audit committees, according to a recent survey conducted by the IIA. But in more than a quarter of the 42 companies that responded to the question, top internal auditors report to either the CEO or the CFO on functional matters.

When it comes to more-routine tasks, chief audit executives (CAEs) most often report to senior finance executives. At almost half of the 74 companies responding to another question on the IIA survey, the CFO (42 percent) or the controller (5 percent) signs off on the budget and performance of the CAE. Just 2 percent of the respondents said they report to the board on budget and performance matters.

Some reformers believe internal auditors should report to the board more often. They argue that, otherwise, CFOs and controllers can exert pressure on internal auditors to rubber-stamp finance-department numbers.

Then again, some internal auditing chiefs like reporting to CFOs, as long as they have complete, private access to the audit committee. For one thing, finance chiefs tend to be more accessible than CEOs. For another, they are generally more savvy about auditing minutiae, says David Richards. Although Richards preaches the institute's gospel of separation of finance and internal auditing at FirstEnergy, he reports to Richard Marsh, the company's finance chief. Both Richards and Marsh say they have a collaborative relationship, working hand-in-hand to bring major internal audit issues to the audit committee.

Richards says he has easy access to FirstEnergy's audit committee, which is responsible for hiring and firing the top internal audit executive and approving the department's annual plan. Marsh and members of the audit committee have encouraged him to call committee members if anything questionable crops up, Richards adds.

A Waste of Resources?

Beyond a change in the reporting lines for CAEs, observers say a move to more intense checking of company financials would be a substantial shift in duties for many audit teams. For years, those teams have focused just on keeping information systems and operations running smoothly, says the IIA's Bishop.

After all, most internal auditors aren't CPAs. Before the current accounting scandals, internal auditors largely steered clear of such complicated financial maneuverings as off-balance-sheet accounting, third-party investment vehicles, and derivatives accounting. Some internal auditing executives still feel they shouldn't get involved in auditing those processes. "Should the internal auditing function be plowing the same ground [as independent auditors]?" asks Richards. "My own view is that it's a waste of corporate resources."

Still, internal audit teams at a number of big companies are working much more closely with their independent audit firms. In that regard, Howard Johnson, Penney's chief internal auditing executive, took it as a vote of confidence when Allen Questrom, the company's chairman, said at a meeting of the company's senior managers early this year that the retailer was counting on its internal auditors to make sure its numbers are right.

Until recently, Penney's internal auditors had given KPMG, the company's external auditor, a wide berth. "We didn't spend a lot of time with them," grants Johnson. "We're doing more of that now, however."

One instance: Penney's internal auditors are providing their external counterparts with timelier operations data than the accountants normally work with, says Johnson. His 80-member internal audit team now supplies KPMG with up-to-date figures on the markdown of company inventory as soon as it gets them.

"KPMG would have the prior history, but we are out there auditing the stores," adds Johnson. Penney's internal auditors are also taking a closer look at company disclosures of special-purpose entities and travel expenses.

Reporting on day-to-day department matters to Charles Lotter, Penney's general counsel, secretary, and executive vice-president, Johnson takes his general direction from the audit committee. But he also works for the committee itself, writing the agendas for its meetings after consulting with members and company officials. Although he says he has "a great relationship" with the company's CFO, Robert Cavanaugh, Johnson notes that it is not a reporting relationship.

Then again, that's just fine with the Penney internal audit chief. These days, he says, "being separate from the finance organization is a very good thing."

David M. Katz is assistant managing editor at cfo.com.