PCAOB Adopts New Audit Report-Should Be Interesting-Still Has To Be Adopted By The SEC

The following is a link to the PCAOB website page discussing the PCAOB’s June 2017 adoption of a new audit report which in part requires the disclosure of critical audit matters (CAM) for certain audits conducted under PCAOB standards. Here’s the link to the PCAOB page CLICK HERE

The new report standard still must be adopted by the SEC. If adopted, some of the new report standards will first apply to annual audits for years ending on or after December 15, 2017; however, the critical audit matter reporting would not apply until 2019 at the earliest for certain entities.

As the PCAOB notes, there is a need to make the audit report more relevant. In fact, there is a need to make both external and internal audit and auditors more relevant.

More will follow on this; however, I usually don’t spend signification time on new laws, statutes, regulations, rules and standards until (1) they are in fact enacted or adopted, and (2) it is near the time of actual use or requirement.

I do note, however, that this new report and the CAM provision is an interesting development, which perhaps should have occurred years ago. If you click on the above link, and then on the actual standard itself, you will also see that the standard contains worthwhile discussions about critical audit matters, materiality and other topics that are relevant to the standard.

Best, David Tate, Esq. (and CPA, California inactive). Royse Law Firm, Menlo Park Office, California.

Royse Law Firm – Practice Area Overview – San Francisco Bay Area and Los Angeles Basin

  • Corporate and Securities, Financing and Formation
  • Corporate Governance, D&O, Boards and Committees, Audit Committees, Etc.
  • Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  • International
  • Immigration
  • Mergers & Acquisitions
  • Labor and Employment
  • Litigation (I broke out the litigation because this is my primary area of practice)
  •             Business
  •             Intellectual Property – Patents, Trademarks, Copyrights, Trade Secrets
  •             Trade Secrets, NDA, Financial & Accounting Issues, Fraud, Lost Income, Royalties, Etc.
  •             Privacy, Internet, Hacking, Speech, Etc.
  •             Labor and Employment
  •             Mergers & Acquisitions
  •             Real Estate
  •             Owner, Founder, Investor, Board & Committee, Shareholder, D&O, Lender/Debtor, Etc.
  •             Insurance Coverage and Bad Faith
  •             Investigations
  •             Trust, Estate, Conservatorship, Elder Abuse, Etc., and Contentious Administrations
  • Real Estate
  • Tax (US and International) and Tax Litigation
  • Technology Companies and Transactions Including AgTech, HealthTech, etc.
  • Wealth and Estate Planning, Trust and Estate Administration, and Disputes and Litigation

 

Important – SEC v. United – Administrative Proceeding Relating to United’s Internal Accounting Controls to Prevent Violation of United’s Policies

On December 2, 2016, the SEC issued an Accounting and Auditing Enforcement, Administrative Proceeding Order against United Continental Holdings, Inc. Here is a link to the Order, CLICK HERE

Why is this Order important – because the SEC found that “United failed to design and maintain a system of internal accounting controls that was sufficient to prevent its officers from approving the use of United’s assets in connection with the South Carolina Route in violation of United’s Policies, which prohibited the use of assets for corrupt purposes.” This isn’t a Foreign Corrupt Practices Act case – the alleged corruption or impropriety occurred in the United States. The SEC alleged that United “instituted the South Carolina Route following pressure from David Samson (“Samson”), then the Chairman of he Board of Commissioners of the Port Authority of New York and New Jersey (“Port Authority”). The route provided Samson – who exercised authority and influence as a Port Authority official in matters affecting United’s business interests – with a more direct route to his house in South Carolina.”

The scenario in this case could occur at any time that a public company (1) allegedly acts improperly, and (2) it is alleged that the act was allowed or able to occur because of insufficient internal controls (resulting in a violation of the books and records and internal accounting controls provisions of the Securities Exchange Act, which is automatically alleged in a great number of cases because it is easy in most situations to allege that something unexpected occurred because of inadequate internal controls), and (3) the alleged improper act also allegedly violates some policy or procedure of the public company (i.e., in this case to not use corporate assets for an allegedly corrupt or improper purpose).

What can a company (and the audit committee) do about these possible situations? Review the company’s policies and procedures, and adopt and enact sufficient internal controls, monitored and updated regularly, to ensure that the policies and procedures are followed. But, of course, it is difficult and probably impossible to ensure 100% compliance. I have previously written that the books and records and internal accounting controls provision in the Securities Exchange Act should be amended to include a standard of conduct provision (such as negligence) because it is unreasonable to expect that internal controls, no matter how good, will stop all alleged wrongful conduct.

Below is a screenshot of some of the SEC v. United Order, providing a summary of some of the facts, and I have also included below a link to Tate’s Excellent Audit Committee Guide. Dave Tate, Esq., San Francisco and California

sec-v-united-continental-holdings

The following is a link to Tate’s Excellent Audit Committee Guide (updated October 20, 2016), Click Here

The following is a link to my trust, estate, conservatorship and elder abuse litigation blog, http://californiaestatetrust.com

Audit Committee 5 Lines of Defense 07182016

 

Why do so many practitioners misunderstand risk? Forwarding post by Norman Marks

The following is a link to a new post by Norman Marks, https://normanmarks.wordpress.com/2016/11/26/why-do-so-many-practitioners-misunderstand-risk/ , Why do so many practitioners misunderstand risk? See also the link to “A Revolution in Risk Management” which is provided in Norman’s post. This is a good, i.e., worthwhile, post and discussion – the point being, I believe, is to not be too singularly focused in your evaluation of risks and risk management. I also like Norman’s use of the tree to visually demonstrate the discussion.

Best to you, Dave Tate, Esq., San Francisco and California. Link for Tate’s Excellent Audit Committee Guide http://wp.me/p75iWX-6z

Gretchen Carlson – Harassment & Discrimination – Culture – A Task For The Board – And Internal Audit?

I have provided below a link to a short article about Gretchen Carlson, an interview that she is giving, possible legislative efforts, and sexual harassment and discrimination. We all know, or should know, that this is an important topic. Not only sexual harassment and discrimination, but harassment, discrimination, retaliation, bullying, and hostile environments, and not only male harassment and discrimination of females, but also female v. male, male v. male, female v. female, and including race, color, ancestry and national origin, religion and creed, age and elder, mental and physical disability, sex and gender, sexual orientation, gender identity, and more.

This is or should become an area of oversight for your board, and it also relates to the culture of the organization, and tone at the top, at the middle, and at the lower employee levels, including an environment that encourages people to report harassment and discrimination without fear of retribution, anonymously if the desired, with the knowledge that the reported conduct will be timely, fairly and fully investigated, and that appropriate action will be taken.

This really isn’t new stuff from legal and governance perspectives. Are your board, and the board’s committees, on top of this issue and the culture of the organization?

These can and often are difficult issues and situations.  Of course anyone accused is entitled to a defense, and to rebut the allegations. At law, in most situations, innocence is presumed. In recent past years there have also been stories involving allegations of harassment and discrimination reported in the news that turned out to be false or at least not sufficiently supported.

An investigation into situations involving these allegations often should be performed by outside legal counsel with a reputation for integrity and knowledge and experience in these practice areas.

But let me also suggest that the culture of the organization (but not an actual investigation of a specific situation) also could be an area for attention by internal audit, if the board or management puts it on internal audit’s agenda, and if internal audit is provided education and training about the critical elements, and investigation techniques, and help preparing an audit and reporting program. After all, internal audit also is looking to become more relevant in helping the organization to achieve its organizational objectives, goals and strategies.

The following is a link to one of the articles about Gretchen Carlson and what she is trying to do and accomplish: http://people.com/tv/gretchen-carlson-alleged-sexual-harassment-in-2020-interview/

 

Who Evaluates the Chief Audit Executive (CAE)?

At the bottom of this post is a screen shot from the new publication Ethics and Pressure, Balancing the Internal Audit Profession, published primarily from the 2015 global practitioner survey of internal auditors worldwide. This is a really big survey. What do you think of the screen shot? Is it appropriate for management to evaluate the chief audit executive (“CAE”)? I say “yes,” of course.

I note however, that the writer also says “Exhibit 9 indicates that this responsibility [i.e., the responsibility for evaluating the performance of the CAE] is generally split evenly between management and the board. The big exception is in North America, where 61% of CAE’s are formally evaluated by management. Often however, these evaluations are reviewed by an audit committee.”

Let me just say, and I read a fair amount of materials from or relating to the internal audit profession, these sentences from the writer probably speak volumes. Do you mean to say that the audit committee isn’t always also doing its own evaluation of internal audit? I really hope that’s not what the writer is saying.

If you are on an audit committee, do you evaluate the performance of the CAE and of the internal audit function (if you have an internal audit function)? I certainly hope so. I mean, regardless of how internal audit operates with management, as an audit committee member aren’t you interacting with internal audit also, and isn’t internal audit helping you to satisfy your due diligence responsibilities? If not, you really need to sit down and think about how the audit committee is using internal audit.

And, if you are an internal audit CAE or member, if the audit committee isn’t sufficiently interested in you to evaluate your performance and how you help or don’t help the audit committee, then you are really missing the boat with a significant entity (i.e., the audit committee) that you should be helping.

In fact, most of the materials that I read from internal audit miss the boat, in my opinion. Yes, management’s use and interaction with internal audit is very important, but the audit committee really should value and make use of the availability of internal audit to help the audit committee satisfy it’s duties. If this isn’t happening, both the audit committee and internal audit are missing out on a tremendous opportunity. It might also be argued that both are failing to satisfy their responsibilities.

Here’s the screen shot from the survey and discussion:

who-evaluates-the-cae

New ISO Anti-Bribery Standard – Will It Give Companies An Absolute Defense?

ISO has published its new international anti-bribery standard, ISO 37001. You can find select information about the new standard HERE and at http://http://www.iso.org/iso/home/standards/management-standards/iso37001.htm .

The short PowerPoint presentation in part says:

The Standard benefits an organization by providing:

  • Minimum requirements and supporting guidance for implementing or benchmarking an anti-bribery management system
  • Assurance to management, investors, employees, customers, and other stakeholders that an organization is taking reasonable steps to prevent bribery
  • Evidence in the event of an investigation that an organization has taken reasonable steps to prevent bribery.

SO HERE’S AN INTERESTING QUESTION: will compliance with the standard give the company a free pass on bribery liability with the SEC and other state and federal entities and agencies if in fact a bribery occurs? I bet not. However, consider that generally liability does not result unless the person or entity charged has breached or failed to satisfy the applicable standard or duty of care (except in select situations, e.g., such as strict liability or products liability, etc.), and that breach or failure causes damages. Thus, if the applicable standard becomes ISO 37001, and if that standard is met or satisfied, it certainly is arguable that no fault or liability should result if a bribery occurs.

Best to you, Dave Tate, Esq., San Francisco and California. See also Tate’s Excellent Audit Committee Guide (updated October 2016), tates-excellent-audit-committee-guide-10202016-final-with-appendix-a

The Business Judgment Rule – a short animation (for fun, but also correct):

Audit Committee 5 Lines of Defense 07182016

DTatePicture_Square

Updated Tate’s Excellent Audit Committee Guide – Attached – Use It – Pass It Along – Free

Below is a link to my updated Tate’s Excellent Audit Committee Guide (updated October 20, 2016). Please use it, and pass it to other people who would be interested, such as audit committee members, directors, officers, accountants, internal and external auditors, in-house counsel, compliance professionals, and other people.

I do note that as I was updating these materials, and going through the entire Guide, it definitely hit me that all of the specifically enacted statutes, regulations, rules and pronouncements definitely could cause an audit committee member to not be able to see the forest for the tress. So let’s also not forget to look at the situation as a whole.

Although the Guide is 186 pages, I do expect some significant updates soon, and perhaps prior to the end of 2016. Many of the updates will be posted to this blog first, and then to the Guide. I am looking forward to the COSO enterprise risk management (ERM) updated framework.

Best to you. Dave Tate, Esq., San Francisco and California.

Here is a link to the updated Tate’s Excellent Audit Committee Guide (updated October 20, 2016), tates-excellent-audit-committee-guide-10202016-final-with-appendix-a

Audit Committee 5 Lines of Defense 07182016

The business judgment rule – an animated video:

 

DTatePicture_Square