House of Commons - Banking Crisis: reforming corporate governance and pay in the City

Banking Crisis: reforming corporate governance and pay in the City - Treasury Contents

6 Auditors

216. Auditors are one component of the web of assurance surrounding financial institutions; they have a responsibility to ensure that financial statements prepared by boards of directors present a "true and fair view". We received evidence alleging that auditors failed to fulfil that responsibility, by approving banks' financial statements shortly before those same institutions failed. As Professor Prem Sikka of the University of Essex observed, "within days of getting a clean bill of health from auditors many banks have simply collapsed".[336] In the course of our inquiry we examined how well auditors of banks had performed their duties, whether their role should change, and how the knowledge of banks that auditors accumulate in the course of their work could be absorbed more effectively into banking supervision.

217. Public confidence in the operation of the capital markets depends in part on the credibility of corporate reports produced by boards of directors. According to the Financial Reporting Council (FRC), the primary purpose of an audit of the financial statements "is for the auditor to provide independent assurance to the shareholders that the directors have prepared the financial statements properly".[337] This requires the auditor to issue an opinion as to whether or not the financial statements give a true and fair view and are in accordance with the relevant accounting framework.

218. The IMA's memorandum accused auditors of following accounting standards in "an overly mechanistic way without applying sufficient professional judgement." Specifically, the IMA commented that accounts had been produced and signed off by auditors:

· where large liabilities held in off balance sheet vehicles were not disclosed;

· where the sophisticated agreements that linked the institutions to the off balance sheet vehicles, or that made it possible for counterparties to trade protection instruments, such as credit default swaps, had not been properly interpreted;

· where disclosures of valuation methodologies were inadequate, particularly in the case of financial instruments where reliable market data was no longer available and institutions had decided to use models to determine values rather than prices.[338]

The IMA further considered that auditors should have raised more questions about the ability of borrowers to repay loans, and about the authentication procedures that had been followed, both by the institution holding the asset and by the originating lender.[339]

219. Unsurprisingly, the auditors themselves defended their performance. Brendan Nelson, KPMG's Vice Chairman, stated that "audit is around expressing an opinion on the truth and fairness of the financial statements and, in the context of the statutory audit responsibilities for 2007, auditors, we believe, discharged their responsibilities professionally and with care and diligence".[340] Mr Hayward agreed that "there is no evidence to suggest that the auditors have failed to do that which they are obliged by duty to do, the issue is around whether they should have been doing something else".[341] Professor Michael Power, of the London School of Economics, concurred that it was "hard to conclude that financial auditing as a whole, or in specific cases, should be a major focus of blame for the financial crisis. … External audit does not have a role at the front line of systemic risk management."[342]

220. Audit quality is monitored by the Audit Inspection Unit (AIU), part of the FRC's Professional Oversight Board (POB). According to Robert Hodgkinson, for the Institute of Chartered Accountants in England and Wales (ICAEW), these assessments were rigorous and auditors were "very much aware" of the AIU.[343] In December 2008 the AIU reported that the quality of auditing in the UK remained "fundamentally sound with no systemic weaknesses".[344] The AIU was also satisfied with the response of the seven major audit firms to challenges arising from the credit crunch. However, the AIU's assessment was, in most cases, made prior to 31 December 2007 and therefore did not address audit challenges associated with the more recent turmoil in the financial markets.[345] The AIU's 2008/9 inspection cycle had not been completed at the time of this Report's publication, but the POB did not believe that any major systemic issues were emerging which undermined their view that the quality of auditing in the UK remained fundamentally sound.[346] During the year to March 2007, the FRC's Financial Reporting Review Panel (FRRP) also reviewed the accounts of 16 banks and identified the "need for refinement of some disclosures in certain cases" but found "no evidence of any systemic reporting weaknesses".[347] During the year to March 2008, the FRRP reviewed the accounts of 10 banks and again found no evidence of systemic reporting weaknesses. The FRRP's inspections have not resulted in any restatements of prior period financial statements.[348]

221. We have received very little evidence that auditors failed to fulfil their duties as currently stipulated. The fact that some banks failed soon after receiving unqualified audits does not necessarily mean that these audits were deficient. But the fact that the audit process failed to highlight developing problems in the banking sector does cause us to question exactly how useful audit currently is. We are perturbed that the process results in 'tunnel vision', where the big picture that shareholders want to see is lost in a sea of detail and regulatory disclosures.

Should the role of auditors be redefined?

222. Professor Power argued that audit "should not be thought of as an early warning system",[349] and that it was not "reasonable" to expect auditors to be challenging business models and raising strategic issues with finance directors, because that was not their job "and if we want it to be their job then things would have to change quite substantially".[350] Paul Boyle, for the FRC, agreed that the role of auditors, as currently defined, afforded little opportunity for auditors to influence the behaviour of banks:

if you want to change the behaviour of banks you need to ask the FSA to do that because they are the banking regulator and the role of the auditor is to report on the truth and fairness of the financial statements. Those roles are complementary, but they are fundamentally different.[351]

223. But auditors occupy a privileged position with regard to the firms that they audit. Apart from the regulator, nobody else has the right to delve into a company's records, speak to staff about decisions made and strategies being pursued. These powers are granted to auditors in order to enable them to carry out their statutory duty, but could perhaps be better utilised in order to provide greater assurance to shareholders. In our previous report The run on the Rock, for instance, we recommended that the accounting bodies consider what further assurance auditors should give to shareholders in respect of the risk management processes of a company, particularly where a company was regarded as an outlier.[352] Helen Brand, the Chief Executive of the Association of Chartered Certified Accountants (ACCA) argued that auditors should indeed take "a closer look" at firms' risk management, and that there should be deeper engagement between banks' internal audit functions and external auditors on risk within an organisation.[353]

224. The FRC warned that any proposals to extend the purpose and intended audience of statutory audit would need to consider the competence of auditors to perform the new requirements; the costs involved; the exposure of auditors and others to liability risk; the need for legislation; and international considerations such as UK competitiveness.[354] Bearing these factors in mind, the FRC's Chief Executive, Paul Boyle, argued strongly against extending the remit of audit to incorporate assurance regarding risk management. He doubted that auditors were well-placed to do such work, or even competent to do so. He was also concerned that the UK might suffer if such a radical change were made to audit responsibilities on a national basis, without corresponding international agreement.[355] Professor Power echoed those comments:

I think the whole question of how boards of directors have oversight over 20 year old PhDs in maths who, three of them on a desk, can take us to where we are now, how you have oversight over that kind of specialism is a very specific kind of management and audit or assurance task. I am not convinced that audit, as it is currently constituted, is fit for that task.[356]

225. We are not convinced that auditors are particularly well placed to provide additional assurance regarding the risk management practices of financial institutions. Bearing in mind the view of the Chief Executive of the Financial Reporting Council, that auditors were not competent to perform such a role, it would be perverse to come to any other conclusion. A better way to ensure that banks manage their risks would be to concentrate on the banks' own internal risk management functions, complemented by more invasive regulation of risk by the FSA.

Links between auditors and the FSA

226. In the course of their work, auditors are in a privileged position to learn much about the strategies and business models of the banks that they audit. Some of this information may be of relevance to the FSA's work in supervising institutions, and could potentially play a part in ensuring financial stability. Professor Power spoke of the tension faced by auditors between client confidentiality and supporting the public interest, and that the exchange of information with a regulator cut across the grain of that client relationship. Nevertheless, he thought it was time to revisit the relationship between regulators and auditors "to see whether a richer set of arrangements can be put in place for information exchange".[357] Professor Sikka argued that "auditors might know that a bank has financial problems but they do not want to tell anybody",[358] so we decided to examine the existing links between auditors and the FSA, and whether they could be strengthened.

227. The FSA has the power under section 166 of the Financial Services and Markets Act 2000 (FSMA) to request from banks' auditors reports on areas such as financial information, fraud, internal controls or compliance with particular regulations. However, the ICAEW said that these powers were used "infrequently" and that the current regime contrasted with that which operated under the Bank of England's supervision of banks, in which auditors were "routinely requested" to conduct such work.[359] What little work auditors currently do for the FSA, explained Mr Nelson, was very much "detective" in the sense that section 166 reports were generally only convened when the FSA had suspicion or evidence that an institution was failing to meet particular regulatory requirements. The nature of the audit work was therefore to try to find evidence requested by the FSA. He contrasted this with the previous regime, which was very "preventative".[360] The ICAEW believed that the use of ad hoc reports could provide valuable insight into difficult areas, without the risk of the reports being misunderstood or alarming the market, since these reports would be private reports from the auditor to the regulator.[361]

228. John Hitchins, a banking audit partner at PwC, described how under Bank of England supervision, there had been an annual meeting between the regulator, client and auditor on each individual bank. There would then follow a meeting between the regulator and auditor without the client present. Mr Hitchins said that, under the FSA, those meetings were now "ad hoc"—occasionally convened by the FSA but with frequency varying from bank to bank. He suggested that the frequency of such meetings should be increased.[362] KPMG also called for the interaction between regulator and auditor to be reinvigorated because the proportionate use of auditors by the FSA would be cost effective and deepen the auditor's understanding of the business "so enhancing audit quality".[363] Mr Boyle agreed that improving communication between auditors and the FSA would be a good thing.[364]

229. We invited audit firms to suggest specific areas where the role of auditors might be strengthened in the audit of banks.[365] The ICAEW Financial Services Faculty responded to our request on behalf of the audit firms, setting out five areas where the role of auditors could be extended. They suggested that the audit profession could contribute to greater confidence in banks by providing objective, expert opinions on reported information, so that those relying on such information could be confident that it had been properly prepared. Their specific suggestions were as follows:

· Some of the financial information reported by banks does not form part of the audited accounts, for example, regulatory capital ratios. The ICAEW suggested that the audit scope be extended to cover such disclosures.

· From 2009, banks will be required to report greater detail of their risk positions under new regulations introduced by Basel II, called 'Pillar 3' disclosures. Basel II includes an option to require Pillar 3 disclosures to be audited. The Government and FSA took the view that it would not require an audit of these disclosures. The ICAEW suggested that the FSA reconsider that decision in the light of changed circumstances.

· Banks' regulatory returns to the FSA include a range of financial information, for example on liquidity, large exposures, a bank's balance sheet and capital. At present, these returns are not subject to review by auditors. The present regime for banks arose under FSMA. It differs from the insurance sector, where regulatory returns are reported on by auditors. Before the introduction of FSMA, banks' returns were subject to periodic review by auditors. The ICAEW urged the FSA to consider whether reintroduction of a review of key bank regulatory returns by auditors would be useful.

· The FSA has powers under section 166 of FSMA to commission reports by auditors on specific issues. The ICAEW argued that the FSA could make greater and more regular use of their existing powers to obtain more information about the operation and application of controls or compliance with regulations.

· Meetings between bank auditors and the FSA are relatively infrequent. The ICAEW argued that the FSA should consider more regular meetings with auditors in order to gain additional insights into the banks they regulate.[366]

230. Lord Turner said that in the future the FSA would be much more actively involved in debates with the auditors and with the banks about how accounting standards were being implemented.[367]

231. The FSA's piecemeal approach to garnering auditor knowledge about individual banks indicates to us a wasted opportunity to improve the effectiveness of bank supervision. In future, the FSA should make far more use of audit knowledge, on a confidential basis. We are grateful for the response by the ICAEW in bringing together audit firms and drawing up some suggestions to strengthen links between the FSA and auditors. We recommend that the FSA should respond to each of the five suggestions made by the ICAEW.

232. In addition to knowledge about individual banks, auditors are in a position to develop an understanding of issues affecting the banking and financial services sector as a whole, spotting industry-wide trends and innovations. All of this information could also be used by the FSA in improving its supervisory practices. PwC told us that there was a great deal of contact at an accounting firm/FSA level. This ranged from formal meetings, to participation by members of the auditing firms on FSA committees, to informal meetings and lunches. Some of this contact "is relatively informal and unstructured", and PwC did not wish for the contact to become overly formal, arguing that to do so might be to the detriment of the regulatory process.[368] To give an example, Mr Nelson of KPMG told us that there was a high-level meeting in late 2007 which was convened by the audit firms with the FSA, the Bank of England and the FRC present. At this meeting there was no discussion of individual institutions,[369] but the FSA explained some of the generic work that they had been carrying out in the sector, particularly with respect to market risk. Audit firms then talked about imminent likely difficulties in valuing financial instruments, and the FRC made some observations about issues such as the difficulty audit firms would have in deciding whether a firm was a 'going concern' or not.[370] Mr Hitchins said that, in general, there was "very good" interaction between firms and the FSA on policy issues, but there was room for improvement in discussing individual banks.[371]

Conflicts of interest

233. In our report The run on the Rock we concluded that "there appears to be a particular conflict of interest between the statutory role of the auditor, and the other work it may undertake for a financial institution".[372] We were particularly concerned about auditors earning fees from work arising from securitisations, especially where assets were held off-balance sheet. Professor Sikka observed that financial audit was the only kind of audit in the world which permitted an auditor to also act as a consultant or advisor to the same firm.[373] The Pensions Investment Research Company (PIRC) stressed the importance of audit being perceived to be a wholly independent process, which depended on "independence being beyond reasonable and informed challenge", as opposed to being simply an arguable case. PIRC held that, "the independence of the auditor is of paramount importance to shareholders, both in respect of individual companies and in terms of audit's public policy function of ensuring investor confidence in financial reporting".[374] Although the auditing profession has long had ethical guidance on objectivity, this has not been sufficient to prevent significant concern being raised.

234. PIRC noted that in the majority of cases UK-listed banks had paid considerable fees to their auditor for non-audit work, and believed that this practice created a conflict of interest.[375] It did not believe that audit firms could be employed to provide consultancy services for management at the same time as undertaking an independent audit on behalf of the shareholders: "We firmly believe that other commercial interests can compromise auditors in their ability to confront directors on difficult issues … and would wish to see a prohibition on non-audit services being provided".[376] Professor Power commented that research had revealed the financial incentives for auditors to be acquiescent to management, but "psychological and cultural barriers to challenge" also existed. He argued that an auditor who adopted "a highly sceptical and scientific approach" to the client and to the financial statements, would quickly be regarded "as an oddity". According to Professor Power, it needed to be accepted that the modern auditor was an economic agent—"scepticism and challenge take place within a narrow 'bandwidth' of what is practically and culturally acceptable".[377]

235. Mr Boyle told us that the FRC had "taken note" of our recommendation and would shortly be publishing a review of the ethical standards for auditors.[378] But he confirmed that, following the review's publication, it would still be possible for a bank's auditor to be paid for the provision of comfort letters for off-balance sheet securitisations, because the FRC did not judge that this practice fundamentally impaired the independence of the auditor.[379]

236. Mr Hodgkinson, for the ICAEW, accepted that "the issue of independence is one which naturally causes concern", but told us that it was very thoroughly examined in 2002-03, and the very firm conclusion, from "the co-ordinated group on accounting and auditing matters" was that blanket bans would be inappropriate.[380] He regarded audit quality as being much broader than auditor independence, referring to the FRC's audit quality framework, which lists the culture of the audit firm, the quality of the audit partners and staff, the processes adopted, the quality of reporting and other factors, "which all drive quality". He added that it was "a little bit disheartening for those who are committed to quality in the firms and the regulatory structure that everything seems to focus on independence. If you are independent that does not enable you on its own to deliver a great audit".[381] Professor Power concurred, saying that the debate about auditor independence was a "complete red herring" and a soft target.[382] His view was that the more important issues were on the operational side of the audit process:

what is it that auditors know, what is it they do, what is it they are capable of doing, who do they rely on in order to carry out their work. I think if we open the black box and have a look at that, there are some very interesting questions to be asked.[383]

Mr Hayward, of Independent Audit, characterised the debate on independence of auditors as "one of those angels dancing on the head of a pin" questions.

Independence is not the same as objectivity; objectivity is what you want in your auditors and these technical issues of independence might or might not support it. One of the poorest audits that I have observed in practice was done by an audit firm that had no non-audit work because the price for having no non-audit work is a considerable level of ignorance about the client's activities. This is a much more complex issue than is made out.[384]

237. We remain concerned about the issue of auditor independence. Although independence is just one of several determinants of audit quality, we believe that, as economic agents, audit firms will face strong incentives to temper critical opinions of accounts prepared by executive boards, if there is a perceived risk that non-audit work could be jeopardised. Representatives of the investor community told us of their scepticism that audit independence could be maintained under such circumstances. This problem is exacerbated by the concentration of audit work in so few major firms. We strongly believe that investor confidence, and trust in audit would be enhanced by a prohibition on audit firms conducting non-audit work for the same company, and recommend that the Financial Reporting Council consult on this proposal at the earliest opportunity.

Going concern

238. Directors of firms and their auditors are required to consider the ability of a firm to continue as a 'going concern' (for the next year) at the time the accounts and audit report are issued. The FRC clarified the situation faced by auditors in its memorandum:

If auditors conclude that the disclosures regarding going concern are not adequate to meet the requirements of accounting standards, including the need for the financial statements to show a true and fair view, they are required to express a qualified or adverse opinion as appropriate. The auditors report is also required to include specific reference to the fact that there is a material uncertainty that may cast significant doubt about an entity's ability to continue as a going concern. If the auditor concluded that a material uncertainty exists that leads to significant doubt about the ability of the entity to continue as a going concern, and those uncertainties have been adequately disclosed in the financial statements, it is required to modify its report by including an emphasis of matter paragraph.[385]

239. Such considerations have proven particularly difficult with regard to banks in the financial crisis, given uncertainties surrounding the marketability of assets and the availability of liquidity. We asked witnesses whether auditors should have been expected to foresee these difficulties, and therefore express reservations over going concern at the end of 2007. Mr Nelson argued that such an expectation would have been unreasonable: "there still was enough evidence to suggest that the crisis that [occurred] in October [2008] would not materialise within the period … covered by the going concern assumption, which is 12 months from the date of the audit report of the financial statements".[386] The ICAEW agreed that the speed with which banks were affected by market developments was "not something that could have been predicted by their auditors".[387]

240. Mr Hitchins, for PwC, explained that the business model of a bank made going concern judgements particularly difficult, especially for 2008 year ends:

The basic business model of a bank always has a funding gap in it because banks take in short term deposits and lend it long … In normal markets and normal circumstances you can have considerable confidence that the banks can meet that funding in the market. Since the collapse of Lehman's that has not been the case and all banks have had to depend on facilities, largely from the Bank of England but also partly from the Government. For this year end we basically have to assess the projections that management have done in forming their own opinion on their funding needs, examine those and consider whether the funding needs shown in those forecasts can be met by the facilities that are available in the market which will, in the short term, largely be from the Bank of England.[388]

Mr Boyle told us that going concern reporting was "a very significant issue" and was one that was getting a lot of attention both in bank boardrooms and amongst audit firms.[389] He was confident that the FRC's approach to the treatment of going concern disclosures was sufficiently clear, and that bank directors and auditors understood their obligations in this area.[390] The FRC published guidance on going concern in November 2008 for directors and auditors, which did not introduce any new requirements but did "highlight the importance of clear disclosure about going concern and liquidity risk in the current economic conditions".[391] BDO Stoy Hayward observed that this guidance would "be helpful to preparers and auditors in the current environment".[392] Mr Nelson was adamant that auditors were capable of working out whether banks were going concerns or not. He stressed that this was a 12-month view, rather than a multi-year view.[393] Mr Hayward was less confident saying that

to come to that [going concern] conclusion requires one to make assumptions about the behaviour of markets which over the last year or two have not been predictable or rational. We just do not know how things are going to shape up; my feeling is that the audit profession though is trying its best to work within what it has got to do and is trying to be helpful in saying yes to that.[394]

241. Given the adverse current economic environment, the ICAEW anticipated that a significant proportion of 2008 year-end annual reports were likely to contain disclosures relating to going concern and liquidity. The nature of the market reaction, they contended, would be heavily affected by the levels of understanding and awareness of going concern. An overreaction by investors could "undermine wider business confidence" with the potential for a number of damaging effects: lenders could react by withdrawing lending; in some cases, a modified audit opinion could be interpreted as meaning that businesses would have breached loan covenants; suppliers could interrupt credit facilities provided to a business; landlords might seek to enforce break clauses in property lease arrangements; and general business confidence and investor sentiment could be damaged.[395] The ICAEW observed that users of financial statements needed to be aware that, even where there are material uncertainties about going concern, it does not follow that the company concerned would cease to exist. In their view, going concern uncertainty was less important than the nature of the uncertainties and the proposed management response.[396]

242. KPMG observed that it would be "unlikely" for a set of a bank's financial statements to be issued if there was a significant doubt around going concern. In such a case, the auditor would have a statutory duty to report their concerns to the FSA, prior to the issuance of any modified audit report. According to KPMG, this in itself would be sufficient for the FSA "to crystallise the bank's status either by ensuring support is provided or suspending its licence to take deposits".[397] Professor Power suggested a possible improvement in this area:

The auditor must either issue a 'clean' audit report, which tends to be highly standardised, or a qualified audit report, which for financial institutions would be highly damaging for its potentially self-fulfilling consequences. Reporting systems in other fields, in health and safety for example, have more finely-tuned and graduated forms of reporting, and adverse reporting is normalised to a certain extent. The lack of such a 'graduated ladder' of reporting options is one source of difficulty for financial auditors, especially as they consider the applicability of the going concern assumption for clients in 2009.[398]

243. The Financial Reporting Council should build on steps it has already taken to ensure that users of accounts are sufficiently well informed about going concern considerations that the issuance of modified audit opinions does not result in undue panic. With a view to the longer term, we believe there is a case for the FRC to consider the introduction of a graduated ladder of concern, along the lines suggested by Professor Power. We would welcome a system whereby the auditor could transparently express an opinion on a bank's future, without triggering emergency action by the FSA.

Financial reporting

244. Many banks produce financial statements that are exceedingly long. We questioned whether such documents truly served the interest of those that they are intended for—the shareholders and other users of the accounts.

245. Mr Nelson, for KPMG, said that there was a constant dialogue with users of financial statements to discuss improving their utility, but the user community was so wide that it was quite a challenge to meet every user's demands.[399] Mr Hayward, of Independent Audit, admitted that the audit profession was culpable in creating financial statements that had "headed for compliance rather than communication", leading to the production of "telephone directories of data".[400] Professor Power echoed these comments, noting that recent disclosures regarding financial instruments provided useful information, but "it is questionable whether they could have enabled readers to understand the underlying risks".[401]

246. Mr Nelson told us that the International Accounting Standards Board was looking at the complexity in financial statements and seeing whether they needed to be restructured to make them easier to understand.[402] The ACCA suggested that the principles outlined in the proposed Operating and Financial Review (OFR) should be reconsidered, because the OFR could be a valuable opportunity for organisations to reflect on their business model and strategy, and to be able to communicate these to its stakeholders.[403] As a good first step towards this goal, they suggested that firms include an Executive Summary at the front of the financial statements.[404]

247. We believe that the complexity and length of financial reports represent a missed opportunity to improve the understanding that users of accounts possess of the financial health of firms and recommend that the FSA consult on ways in which financial reporting can be improved to provide information in a more accessible way. At the moment, financial reports can be used for finding specific bits of information, so are useful for reference, but they do not tell the reader much of a story. We would like them to read less like dictionaries and more like histories. A useful approach would be to insist on all listed firms setting out their business model in a short business review, in clear jargon-free English, to detail how the firm has made (or lost) its money and what the main future risks are judged to be.

3 336 36 Q 1080 Back

3 337 37 Ev 29 Back

3 338 38 Ev 225 Back

3 339 39 Ibid. Back

3 340 40 Q 1131 Back

3 341 41 Q 1133 Back

3 342 42 Ev 176 Back

3 343 43 Q 1122 Back

3 344 44 Ev 167 Back

3 345 45 Ibid. Back

3 346 46 Ibid. Back

3 347 47 Ev 165 Back