Ask Glyn Smith who internal audit should report to, and the answer is clear: the audit committee. “In the post-Enron, post-Andersen environment,” he says, “internal audit really needs to function independently of either the CEO or the CFO.”
Smith should know. As a senior manager in WorldCom’s internal audit department, he worked closely with Cynthia Cooper, the vice president of audit, in the investigation that unearthed an alleged fraud involving almost $4 billion in overstated revenues, later revised to $7.1 billion.
That internal audit team seems to have demonstrated why such a reporting setup may be preferable. According to sworn public documents filed by WorldCom, on June 11, after Cooper discussed her investigation with then-CFO Scott Sullivan, Sullivan asked for a delay in the review. The next day, however, Smith and Cooper called audit-committee chairman Max Bobbitt to discuss “questionable transfers” made during 2001 and the first quarter of 2002. Their concerns apparently centered on the company’s accounting for its line costs (payments for network services and the use of third-party facilities) as capital expenditures — and not as expenses. That treatment was out of whack with industry practice. It also didn’t jibe with generally accepted accounting principles.
WorldCom’s Securities and Exchange Commission filing indicates that, during the call to the audit-committee chairman, Smith himself told Bobbitt about the key points Sullivan made in his discussion with Cooper. The points included the CFO’s request for a delay of the audit review, and his claim that the capitalization issues would be cleared up in the second quarter of 2002.
On June 26, WorldCom management announced the discovery of the expense transfers, along with the firing of Sullivan and a pending restatement. All in all, the improper bookkeeping would trim nearly $3 billion from WorldCom’s previously reported earnings for 2001.
While Smith insists his internal audit recommendations do not stem from his experiences at WorldCom, he maintains that audit committees need to learn more about accounting. Toward that end, Smith believes committee members should take at least 32 hours of professional-education courses in auditing and corporate governance annually. In addition, he thinks audit-committee terms should be limited to about three years. Besides boosting alertness, regular audit-committee shake-ups would supply internal auditors with a changing group of bosses, he says.
Smith readily concedes that most chief audit executives get their policy direction from audit committees. But he says they tend to be managed and evaluated by CFOs. Such a setup, however, can cause an internal auditor to become too beholden to finance or operations.
To avoid conflicts, Smith thinks some firms will install a senior vice president of risk management or governance to oversee the audit department. But the real oversight should rest with the audit committee. They should be “driving the internal audit plan and giving direction to the internal audit department,” he says. —D.K.