CHAPTER 1

Auditing: The Rise of a Profession

We have audited the balance sheet and say in our report
That the cash is overstated, the cashier being short;
That the customers’ receivables are very much past due;
That if there are some good ones they are very, very few;
That the inventories are out of date and principally junk;
That the method of their pricing is very largely bunk;
That, according to our figures, the undertakings’ wrecked.
But, subject to these comments, the balance sheet’s correct.

—John Carey¹

A textbook definition of an audit: “A systematic process of objectively obtaining and evaluating evidence regarding assertions about economic actions and events to ascertain the degree of correspondence between those assertions and established criteria and communicating the results to interested users.”² The U.S. securities acts of the 1930s required an annual audit conducted by a certified public accountant (CPA) for all publicly traded corporations, making the CPA a critically important profession—with something of a government-sanctioned monopoly.

Early auditors reviewed all transactions beginning with the original voucher or receipt through posting to the journal and ledger, recalculating the trial balance because debits must equal credits; a simple, time-consuming process to document all operating and financial activity. The objective of checking for clerical errors and certain types of fraud was met; the auditor emphasized the importance of “profession judgment,” that all entries were recorded correctly. The auditing profession was created in the 19th century and well established by 1900 in both Britain and America. Bankers, capital markets, and investors came to demand reliable information, presumably supplied by the auditor.

Auditing has never been fool-proof and changes in audit procedures and objectives often come from market and audit failures; the failures make the headlines, not the successes. The number one failure was McKesson & Robbins in the 1930s, because of undetected and long-term fraud on a massive scale—uncovered by a whistleblower not the auditor. Auditors were led astray by fast talking executives and lack of stringent techniques to detect the fraud—in part because there were no professional audit standards at the time. The embarrassment to the entire profession led quickly to auditing regulation by the American Institute of Accountants (now the American Institute of Certified Public Accountants or AICPA), the trade association of CPAs. Beginning in the 1950s computers became big business and corporate use continually expanded, including accounting-related activities. Auditors had the complex task of auditing around or through the mysterious “black box” that defined computer systems. Audit failures continued, including the disastrous bankruptcies at Enron, WorldCom, and other tech firms early in the 21st century.

Early Auditing

Auditing is an ancient concept coming from the Latin term “audire,” to hear. By ancient tradition, reports were presented orally, largely because most people were illiterate. Trade and wealth expanded during the late Middle Ages, with the important assist of double-entry bookkeeping. The concept of reviewing records by skeptical partners, bankers, customers, and tax-collecting governments increased and auditing procedures expanded and became more sophisticated. Italian Merchant partners in, say, the 12th century typically liquidated operations periodically. A formal liquidation needed to pay all outstanding debt, then divide the available cash and other assets between the partners. Reviewing the records supporting the final accounting was critical, made easier by both double entry and review by outside experts. Accountants in Florence and Venice often were paid a percent of the errors and frauds discovered.

The English Experience

Anglo-Saxon England had experience with record-keeping and a developing government-bureaucratic-judiciary structure, which was adapted by and expanded on by the Normans. The Domesday Book of 1086 could be considered an audit census for tax purposes. Woolf described the Pipe Rolls (annual tax records) used by the English Exchequer: “showing the amounts due each year from the Sheriffs to the King … made in triplicate. This system of checking by means of copies obtained throughout the Exchequer. We find that three officials (the Treasurer’s Clerk and two Chamberlains) kept separate accounts of all moneys actually received, and a record of all moneys actually paid out, the accounts of each officer being compared periodically with those of the other two.”³ This interesting internal control process was expanded upon in later reigns, including the “Auditors of Imprest” and later Commissioners of Public Accounts.

The South Sea Co. became the first financial bubble and bust of a joint stock company. Charles Snell, calling himself a “writing master and accountant in Foster Lane, London”—perhaps the first public accountant—reviewed the finances of Sawbridge & Co. in 1720 because of the alleged corruption after the South Sea Bubble burst. Jacob Sawbridge was a director of the South Sea Co. and accused of bribing government officials. Snell’s report, issued in 1721, is the earliest “audit report” in existence. Sawbridge was expelled from the House of Commons and stripped of most of his fortune.

The Industrial Revolution changed everything in the world of economics and business. Factories using steam power replaced the craft system and the interrelated concepts of productivity and economies of scale became meaningful. Industrial corporations, railroads and other mass transportation, new markets (national and possibly global), plus the capital markets to finance big business all required new accounting perspectives—and professional accountants. Accountants had to be innovative to provide the information to meet the needs of complex operations.

Prior to 1800 the term “professional accountant” had little meaning. A directory of London professionals from 1790 listed exactly five accountants; the list would grow to over a thousand by 1900.⁴ Owners and professional managers performed most accounting functions as part of their jobs (and virtually anyone could claim to be an accountant or auditor). A real profession was on the way by mid-century. The British Companies Act of 1844 required audits of joint stock companies (now corporations), although exactly what an auditor did was not explained.⁵ Early professional accountants dealt largely in bankruptcies, liquidations, taxes, kept books, and examined disputed accounts, with the support of government regulations. The Bankruptcy Act of 1831 mentioned accountants (along with merchants and brokers) as potential “Official Assignees.” Railroad legislation in the 1840s called on the use of auditors. The Bankruptcy Act of 1869 included the need for trustees for the estate, which again could be accountants.⁶

British accountants took it upon themselves to create a profession. The earliest British version was the Institute of Accountants in Edinburgh, founded in 1853, followed by the Institute of Accountants and Actuaries in Glasgow two years later. They joined in 1893 to create the Chartered Accountants of Scotland. England proved a laggard, creating the Incorporated Society of Liverpool Accountants in 1870, followed shortly by the Institute of Accountants in London, then the Manchester Institute of Accountants. Finally, a charter was passed in Parliament, resulting in the Institute of Chartered Accountants in England and Wales in 1880. The first members became Chartered Accountants by waiver. Admission by examination started in July 1882. As of 1882, the Institute had 1,193 members.⁷ Accounting societies followed in the various British colonies as well as the United States. Professional training was based on apprenticeship, initially a five-year program, which was reduced as firms began to hire college graduates. Several accounting firms becoming the Big 8 (now reduced to the Big 4) were founded in mid-century London. These were named after their founders, including Deloitte, Whinney, Price, Waterhouse, Cooper, and Peat.

Auditing became an increasing part of the accountants’ time, probably half the professional work by the turn of the 20th century. At that time auditing centered on the “detailed” or complete audit, which proved reasonably effective for discovering errors and certain types of fraud. Journals were checked to vouchers or other documentation of transactions, then traced to ledger entries. Normally, this was important to the owners and usually bankers and creditors. In addition, auditors would check legal records such as the articles of incorporation of the client and minutes of board meetings.

The typical focus of the balance sheet audit, an extension of the detailed audit, was well established by the late 19th century. Included was checking all securities and cash, receivables (including aging the accounts and estimating value and the need to write off bad debts), determine inventory (including possible obsolete items), fixed assets including reasonableness of depreciation and other wear and tear techniques, all liabilities and other obligations, and finally capital. A major purpose was to determine the capacity of the firm to repay outstanding loans to bankers and other creditors. Stockholders became more interested users of the balance sheet audit, which provided information on the capacity of the firm to earn income and pay dividends. Over time, the purpose of the audit shifted to ascertain actual financial conditions and earnings. All transactions did not need to be audited if small frauds were not important, eventually allowing the auditor to use audit sampling on balance sheet accounts. However, the use of sampling implied that internal controls⁸ worked to limit the potential for fraud.

Auditing Moves to America

Wealthy English investors found investment opportunities in America—everything from railroads and heavy industry to cattle ranching in the West. British accountants followed the British wealth to protect investor interests in the relatively corrupt former colonies. The first accounting firms to establish a New York office was Barrow, Wade, and Guthrie in 1883, followed by Price Waterhouse in 1890.

America had gigantic industries and big domestic investors by then; consequently, American accountants borrowed from their more professional British counterparts. American high tech included electric utilities, typewriters, and mechanical adding machines. The Tabulating Machine Co. produced the Hollerith tabulating machine; the company later changed its name to the more grandiose sounding International Business Machines (IBM).

Accounting was a service that required massive manpower. Before the tabulating machine and, later, computers, office productivity was close to zero—roughly comparable to manufacturing before the Industrial Revolution. Six of the Big 8 (see Table 1.1) had been founded in 19th century Britain⁹ (American firms Arthur Young and Arthur Andersen were started later—in 1906 and 1913, respectively). State licensing for the CPA started late in the 19th century. Many CPAs joined professional groups, including the American Association of Public Accountants (AAPA) and later the American Institute of Accountants (AIA), both predecessors to the AICPA.

The profession established procedures (later incorporated in a code of ethics) that protected their turf as much as provided ethical standards (with practices akin to the guilds of the Middle Ages). Thus, accountants performed “audit engagements” (the terms of which were generally determined by the client), did not advertise or solicit clients, or blatantly seek clients. The firms preferred long-term relationships with clients where audit fees were expected to rise year after year. This perspective did not change much until the 1970s.

Employment at the bigger firms took a pyramid perspective, with the partners (they were the owners of the business) at the top, down the line through managers, supervisors, and staff auditors. The climb up the ladder was based on seniority and merit (the so-called “unsuccessful” often were placed as accountants of client firms). The term “leverage” was defined as the staff-to-partner ratio. A high ratio, perhaps 20 to 1, meant greater billable hours and higher expected partner earnings.

Except for licensing requirements in a few states, audits were effectively unregulated around the turn of the 20th century. Short of outright fraud (or other illegal acts under common law), it was difficult for CPAs to break the law—without specific regulations what laws could be broken? There were few if any rules, no mandated duties or responsibilities beyond engagement contracts with clients, no code of ethics (until the AIA passed a code of ethics in 1917). The auditor worked for the client, the purpose of which was determined by the client, seldom involving the public interest. As the separation of ownership and management expanded and financial needs provided by Wall Street, corporations wanted the credibility that an audit report provided. Wall Street demanded corporate prospectuses and annual reports to market their securities as did bankers for commercial loans. But how effective were these early audits? There were no uniform standards. Price Waterhouse (PW) was an audit firm known for high quality audits. However, not all firms had PW’s high standards, and later events proved even these standards could be deficient.

Table 1.1 The founding and changes of the Big 8

Substantial abuse existed with the audit. The typical prospectus mentioned the audit, but did not publish the auditor’s report. Stockholders would know an audit was conducted, but not the results or even if it was a standard balance sheet audit or procedures much less inclusive. Because generally accepted accounting principles (GAAP) were decades away, financial statements could easily be manipulated or misrepresented. Accounting procedures and reports were based on the accountants’ judgment, whatever that might mean. Auditors had the choice of accommodating clients or, if not, withdraw from the engagement—giving up lucrative clients made staying in business difficult. Short of articles by muckraking journalists or bankruptcy, stockholders would never know. The commercial bankers might, because they could insist on their own requirements before making loans. However, the incentives of investment bankers to sell securities might encourage misrepresenting the audit as much as the corporation.

Audit regulations started before the turn of the century. New York was the first state to license CPAs in 1896. Initial members were awarded licenses by waiver. Frank Broaker became the first CPA, because the initial list was in alphabetical order. More famous accountants, including Charles Haskins and Elijah Sells, also were on the list. By 1921 all states licensed CPAs. The uniform CPA exam started in 1917. Thus, by the early 1920s CPAs were subject to state regulations, professional societies (including the AAPA and AIA, both predecessors to the AICPA) they could join, and standard professional knowledge as demonstrated by testing.

Some thought was given to federal standards. In 1917 the Federal Reserve Board published “Uniform Accounting” in the Federal Reserve Bulletin, based on a Price Waterhouse memo submitted by the AIA to the Federal Trade Commission (FTC; which was accepted with minor changes). The new rule was essentially a standardized audit process with step-by-step methods to evaluate each balance sheet account to issue a basic audit report. Substantial reliance was placed on professional judgment to determine the right calculations, journal entries, financial reporting, and audit requirements.

The New Deal and Beyond

Modern auditing is a major service industry, highly regulated and international is scope. Sophisticated technology and techniques are used to determine if financial statements are presented fairly in accordance with GAAP. Around the turn of the 20th century, power banker J.P. Morgan insisted on audited financial statements publicly available for the giant corporations he created; this included U.S. Steel, the largest American corporation at a market value of $1.4 billion after going public in 1902. However, most big business and securities institutions were slow to see the need for financial audits and full disclosure. The New York Stock Exchange (NYSE) made limited accounting regulations for member firms. Ninety percent of NYSE firms were audited (in some form) by 1926, but the exchange did not require audited financial reports until 1933—well after the market crash and start of the Great Depression. By then the Dow Jones Industrial Average (DOW) dropped 90 percent from its 1929 high. Franklin Roosevelt’s 1932 presidential run promised a New Deal including financial reforms; he won and delivered legislation in his first 100 days. The securities laws required financial audits done by CPAs. The AIA took the lead in writing appropriate accounting and auditing standards.

The AIA issued Examination of Financial Statements by Independent Public Accountants in 1936, a revision of Uniform Accounting. Additional auditing procedures were instituted, but Examinations did not require either observation of inventories or confirmation of receivables, common audit procedures since early in the century. Consequently, many auditors neglected these relatively expensive steps. The long-term fraud at McKesson & Robbins proved an embarrassment to both the profession and AIA, plus the obvious need for stiffer audit regulation. The Securities and Exchange Commission (SEC) concluded: “… the financial statements [audited] by Price Waterhouse & Co. [were] materially false and misleading.” The McKesson president was a crook using a bogus Canadian subsidiary to claim nonexistent inventory and receivables. Had the receivables been confirmed and a physical count of the inventory taken, the fraud would have been exposed. Neither was done by Price Waterhouse and the fraud went undetected until discovered and disclosed by a whistleblower.

An embarrassed AIA responded by setting up the Committee on Auditing Procedure (CAuP) in 1939. The CAuP almost immediately issued Statement on Auditing Procedure (SAP) No. 1, which required procedures lacking in the McKesson audits. These included observation of inventories, receivables confirmation, selecting the auditors either by the board of directors or annual election by the stockholders, and a new auditor’s report which included an emphasis on internal control. The SEC required the auditor to state in the auditor’s report whether the audit was made in accordance with “generally accepted auditing standards” (GAAS) in Accounting Series Release (ASR) No. 21. The AIA maintained jurisdiction over audit standards but created a new standard setting body in 1972 called the Auditing Standards Executive Committee (AudSEC). (The CAuP issued 54 SAPs over its 33-year tenure.) The Public Company Accounting Oversight Board (PCAOB), created by the Sarbanes-Oxley Act of 2002 (SOX), now establishes auditing standards.

Auditing Around and Through the Computer

Accountants were comfortable working with pencil and paper; however, basic accounting entries such as sales, purchases, or payroll are repetitive and time consuming in a manual system. After the Hollerith machine was successfully used for the 1890 U.S. Census, tabulating machine found a market for business uses early in the 20th century, basically turning repetitive transactions over to the machines. IBM achieved success partly for installing and servicing these machines. From an accounting perspective, the paper trail remained, now in the form of punch (or IBM) cards and printouts. Beginning in the 1950s the computer replaced the tabulating machine, initially for mundane accounting entries. As computer power increased prices fell and programming more refined, virtually all phases of accounting were computerized and increasingly integrated—even across diverse business segments and multination jurisdictions.

Once the computer became the key business information technology in the 1950s, the auditor had to adjust, creating both opportunity and problems for auditors. Auditors learned to use computers for various audit procedures such computer-assisted audit techniques and many of the large audit firms developed extensive computer expertise as part of their audit as well as consulting services. They also had to figure out how to audit through the computer, a potentially difficult task when no “paper trail” existed. Initially the computer was treated as a “black box,” with information fed into and other information and reports outputted; auditors first attempted auditing around the computer, checking original documents used to input data with output results. A paper trail in the form of a computer printout could be audited by hand, but problems developed. First, skilled computer experts could write programs to confuse the auditors. Second, as computer sophistication increased computer printouts became less common and sometimes less useful. Answers were possible only after auditor firms became computer literate—often by employing nonaudit computer experts.

Auditors used various procedures including systems-oriented auditing and audit risk models, with a major focus on the effectiveness of internal controls (that is, procedures to protect resources and both prevent and detect fraud). Fortunately, certain types of errors are eliminated when using computer systems, although other types of errors and problems are made worse—including programming errors and unique computer frauds. An early process for “auditing through the computer” was audit test data which simulated firm transactions, to validate existing computer programming and procedures. Generalized audit software and other utility programs were developed to perform various data processing functions such as reading and comparing files, accessing specific data, and performing a variety of calculations. The software could do other tasks, such as determining statistical-based samples and then printing out accounts receivable confirmation forms for these samples.

Consulting

With the rise of the computer in the post-World War II period, consulting became the major growth area of the major accounting firms. This proved to be a big, relatively unregulated field. Without stringent rules, auditors were free to provide whatever service they could sell, often for lucrative sums. In addition to computer-related expertise such as developing information systems, or integrating accounts and networks, consulting included anything from executive recruiting, to mergers and acquisitions, to advising foreign governments.

Arthur Andersen developed computer expertise in the 1950s and became perhaps the most successful major (Big 8) accounting firm in consulting. Andersen specialized in such fields as operations research, production control, and installing major accounting systems. However, once consulting became much more profitable than auditing, tensions developed between auditing and consulting partners at all Big 8 firms. Anderson Consulting became a separate entity in 1987 (now Accenture, a public company trading on the NYSE).

A major fear of regulators was what is called lack of independence (a significant ethics issue). An audit client buying lots of consulting services might expect a “friendly audit.” Would the lead audit partner insist on more conservative accounting when giving up a client would mean not only forsaking audit fees but also lucrative tax and consulting fees? Various fraud cases such as Enron—audited by Andersen—suggested independence as a major problem. On the other hand, accounting research on this topic generally did not find a statistically significant correlation.¹⁰

Audit Legal Responsibilities and Regulation

Auditors have almost always worked for their clients and, although subject to client lawsuits for fraud and breach of contract, had little public liability. In 1931 the Ultramares case added gross negligence to the auditor liability list. The auditor, Touche Niven, did not discover ongoing fraud at client Fred Stern and the courts found Touche’s audit negligent but not fraudulent—enough to make the firm liable to creditor Ultrameres. The Securities Acts of the 1930s included liability provisions under Section 10b-5, which made fraudulent practices associated with the purchase of corporate securities illegal. The 1970 Continental Vending Case demonstrated that compliance to GAAP was not a complete defense if the court found that further evidence was needed. In this case, improper activities were not disclosed by the auditor, Lybrand, Ross Bros. and Montgomery. On the other hand, in Ernst & Ernst v Hochfelder (1976) the auditor (Ernst & Ernst) did not disclose a fraudulent escrow account; however, the Supreme Court ruled Ernst & Ernst did not violate Rule 10b-5 of the securities rules, because there was no proof the auditor intended to deceive; that is, the auditor was not liable based on negligence alone.

When the government bailed out Lockheed in 1971 by guarantying bank loans, the Emergency Loan Guarantee Board was established to monitor Lockheed. The Board discovered substantial bribes by the company to foreigners for military contracts (including West Germany, Netherlands, and Saudi Arabia). Executive resignations and Congressional hearings followed. The SEC investigated and found some 400 companies admitting to bribery and other illegal payments involving foreigners. The Foreign Corrupt Practices Act was passed in 1977, which banned U.S. companies from making bribes or other illegal payments to foreign officials for business. Of particular importance to auditors was the additional requirement for adequate internal controls. Auditor responsibilities expanded to eliminate the possibility of bribery and ensuring adequate internal controls of corporations was part of the process.

Other fraud cases popped up. Equity Funding and Sterling Homex both declared bankruptcy in the early 1970s. Equity Funding was a massive computer fraud of insurance companies using bogus policies inserted into the computer system, again discovered by a whistleblower. Modular homebuilder Sterling Homex bribed union officials for favorable contracts. These and other corruption cases led the AICPA to appoint a Commission on Auditors’ Responsibilities in 1974 headed by former SEC Chairman Manuel Cohen. A major finding of the Cohen Commission was an “expectations gap” in investor perceptions of auditor performance—basically, auditors did not claim they could detect fraud, while investors thought they should. Congress was equally interested with sub-committee investigations by Representative John Moss (federal regulatory agencies) and Senator Lee Metcalf (the accounting profession). Both issued reports critical of the profession.

Other regulatory problems of the 1970s included the view of both the Justice Department and FTC that the accounting profession was uncompetitive. Under federal pressure, the AICPA lifted the ban on competitive bidding for clients. Also under Justice Department pressure, the ban on direct advertising and solicitation of clients was lifted in 1979. Result included unintended consequences: greatly increased competition, but possibly at the expense of “professional integrity.” Increasingly, the audit became viewed as a commodity leading to the idea that auditors should be chosen based on low bid (also called price leadership). Auditors submitted very low bid to attract new clients (called “low-balling”). Almost simultaneously, lucrative consulting practices (most often revolving around sophisticated computer and information technology practices) were developed by accounting firms, with increased revenues from nonaudit fees swamping audit practice. Auditor independence became a growing concern to accounting regulators as auditors sought new clients to sell them nonaudit services. Enron becoming a prime example, with more revenue generated from consulting than the financial audit. According to Stephen Zeff: “By 1980, deterioration in professional values appears to have set in.”¹¹

Rising litigation costs added to accountants’ woes and generated bad publicity. A break came because of a 1994 Supreme Court case (Bank of Denver v. First Interstate Bank of Denver), limiting the ability of plain-tiffs to sue investment banks as well as accounting firms and attorneys from secondary liability in fraud cases. Even more important was the Private Securities Litigation Reform Act of 1995 after intense political lobbying, which changed the litigation rules under the federal securities laws. The result per Zeff (2003–2) was auditors allowing more aggressive accounting and possibly doing less work in a typical audit.¹²

The new millennium ushered in a period of chaos, with the collapse of the tech bubble, a crashing stock market and recession. The tech boom of the 1990s had been fueled in part by aggressive accounting and lax auditing. Multiple frauds and evidence of widespread corruption shocked America starting with the collapse of Enron in late 2001—at the time the largest bankruptcy in American history. Enron’s auditor, Arthur Andersen, collapsed after being indicted by the Justice Department. Congressional hearings followed almost immediately. New securities legislation stalled in Congress—until the collapse of WorldCom in mid-2002 because of multibillion-dollar fraud, the new largest bankruptcy in America.

After that, stringent federal regulation was guaranteed, specifically the SOX, the major reform bill to securities law since the New Deal. Provisions affected auditors bigtime, including the creation of a new federal audit regulator, the PCAOB. Other provisions expanded funding for the SEC and other regulators, plus new corporate governance rules and other requirements. SOX and new PCAOB rules resulted in major audit changes. The auditor was required to issue a report on internal control in the 10-K, in addition to the regular auditor’s opinion. This proved extremely costly in the early years, as auditors spent considerable extra time evaluating interest control procedures and firms had to improve control standards to avoid the reporting of “material weaknesses.”¹³ The PCAOB establishes auditing standards; some 18 as of 2015 plus a multitude of “interim standards.” The Board requires registration of audit firms who want to audit public corporations, inspects audit and quality control, and investigates possible misdeeds and can issue disciplinary actions for violations of laws and professional standards. The Board also issues ethics and independence rules, as well as quality control standards.

Internal Auditing

While this chapter focused mainly on external financial audits, other types of audits are important, particularly internal audits (IAs). IAs are audit-related activities done by organization employees including assurance services, consulting, and other assigned activities. IA departments should be independent, providing systematic and professional skills to improve the internal controls, compliance with laws, regulations, and governance processes, while reducing management risk levels. The scope of IA is determined by management and the governing board (subject to existing rules and regulations), preferably ultimately subject to the audit committee of the government board. Practices can include diverse functions such as compliance audits, internal control reviews, program (economy, efficiency, and effectiveness) audits, risk management assurances, best practices analysis, and fraud detection.

After the bankruptcies of Enron and WorldCom (where IAs played an important part), fraud detection and internal control analysis became more urgent. Many of the requirements of Sarbanes-Oxley were delegated to IA, including internal control reviews, risk management, and corporate governance analysis. IAs typically do activities related to financial audits and often provide both documentation and direct assistance to external auditors.

The history of IA as a separate profession started after World War II, with Lawrence Sawyer, an attorney with experience at the Government Accountability Office (GAO) and aerospace industry and author of numerous IA books and articles, considered the “father of modern internal auditing.”¹⁴ The Institute of Internal Auditors (IIA, founded in 1941 as a nongovernment organization or NGO) is the international standard-setting body for IA professionals with 185,000 members in 190 countries. The IIA awards the Certified of Internal Auditor designation (CIA), which demonstrates professional knowledge of IA. IIA has a professional practices framework, including a code of ethics (stressing integrity, objectivity, confidentiality, and competence), IA standards, and practice guides.¹⁵