All financial institutions must hire an outside CPA firm to audit their financial statements as well as the accounting information system and controls that affect those statements. The relationship between the bank and the external consultant can be mutually beneficial–but only if the bank goes about selecting, hiring and working with the CPA firm in a systematic and effective way.
What You Should Expect–and Receive–From Your CPA
The CPA firm you hire should have industry expertise that is specifically targeted to financial institutions the size and complexity of yours, and the firm should have experience and expertise in your major lines of business. You should also expect the firm’s CPAs to have a deep knowledge of SEC regulations and professional standards such as those issued by the PCAOB.
In addition, you need to be confident that your CPA firm understands the broad spectrum of risks facing your bank, including the potential exposure and return of each. An understanding and audit of the tools that management uses to monitor the bank’s performance results is also essential.
It’s important for you to recognize the difference between your bank’s problems and the auditor’s problems. Don’t expect the auditors to take responsibility for problems that are actually management’s issues to deal with. Doing so only invites delays and a loss of independence on the part of the auditor.
The ideal CPA firm focuses on relationships. The external audit team needs to communicate and work well with the bank’s team. On both sides, clear and informative discussions upfront about roles, timelines, methodologies, controls testing, documentation and the like will go a long way toward ensuring smooth and efficient planning, auditing and reporting process. The audit team also needs to be able to communicate effectively with the bank’s audit committee as well as management.
The Match Game
When contemplating hiring a CPA firm, you must first define your objectives. Understand and communicate the scope of what you expect the firm to do. You can select the appropriate firm only if you know your own organization well–its business, community, management strategy, performance and risks. Think long and hard about the nature of your institution’s risks, and then seek a consultant whose strengths match up with those risks.
Meet face to face with representatives of firms you are considering hiring. Read reports, ask penetrating questions and compare what they say with your understanding of the CPA firm’s reputation, skill set, and culture. Provide input and a balanced approach. Follow through in providing direction to the organization. Think through the cause and effect of problems your institution faces and use the consultants you interview to confirm your conclusions. Act on the recommendations.
You Have Rights
You have the right to continue to be involved and receive clear communication from the consultants throughout the audit and reporting process. You also have the right to receive advance warning from the CPA firm of possible problems.
Take the time to understand the auditors’ perception of the risk profile of your bank and their conclusions about management, and ask questions if you don’t.
Changing Standards, Changing Role
The best-in-class banks anticipate tomorrow’s standards by which today’s actions will be judged. The ubiquitous implementation of enterprise risk management programs in recent years should not have been a surprise given all the chatter of the past several years. And in the near future? Our crystal ball says that “stress testing” will be required soon, so now is the time to embrace it.
The Center for Audit Quality and other groups are looking into the auditor’s role, which we expect to change just as it has done before–particularly in the aftermath of the thrift industry crisis (which led to the Federal Deposit Insurance Corporation Improvement Act) and the major corporate and accounting scandals of the 1990s (which led to Sarbanes-Oxley). Look for greater CPA involvement in10-Ks, and in risk factor disclosure in 10-Ks/Qs and MD&A.
More big changes might be on the horizon, particularly for privately held companies, in light of the analysis of the report of the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committee, an analysis indicating that audit committee effectiveness depends on independence and the number of meetings.
Collaboration, Not Confrontation
A good working relationship between your team and the external audit team will enhance the financial reporting process, reduce surprises and generally make everyone’s life easier.