In December the Office of the Comptroller of the Currency announced that Comptroller John Dugan had found that Grant Thornton LLP acted recklessly in its auditing of First National Bank of Keystone.
According to Mr. Dugan, Grant Thornton participated in unsafe and unsound practices by recklessly failing to comply with general accepted auditing standards in planning and conducting an audit of Keystone's 1998 financial statements. Among the issues raised at the administrative hearing in this matter were Grant Thornton's alleged failure to follow up and confirm the existence of bank assets, and its allegedly crossing the line from auditor to advocate for the bank and its staff.
The implications of the Grant Thornton decision are mixed. The standard that the regulators must meet in bringing an enforcement action against a third-party consultant, accountant, or attorney - conduct that constitutes "disregard of, and evidencing a conscious indifference to, a known or obvious risk of substantial harm" - is subjective. Though the regulators must measure the respondent's conduct against an established standard of care, determining how much deviation from that standard constitutes an unsafe and unsound practice is up to the examiners.
Ultimately, as practitioners and industry leaders have come to realize, what constitutes an unsafe and unsound practice is whatever the examiners say it is. This case is limited in providing insight on what regulators will view as reckless conduct by auditors and attorneys, because such cases are context-specific.
The two major failures of Grant Thornton in this case were its failure to exercise professional skepticism and its failure to maintain appropriate independence. This decision shows the OCC's resolve (which may encourage other regulators to bring similar actions) to pursue auditors and attorneys who fail to exercise appropriate independence when the circumstances warrant.
In the post-Sarbanes-Oxley environment, the requirement for professional skepticism and independence is more important than ever for independent auditors and for attorneys conducting internal investigations.
Whether the investigations are pursuant to Section 10A of the Exchange Act or other requirements, increasingly auditors are forced to assume the role of quasi-examiners, as bank examiners rely on audit reports as a supplement to their own reports. This is especially true as institutions expand their range of products, services, and technologies.
Grant Thornton argued that it was not the auditors' responsibility to detect fraud by bank insiders, and that expecting the auditors to do so was unreasonable, particularly because the fraud also escaped detection by OCC examiners.
In rejecting this argument, the OCC seems to favor a view that where examiners find deficient internal controls, and the auditors have not otherwise cited such in their report, the examiners may conclude that the failure to discover imprudent practices or even violations of law may reflect a failure in the audit process generally - which may invite an enforcement action.
This same focus on maintaining independence appears when attorneys are brought in, either by the bank or at the urging of an outside auditor, to conduct an internal investigation. Recent trends, coupled with the OCC's decision in the Grant Thornton matter, illustrate that regulators increasingly will scrutinize whether an investigating counsel maintains the appropriate degree of skepticism and independence.
Failure to exercise that independence, particularly where the counsel concludes that no misconduct or violations occurred, may subject that counsel to additional risk.
The Grant Thornton decision reinforces the trend toward increased scrutiny of independent auditor and attorney review of institutions, particularly in that such parties, when issuing reports of internal investigation, are likely to become increasingly averse to rendering unqualified opinions indicating the complete absence of suspected misconduct, violations of law, or unsafe and unsound practices.
Though this may help increase the diligence of auditors and attorneys in ferreting out fraud, it also may create increased costs for institutions in ordering investigations of matters that otherwise might have been addressed internally or resolved informally with bank examiners.
