More on Embedding, Automating Controls

Last week I had a post about an SEC enforcement action against rent-to-own retailer Conn’s, where the SEC dinged Conn’s for using manually updated forecasting tools to estimate customer credit risk. Executives had low-balled their estimates for years, until that short-sighted maneuver finally forced the company to cut earnings and the share price tanked.

Today I want to explore further how a company can avoid such a trap — because that first post generated a considerable bit of feedback from other compliance and audit executives, who raised some great points about effective internal control.

First was a quip from Dan Ramey, forensics accountant and accounting professor at the University of Houston, who said, “Just a case of good ol’ earnings management!” 

Ramey packed a lot of insight into that wisecrack. The issue at Conn’s was that senior executives designed a forecasting model that let them manually estimate the company’s “roll rate.” That’s the percentage of customers whose credit card balances with Conn’s might roll from one category of delinquency into a more serious category. 

The higher the roll rate, the more money a firm should set aside as an allowance for doubtful accounts. In a perfect world, the future roll rate should be determined automatically, by looking at actual roll rates from prior periods. And with modern financial software, there’s no reason a large company can’t configure its systems that way.

Except, per Ramey’s point, if you want the ability to manage earnings, you need a manual system that relies on executive judgment. With a system like that, you can embed the ability to manage earnings from the start. On the other hand, if financial systems generate the roll rate automatically, management can only alter that rate via an override — which is a more public decision, harder to hide than low-balling a financial metric from the whole cloth. 

An override says management believes its judgment is better than what the data tells you the answer should be. An override can be subject to more scrutiny, especially by an auditor who could re-run the same automated calculations and find the original roll rate; and then start asking for evidence of why management believed its gut instinct trumped the data.

So Ramey’s quip actually brings the relationship between manual controls and earnings management into sharp relief. As he suggests, the concept isn’t new. The solution might not always be easy to implement, but it is clear to see.

Controls to Resist Temptation

Then came another comment from Terry Thompson, a seasoned chief audit executive who lives in Atlanta. He, too, started by pointing out the obvious:

I’m sure these intelligent people knew that shooting from the hip instead of establishing a sustainable, defensible standard was bad for business and would eventually catch up with them.  So I have to ask: What did their incentive plans look like? What actions were taken against all individuals responsible for these decisions? At the end of the day, the penalties have to outweigh the self-interests and benefits.

Thompson’s comment points toward a much larger issue: a company’s control environment, and how to design business processes and internal controls to support that environment.

Manual controls put more power in the hands of people — and as Thompson suggests above, once people have some amount of power to exercise, they tend to exercise it in their self-interest.

That’s human nature. As much as individuals strive to rise above petty self-interest, we all fail at that lofty goal from time to time, and some of us fail at that goal many times. So business processes, and the internal controls that govern them, need to be designed to block us from that temptation to act in our self-interest.

In practice, that would look like executives sitting at a conference table, saying: “One of our ethical principles is integrity and honest in our financial reporting. So we need to design our systems to be as data-driven as possible, where they force us to reach logical, irrefutable decisions.” Then the company can build its accounting processes and systems to achieve that goal.

That’s how you connect abstract ideas about ethics and a strong control environment to real, practical systems and control activities. You make an ethical commitment to reduce your own ability to commit misconduct, and then design systems and controls that build such a barrier right into the business process.

Auditors, Anyone?

Hal Garyn, who has more than 20 years’ experience in corporate auditing, chimed in from Orlando with another simple yet important point: “And where were the external and internal auditors during all this?”

Well, we don’t know. The SEC complaint against Conn’s doesn’t address that point. Perhaps Conn’s had no internal audit function at the time, or maybe internal audit was occupied with other issues. In a press release last week, Conn’s did stress that the executives involved with the roll rate mess are no longer with the company, and “we have transformed Conn’s since that time period.” OK, we’ll say no more about internal audit shortcomings here. 

I don’t know that we can be so charitable with Conn’s external audit firm, Ernst & Young. E&Y gave Conn’s clean audit reports for the years in question (2012-2014), for both the company’s financial statements and its internal control over financial reporting. E&Y continues as Conn’s audit firm to this day, and has never flagged any concerns about the company’s financial reporting — despite clear warning signs in Conn’s delinquent accounts in the mid-2010s, which ultimately led to a cut of $0.08 EPS in 2015. 

Still, let’s not lose sight of who’s really responsible for this mess: the Conn’s executives who ran the business in the early part of this decade, and designed a control system that allowed them too much temptation. 

It’s good to have ethics; it’s good to have controls. But unless you design those controls to force you as much as possible to adhere to those ethics, you create opportunity for situations like what we saw with Conn’s. 

And when you leave an opportunity like that lying around long enough, someone will take it.