Regulators have delivered a warning shot that companies and auditors need to be more careful about the personal relationships that develop in the course of the audit, as they could cross the line and impinge the auditor’s independence.

Two related, yet slightly different, enforcement actions by the Securities and Exchange Commission should give audit committees new incentive to ask more questions about the relationships between external auditors and the corporate accounting and finance personnel with whom they work closely. Across the two cases, the SEC collected penalties of more than $9 million from EY, three of its former partners, and a former corporate accounting officer, all accused of engaging in or overlooking relationships that tainted independence.

In one case, disclosed to investors as soon as the issue erupted, EY discovered the engagement partner assigned to the audit of Ventas, a real estate investment trust, was involved in a romantic relationship with the company’s chief accounting officer. EY withdrew its audit opinions for two years and the company hired another firm to perform new audits, which uncovered no accounting anomalies.

In the second case, although the SEC does not allege any romance, the enforcement release devotes more than two pages to the extravagance and detail of the social relationship between another EY partner and the chief financial officer at an unnamed company. While the SEC did not name the company involved here, it was Universal American, a healthcare company. Universal American didn’t disclose the issue with its 8-K announcing a change in auditors, but instead revealed it several months later with a paragraph in its year-end 10-K.

The activity cited between EY’s partner and Universal American’s CFO went well beyond the occasional dinner or round of golf to include numerous high-end sporting events, trips, family vacations, and overnight stays at one another’s homes.

Research into the details reveals EY did not withdraw its audit opinion in that case, but assigned a new engagement partner and performed some re-audit work to clean up the independence breach.

“This might be the first time the SEC has not tied a case to a specific independence violation. They are relying on the overall principal.”

Tammy Bieber, Partner, Thompson Hine

The Ventas and Universal American cases differ from typical SEC enforcements that involve inappropriate financial relationships, says Nancy Reimer, an attorney with law firm LeClairRyan. “They did cross the line,” she says. “You might have a business relationship with someone where you might have lunch or dinner, play golf, or go to a charity event,” she says. “This went beyond that. They were acting more like you’d expect close friends to act. In business relationships, families don’t go on vacations together.”

EY FAILS TO ACT

An excerpt from the SEC Administrative Order/Bednar below describes how EY failed to act on red flags in regard to Bednar’s relationship with the chief financial officer.
EY partners other than Bednar, including EY partners senior to Bednar, were made aware of certain facts related to Bednar’s entertainment expenses and his relationship with the CFO during the relevant time period.
For example, in October 2012, two senior EY partners—one the head of Bednar’s practice group and Bednar’s immediate manager (“Senior Partner A”), and the other a senior partner with national management responsibilities (“Senior Partner B”)—learned that Bednar’s expense spending was “by far the highest in the practice,” after Bednar sought their help in obtaining reimbursement for certain spousal travel unrelated to the Issuer. Senior Partner B asked Senior Partner A to “get a better understanding of [Bednar’s] spending . . . and the market impact it’s having.”
Thereafter, Senior Partner A sent Bednar an email with the subject line “Controllable expenses” that attached a spreadsheet titled “Bednar Q1 FY13.” The spreadsheet reflected total expenses, across all of Bednar’s audit engagements, of $80,359; $31,852 of these expenses were for “Entertainment” associated with several clients, including the Issuer. The spreadsheet stated, “The top Spender in all of FSO ASU [Assurance]–total spend is double the next highest individual.” Senior Partner A then spoke to Bednar about reducing his expense spending. Bednar claimed that the large volume of expenses was due in part to the fact that he was catching up on submitting older expenses. Neither Senior Partner A nor Senior Partner B inquired into whether these levels of expenditures could suggest a violation of EY’s policies or the existence of an inappropriate personal relationship with any of Bednar’s audit clients.
In addition, one of the engagement partners on the audit team was aware of at least four overnight, out-of-town trips that Bednar and the CFO took together, some of which included members of the CFO’s family. This engagement partner attended one of these trips.
The same engagement partner received information regarding Bednar’s entertainment spending in connection with the Issuer’s audits. Specifically, in September 2014, a senior Issuer employee who worked for the CFO asked EY for more detail on the expenses it was billing to the Issuer. The senior manager on the engagement team sent the Issuer a four-line expense summary table showing the total amount owed divided into three sub-categories: transportation, lodging, and meals. The Issuer responded that the table was too summarized and asked for a replacement showing the expenses incurred by each member of the engagement team.
Bednar, the engagement partner, and the senior manager then reviewed a spreadsheet showing all of the expenses charged bythe engagement team to the 2014 audit code. The spreadsheet contained four tabs, including a summary tab that broke out the expenses incurred by each engagement team member into 17 different categories, including “entertainment” and “lodging.” The summary tab showed that Bednar had already charged more than $18,000 in expenses coded as “entertainment” to the 2014 audit code, although some of these expenses had in fact been incurred during the prior audit period. Neither the engagement partner nor the senior manager inquired as to whether Bednar’s level of entertainment-related spending complied with EY’s independence policy or alerted others at EY.
After reviewing this spreadsheet, the engagement team created a new spreadsheet to provide to the Issuer. As requested, the new spreadsheet broke out the expenses incurred by each engagement team member across the three categories previously provided: transportation, meals, and lodging. It also included a fourth category called “Summit,” which referred to an offsite finance meeting between EY and the Issuer. Expenses classified as “entertainment” expenses in the internal EY spreadsheet were classified as “meals” in the spreadsheet given to the Issuer. The senior manager then sent the new spreadsheet to the Issuer.
The Issuer responded with five questions about the expenses, including the following: “Greg [Bednar] has $32k in expenses, but only $2,400 is the Summit. Seems really high, given he has not been in [the Issuer’s headquarters] too often over the last few months. What is in here?” The senior manager forwarded the Issuer’s email to Bednar and the engagement partner, saying, “I’ll work on the responses but just wanted to share.” The senior manager, however, never responded to the Issuer, and neither Bednar nor the engagement partner followed up.
In February 2015, the engagement partner and members of EY’s management were again alerted to Bednar’s excessive client entertainment spending. On February 7, 2015, Bednar wrote an email to the invitees of the planned April 2015 trip to attend the Masters golf tournament. Among the recipients was the engagement partner who had reviewed the spreadsheet listing the engagement team’s (including Bednar’s) expenses five months earlier. After explaining that he was going to rent three houses for all of the invitees to stay in, Bednar said that he would “pick up the tickets for the Wednesday round under the guise of this being a ‘business’ meeting.”
On February 12, 2015, Bednar wrote an email to Senior Partner A and another senior EY partner with regional management responsibilities (“Senior Partner C”)to inform them about the planned April2015 trip to the Masters. Bednar explained that he had invited 13 people, including the CFO, the CFO’s wife, the CFO’s son, the engagement partner, the engagement partner’s spouse, and other clients; that he had rented three houses for the trip; and that he had decided to turn it into a client event in addition to celebrating the retirement of the CFO. Bednar asked if EY would help pay for the tickets, but that he didn’t “want to create an issue if you think it would raise eyebrows.”
Senior Partner C responded by saying that EY would not be able to pay for the tickets, but thanked Bednar for his “continued focus on building long lasting client relationships.” He then apologized for not being able to help, writing “it sounds like a great event.” Neither Senior Partner A nor Senior Partner C questioned Bednar about the level of his expense spending or his relationship with the CFO, nor did they take any other steps to ensure that Bednar was complying with EY’s independence policies.
Between 2012 and 2015, EY also had access to certain facts about Bednar’s entertainment of, and relationship with, the CFO as a result of Bednar’s entertainment expense submissions to the Firm’s time and expense system. Although some of Bednar’s expense submissions contained certain incorrect information, these expense submissions, when taken together, constituted red flags that Bednar was violating EY’s independence and gift and hospitality policies. EY did not, however, review Bednar’s or other partners’ aggregate entertainment expenses to ensure compliance with its independence policies during the relevant period. Similarly, while EY generated certain expense summaries by region, it did not maintain any systems that would alert the Firm when a partner’s entertainment expenses reached aberrational levels or were improperly charged to a billable client account.
Source: SEC

In some respects, the audit committee in such situations is a bit hostage to the determinations of the audit firm with respect to its ability to remain independent. “The audit committee is poorly suited to do these kinds of analyses of what’s appropriate activity and what’s over the line,” says Matthew Stock, an attorney with Zuckerman Law. “The burden is really on the external audit firm to maintain its independence, but this can have a huge impact on the company.”

The Universal American case in particular demonstrates the opposing forces on auditors, who are bound to serve investor interests yet are being paid by the entities they audit, says Tom Ray, who teaches accounting at Baruch College and is a former chief auditor at the Public Company Accounting Oversight Board. In that case, the SEC says the engagement partner was specifically tasked by EY to improve the relationship with the client because it was regarded as a troubled account. “It highlights that tension that exists in the firm to both retain clients and provide a good service, yet at the same time trying to maintain that independent attitude when performing the audit,” he says.

That makes it all the more important for audit committees to take a more proactive position with respect to policing the relationships between auditors and company personnel, says Stock. Audit committees should be asking for information about the relationships, viewing the details through the lens of whether a reasonable investor would consider any of it important when making investment decisions. “From my point of view, that’s a good gut check,” he says.

The SEC seemed to send that signal, in fact, with the nature of the charges in both the EY independence violations, says Tammy Bieber, a partner at Thompson Hine. “This might be the first time the SEC has not tied a case to a specific independence violation,” she says. “They are relying on the overall principal.”

In a case like Universal American, where much of the cost of the social activity was passed on to the company, audit committees can study those charges and ask questions. “It was on the high end of expenses, so you try to kick those tires,” says Bieber.

But the costs associated with social activities may not necessarily be billed to the company, leaving the audit committee to resort to other means. That could even inspire the more proactive audit committee to require company personnel to report on its social engagements to enable monitoring. Audit firms are supposed to police that kind of activity, but nothing prevents audit committees from instituting their own processes.

In terms of identifying behaviors that cross the line, however, that will remain a judgment call, says Cathy Allen, an auditor independence consultant who formerly worked in the national office of a Big 4 firm.. “The SEC is not going to give you a direct answer on that,” she says. “It’s a reasonableness test. It depends on the facts and circumstances.”

The dialogue between the audit committee and the company’s financial reporting personnel and auditors is critical to exposing indicators of close relationships that the audit committee needs to consider. “The people on the audit committee are representing the public interest or the investor perspective, so they have to air that,” says Allen.

Audit committees need to be mindful not only of a clear breach of independence, but even the appearance of independence, Allen says. “People in the profession don’t always take that as seriously as they should,” she says.