United States General Accounting OfEce 

Testimony 

. 

For Release 

on Delivery 

Expected at 

1O:OO a.m. EST 

Tuesday 

February 21, 1989 

The Need To Improve Auditing 

in the Savings and Loan Industry 

Statement of 

Frederick D. Wolf, Assistant Comptroller General 

Accounting and Financial Management Division 

Before the 

Committee on Banking, Finance and Urban Affairs 

House of Representatives 

ML91 

GAO/T-AFMD-89-2 I GAO Fam la0 (U/87) 
Mr . Chairman and Members of the Committee: 

We appreciate the opportunity to be here today to discuss 

auditing in'the savings and loan (S&L) industry and our recent 

report to you entitled, CPA Audit Quality: Failures of CPA 

Audits to Identify and Report Siqnificant Savinqs and Loan 

Problems (GAO/AFMD-89-45, February 2, 1989). Today, we would 

like to address 

--the auditing problems we found during the course of our 

review, 

--the recommendations we are making to the public 

accounting profession to address those problems and bring 

about improvements in the overall quality of S&L auditing, 

and 

--suggestions we have to this committee to help strengthen 

the role of auditing as an effective regulatory and 

oversight tool. 

AUDITING PROBLEMS 

At the request of your committee, we reviewed the quality of 

audits of S&Ls in the Dallas Federal Home Loan Bank District. 

Our review focused on the most recent audits performed by 

1 
independent certified public accountants (CPAs) of 11 S&Ls out 

of a total of 29 S&Ls which failed in the Dallas district during 

the period January 1, 1985, to September 30, 1987. 

The latest audit reports for the 11 S&Ls before they failed 

showed combined positive net worth totaling approximately 

$44 million. At the time of the S&Ls' failures, which ranged 

from 5 to 17 months after the date of the last audit reports, the 

11 S&Ls had combined negative net worth totaling approximately 

$1.5 billion. 

We concluded that for 6 of the 11 S&Ls, CPAs did not always 

audit and/or report the S&Ls' financial or internal control 

problems in accordance with professional standards. The 

problems essentially fell into two areas: (1) CPAs did not 

adequately evaluate whether S&Ls could collect on their 

outstanding loans and (2) CPAs did not adequately report on S&Ls' 

financial, regulatory, and internal control problems. The 

problems the S&Ls in our review were experiencing were similar to 

the problems we' have found in other failed S&Ls. 

While audit problems do not cause S&L failures, audits do 

play an important role in the regulatory and oversight process. 

They are an integral part of the system of controls designed to 

identify and report problems in S&Ls when those problems first 

arise, so that timely corrective action can be taken to resolve 

2 
them. 

It is imperative that we have an accurate, reliable gauge on 

. 

the extent of the financial problems in the S&L industry. If 

this committee, federal regulators, and others are to resolve 

the industry's Current Crisis, audit reports must be able to 

fully describe the significant financial problems. Otherwise, 

existing problems may continue to go undetected. 

Although all of the problems we found were not necessarily 

of the same magnitude, we believe they were all significant 

enough to bring to the attention of this committee, the public 

accounting profession, and regulatory and oversight bodies such 

as the Federal Home Loan Bank Board. Resolving the problems we 

identified should provide the opportunity to help ensure that 

future CPA audits of S&Ls will be performed in a quality manner. 

Fieldwork Problems 

I will briefly summarize the problem areas we identified. 

1. Evaluation of hiqh-risk loans. Many S&Ls over the past 

decade have moved away from traditional home mortgages 

and into concentrations in riskier land and 

acquisition, development, and construction (ADC) 

projects. CPAs in our review did not always have 

3 
evidence that they adequately recognized and evaluated 

the financial risks that such projects posed to S&Ls. 

. 

2. Identification of loan problems. In the mid-1980s, 

many ShLs began experiencing problems in collecting on 

their ADC loans, many of which were "balloon" type 

loans in which the entire principal and interest became 

due at once, usually 2 to 4 years after the loan was 

first granted. To avoid default, in many cases problem 

loans were renewed or restructured. The CPA firms in 

our review did not always identify or adequately 

evaluate the financial effect or risk of these 

restructured loans. 

3. Verification of manaqement assertions. In many cases, 

management of troubled S&Ls contended that problem 

loans were collectible or, in the cases of default, 

that collateral underlying the loans was sufficient to 

cover the outstanding loan balance. Standards require 

auditors to obtain independent corroboration that key 

management assertions are true--often a timeconsuming but necessary audit function. However, the 

CPAs in our review did not always perform this 

function and, instead, often relied on management's 

unsubstantiated oral assertions that problem loans were 

collectible. 
4. ~0110~ up on examiners' findinqs. Federally insured 

S&LS are subject to examination by the Federal Home 

Loan Banks' auditors. These examinations are made 

primarily to help federal regulators know whether S&Ls 

are managed properly and whether they comply with 

federal regulations. They also provide useful 

information to a CPA who is issuing an opinion on the 

fairness of the financial statements. We identified 

cases where the auditor did not follow up on those 

problems which were identified by examiners and which 

we believe cast doubt on the S&L's financial 

statements. 

Reportinq Problems 

In the area of reporting, CPAs did not always disclose 

certain problems, which we believe might have affected the 

usefulness of financial statements to others. These include the 

following: 

1. Improper accountinq practices. In two cases in our 

review, CPAs did not point out in their audit reports 

that their S&L clients had materially misstated their 

income. In one of those cases, the S&L client had lost 

four times as much money as it had reported in its 

5 
financial statements for that year. 

2. Regulatory violat ions. In some cases, CPAs did not 

. 

report serious regulatory violations, such as excessive 

loans to single borrowers and formal cease and desist 

or similar orders by regulators. Thus, report users 

were unaware of those operating risks and the 

corresponding potential regulatory actions, all of 

which may have impacted the S&Ls' operations. 

3. Insider loans. Extensive amounts in loans to 

shareholders or other "insiders" went undisclosed in 

some of the cases in our review, leaving report users 

unaware of the potential financial effects of relatedparty influences. 

4. Risk and limited qeoqraphic concentrations. The risks 

inherent in high concentrations of loan activity in 

limited geographic areas or loan t:lpes which had 

experienced economic difficulties were not always fully 

disclosed to readers of the audit reports in our 

review. 

5. Internal control problems. Management and internal 

control problems have been cited by GAO and others as a 

leading cause of S&L failures. Although the auditors 

6 
in our review were aware of material internal control 

problems at the S&Ls in our review, they often did not 

report on those problems or characterize them as being 

. 

material. 

THE PUBLIC ACCOUNTING PROFESSION 

CAN IMPROVE S&L AUDITING 

The American Institute of CPAs (AICPA), the most important 

professional group in the area of public auditing, can take the 

lead in addressing and resolving the kinds of auditing problems 

noted in our review. While the auditing problems we found are 

significant, we believe that they can be corrected. Accordingly, 

we made two overall recommendations to the AICPA to help improve 

the quality of S&L auditing. 

First, we recommended that the AICPA revise its guidance for 

auditing S&Ls. The current S&L audit guide is outdated and does 

not adequately address a number of areas for ensuring that S&L 

audits are properly performed. We believe that the AICPA should 

move qui.;kly to revise the S&L guide to include detailed 

discussion and specific requirements for, among other things, 

--identifying the nature and inherent risks of land and ADC 

loans, 

--evaluating the potential effects of increases in 

7 
restructured and past-due loans, 

--following up on the work of federal examiners, 

--ensuring that regulatory violations and formal regulatory 

. 

actions are disclosed, and 

--properly reporting all material weaknesses in internal 

controls. 

Second, we recommended that the AICPA communicate the 

results of our review and bring to the attention of its members 

any other recently noted S&L problems. Such communication should 

include discussion of the types of problems that may occur in 

auditing S&Ls and should require that 

--staff performing S&L audits have sufficient knowledge of 

S&L operations, 

--auc-t methodologies be specifically tailored to take into 

account changes in the operations of their individual S&L 

clients and the S&L industry environment, 

--evidence of all audit work be properly documented in the 

working papers, and 

--financial risks, regulatory violations and formal 

regulatory actions, and internal control weaknesses be 

fully disclosed in audit reports. 

We think that an effective way for the AICPA to develop and 

successfully implement our .recommendations would be to establish 

8 
formally a project team or task force which would be charged with 

developing a comprehensive action plan to see that real 

improvements are brought about in the quality of S&L auditing. 

The AICPA might consider a task force similar to the one it 

established in 1985 to address problems GAO noted in the quality 

of CPA audits of governmental entities. 

Response by the AICPA 

In the past, the public accounting profession has 

demonstrated its ability to bring about needed changes and 

improvements in accounting and auditing. The profession has 

responded to suggestions and recommendations GAO has made to help 

strengthen guidance and controls for improving the quality and 

effectiveness of auditing. 

In the case of S&L audits, we believe that the profession 

can and will move expeditiously to ensure that S&L audits are 

performed in a quality manner. Discussions that we have had with 

representatives of the profession confirm that steps are being 

taken to ensure that our recommendations are implemented and that 

audit quality is improved. 

The AICPA, as well as this committee, needs to send a 

message to auditors that improper, ineffective, and inaccurate 

S&L audits cannot be tolerated. Auditors must clearly describe 

9 
the problems and risks facing S&Ls. Instead of bowing to any 

pressure from S&L clients or others to consider or present bestcase scenaiios, auditors should be instructed to exercise more 

professional skepticism when auditing and reporting on ScLs' 

financial statements. For example, when evaluating reserves for 

estimated loan losses, auditors should be as conservative as 

possible. If auditors are going to err, then it is better to err 

on the side of caution. Otherwise, we are likely to see some of 

the same problems we are discussing here today. 

STRENGTHENING THE ROLE OF AUDITING 

AS A REGULATORY AND OVERSIGHT TOOL 

Improving audit quality alone, however, will not provide all 

the answers to the question of how to make auditing an effective 

regulatory and oversight tool in the S&L industry. To maximize 

the benefits that can be achieved from auditing, it is necessary 

to ask auditors to do more than just opine on the financial 

statements. 

In this regard, we believe that CPA firms should be 

specifically required to report on S&Ls' internal controls and 

compliance with specific laws and regulations. Such a 

requirement would enhance the role of auditing as a regulatory 

and oversight tool by providing an early warning to federal 

regulators and others of management and systems problems that, if 

10 
not properly addressed, could contribute to financial failures. 

In January of this year, we testified before this committee 

that financial institution failures have often been associated 

with management-related problems such as serious internal control 

weaknesses, insider abuse and fraud, unresponsiveness to 

regulators, and disregard for the safety and soundness of 

financial operations.1 Our findings were consistent with those 

of others, such as the Office of the Comptroller of the Currency, 

which recently cited poor management as a driving force behind 

bank failures. 

We believe that any legislation designed to address 

federally insured financial institutions must underscore the 

importance of sound internal controls and specific compliance 

with laws and regulations and require publiz reporting of the 

same. In doing so, we believe that the regulatory and oversight 

process can be enhanced by drawing on the work of the independent 

auditor and by requiring that the independent auditor publicly 

report on management's internal control system and compliance 

with specific laws and regulations. 

Our position on this matter is consistent with our letter to 

lFailed Financial Institutions: Reasons, Costs, Remedies and 

Unresolved Issues, Statement of Frederick D. Wolf, Director, 

Accounting and Financial Management Division, before the 

Committee on Banking, Finance and Urban Affairs, House of 

Representatives, January 13, 1989. 

11 
this committee in August of last year in which we discussed 

broadening the responsibilities of independent auditors in any 

legislation.to provide new securities powers to banks. (See 

attachment.) In our letter we stated that an effective system 

of internal controls is essential to entities operating in 

today's complex and fast-moving financial markets. Since 

independent audits are an integral part of the regulatory and 

oversight process, reporting on internal controls and compliance 

with laws and regulations as part of these audits would greatly 

enhance their purpose and usefulness. 

As we stated in our letter, management should be required to 

prepare the report on internal controls and compliance with laws 

and regulations, with the independent auditor required to review 

and report on management's assertions regarding internal controls 

and compliance. During this review, the independent auditor 

should determine whether the entity has internal Tontrols to 

provide reasonable assurance that it complies with laws and 

regulations. The format of the reports by management and by the 

auditors could be designed by federal regulatory authorities, in 

consultation with GAO. 

Requiring internal control and compliance reviews and 

reports is not a new concept. The Securities and Exchange 

Commission has proposed rules that would require public companies 

to assess and report on their internal control systems. Also, 

12 
the Congress passed the Single Audit Act of 1984 (Public Law 98- 

502), which requires CPAs auditing state and local governments to 

evaluate ati report on internal controls and compliance. 

In the past, the AICPA has worked cooperatively with us and 

others in bringing about these types of constructive reporting 

changes. 

Mr. Chairman, auditing can-- and should--play a key role in 

helping to ensure the safety and soundness of federally insured 

S&LS. Our work, however, shows that significant improvements are 

needed to be able to fully rely on independent audits performed 

by CPAs. We believe those improvements can--and will--be made 

by the public accounting profession. Such improvements, 

combined with a broadening of the auditors' responsibilities for 

reviewing and reporting on internal controls and compliance with 

laws and regulations, can go a long way toward bringing about 

improvement in the regulation and oversight of the nation's S&L 

industry. 

This concludes my statement, Mr. Chairman. We will be 

pleased to respond to any questions you or the other members of 

the committee may have. 

13 
GAO I ctcd States 

General ACCOUnting Omce 

washington, D.C. 20538 

Accounting and Financial 

Management Dh-ision 

B-229444 

. 

August 5, 1988 

The Honorable Fernand J. St Germain 

Chairman, Committee on Banking, 

Finance and Urban Affairs 

House of Representatives 

Dear Mr. Chairman: 

We are writing this letter to discuss some items that we 

believe should be addressed in any legislation to provide 

new securities powers to banks. Specifically, while the 

proposed legislation (Depository Institutions Act of 1988) 

provides several "firewalls" and safeguards to ensure the 

safety and soundness of the nation's banks, we believe that 

two further items should be added to ensure that the 

safeguards are in place and are functioning properly. 

Current bank regulations do not require independent 

financial audits of all banks. We strongly urge that, if a 

bank or bank holding company has a securities affiliate, it 

should be required to obtain an annual independent audit of 

both the bank and securities entities' financial 

statements, regardless of any regulation that may allow it 

to do otherwise. The entity should Se required to submit 

these audit reports to the applicable bank regulatory 

agency. Such audits would provide an additional safeguard 

to ensure the securities affiliate's activities are not 

adversely affecting the banks and to ensure the safety and 

soundness of the nation's banking system. The Federal 

Deposit Insurance Corporation has been evaluating the audit 

issue as it relates to small banks. We recognize that an 

exemption from this requirement for small banks may be 

appropriate. However, the volume of securities 

transactions and other thresholds should be considered to 

ensure that a small bank with a significant level of 

securities activities is not exempt. 

In addition, while the proposed legislation requires the 

three bank regulatory agencies and the Securities and 

Exchange Commission (SEC) to establish a compliance 

monitoring program, we believe that it would also be 

beneficial to specifically require management to report on 

the adequacy of the entities' internal controls and on 

compliance with the firewall and safeguard provisions of 

this proposed legislation (and any applicable 

regulations). Moreover, as part of the annual financial 
ATTACHMENT ATTACHMENT 

0-2 294’4 4 

audik, independent auditors should be required to review 

and report on management’s assertions regarding internal 

controls and compliance. During this review, the 

independent auditor should determine whether the entity has 

internal controls to provide reasonable assurance that it 

complies with the act. 

An effective system of internal Controls is essential to 

banks and other entities operating in today’s complex and 

fast-moving financial markets. In this regard, our ongoing 

analyses of the factors contributing to the failures of 

banks and savings and loan associations, as well as a 

June 1988 Off ice of the Controller of the Currency report 

on national bank failures , clearly show that inadequate 

internal controls are a primary factor in the vast majority 

of those failures. Since financial audits are an integral 

part of the system of safeguards for banks and the banking 

system, reviewing internal Controls and compliance with the 

act as part of these audits would greatly enhance their 

purpose and usefulness. 

Requiring internal control and compliance reviews and 

reports is not a new concept. The SEC has recently issued 

for comment proposed rules that would require public 

companies to assess and report on their internal control 

systems. Also, in 1984, the Congress passed the Single 

Audit Act of 1984 (Public Law 98-502) , which requires most 

state and local government units to have independent 

audits. In addition to issuing an opinion on whether the 

financial statements present fairly the entity’s f lnancial 

position and results of operations in accordance with 

generally accepted accounting principles, as part of the 

audit, the auditor is also required to determine (and 

report on) whether: 

-- the entity has internal accounting and other control 

systems to provide reasonable assurance that it is 

managing its federal assistance programs in compliance 

with appl icable laws and regulations, and 

-- the entity has complied with laws and regulations that 

may have a material effect on its financial statements 

and on each major assistance program. 

Requirements similar to those contained in the Single Audit 

Act could be added to the proposed legislation to provide a 

means to determine whether the firewalls and safeguards are 

achieving their purpose. 

2 
ATTACHMENT ATTACHMENT 

B-229444 

l 

We are also sending this letter today to the Chairmen, 

Committee on Banking, Housing, and Urban Affairs, United 

States Senate, and Committee on Energy and Commerce, House 

of Representatives. I hope these suggestions will be 

useful in developing legislation to restructure the 

nation’s financial industry. If we can be of any 

assistance, please contact me or Mr. Robert W. Gramling, 

Associate Director, at 275-9461. 

Sincerely yours, 

Director 

3