Yet another case of spreadsheet fraud surfaced today in the Boston Globe. Cohmad Securities Corp. was fined $200,000 for failure to cooperate with Massachusetts state investigators inquiring about Cohmad’s role in the Madoff ponzi scheme. Cohmad was founded in 1985 by Maurice “Sonny” Cohn and Bernard Madoff. Apparently, Cohmad failed to maintain proper books and records of their trading operations, including a spreadsheet used to track client’s Madoff accounts. The state was tipped off when they found out that Cohmad had received $37.4 million in fees from Madoff’s firm between 2003 and 2007, which accounted for 90% of their revenues.
Key Takeaways
Uncontrolled spreadsheets can expose organizations to the risk of fraud, leading to non-compliance and/or fines.
By maintaining an up-to-date inventory of all critical spreadsheets, Access databases and end-user computing applications (EUCs, a.k.a. user-developed applications or UDAs) and applying the proper controls, an organization can easily be prepared for these type of routine investigations.
Technology such as the Prodiance ERM System can help automate inventory management, risk assessment, remediation and control.
Of course, all of this assumes the intentions of the executive staff are moral to begin with. Enough said on this note.
In a recent webinar, I presented some data from the internet about the cost of spreadsheet errors, and proposed that based on the articles published to date, the problem is at least $11.5 Billion. That is, of the articles published on the internet to date about errors, non-compliance, and fraud due to uncontrolled and unmonitored spreadsheets, the issue has collectively cost companies at least this much. To quantify this amount (in approximate figures), you could compare it to the following:
>> National US debt: $12 Trillion
>> Cost of U.S. healthcare bill: $1.1 Trillion
>> Cost of spreadsheet errors: $11.5 Billion
>> Cost of NASA space shuttle Endeavor: $1.7 Billion
Enterprise Spreadsheets – The $11.5 Billion Problem OK, so it turns out that spreadsheet errors are an order of magnitude off from the real big issues threatening our economy today, but at $11.5+ Billion, the cost of these errors due to risks associated with mission critical spreadsheets is significant, and must be dealt with at a corporate level. Yet, most companies are not really addressing the issue to the extent they should. I call this the “Titanic Effect.”
When it comes to Spreadsheet and end-user computing (EUC) risk, most companies “don’t know what they don’t know.” They can’t see the risk or the scope of the problem until it’s too late. Yet, spreadsheets are used everywhere within their business – monthly and quarterly close, account reconciliations, actuarial processes, underwriting, tracking and executing trades, tracking inventory and cost, tracking revenue and pipeline, executive compensation, 401k contributions, journal entries, and the list goes on. Just like the Titanic – a supposedly “unsinkable” ship which hit an iceberg and suffered a catastrophic failure – most businesses are cruising along smoothly until they notice there is a problem (e.g. a material error, a fraud case, audit deficiencies, material weakness, etc.). By the time the problem occurs it’s too late. Spreadsheet and end-user computing risk is the same way – many organizations have not evaluated or assessed the risk, so they don’t even know if their mission critical spreadsheets being used to close the books on a monthly, quarterly or annual basis even have errors in them. To check my math, you can visit the EuSpRIG web site and Cases of Fraud & Errors on this blog, and simply add up the costs.
Understanding the Risks & Exposure to Your Organization
So what you need is an assessment to uncover the problem – just like going to the doctor for an X-Ray, CAT Scan or an MRI. Ask yourself these simple questions:
When was the last time an auditor checked your key financial and operational spreadsheets for errors?
What processes and tools do you have in place to make these routine checkups happen within your business?
If you’re like most companies, you might not have good answers to these questions. So, then it’s time for a check-up. To get started, you can peruse this blog for articles on auditor guidance and best practices, or check out the leading technology solution to address spreadsheet and EUC risk, the Prodiance Enterprise Risk Manager (ERM) System.
Take the Poll
Good luck, and be sure to take the poll below to let us know what your view is!
A new fraud case just surfaced in the Financial Times involving spreadsheets. This time, a fund manager at BlueBay Asset Management named Simon Treacher “carefully cut out and pasted different figures on to seven original broker quotes”. The quotes (i.e. spreadsheets) were then provided to administrators who were valuing the assets in the UK-based fund he managed.
The result: an artificial boost in valuation of the fund by $27 million. Nice, unless your an investor. When BlueBay discovered the mis-markings, they closed down the fund, which lost 80% of its value as a result. Then came the fines and damage to company reputation and image.
Bottom line: all firms are at risk when uncontrolled and unmonitored spreadsheets, Access databases and other EUCs are used in critical processes such as reporting on book values. If you combine the autonomy of users who can make changes to spreadsheets, personal motivation, and the current economic environment, then you have the perfect storm for spreadsheet fraud. The best way to mitigate the risk of spreadsheet fraud is to develop a culture of awareness and a new controls to mitigate it.
Last month I wrote about The Spreadsheet Risk Continuum in which spreadsheet and EUC risk can efficiently be mitigated through by adopting a formal policy on EUC control, defining internal controls for EUCs, leveraging best practices, and deploying new technology. It’s worth a read for any organization evaluating their EUC risk.
For more details on the BlueBay fraud case, you can access the full story at FT.com.
Although this story surfaced in September of 2009 in the Financial Times, I thought it was noteworthy enough to list here under Cases of Fraud & Errors linked to the uncontrolled use of spreadsheets. In many cases, personal motivation, lack of adequate controls, and the autonomy granted to users to make unauthorized (or fraudulent) changes to key spreadsheets has led to cases of errors and fraud. The Madoff case is no different, but in this scenario it was perhaps the source of data (and not the actual spreadsheet) that was fraudulent.
The story summaries the inner workings of the Madoff operation and how spreadsheets were updated through queries into an old AS/400 main frame system which tracked false trades, each resulting in a 1 cent profit. Using a simple spreadsheet, his client’s accounts were all magically updated - unbelievable!
Accounting Fraud on the Rise In November, PwC published a new report entitled The Global Economic Crime Survey: Economic Crime in a Downturn. Of 3,000 senior executives survey across 54 countries, 62% reported their organizations suffered a decline in revenues in the past year, and 40% reported the risk of economic crime has risen due to the recession. Given this 60-40 split, they expected organizations with increasing revenues would be immune to the increase in economic crime. However, this was not the case. To this end, economic crime remains a pervasive risk in today’s business environment where increasing pressures to perform, increased opportunities to commit fraud, and people’s attitude are skewed by survival instinct and personal motivation.
Spreadsheets & Fraud – The Perfect Storm? One of the key findings from the survey is the sharp rise in accounting fraud, which contributed 38% of reported cases, which PwC claims is linked to the economic downturn. If we then link this trend with the ubiquity of spreadsheets used in financial and management reporting, we have the “perfect storm” conditions for fraud to occur. Spreadsheets, PC databases and other types of end-user computing applications (EUCs) are used to support many key financial and operational processes, including (but not limited to) journal entries, account reconciliations, tracking and executing trades, revenue recognition, 401k contributions, executive compensation, actuarial processes, underwriting, budgeting, forecasting, and consolidation. Organizations are at risk and exposed when these mission critical spreadsheets are unmonitored and lack the proper IT controls such as change control, versioning, security and access control, segregation of duties, testing and validation, etc.
Is Your Organization at Risk?
So how do you know if your organization is at risk of spreadsheet accounting fraud? Clearly an assessment is needed which typically requires (at a minimum) performing an inventory and risk assessment of a sampling of key spreadsheets. This process can take several weeks or months to complete via manual means, but it can be accelerated by using Spreadsheet Management & Control software, domain expertise, and best practices from Prodiance. To read more about spreadsheets and fraud, I encourage readers to download my latest white paper entitled Fraud Detection & Prevention for Mission Critical Spreadsheets. For more details from the 2009 PwC Global Economic Crime Survey, you may download the full report here.
Complex spreadsheets have been used extensively in mergers and acquisitions. Although spreadsheets can provide rapid and immediate results to speed due diligence efforts, the potential for error is high and left undiscovered such errors can lead to disastrous results.
We saw an example of this last year during the Lehman fire sale when a complex spreadsheet containing hidden data for 179 contracts went undetected in a spreadsheet, causing Barclays to acquire more assets in the deal. Due to the tight timelines to complete the transaction before a bankruptcy court dealine, the spreadsheet was converted to PDF and the unwanted contracts (apparently in a hidden worksheet tab) were included in the deal.
To avoid this type of risk, organizations relying on spreadsheets for M&A activity should ensure they are inventoried, managed in a controlled environment with access control, versioning and audit trails, and finally analyzed for errors using diagnotic tools prior to the close of the deal. For more information on technology to satisfy these needs, check out www.prodiance.com.
The complete details of the Lehman-Barclays story are in this PC World article.
This spreadsheet fraud case includes Scott Hirth, former CFO of software firm ProQuest, who cooked the books by making fraudulent accounting entries in spreadsheets for more than five years. Hirth manipulated spreadsheet data using ”hidden rows” so that the false account entries didn’t show up when they were printed in hard copy.
This Bloomberg article (Nov. 2008) reports on a lengthy federal investigation where former BMO officers and executives manipulated uncontrolled spreadsheets to artificially inflate the bank’s gas options portfolio. This fraud went on undetected for about 3 years until the market turned against the traders, who were unsupervised. BMO eventually suffered related losses of $853 million.