CASE 1 Oxalite Inc.: A Cautionary Tale* The headlines stunned investors, regulators, and the business community. Over a period of five years, several members of the management team at Oxalite Incorporated had engaged in fraudulent financial reporting. The offenses discovered included revenue-timing schemes and the creation of fictitious revenue in both U.S. and Asian offices. Prior to the discovery, a cursory look at Oxalite would have given little hint of vulnerabilities to financial reporting fraud. Its board of directors was populated with respected individuals. Oxalite had a written code of conduct. It had expanded at a healthy rate, even opening facilities in Asia. The company had experienced steady profits. But a look behind the curtain revealed a culture that encouraged and enabled fraud. Promotions were based on loyalty rather than competence. Fast and new were the watchwords, trumping deliberate and documented. Employees did not feel safe bringing bad news forward. Furthermore, skepticism was discouraged and questions were frowned upon. Executives shared the company code of conduct with investors, media, and others outside the company; however, employees were simply provided with a weblink to the code upon hire and few had ever accessed or read it. A significant portion of executive compensation hinged on making the numbers. The Asian offices came under particular pressure, as hopes for ever-higher earnings were pinned on rapid-growth markets. Executives struggled to hit targets but learned to manipulate the books to make it appear they had. The board of directors and audit committee met regularly but rarely availed themselves of the opportunity to engage internal or external auditors, or the companys ethics and compliance personnel. Board meetings discouraged two-way discussion, and the board frequently ran out of time before ethics and compliance issues could be discussed. The audit committee rarely met with executives or middle management, and when they did, failed to ask questions whose answers might have raised red flags. In short, the participants in the financial reporting supply chain were insufficiently inquisitive or skeptical. They assumed all was well. It was not. Note: *Oxalite Inc. is a fictional company created for illustrative purposes. It appears as the opener to the Center for Audit Qualitys (CAQ) November 17, 2014, publication, The Fraud-Resistant Organization: Tools, Traits, and Techniques to Detect and Report Financial Reporting Fraud.25 The publication resulted from the work of the Anti-Fraud Collaborative formed in 2010 and consisting of the CAQ, Financial Executives International (FEI), the Institute of Internal Auditors (IIA), and the National Association of Corporate Directors (NACD). Discussion questions: 1. For discussion purposes, treat Oxalite, Inc. as a public company. Based on this assumption, reflect on the following: a. What were some internal control deficiencies and even material weaknesses? How would they have been discovered? What would be the implications for Sarbanes-Oxley Section 404 compliance? b. Analyze this case using the COSO Fraud Risk Management Guide Principles 1, 2, and 5 relating to the COSO internal control components of control environment, risk assessment, and monitoring. 2. How could the external auditors have helped avoid this adverse corporate governance outcome? 3. How could the internal audit function have helped evaluate the design and operating effectiveness of internal controls? 4. Mr. N. G. Shankar, CAE of the Aditya Birla Group, a large conglomerate in India and a former member of the Internal Audit Standards Board of The IIA, has remarked, Poor culture leads to organizational disaster. In what way was his observation justified in the case of Oxalite, Inc?