This WSJ article provides you with excellent historical perspective of how US financial audit practice have been evolved.

This is the designated posting area for your article review based on your reading of this one WSJ article, "Behind Wave of Corporate Fraud: A Change in How Auditors Work: 'Risk Based' Model Narrowed Focus of Their Procedures, Leaving Room for Trouble".

Then, by clicking the reply button, you can post your "take-on/comment/opinion" on this article within boundaries of auditing.

The recent wave of corporate fraud is raising a harsh question about the auditors who review and bless companies' financial results: How could they have missed all the wrongdoing? One little-discussed answer: a big change in the way audits are performed.

Consider what happened when James Lamphron and his team of Ernst & Young LLP accountants sat down early last year to plan their audit of HealthSouth Corp.'s 2002 financial statements. When they asked executives of the Birmingham, Ala., hospital chain if they were aware of any significant instances of fraud, the executives replied no. In their planning papers, the auditors wrote that HealthSouth's system for generating financial data was reliable, the company's executives were ethical, and that HealthSouth's management had "designed an environment for success."

As a result, the auditors performed far fewer tests of the numbers on the company's books than they would have at an audit client where they perceived the risk of accounting fraud to be higher. That's standard practice under the "risk-based audit" approach now used widely throughout the accounting profession. Among the items the Ernst & Young auditors didn't examine at all: additions of less than $5,000 to individual assets on the company's ledger.

Those numbers are where HealthSouth executives hid a big part of a giant fraud. This blind spot in the firm's auditing procedures is a key reason why former HealthSouth executives, 15 of whom have pleaded guilty to fraud charges, were able to overstate profits by $3 billion without anyone from Ernst & Young noticing until March 2003, when federal agents began making arrests.

A look at the risk-based approach also helps explain why investors continue to be socked by accounting scandals, from WorldCom Inc. and Tyco International Ltd. to Parmalat SpA, the Italian dairy company that admitted faking $4.8 billion in cash. Just because an accounting firm says it has audited a company's numbers doesn't mean it actually has checked them.

In a September 2003 speech, Daniel Goelzer, a member of the auditing profession's new regulator, the Public Company Accounting Oversight Board, called the risk-based approach one of the key factors "that seem to have contributed to the erosion of trust in auditing." Faced with difficulty in raising audit fees, Mr. Goelzer said, the major accounting firms during the 1990s began to stress cost controls. And they began to place greater emphasis on planning the scope of their work based on auditors' judgments about which clients are risky and which areas of a company's financial reports are most prone to error or fraud.

Auditors still plow through "high risk" items, such as derivative financial instruments or "related party" business dealings between a company and its executives. But ostensibly "low risk" items -- such as cash on the balance sheet or accounts that fluctuate little from year to year -- often get no more than a cursory review, for years at a stretch. Instead, auditors rely more heavily on what management tells them and the auditors' assessments of a company's "internal controls."

Old and New

A 2001 brochure by KPMG LLP, which claims to have pioneered the risk-based audit during the early 1990s, explained the difference between the old and new ways. Under a traditional "bottom up" audit, "the auditor gains assurance by examining all of the component parts of the financial statements, ensuring that the transactions recorded are complete and accurate." By comparison, under the "top down" risk-based audit methodology, auditors focus "less on the details of individual transactions" and use their knowledge of a company's business and organization "to identify risks that could affect the financial statements and to target audit effort in those areas."

So, for instance, if controls over a company's sales and customer IOUs are perceived to be strong, the auditor might mail out only a limited number of confirmation requests to companies that do business with the audit client at the end of the year. Instead, the auditor would rely more on the numbers spit out by the company's computers.

For inventory, the lower the perceived risk of errors or fraud, the less frequently junior-level accountants might be dispatched on surprise visits to a client's warehouses to oversee the company's procedures for counting unsold goods. If cash and securities on the balance sheet are deemed low risk, the auditor might mail out only a relative handful of confirmation requests to a company's banks or brokerage firms.

In theory, the risk-based approach should work fine, if an auditor is good at identifying the areas where misstatements are most likely to occur. Proponents advocate the shift as a cost-efficient improvement. They also say it forces auditors to pay needed attention to areas that are more subjective or complex.

"The problem is that there's not a lot of evidence that auditors are very good at assessing risk," says Charles Cullinan, an accounting professor at Bryant College in Smithfield, R.I., and co-author of a 2002 study that criticized the re-engineered audit process as ineffective at detecting fraud. "If you assess risk as low, and it really isn't low, you really could be missing the critical issues in the audit."

Auditors can't check all of a company's numbers, since that would make audits too expensive, particularly in an age of sprawling multinationals. The tools at auditors' disposal can't ensure the reliability of a company's numbers with absolute certainty. And in many ways, they haven't changed much over the modern industry's 160-year history.

Auditors scan the accounting records for inconsistencies. They ask people questions. That can mean independently contacting a client's customers to make sure they haven't struck undocumented side deals -- such as agreeing to buy more products today in exchange for a salesperson's oral promises of future discounts. They search for unrecorded liabilities by tracing cash disbursements to make sure the obligations are recorded properly. They examine invoices and the terms of sales contracts to check if a company is recording revenue prematurely.

Auditors are supposed to avoid becoming predictable. Otherwise, a client's management might figure out how to sneak things by them. It's also important to sample-test tiny accounting entries, even as low as a couple of hundred dollars. An old accounting trick is to fudge lots of tiny entries that appear insignificant individually but materially distort a company's financial statements when taken together.

Facing a crush of shareholder lawsuits over the accounting scandals of the past four years, the Big Four accounting firms say they are pouring tens of millions of dollars into improving their auditing techniques. KPMG's investigative division has doubled to 280 its force of forensic specialists, some hailing from the Federal Bureau of Investigation. PricewaterhouseCoopers LLP auditors attend seminars run by former Central Intelligence Agency operatives on how to spot deceitful managers by scrutinizing body language and verbal cues. Role-playing exercises teach how to stand up to a company's management.

But the firms aren't backing away from the concept of the risk-based audit itself. "It would really be negligent" not to take a risk-based approach, says Greg Weaver, head of Deloitte & Touche LLP's U.S. audit practice. Auditors need to "understand the areas that are likely to be more subject to error," he says. "Some might believe that if you cover those high-risk areas, you could do less work in other areas." But, he adds, "I don't think that's been a problem at Deloitte."

Mr. Lamphron, the Ernst & Young partner, and his firm blame HealthSouth's former executives for deceiving them. Mr. Lamphron declined to comment for this article. Testifying before a congressional subcommittee in November, he said he had looked through his audit papers and "tried to find that one string that, had we yanked it, would have unraveled this fraud. I know we planned and conducted a solid audit. We asked the right questions. We sought out the right documentation. Had we asked for additional documentation here or asked another question there, I think that it would have generated another false document and another lie."

The pioneers of the auditing industry had a more can-do spirit. In Britain during the 1840s, William Deloitte, whose firm continues today as Deloitte & Touche, made a name for himself by helping to unravel frauds at the Great Eastern Steamship Co. and Great Northern Railway. A growing breed of professionals such as William Cooper, whose name lives on in PricewaterhouseCoopers, began advertising their services as an essential means for rooting out fraud.

"The auditor who is able to detect fraud is -- other things being equal -- a better man than the auditor who cannot," wrote influential British accountant Lawrence Dicksee in his 1892 book, "Auditing," one of the earliest on the subject.

But in the U.S., the notion of the auditor as detective never quite took off. The Securities and Exchange Commission in the 1930s made audits mandatory for public companies. The auditing profession faced its first real public test in 1937, when an accounting scandal broke open at McKesson & Robbins: More than 20% of the assets reported by the drug company were fictitious inventory and customer IOUs. The auditors had been fooled by forged documents.

The case triggered some reforms. Auditing standards began requiring that auditors perform more substantive tests, such as contacting third parties to confirm customer IOUs and physically inspecting clients' warehouses to check inventories. However, the American Institute of Certified Public Accountants, the group that set auditing standards, repeatedly emphasized the limitations on auditors' ability to detect fraud, fearing liability exposure for its members.

By the 1970s, a new force emerged to erode audit quality: price competition. For decades, the AICPA had barred auditors from publicly advertising their services, making uninvited solicitations to rival firms' clients or participating in competitive-bidding contests. The institute was forced to lift those bans, however, when the federal government deemed them anticompetitive and threatened to bring antitrust lawsuits.

Bidding wars ensued. The pressures to hold down hours on a job "inadvertently discouraged auditors to look for" fraud, says Toby Bishop, president of the Association of Certified Fraud Examiners, a professional association.

Increasingly, audits became a commodity product. Flat-fee pricing became common. The big accounting firms spent much of the 1980s and 1990s building more-lucrative consulting operations. Many audit clients soon were paying their independent accounting firms far more money for consulting than auditing. The audit had become a mere foot in the door for the consultants. Economic pressures also brought a wave of mergers, winnowing down the number of accounting firms just as the number of publicly traded companies was exploding and corporate financial statements were becoming more complex.

Even before the recent rash of accounting scandals, the shift away from extensive line-by-line number crunching was drawing criticism. In an October 1999 speech, Lynn Turner, then the SEC's chief accountant, noted that more than 80% of the agency's accounting-fraud cases from 1987 to 1997 involved top executives. While the risk-based approach was focusing on information systems and the employees who fed them, auditors really needed to expand their scrutiny to include top executives, who with a few keystrokes could override their companies' systems.

Looking back, the risk-based approach's flaws are on display at a variety of accounting scandals, from WorldCom to Tyco to HealthSouth.

When WorldCom was a small, start-up telecommunications company, its outside auditor, Arthur Andersen LLP, did things the old-fashioned way. It tested the thousands of details of individual transactions, and it reviewed and confirmed the items in WorldCom's general ledger, where the company's accounting entries were first logged.

But as WorldCom grew, Andersen shifted toward what it called a risk-based "business audit process." By 1998, it was incurring more costs to audit WorldCom than it was billing, making up the difference with fees for consulting and other work, according to an investigative report last year by WorldCom's audit committee. In its 2000 audit proposal to WorldCom, Andersen said it considered itself "a committed member of [WorldCom's] team" and saw the company as a "flagship client and a crown jewel" of the firm.

Under the revised audit approach, Andersen used sophisticated software to analyze WorldCom's financial statements. The auditors gathered for brainstorming sessions, imagining ways WorldCom might cook its books. After identifying areas of high risk, the auditors checked the adequacy of internal controls in those areas by reviewing the company's procedures, discussing them with some employees and performing sample tests to see if the procedures were followed.