at a european executive financial conference a few yrs ago, I commented that it would be relatively straight-forward to manipulate computer books to get by (SOX would catch mistakes but didn't seem like it would explicit fraud) ... and the only thing I saw in SOX was the section about whistle-blowers. a couple old posts with references:
http://www.garlic.com/~lynn/2008s.html#9
http://www.garlic.com/~lynn/2009.html#53

Enron & Worldcom was supposedly laid at the door of deregulation and Sarbanes-Oxley was the result ... pbs website with discussion of Enron, Worldcom, deregulation, repeal of Glass-Steagall:
http://www.pbs.org/wgbh/pages/frontline/shows/wallstreet/

then comes congressional hearings last week into Madoff ponzi scheme ... with the person that has been trying for a decade to get SEC to do something about it .. A few recent posts ... discussing in more detail:
http://www.garlic.com/~lynn/2009b.html#65
http://www.garlic.com/~lynn/2009b.html#73
http://www.garlic.com/~lynn/2009b.html#80

In his testimony, there was repeated theme that crooks & fraud thrive where there is lack of visibility and transparency ... and the major recommendation is to change the culture to provide transparency in all aspects of the operations. There is need for new legislation and regulations, but they will always lag behind the crooks. Much more important is creating institutional and infrastructure transparency.

A couple other tidbits:

could only think of one person at SEC (in some field office, gave their name) that had any understanding of financial transactions ... all the others at the SEC had no understanding (and were mostly lawyers).

only 4% of fraud is turned up by audits ... over 50% from tips; tips are 13 times more effective than audits. SEC has a 1-800 hotline for companies to complain about too vigorous investigation. there is no corresponding "tip" line.

The Madoff ponzi scheme isn't the only one, in the process of turning over detailed documentation to the authorities about a (different) "small" $1b ponzi scheme.

if it wasn't for the current financial crisis, the Madoff ponzi scheme easily could have continued to $100B

None of the clients he advised, had gotten involved with Madoff

... snip ...

Possibly, in part because SEC didn't seem to be doing anything, GAO started database:
http://www.gao.gov/special.pubs/gao-06-1079sp/index.html

from above:

The database consists of two files: (1) a file that lists 1,390 restatement announcements that we identified as having been made because of financial reporting fraud and/or accounting errors between July 1, 2002, and September 30, 2005, and (2) a file that lists 396 restatement announcements that we identified as having been made because of financial reporting fraud and/or accounting errors between October 1, 2005, and June 30, 2006.

... snip ...

Ian

audit started falling apart after y2k when the "big four" crawled all over the investment banks. Then there was the departure of any talent the banks had to the dot com boom meaning a tranche of consultancy flotsam was sucked up the management tree in the investment banks. It was the beginning of the end. First thing they did was get rid of any engineers and people with expertise - last thing they wanted was people who could make them look bad. Then it was the usual model - bums on seats - bring in your erstwhile chums, build huge projects staffed by muppets. Nothing of any consequence was delivered - great example of this was XXX.

Meanwhile in security land, the web meant that the green zone now had holes punched into it. Network guys with their firewalls were no longer of any use. Risk assessment was the order of the day. This once was the province of the business as they had to evaluate and accept their own risks. In IT - "domain experts" [in security] paddled tacit advice post implementation. They were in reality glorified form fillers, adding little value. Enter IT Audit - under the auspices of the big four of course: sas70, PCI, GLB, BSI7799, ISO27001 etc etc. Just what they love - a checklist based audit standard which has led to the demise of real security. All we do now is ensure the ticks are met - no one cares about security - as long as we pass audit. Budgets are cut, tools go unused, personnel are trimmed to the bone. Processes are threadbare and poorly designed. Still - we pass audit - and that's all that matters.

no - don't attribute this to me :-)

If all the parties in an investment scheme have recourse and real time information then no one is a threat, and that threat is what is killing Western finance not executives making over $500,000 per year. Obama has basically told Wall Street he doesn't understand the mechanics and Bush told Wall Street he didn't want to know how the sausage was made , just go about making the stuff. In essence a chart of accounts that allows members of a trading community to know each others risk is key and if the primary participants can trust each other then that trust can be passed on to others. We lack a core essence of primary participants that trust each other. Even if all the finance institutions are nationalized, without real time roll up of critical data no one will trust anyone.

The rating agencies role has yet to filled properly and a trading regime that has a real time reporting system for verification of risk exposure and real time mark-to-market reporting does not exist, but your system could leverage that and the actual instruments being traded are secondary. The real value of a clearing house and exchange are trust being passed from primary parties into the rest of the market.

It is the time factor. The old scenarios are not working because more can happen in a half day than before and within that half day everyone can be broke due to some clod in Paris exceeding his limits.

We can only trust what we can see, and a contract that replicated an accounting transaction is required real time. It is the same scenario I suggested be used for shipping containers via use of contracts at each end verifies assurance. We are now using something akin to the Roman Wax tablet and expecting the Fourth Legion to take on a tank squad. The only problem with that is the tank squad has only one purpose and it is not policing folks into and orderly fashion it is as designed a death machine. In this case the Panzer commander believes he can breath life back into the corpses to keep the game going. The game is over with until someone finds the solution I suggest.

One can only have a game if the investor is armed with the same level of information that the insiders have that way they can assess the bet. As it stands now a great many insiders are not armed with anything more than anecdotal experience and a sense that Mr. Madoff is an honorable man.

That sense is stupidity without real numbers that can be seen daily even hourly.

If there is a real-time transparent accounting system, audits become titular and nothing of substance. Which they are now anyway.

Think about the ramifications. Just-in-time debt that matches actual revenue. The debt could be based on stated assumptions rather than vague notional statements. Banks in the past lent money in this manner, actually sitting there on a daily basis watching the sales being deposited. The cover being ripped off the exchange system and the banking system left everyone in the blind. Securitizations left the bond holder in the dark regarding collections and the delinquency rates. So if the damn thing where designed from the beginning with that reporting, then the event of default could have been strictly with well-informed investors who would have chosen to lend money at a higher rate.

Sarbanes-Oxley supposedly also required SEC to do something about the rating agencies .. but there doesn't seem to be anything other than:

Report on the Role and Function of Credit Rating Agencies in the Operation of the Securities Markets; As Required by Section 702(b) of the Sarbanes-Oxley Act of 2002
http://www.sec.gov/news/studies/credratingreport0103.pdf

In the congressional hearings last fall on the rating agencies, there was repeated testimony that both the rating agencies and the toxic CDO issuers/sellers knew that the toxic CDOs weren't worth triple-A ratings, but the issuers/sellers were paying for the triple-A ratings. Futher testimony was that in the early 70s, the rating agencies business process became misaligned when they switched from the buyers paying for the ratings to the sellers paying for the ratings (significantly opening things up for conflict of interest).

Last month there was news item that IDC had been brought in to help price toxic assets the gov. was looking at buying. IDC had bought the "pricing services" division from one of the rating agencies in 1972 (in the period that testimony said the rating agencies' business process became misaligned) ... as an aside I interviewed with IDC in '69 ... some recent posts
http://www.garlic.com/~lynn/2009.html#21
http://www.garlic.com/~lynn/2009.html#31
http://www.garlic.com/~lynn/2009.html#32

Long-winded decade old post mentioning some of the current issues
http://www.garlic.com/~lynn/aepay3.htm#riskm

We had been called in to consult with a small client/server startup that wanted to do payment transactions on their server ... and they had invented this technology they wanted to use called SSL. there had to be a whole lot of work to turn technology into actual business processes to do financial transactions (frequently now called "electronic commerce"). then in the mid-90s, we were invited to participate in the x9a10 financial standards working group which had been given the requirement to preserve the integrity of the financial institution for all retail payments ... which resulted in the x9.59 financial standard ... some references
http://www.garlic.com/~lynn/x959.html#x959

Somewhat as the result of "electronic commerce" & x9.59 work, we were asked to come in to NSCC (since combined with DTC and renamed DTCC) to see if we could do something similar for all the operations in the securities industry. After some amount of effort, it was eventually suspended because a side-effect of the increased integrity would have created significantly more transparency in all aspects of the industry. This ran into conflict with pervasive cultural for lots of obfuscation and lack of transparency ... recent post:
http://www.garlic.com/~lynn/2008s.html#63

Auditors cleared of blame for bank collapse
Saturday, September 19, 2015
Eamon Quinn

The world's largest accounting firms were yesterday cleared of blame for their audits of banks here as the country hurtled toward financial disaster in 2008.

A major review of the accountants’ actions, which cost €1.33m and took five years, yesterday said an accounting standard applied by external auditors was "found wanting", but that the external audits themselves were generally of a high standard.

The Chartered Accountants Regulatory Board (CARB) said it had asked the tough questions and, for the first time, examined the audits its members had carried out on Irish banks, which had to be rescued at huge expense to taxpayers.

Critics have long raised questions about the breakdown of a web of controls over Irish banks and why external auditors were not able to identify mounting losses on the banks' loan books as the property market started to slide in 2008.

Taxpayers ended up paying €64bn to keep the banks from collapse.

The audits of the banks by the so-called 'Big 4' accounting firms had not previously been put under detailed scrutiny in the three official reports carried out since the crash. The firms received millions of euro in fees for their audits of Irish banks.

The CARB review looked at the standards of the audits in 2008 and 2009 by KPMG of Allied Irish Banks, EY's audit of Anglo Irish, and PwC's audit of Bank of Ireland. It also involved scrutinising EY's audit of the EBS Building Society, KPMG's audit of Irish Life & Permanent and the audit of Irish Nationwide, also by KPMG.

The review was led by CARB chairman and former senior civil servant Don Thornhill and David Spence, an international expert. Their 80-page report does not name individual banks or auditors, but details minor weaknesses in audit processes in some banks at the time. CARB said its review examined whether external auditors followed the "legal, regulatory, and professional standards" in their audits in assessing the value of loans on the books of the banks.

Its main finding is that the so-called IAS 39 standard, an international accounting rule used by auditing firms, was to blame. The rule only allowed loan loss provisions to be booked in the financial year that they occurred.

"It was found not to be satisfactory," Mr Spence said.

He said CARB was satisfied that the review was "tough" on the auditors, and, apart from a few areas, external auditors applied the standards of the day in full.

Over five years, CARB obtained all the paper and electronic audit files. It said it thoroughly challenged the judgments of the auditors made at the time. It said it was prohibited by law from identifying individual banks, and from conducting "over-arching" investigations.

Last night, however, Eugene McErlean, a leading expert and commentator on banks and corporate governance, told the Irish Examiner questions still remain about the failure of internal and external controls that led to the banking collapse.

"Are accounting processes so far removed from reality that they miss something that should be staring them in the face?" he asked.

Mr Thornhill said CARB was confident its review was a fair and independent one.

It focused on the level of impairments for loan losses set aside by the banks as the country’s property markets started to collapse. It said implementation of a new accounting standard "is on the horizon", to include providing for estimates of future loan losses, but that more work may need to be done.

CARB recommends regularly reviewing an existing protocol between auditors and the financial regulator.

Mr Thornhill said: "The banking institutions covered by the government guarantee were at the centre of the crisis which hit Irish society and the economy from 2007/2008. The board considered that it would be remiss if, in the public interest, we did not conduct a thorough review of the role of the auditors of the relevant banks during the critical period."

Mr Spence said the conclusion of the report was that "the auditors were able to demonstrate that they had generally applied appropriate procedures and complied with relevant standards” in relation to the audits of the directors' valuation of loans and provisions for impairment of these loans but that “a number of improvements were needed to clearly demonstrate the challenges and scepticism applied in reaching their conclusions".