Mobilizing the PCI Resistance, Part II: First Let's Re-Examine The SOX-404 Problem...

(Reprinted from personal blog entry.)

Previously, I wrote about my blog post "Upset about the subjectivity and ambiguity in the PCI DSS compliance standards? My #BSides submission on the answer..."  In that article, I suggested that in order to improve the state of the practice for PCI, we should look at the similar symptomology that happened in Year 1 and Year 2 for the IT portions of SOX-404.

Last week, during one of the working calls I had with my PCI Scoping SIG team, I dug out some of the early presentations I did as we were launching the GAIT project at the Institute of Internal Auditors.

The approximate timeline of the project began in July 2005 when we held our first summit, to February 2007 when the GAIT guidance was officially announced.

We held the first summit in July 2005, where we assembled internal auditors and security executives from publicly held companies (i.e., SEC registrants), external auditors from the Big Four and probably most importantly, Bill Powers from the Public Company Accounting Oversight Board (PCAOB, created by SOX-404 to audit the auditors).

Instead of showing you slides from that summit, I'm going to show you slides from the January 2006 summit, because we were much better talking about the problem by then.

The Problem

When I showed the slide above to the PCI Scoping SIG team, most everyone seemed startled at how similar the SOX-404 IT problem statements are to the current PCI problem statements.

Let's talk about each one of these in turn in the SOX-404 context:

• No well-established guidance for scoping IT work results in inconsistency and the process being overly subjective
  
  One of the problems was that auditors were often guilty of auditing anything, just because it looked important.  Sure, all the applications that talk to SAP may look important, but is there anything in those apps that could result an undetected material error?
  
  The problem is that in a risk-averse environment, management and internal auditors could rarely effectively challenge the external auditor.  In other words, the external auditor could say, "Well, I can't give a clean, unqualified opinion on your 10-K unless we audit everything."
  
  So, these were always lonely battles against the external auditor.
  
  (It sort of feels like a Mafia protection racket.  "Sure is a nice, clean 10-K financial statement you got there. Shame if something bad were to happen to it. (wink)")
  
  
• Significant key controls reside inside IT and IT processes as well as in the business processes
  
  Incidentally, the real control where reliance is placed may not even be an IT control, instead it's some manual reconciliation process!  So in that case, auditing that IT systems would be totally inappropriate.
  
  
• Sometimes result in overly broad scope and excessive testing costs
  
  If you're auditing areas where there is little risk, you're wasting resources, time and money.
  
  I remember vividly talking to a controller at a Fortune 20 company who was furious that his compliance costs for the IT and financial portions was the same. I think he said something like, "The Enron failure was not caused by a DBA. So, why am I paying so much for IT control compliance, when that's not where the risk is?"
  
  So this is when scope is overly broad: we're testing stuff that doesn't matter.
  
• Significant risks to financial assertions may be left unaddressed
  
  This is the case when scope is too small: we never test something that's actually really important, that could cause an undetected material error in the financial statement!
  
• Suboptimal use of scarce resources
  
  This doesn't require any explanation.

I will describe in my next post why there was a problem.  This is one of my favorites, because it shows the real gap that existed between COSO and COBIT.  I'm hoping you'll find that as interesting as I do!

In the meantime, do you see the similarities between the problem statements of SOX-404 and PCI?   Please comment.

(Also, if anyone interested in the slides, let me know -- I can post them on Slideshare or something...)

Talk notes: Effective Compensation Committees (NACD Director Professionalism)

Director Professionalism Course
National Association Of Corporate Directors
Philadelphia, PA
June 8-9, 2010

Effective Compensation Committees

Matthew Turner, Managing Director, Pearl Meyer & Partners

Robert Galford, Director and Chair Compensation Committee, Forrester Research; Managing Partner,Center for Leading Organizations 

This talk was a surprise to me. I expected to pay less attention to this talk, especially after the fantastic talk on audit committees. But, holy cow, this was a great session.

Ever wonder how your pay packages get set up? Ever wonder what philosophies drive the creation behind the bonus plan? Ever wonder how to better negotiate your own salaries and bonus? Then read further.

Great session.

• Federal Reserve found today that banking compensation packages that led to financial meltdown are still here
• Agenda
  • Compensation in the spotlight
  • Action steps
  • Case study
  • Q&A
• Questions from audience
  • benchmarking
  • is CEO comp as big an issue as the press makes it out to be?
• Overview: role of committee
  • structure
    • independent
  • "Great to have HR exec on the compensation committee"
• Charter
  • written responsibilities and authority
    • composition
    • duties and responsibilities
      • meeting frequency
      • communication
      • outside resources
  • Categorize roles in charter
    • full board approval
    • committee
    • advisory to CEO
    • informational
  • Example: CEO contract approval and terms
    • boards will typically reserve approval to full board
    • for other execs and named execs, committee might approve
    • could be approving plant level bonus plan
  • for informational items, then don't spend much time on them
• Philosophy
  • under score the value and goals of corporation
  • attract, develop and retain valued employees
  • establish overall importance of compensation
  • provides clarity and sets priorities
• Strategy
  • clear statement of purpose of compensation in all its forms
    • what is appropriate target pay opportunity (level)
    • how should that pay opportunity be delivered (mix)
    • what criteria should pay be tied (pay for performance)
    • appropriate upside/downside (risk/leverage)
    • when should pay be earned (horizon)
    • alignment with shareholders (balance, equity)
    • share ownership, contracts, CIC, severance
  • comment: "this talk sounds very defensive. I want to be able to define the compensation plan and bonuses for the entire company, have the company work at maximum level, and pay the bonuses. I want to tell the company that this is the best money we can spend."
  • discussion around thresholds: someone gave pharmaceutical example: all about drug trials have lots of uncertainty, but if it's approved, then very large payouts; and if not, then nothing.
  • comment: "I am comfortable with having high expectations of our operating executives."
  • comment: "because of banking crisis, there's desire to have a sufficiently long term horizon."
  • Asked for examples of setting horizons
    • "vesting over 7 years, but could accelerate to 5 years" (holy cow. he's from banking industry. would be interested to know what it was before)
    • "separate vesting vs. holding"
    • "all execs required to hold certain number of shares, and hold them until they retire"
• Procedures and processes
  • promote good communication, sound documentation and timely execution of committee responsibilities
  • assure independence
  • align meeting agendas with responsibilities and timing
  • create open atmosphere
  • assure functioning of review and control processes
  • commentary
    • Matthew is from Chicago. thinks high tech startups would benefit from process. again, process is as important as the decision coming out of process.
  • meetings
    • frequency: 4x or more a year (2x per year not enough?)
    • duration
    • advance materials and action items
    • minutes
      • key deliberations
      • materials reviewed
    • executive session
      • "have regularly scheduled executive session, so scheduling one doesn't freak everyone out"
  • access to management and in-house staff (HR, legal, finance)
  • outside advisor relationships
    • ability to select, retain, direct, evaluate and fire
  • reports to full board
    • "does your comp committee understand the talent in the organization. how many key execs are needed, and how many do we have? large example: 400 key people, and the 200 people that are filling them."
    • "could include the chief engineer: it's not always the top of the ladder. who knows how to unlock all the doors."
• Ripped from the headlines
  • "NYSE Grasso example: $130M bonus was indefensible. what went wrong with the creation of the comp package?"
  • Scenario of company considering adjusting comp plan halfway through the year
    • For those adjusting comp plan, it begs the question of whether you would adjust the plan if company is knocking it out of the park, and adjusting bonuses down
  • Issues
    • Tactical: not adjusting puts staff at risk of leaving
    • Strategic: designing a good comp plan that can handle adverse economic conditions
  • comment: "how can you penalize management when things totally outside their control change? would prefer factoring how they're faring against competition"
    • A + R + C (absolute + relative + comparative)
    • unless you put all three into the equation,
    • A example: absolute benchmark (e.g., bookings number)
    • R example: change in performance measures: relative benchmark (e.g., gross margins, could be historic)
    • C example: often missed
• Exercises
  • 1. evaluate board comp raise in tough economic environment
    • commentary: example: board positions needed increase: if company has money, increase compensation, since no raise in 10 years
    • opinion: the company is making money, so give them the money; look at peers and comparables.  (A, R everwhere)
    • weigh optics issue: what is impact in press when board gets raise, when company is doing layoffs
    • commentary: "we went through same thing lately. comp was all over the place, some made more than others. we created rules for meeting fees, increased pay for audit committee"
      • current trend is towards unified retainer, away from meeting fees
  • 2. skipped
  • 3. private equity firm forces management to buy stock, not entitled to annual stock grant, receive restricted stock that only vests on the basis of total shareholder return over three years, receive zero bonus if corporate targets are not met
    • comment: "tell investor: some recommendations are good, some not. needs further study. what does it do to retention?"
    • overarching theme is fairness and alignment with shareholder value ("you'll become wealthy if they perform over time")
    • comment: "this guy is trying to super-impose private equity model on this company. if they want that, then they should buy 100% of the company like private equity does. Other shareholder may not agree with this 'shoot the moon' approach."
    • comment: "holding stock for three years; how much of stock price is within control of management" (eligibility vs entitlement)
  • 4. attract CEO of publicly traded company from competitor, who would leave lots of money on the table
    • comment: this is mirror image of #3.
    • the issue here is how do you attract a CEO that you want? the suggestion is very much like Peter Drucker: what kind of company do you want to be? you're trying to hire the CEO of the company you want to be. if you can't afford it, then hire one that you can afford.

• 

Talk notes: Effective Audit Committees (NACD Director Professionalism)

Director Professionalism Course
National Association Of Corporate Directors
Philadelphia, PA
June 8-9, 2010

The Audit Committee And Risk Oversight: Effectiveness In The New Environment

Ken Daly, President and CEO, NACD

Ken was formerly head of the KPMG Audit Committee Institute and a passionate former auditor.

As someone who has spent a lot of time in standards-setting for SOX-404, I'm loving this talk. It brings back memories of the GAIT effort, where I worked with Bill Powers at the PCAOB, the Institute of Internal Auditors, and all the Big 4 national practice leaders.

Ken is hilarious.

• I've been on audit committees, as well as hired by and fired by audit committees." (haha)
• Collected desired outcomes and desired answers from audience (nice touch)
  • Protocol between directors and external audit firms, CEOs
  • For non-financial experts, what is minimum skills needed to serve on audit committee
  • What should non-audit-committee members be asking from the audit committee
  • Relationship between audit committee and disclosure committee
• Framing some problem statements
  • Audit committees deal with accountants, and we wonder why communications are so bad: accountants are terrible communicators  (haha)
  • "the price of poker is very high": no one is smiling when they deal with SEC enforcement. lots of trust required. use tension in good stead. lots of tension between external auditors, internal auditors, audit committee, and management. job of audit committee is to manage that tension
• Today's discussion
  • overview: the audit committee
  • overseeing financial reporting and controls
  • risk oversight
  • managing interactions
• Overview: period of change, 2002-Present (SOX)
  • impact of corporate accountability (SOX)
    • "audit committee used to be most unpopular. now, it's comp committee, which is helpful." (haha)
  • emphasis on risk
    • "focus on compliance is a fool's errand. you'll never have enough time, and you'll eyes will leave the ball."
    • "policy woks think independent directors are full time -- if that were true, then we wouldn't be independent, would we?"
    • "a new tsunami of rules is coming your way. you will be more challenged more than ever staying on top of things."
  • economic issues
  • confidence and trust being questioned
  • heightened role and greater time commitment
  • new legislation, rules, expectations
  • connectivity with other committees
  • IFR and XBRL
    • "Extensible Business Rule Language: COSO, SEC was there. you're tagging information in the reports. how could it help you get info that you don't regularly get."
    • "doubts that IFRS will be a big issue because SEC has so many other things on their plate"
    • "In one afternoon, GM wrote of $38B of deferred tax assets. What did market do? Nothing. It's non-cash, so it doesn't matter. My point? All the stuff you'll be spending time on is compliance. Go to accounting standards board and complain: footnotes are like Armegeddon documents. As you increase data, you pay less attention."
    • "Pay attention to tone-at-the-middle. Lots of restatements is not due to CEO fraud, but due to tone-at-the-middle problems."
      • Questions: "what processes are putting in place to set tone-at-the-middle?"
      • "Go to call centers: they know everything about the company, despite lower wages. They are the vanguard of the company. They'll know whether product is worth a darn, whether there's a receivable problem, etc.  Suggest directors should hang out at call centers."
• Significant audit committee responsibilities
  • direct responsibility for external audit
    • "fool's errand to manage this relationship"
    • "don't negotiate the fees. audit committees have strong opinion and no facts."
    • "have CFO community do the negotiation"
    • "saying 'we want job cheap as possible' is dumb. in this case, we're using shareholder money to protect shareholder money."
    • your worries
      • how does management feel about them?  like cop doing customer satisfaction survey after giving driver a speeding ticket
      • how is auditor supporting audit committee goals?
      • how does the audit firm support audit committee chair?
        • "I wanna have dinner 2-3 days before the audit committee meeting. they'd then ask me about things I was concerned about. this helps focus the conversations."
        • "often wisdom is, if it's complex, has tons of risk, give it to the audit committee. not terrible."
  • oversight of internal controls, disclosure controls, and internal audit
    • disclosure committee composed of line managers: can't be external auditors, because it breaks independence
    • disclosure committees don't have minutes: 4 questions he'd ask
      • what will you be discussing? (should we disclose right away?)
      • was there significant discussion?
      • what are the areas of disagreement? (why did they disagree? what door did we come out of?)
      • is there anyone vetoing? (huge red flag: big matter, can't come to conclusion. Likely there was a veto at Tyco, Enron, etc.)
      • Question: "best practice is to keep minutes?"
        • "most disclosure not keeping minutes, because of litigation risk. proof is in the disclosure document. if there's a discovery action, you've just handed over roadmap."
  • oversight of financial reporting
  • oversight of risk management
  • oversight of legal and regulatory compliance
• Keys to audit committee effectiveness (most important slide)
  • setting agendas and priorities; making the most of the meetings
    • "I don't believe we can sustain the level of effort required around compliance. Current legislation being considered will hold directors will be held personally liable. Not worth any fees collected as director."
    • "only 1 Powerpoint presentation. 1 slide. You can educate, persuade, or call to action. No longer time to be educated -- that has to happen beforehand. Spend all your time on the call to action. Send me the PPT (all 500 pages), but in meeting, 1 slide about what decisions we need to make. If we don't discuss, then things will start going bump in the night."
    • "You need information architecture."
    • "The key risk: management risk that they cannot/will not supervise the activities of the corporation. They won't bother with it, or they are clueless. Treasury went into small unit of AIG, and found that they had no idea what was going on, not even the nature of the transactions. Spend 50-60% of time in dialogue."
  • setting clear expectations for each participant in the financial reporting process
  • supporting the CFO and other financial reporting participants
  • coordinating and communicating with the full board and other committees
  • ensure continuous improvement (education and self-evaluation)
  • Dialogue -- not presentations
    • "use consent agenda: review a doc and pass it on. no dialogue."
• Top concerns in 2010
  • Regulatory/legislative matters
  • key financial risks: liquidity, access to capital, cash flow
  • exposure to third parties: customers, vendors, lenders
  • tone at the top and tone at the middle
  • fraud
  • SEC proxy disclosure enhancements: compensation
    • how does compensation create incentives that affect company risk
    • situations that could trigger discussion/analysis
      • a business unit that carries a significant portion of company risk profile
      • a biz unit with significantly different compensation structure
      • a biz unit with significantly more profitable
      • a biz unit with compensation expense is higher
      • a biz unit where risk/reward balance is significantly different
    • "BRAC controls: you can speed up and slow down so quickly, your competitors will slam into the wall." (tweet)
  • FASB 166 & 167
  • pensions (huge problem: we're not doing a good job on this: "raise hand if you think your pension fund will have 8.5% return. where did you get these numbers? these pensions are going to blow up in our faces."
    • "if it moves, tax it. if it keeps moving, regulate it. if it stops, bail it out." (tweet)
• environmental issues challenging effectiveness
  • complex biz environment and part-time directors
  • inadequate support resources
    • Your assets as an audit committee
      • good agenda setting: enough time for dialogue
  • • • CFO
      • CIO: totally underutilized: tell me about information architecture and how you can make my job better: most CIOs have never been in audit committee room. huge mistake
      • internal audit
      • want "advice and consent"
      • disclosure committees
      • tone at top/middle
      • emerging problems: 
  • assymmetrical info
  • looking at all the "right stuff"
  • compliance-oriented agendas
  • insufficient discussion time
  • inadequate time/support
  • information architecture
  • external audit
• Financial restatement trends
  • "this is insanity: 1800 restatements in 2006. 675 in 2009. Now smaller companies. Number of double-dippers dropping."
  • Source were not fraud, instead wrong accounting principle
• Critical accounting policies, judgements, estimates
  • Potential questions to ask
    • how do you feel about the accounting process?
    • skip a level
    • what stupid mistakes were made in the past?
    • what is absolutely required to get this right?
    • go to CFO, do you have enough time to check the numbers before we send them out. If answer is "we barely have enough time to complete", then a huge risk (tweet)
  • people are cutting expenses to restore profitability: but cutting finance staff increases probability of error
  • "asymmetrical information risk: the risk you have when bulk of info is coming from one source." (tweet)
    • "what are other companies doing?" "hell if I know. I have enough trouble getting my stuff done"
• Evolving role of CFO
  • CFO turnover is unprecedented: higher than ever. (turnover)
    • why? 
      • they don't understand expectation of audit committee
      • role has changed significantly
      • they don't trust you (fed up with the audit committee) (stunning: tweet)
  • increased pressures
    • volatile capital markets
    • increased regulatory/stakeholder demands
    • business complexity
  • expanding responsibilities
    • enforcing compliance
    • playing a leadership role
  • Commentary
    • "complaining about inadequacy of IT systems to support reporting. Staff being cut. CIO reporting to CFO. CFO problems dripping down onto the CIO." (whoa: tweet)
• Risk oversight framework
  • clarify risk oversight objectives
  • understand strategy/risk link
  • align risk oversight responsibilities
  • consider BRC's 10 guiding principles of effective
  • reassess and adjust
• Five areas of risk
  • capital
  • do you have right systems in place
  • expectations of investors
  • regulatory matters
  • risk tolerance
• Primary responsibility: financial reporting risk vs every other risk
  • you can't handle all other risks if you're firefighting financial reporting risks
  • what % of directors understanding strategy: 11% (from McKinsey)
• Quiz: pursuant to NYSE regs, is the audit committee solely responsible for the oversight of risk?
  • Of course not.
  • But, Conference Board said that 66% of Fortune 500 thought it was.
• Red flags
  • "too good to be true": 
    • "AAA paper in 5% interest env making 17%"
    • "MCI is only company making money. Just capitalizing expenses. Works for us"
    • "Imperial defense. Defrauded by agriculture note operation. Always heard, 'you can't bug them. they're making so much money. can't be bothered."
    • "unusual behaviors" "kozlowski having toga parties" "chief lending officer was supposed to be picked up, but drunk from party on lawn"
    • "whitewashed" "use all time presenting, 3 minutes for questions"
    • "close calls"
• Elements of a proper audit committee risk oversight process
  • right environment: the right people with appropriate leader
  • structure and responsibility: who is authorized to make calls?
  • information and communication: identify risk categories
  • control system: are boundaries set?
  • incentives: where is the balance of risk and reward?
  • monitoring: monitoring process, not monitoring done by the process (tweet)
• What does the risk conversation sound like?
  • the objective of the conversation:
    • satisfy the board that management can --and does-- identify, assess and manage risk
  • test stuff: talk about how you test it?
  • conversation
    • what to ask
    • what to listen for
    • what to test (<------ excellent)
    • the need for third-party input and validation
  • "don't be so arrogant to say "you don't know"
    • doing exercise around loss reserves? CFO says, "we're using forward loss triangulation." had no idea what that was. Mathematician came in and presented to the whole board. Not even listening to him anymore.
    • everyone praising doctor.
    • Code name for project was "argot", but no one knew that it was actually "secret language used by thieves to hide the truth."
• As part of your risk conversation
  • have the person in the right room at the right room: example: tax risks: CFO will never know, likely, might as well ask about nuclear reactors.
  • insist that management
• Improving communications about risks
  • map risks to managers
  • map committee oversight responsibilities
  • identify significant non-financial risks
  • educate directors about financially sensitive risks
  • consider overlapping committee memberships/attendance
  • ensure committee reporting (including minutes) to full board
    • lessons from Disney: record time, data available to you, what you actually looked at, participants, demonstration of independence (to imaginary hostile meeting minute reader) ("have you thought about bringing in experts"), consideration of other input and source data
  • encourage informal discussion among directors
• Issue: information quality
  • "there is desire to talk to CIO or IT guy."
    • accurate
    • complete
    • relevant
    • transparent
    • fresh/current
    • available
    • secure
    • satisfied legal/regulatory requirement
    • cost effective
  • there's no one guy who will know
  • "why are corporations relying so much on manual controls?"
    • "because we never had time to turn on automated controls?"
    • "go back to CIO and turn on automated controls" (tweet)
• top red flags/indicators that IT is starved
  • 60% of installations bring no value: no one sure where value: IT people love gadgets,
  • ask CIO, "are we starving?"
  • Question: "what is audit committee responsibility to IT projects?"
    • "definitely on the whole board. things are late. big conversions like Hershey and Halloween. responsibility depends on systems, and financial reporting cares about audit committee"
    • "purpose of computing is insight numbers. Purpose of computers is not in sight."
• Poll: are you satisfied that board can conclude that management can identify/assess/mange meaningful risk?
  • 67% yes
• Question: "what is protocol with external audit?"
  • "are our application processes commensurate with the industry?"
• Question: "what is protocol with CEO?"
  • "I want CEO there, and hear him/her say that they've heard issue before and that they agree."
• Question: "what should other committee members ask?"
  • "what did you spend your time on and what do you see as next big thing?"

Talk notes: NACD Director Professionalism: The Nominating and Governance Committee: New Challenges and Opportunities in Board Composition

Director Professionalism Course
National Association Of Corporate Directors
Philadelphia, PA
June 8-9, 2010

The Nominating and Governance Committee: New Challenges and Opportunities in Board Composition

Suzanne Hopgood, Managing Director, Board Advisory Services, NACD; Director, Acadia Reality
Bob Hallagan, Director ResCare, Inc., and Beskshire Life Insurance Company; vice chairman and managing director, board leadership services for Korn/Ferry International; former CEO of Heidrick & Struggles

Suzanne specializes in companies in trouble, including company whose CEO is on $400M bail. Was on board of Worldcom.

This was a surprisingly interesting topic, all about board composition and the urgent issue of how boards get rid of deadwood. New SEC requirements require explanations of why every director is on the board, challenging the sense of entitlement that many directors have that "I join a board when I'm 50, and I'm on the gravy train until I'm 70."

This sounded like a potentially boring topic, but they suggest that the board Nominating/Governance Committee should lead the effort to "get the right people on the bus, and get the wrong people off."

• "This is an extraordinarily important. Years past, it was audit. Then compensation. Now it's board composition, which means Nominating and Governance committees."
• Bob shows chart of "Alan's hypothetical performance, leading up to and after the IPO"
  • Going public?  Lawyer says that after you go public, "You need a board. Right now, it's your mom. You can get a group of people who have solved the problems you're trying to solve."
• Four types of boards
  • Has negative impact on performance
  • No impact on performance
  • Good fiduciary checkmark board (i.e., ensures you stay compliant) -- affects performance a little, minuscule bit
  • Has positive impact on performance
• "Announcement that you're looking for a great board can scare the crap out of competitors. Imagine the list of board members that would scare your competitors."
• Focused objective of governance committee, the charter should read, "our company takes on all the characteristics of a high-performing board"
  • "Our biggest risk is our fellow board members. There are people I'm on boards with that I'd never serve again with, regardless of how much money I get. We can't overlook that today."
  • "Do you want to be on the board of Massey Energy (coal company with the worst safety record in the U.S., had recent coal mine disaster, etc.)? Are these people you want to be on the boat with? If not, then it's the responsibility of the nominating/governance committee to take action."
• Questions to ask
  • are we taking advantage of new disclosure requirements?
    • "if you can't answer the unique value you provide, then get off the board."
  • have we identified and secure necessary skill sets for the board?
  • do we maximize communication?
• New SEC regulations impact Nom/Gov committees
  • Elimination of broker discretionary voting (NYSE Rule 452)
  • Proxy Disclosure Enhancements Release No 33-9089
    • Rules focus on enhancing disclosure in following areas:
      • compensation
      • director qualifications
      • diversity (not defined? skill set? racial? sex?)
      • board leadership (incl. CEO/chairman roles: explain why it works for your company)
      • risk
    • Some write a paragraph; Suzanne's board wrote lots of pages.
  • Expectation from directors is that it's lifetime employment: not a three year term, but a sense of entitlement: "I get a board position at 50, and I'll be there until, say, 70 years old."
    • When prompted, 80% of room believed that this is the expectation AND that this is reality.
    • When prompted, 0% thought that this is NOT the way it should be
    • (Interesting. What are the barriers for getting the board rotation people want? Someone suggested term limits.)
    • (Interesting article on board compensation here. Stunning how highly paid many directors are:
      • "The article goes on to note that data from executive recruiter Spencer Stuart's study of 491 large and important companies reveals that average director pay for non-employee directors was $213,000 in 2008.  Moreover, proxy statements companies in the surveywhose average salary, in Fortune's words, "exceeded the nosebleed level of $400,000," revealed director compensation packages ranging from $713,500 to roughly $1.5 million.  Does this kind of compensation gut the idea of director independence?"
    • Question: what is average age of average board member age?
      • north of 65 for many; many have board members with age over 80
    • Institute of Institutional Investors: new SEC rules for proxy will be incredibly disruptive: the fact that boards can't explain why board members are there, activist boards will use this as a wedge to get their people on the board.
      • Another thing going on: was interviewed by The Atlantic about Coca Cola board: board age was so old, many had problems finding rooms; advanced age doesn't mean diminished competence. Boards rely on age rules because they don't have balls to kick ineffective directors off boards.
      • The demands from boards are so high, people with full time jobs can't be on boards. CEOs average on 1.2 boards. CEOs don't have time to be on boards.
      • Consequently, people are on boards, merely because they have time to do it.
      • Average retail vote: less than 8%.  (Don't know what this means.)  Apparently, when it's this low, boards are ceding all the power to activist investors. "They will take this power away from companies. You don't want Washington, D.C. to have this kind of power."  (Interesting. TODO: study this more later.)
• Nom/Gov committee as focal point
  • governance issues
  • corporate strategy
  • director composition
  • director and management evaluation
    • "according to your peers, you were rated a 2 out of 10."
  • shareholder communication
  • risk processes
  • committee roles and responsibilities
    • "we change board charter every year, even a couple of words, so there's no question that we're reviewing it."
• Risk responsibilities of the nom/gov committee
  • ensure that the right people are on board
    • skills, experience, etc.
  • evaluate management and directors
  • handle risks associate with:
    • board structure
    • director selection
    • CEO selection
    • coordination between committees
    • communication with shareholders
  • "I was the CEO of a company where I was the fourth CEO in four years, and CEO of another company where I was the fifth in five years. Just based on that, you know that the company performance was terrible. Imagine standing in front of a group of employees who are thinking, 'I've survived the last four fools. I can survive you." (haha)
• High performance board framework (source: NACD Blue Ribbon Commissions on Board Evaluations)
• Listing Exchange requirements
  • NYSE
    • Nom/Gov must be established by charter and be completely independent
    • Key committees must be evaluated annually
  • NASDAQ
    • director nominations must be made by an independent nominating committee OR by a majority of the independent directors on the board
    • One non-independent member of the nominating committee may be permitted to serve, for a limited time, under certain disclosed circumstances
• Governance issue
  • Independence: Listing Exchange, SEC
    • no significant economic ties to the company
    • not an advisor to the company
    • no significant familial relationships
    • not part of management within the last three years (NYSE)
    • audit committee standards are even higher
  • to be meaningful, independence must go beyond structural considerations
• Board evaluations
  • Question: "say more about the disclosability of those board evaluations"
    • "we only do it on paper. we destroy after 30 days. we don't trust electronic forms of this sensitive document."
    • "in board meeting minutes, note that reviews were delivered, but don't go into detail."
    • (golly. very sensitive! apparently the rationale, people get sloppy about what they write down, and without the context, it can be taken out of context.)
• Annual disclosure report
  • disclose all relationships that constitute conflict of interest.
    • "Important. This is the first form that SEC pulls when there's a question of conflict of interest."
  • If uncertain about conflict of interest, the director must disclose all conflicts.
    • "If CEO is holding all their stock in a margin account, is that important to  know?"
  • "D&O insurance is really O-insurance. All funds get used to defend officers. All money is gone by the time you get the directors. Get D-insurance, so officers can't tap out the defense fund."
• Board composition
• Example: Point Blank Solutions 2008 proxy disclosure (wow. this is terrific. shows compensation [up to $25K per year], and brief bio of each person. look at bios on Page 8)
  • "in 2008 proxy, we disclosed strategic plan to shareholders, the nine skillets needed, and disclosed how the skillsets matched the strategic plan. we wrote 5 pages. suddenly, we realized how ridiculous the 5-line legally required bio is."
  • after proxy battle, every one of top 18 shareholders expressed appreciation for the detail explaining the board composition
• Board search process
  • Engage search firm or NACD Directors Registry: the process
    • consultative process
    • interview process
    • background check
    • candidate selection
    • the presentation of an invitation to join the board
• New skillset needs
  
  • Understanding global markets
  • social media (again, the quote that Facebook would be the 4th largest country: it's the 2nd time I've heard this quote at a conference in 4 weeks. First time was the WebVisions 2010)
  • "you want board members that will maximize the group dynamics."
• Background checks and interviewing
  • "You are bringing on someone who is likely to be your partner for a long period of time. Think of how superficial the interview process is. You need to validate the success record of candidates, in the areas that you need time. Really drill down on background and their success, and be sure they have history of making good decisions. What is point of having people on board that don't have history of making good decisions. Then we do extensive 360 degree reference checking. Think that board member may be with company for 10-25 years."
• "Tone at the top doesn't with the CEO, it starts at the board"
  • "Everyone in accounting will know how much money a board member spends. Spending $800/day on hotel in NYC when company is doing layoffs is indefensible."

Talk notes: NACD Director Professionalism: Identifying Issues In Financial Statements

Director Professionalism
Philadelphia, PA
June 8-9, 2010

Course description at at the NACD website here.

Identifying Issues In Financial Statements

Dwayne L. Cook
Mid-Atlantic Practice Leader, Partner, Tatum

Dwayne was a KPMG consultant, then became CFO of a client (before SOX, so it was allowed back then), then started working for Tatum.  Specializes in clients doing acquisitions or divestitures.

This was a fun talk. Basic accounting review, but Dwayne walked through an analysis of the Blackboard, Inc. financials.

Part of the talk was "stump the non-accountants" which didn't seem useful for spotting red flags, but watching the thinking process of dissecting a financial statement was absolutely fascinating and entertaining.

(Disclaimer: I'm not an accountant, so notes may not be accurate.)

• As a CFO, when he had to deal with company audit committee, there was a scripted dialogue: what were the questions, and there was a proper way to answer the questions.
  • Your job is to ask me questions.
  • Biggest mistake is not following-up
  • Most recent SEC enforcement action: Diebold
    • They went after usual suspects (CEO, CFO, controller)
    • They also went after board for "recklessly not knowing"
    • i.e., As an audit committee director, if you don't know something, you're liable
  • Cartoon: CEO whitewashing stock analysts, board of directors, accountants
• Basic SEC filings
  • Proxy: communications to shareholders of matters for shareholder action
  • 10-K: annual report to SEC: includes financial statements/other disclosures
  • 10-Q: quarterly report to SEC
  • 8-K: special report, such as major acquisitions, director resignation, change of auditors
    • Now includes "VIE" (variable interest entities), or SPE (is a type of VIE)
    • Why?  get things off their balance sheet
    • Bad loans? Sell it off to another entity, and now it's off the books -- and because you sell it, it book a gain (even though you didn't get cash)
    • Enron: created VIE; you want risk to go with the transaction; if they go bad, did you transfer the risk and reward?
    • Questions:
      • do we have VIE?
      • did we transfer risk and reward?  (if not, then it wasn't a "sale")
      • if you book a gain or sale, was it properly recorded?
      • what is the nature of "any continuing involvement?" (do we need to book a reserve?)
    • The SEC will ask: they will want a comment letter on it
    • Question: "what are valid uses of VIE?"
      • Answer: "tried/true tactic: separate bad assets from good, and VIE are a vehicle to do that, so the company can raise money.  If you really wanted to get rid of it, you'd sell it. But since you can't, you have to do a VIE."
      • "What you're really doing is enabling yourself to borrow against it. The last two years shows what happens when you go down that bad path."
    • Question: "what about spin-offs? no one actually bought it."
      • "Could be perfectly legitimate"
    • Question: "what about companies that pay down debt on the last day of quarter, then reborrow the money at the beginning of next quarter?"
      • "When you see transactions at quarter/year end, it's usually monkey-business"
  • S-1: basic form for the registration of new issues
• The annual report
  • non-audited information
    • letter to shareholders
    • description of firm activities
    • management discussion & analysis
  • audited
    • income statement (i/s)
    • balance sheet (b/s)
    • statement of stockholder equity (n/a for non-profits)
    • statement of cash flows (scf <--- most important, as companies thrive when they generate cash from operations)
      • "if company is not generating from operations, what's the point? you can borrow money, but only for so long..."
      • "banker is best friend, until he wasn't...  they wanted $20M right now."
    • footnotes
    • auditor's opinions
    • statement of managements' responsibilities
• Underlying concepts
  • Period concept
  • Method of accounting
• Balance sheet: format
  • assets: economic resources w/future benefits (depreciated over life: building lasts 40 years)
    • very subjective: why 40 years?
    • depreciated at cost; if it appreciates, no ability to record the increase, under GAAP (under IFRS? yes, but only through equity, not P&L)
    • US GAAP is very conservative: assets can go down in value, not up
    • Question: "what is difference between GAAP and IFRS?"
      • "IFRS allows much more judgement. asks, 'would it be prudent to record something this way?'."
      • "Judgement not compatible with litigious U.S. society"
      • "No one is prepared for IFRS: schools, CPAs, etc..."
    • Examples
      • current assets
      • long-term investments (pick valuation method: mark to market, fair value, cost; when you acquire the asset)
        • fair value: gain/loss recorded on income statements
        • costs: talk about it, but don't record on income statement; can become impaired asset, which you need to "write it down"
        • Question: "how long can you defer write-down of impaired asset?"
          • Answer: "SEC guidance: 'it's not years, it's months'"
      • property, plant, equipment
      • intangible assets
        • "this is almost as fun as 'goodwill': mostly you expense R&D. if it's acquired, then you capitalize it as an intangible asset."
        • "patents are intangible assets; so are trademarks, copyrights, customer relationships."
        • "websites? If you're Amazon.com, you want to capitalize it. If you're GE, you don't care. You can do initial set up and design, you can't capitalize modification."
        • "software that you develop for your own use? capitalize. I'm going to take their payroll and capitalize it, that used to be expenses. Until they have a bad year, then they take more developers out of SG&A and capitalize it. This is what Diebold did that got them in trouble."
          • This is one of the five things that Diebold did that got them in trouble: there are only a couple things you can do to hide worsening results.
      • other assets
      • deferred charges
      • Question: "what about goodwill?"
        • Answer: "SEC is saying, if you have significant declines in share price or earnings, whatever you bought must be written down, because it's not worth what you paid for it."
        • "Goodwill can only down."
  • liabilities
    • current liabilities
    • long-term liabilities
  • equity
• "When I look at a company, I look at Statement of Cash Flows: see where company is making money in daily operations"
  • Three sections: 
    • Operating: making money
    • Investing: bought something
    • Financing: if not making money from operations, then where did cash come from?
• Example: Dwayne pulled up Blackboard, Inc balance sheet: three years between 2005-2007
  • Observations
    • Lots of cash: $206M. where'd it come from?
    • If you're not making money: be careful.  Will likely affect/impair goodwill, intangibles, deferred tax assets (future taxable income which is not going to be realized -- if you're not making money, this is going to go away),
    • "Companies get away with this all the time": meaning, "they're not writing it down when they should"
    • "Finance team is not being adequately transparent and having adequate integrity"
  • Now we move to current liabilities
    • 'Oh, here's where the cash came from: convertible debt; today, there are covenants that they need to comply with. $160M.  They can call the money due. Or cash call due immediately."
    • "How do you account for liabilities? Cost or fair value? It depends."
    • Convertible debt: say for $150M, with "conversion option feature", converts into stock, diluting shares; 
      • Two instruments: it's an "embedded derivative", which are booked at fair value
    • "It actually happened: Many companies in Q3 2008 had record quarters because they adjusted down their own debt: $150M debt that market only valued at $100M, because it was fair value. Even though the companies were contractually obligated to pay back the entire $150M. Even though you didn't retire the debt."
• "The rest is just presentation"
• Let's move to P&L:
  • They're making a lot more money in 2007
  • Story: 
    • R&D way up (more than doubled)
    • Before revenue went up
    • Gap was closed through Financing
  • How does GM record loaning money to dealers: Operating (because their business is to sell cars. financing enables operations.)
  • How about factory making watches, and I insure the factory; the building burns down; how do you record the money spent insurance. SEC says Investing, because it should match the asset.
• Non-GAAP financial measure
  • SEC: if you talk about non-GAAP on website or analyst calls, then it should be on your financial statements, too.  Usually in MD&A.
• Issues of concern in financial statements
  • Fair value
  • Revenue recognition
  • expense matching
  • use of reserves
  • write-offs
  • off-balance-sheet accounting
  • derivitives
  • Former chief counsel of SEC: "what would I spot as red-flags? I'd ask about any accounting that has judgements and assumptions."
• Restatements by reason/cause
  • Most come from revenue recognition
  • Next, cost
    • Example: I invest in a REIT-owned property. I replace the roof of that building. How do you record cost? If roof lasts longer than the building, then you expense it.
      • "People want to capitalize it. It must increase capacity, increase useful life.  People don't want to expense it."
  • Question: "as board member, there are thousands of transactions, on both revenue and cost: so where do we focus?"
    • "SEC says Diebold charge was 'recklessly not knowing'. So, all the 'squishy' areas. Look at accounting policies, compare to others in the industry, and follow-up when you ask the question."
    • "Ask about revenue recognition, and then follow it to its conclusion."
  • Question: "if you're not on budget or audit committee, what is my responsibility?"
    • "This info is targeted to financial expert and audit committee."
    • "Every board member should make it their business to be on top of the financial statements."
• Fair value
  • beware "bill and hold" transaction: Diebold did this: they had inventory, booked revenue, but still had ATMs -- turns out customer didn't request it. It was fraud.
• Cost recognition
• Use of reserves or estimates