The Ontario Securities Commission (OSC) has fined the former chief financial officer (CFO) of now-defunct forestry company Sino-Forest Corp. CAN$700,000 for "allowing alleged fraud to happen under his nose," according to the
Financial Post. In a settlement, David Horsely admitted he had failed to notice that the company had back-dated purchase and sales contracts. Horsely acknowledged he had limited knowledge of the operations of the China-based company's suppliers and customers — in particular its dealings with its most crucial counterparties. Instead, he relied on the word of company executives. Sino-Forest went out of business after it was accused of fraud in 2012. In addition to a fine, the OSC banned Horsely from being a director or officer of a publicly listed company, and Horsely agreed to pay CAN$5.6 million to settle shareholder lawsuits.
As this story demonstrates, executives can pay a stiff price when fraud occurs, even when they themselves are not the perpetrator. With so many businesses now operating internationally, CFOs, and possibly board members, now are vulnerable to operational practices in faraway locales. This case also indirectly raises several important questions about the most desirable qualities to look for in a CFO, the oversight responsibilities of the boards of international corporations, and the adequacy of corporate financial controls in such circumstances. These are all issues that internal auditors should think about and regularly assess as part of their audit plans.
Horsley's problems may have been caused partly by mixed messages and direction about the role and priorities of the CFO. For some years now, the CFO's role has been evolving — in some areas significantly. Once viewed primarily as a financial gatekeeper, the CFO role has expanded to be a strategic partner and adviser to the CEO. In a 2013 McKinsey & Co. report, 88 percent of 164 CFOs surveyed said CEOs expect them to be more active participants in shaping the strategy of their organizations. Half of them also indicated that CEOs count on them to challenge the company's strategy. Additionally, CFOs are sometimes expected to take on broader responsibilities, including procurement, asset management, and human resources management. At the same time, the OSC's ruling in this case clearly shows that a CFO must serve as the organization's financial authority, ensuring the integrity and control of financial data and modeling transparency and accountability.
From an audit perspective, it is critical that audit plans and programs address the roles and relative priorities established for CFOs. Auditors should be looking for balance, role clarity, clear segregation of duties, effective management controls, accountability, and reporting systems in at least five key areas, in each of which Sino-Forest's CFO demonstrated significant weaknesses:
Company strategy and performance, including budgeting and expense control. A CFO must understand the company's business model for generating customer value and must oversee budget preparations and translate the operational metrics into performance measures. He or she is the company scorekeeper, using tools such as balanced scorecards, dashboards, forecasting, and financial statement analysis to communicate both the company's expected and actual financial performance. The CFO also is responsible for overseeing the budget process, collecting inputs, and comparing the company's actual performance with estimates (i.e., the budget). It is debatable whether it is necessary for the CFO to always relocate to a company's main operations location. However in this case, Horsley, who was based in Canada, failed to acquire the kind of deep understanding of Sino-Forest's business in China, nor did he appear to seek expertise to compensate for it. Moreover, Sino-Forest's board did not take any action.
Cash flow. Overseeing a company's cash flow position is the most important role a new CFO has to play in any company. He or she must understand the sources and uses of cash, and maintain the integrity of funds, securities, and other valuable assets. The CFO receives, has custody of, and disburses the company's monies and securities. The CFO must exercise his or her authority to establish accounting policies and procedures for credit and collections, purchasing, payment of bills, and other financial obligations. As an OSC spokesperson stated, a "CFO needs to have a hammerlock on how revenue is collected and payments are made, regardless of where the company is located." Horsley did not have this, nor did he apparently take sufficient steps to ensure someone with the appropriate qualifications was assigned that job in Sino-Forest's China operations.
Liabilities. After cash flow, a CFO's responsibility is to understand all of the company's liabilities. A company has many legal contracts, statutory and tax obligations, hidden liabilities (e.g., contingencies, leases, or insurance summaries), and expectations from loan covenants and the board of directors. If a company's CFO is not watching out for the liabilities, who is?
Financial Obligations. A CFO needs to approve all agreements concerning financial obligations, such as contracts for raw materials, IT assets, services, and other actions requiring financial resources. The CFO also needs to have, either directly or via subordinates, a comprehensive appreciation of who the company's customers and suppliers are. A part of that is knowledge of the company's ownership and control over suppliers, another failing of Sino-Forest's CFO.
Record control. The CFO is responsible for the financial aspects of all company transactions including real estate bids, contracts, and leases. He or she also provides for insurance coverage, as required, ensures the maintenance of appropriate financial records, prepares required financial reports, and ensures audits are completed on time and statutory book closings occur. The CFO also ensures the company's compliance with financial regulations and standards such as the U.S. Sarbanes-Oxley Act of 2002, government tax codes, and U.S. Generally Accepted Accounting Practices or International Financial Reporting Standards. In this case, the CFO admitted not knowing that purchase and sales contracts were being created in the financial quarter after they were dated.
If hypothetically, Sino-Forest's CFO had taken steps to ask that the company's internal audit function assess these five role factors, and then discussed the results with the company's board, would the outcome have been different? It is something to think about.