JIMMY JONES
Advanced Auditing, Liberty University
Discussion Thread Critique for Wojciech Miezin:
Wells Fargo Case Study
Discussion Thread Critique for Wojciech Miezin: Wells Fargo Case Study
The case summary prepared by Wojciech Miezin for the comprehensive case analysis of Wells
Fargo included all of the appropriate and necessary information needed to be able to understand and
answer the corresponding questions. I appreciate the thoroughness of the information, knowing that the
content was condensed significantly. I went through the case in the textbook and noted any important
information to be included in the case summary and your case summary included everything perfectly. I
find that no other comments are needed to improve the summary and that the summary is complete
and reliable as-is. The following is a brief overview from Knapp (2022), "the Wells Fargo & Company case
examines the massive and high-profile scandal stemming from the company’s aggressive sales practices
that left the reputation of the prominent company in tatters. Critics questioned why Wells Fargo’s
independent auditors did not disclose the internal control deficiencies that allowed the questionable
sales practices to go unchecked for years," used only to quickly recap the case.
Case Questions and Answers
Identify the different types or classes of internal controls. How do internal controls over financial
reporting (ICFR) differ from the other types or classes of internal controls?
The three different types or classes of internal controls were identified and listed as follows:
"those affecting a company’s operations, those affecting a company’s compliance with regulations, as
well as those affecting a company’s financial reporting."(Miezin, 2022) The preparer's answer is
appropriate and correct, supported by COSO's 2013 framework for "the design and evaluation of internal
control systems for organizations looking to achieve operational, compliance, and reporting objectives."
(2019) I agree with the preparer's assertion that, "although many times a control can address multiple
objectives, internal controls over financial reporting (ICFR) only focuses on controls that affects financial
reporting, which was the focus of section 404 of the Sarbanes-Oxley Act of 2002," (Miezin, 2022) which
addresses that internal controls can overlap objectives and supports that ICFR reporting "pertain to
internal and external financial and nonfinancial reporting and may encompass reliability, timeliness,
transparency, or other terms as set forth by regulators, recognized standard setters, or the entity’s
policies." (COSO, 2019) The following descriptions aim to further differentiate ICFR from other internal
control classes, "operational objectives pertain to effectiveness and efficiency of the entity’s operations,
including operational and financial performance goals, and safeguarding assets against loss. Compliance
objectives pertain to adherence to laws and regulations to which the entity is subject." (COSO, 2019) I
agree with the inclusion of the five additional interrelated components of the COSO 2013 framework in
the answer, as it expands the depth of the internal control assessment to reach "an effective internal
financial reporting control system." (Miezin, 2022)
(COSO, 2019)
Do you agree with KPMG’s position that Wells Fargo’s improper sales practices did not involve the
company’s ICFR? Defend your answer.
I support the preparer's disagreement with KPMG's position that Wells Fargo's improper sales
practices did not involve the company's ICFR. I appreciate that the answer included a means of
assessment, the COSO 2013 framework, to use to discern if Wells Fargo's improper sales practices
involved the company's ICFR. The answer used appropriate and logical application to determine that
weaknesses existed in the ICFR and the improper sales practices would have been indicative of the
existence of further weaknesses in internal controls that should have been tested, disclosed, and
addressed. Senators Warren and Markey also argued that, "KPMG’s decision to not reference Wells
Fargo’s improper sales practices in its ICFR audit reports was inconsistent," supported by a study
released by independent board members, that "suggested that Wells Fargo’s flawed “corporate culture”
impacted the effectiveness of its ICFR and the reliability of its periodic financial statements." (Knapp,
2022) The most condemning evidence reported by the senators supporting that the improper sales
practices affected Wells Fargo's ICFR was that "credit card applications and new checking accounts had
plummeted by 40 percent" following the CFPB sanction and "the results of an independent study by a
consulting firm that projected the scandal would ultimately cost Wells Fargo $99 billion in deposits, $4
billion in revenues, and 30 percent of its customers." (Knapp, 2022)
How does the AICPA’s Auditing Standards Board define a material weakness in internal control? How
does the PCAOB define a material weakness in ICFR? What factors should auditors consider in deciding
whether an ICFR deficiency qualifies as a material weakness in ICFR?
The AICPA's Auditing Standards Board, AU 325, defines a material weakness in internal control as,
"a material weakness is a deficiency, or combination of deficiencies, in internal control, such that there is
a reasonable possibility that a material misstatement of the entity's financial statements will not be
prevented, or detected and corrected on a timely basis." (2009) In comparison, AS2201 states, "a
material weakness is a deficiency, or a combination of deficiencies, in internal control over financial
reporting, such that there is a reasonable possibility that a material misstatement of the company's
annual or interim financial statements will not be prevented or detected on a timely basis. Note: There is
a reasonable possibility of an event, as used in this standard, when the likelihood of the event is either
"reasonably possible" or "probable". (PCAOB, 2007) The definitions provided in the answer were correct
and complete for each respective association. The factors that auditors should consider in deciding
whether an ICFR deficiency qualifies as a material weakness in ICFR is most importantly, the use of
"professional judgment". (Miezin, 2022) The answer included support to the conclusion based on
absence of "clear tests on quantitative measures and qualitative measures need to be considered" and I
agree with the preparer that professional judgment is the overarching requirement needed to consider
and evaluate materiality factors. An auditor may evaluate severity as a factor, by identifying "whether
there is a reasonable possibility that the company's controls will fail to prevent or detect a misstatement
of an account balance or disclosure" and "the magnitude of the potential misstatement resulting from
the deficiency or deficiencies". (PCAOB, 2007) A misstatement doesn't have to actually occur, to perform
a severity evaluation. Auditors should consider additional evaluation factors when deficiencies have
been identified to determine if they qualify as a material weakness, such as risk factors. AS2201 states
that, "risk factors affect whether there is a reasonable possibility that a deficiency, or a combination of
deficiencies, will result in a misstatement of an account balance or disclosure," and "the evaluation of
whether a control deficiency presents a reasonable possibility of misstatement can be made without
quantifying the probability of occurrence as a specific percentage or range." (PCAOB, 2007) An auditor
should consider that, "multiple control deficiencies that affect the same financial statement account
balance or disclosure increase the likelihood of misstatement and may, in combination, constitute a
material weakness, even though such deficiencies may individually be less severe," and make an
appropriate determination about materiality. (PCAOB, 2007) Lastly, "the auditor should evaluate the
effect of compensating controls when determining whether a control deficiency or combination of
deficiencies is a material weakness. To have a mitigating effect, the compensating control should operate
at a level of precision that would prevent or detect a misstatement that could be material." (PCAOB,
2007)
Do you believe the decentralized nature of Wells Fargo’s corporate structure qualified as a “material
weakness” in Wells Fargo’s ICFR? Why or why not?
In and of itself, the decentralized nature of Wells Fargo's corporate structure wouldn't qualify as a
material weakness in their ICFR, because it wasn't one of the root causes of the scandal. I share
agreement with the preparer on the belief and acknowledgement that, "this could be a plausible
scenario in another instance," regarding decentralization not being a root cause in the case of Wells
Fargo. Decentralization is being cited as the scapegoat in an attempt to redress and ICFR issue as maybe
an operational control issue, only to remove focus from the Wells Fargo executives and to divert or
project the blame to lower-level managers and employees. As Witman (2018) states, "measurement and
incentive programs continued up the organization chart to include the branch and regional management
teams. They would have weekly, sometimes daily, conference calls to check on results, and it was
important to the managers to have good numbers to report. Further up the organizational chain, though,
at the senior management levels, incentives were tied less to the immediate achievements and more
toward longer-term results," which further serves to support your answer and my agreement that the
more likely culprit of a material weakness came from the cross-selling culture. (pp. 133-134) Hurley &
Hurley (2020) further asserts that, "management should have looked for the root of the problem not
hide behind the cloak of bank clerks" and "blaming the scandal on a few lower tier employees will not
pass the common sense standard." As mentioned previously, the determination of material weaknesses
takes professional judgment and we are provided with factors and evaluations that help in making the
determination for a deficiency. Senators Warren and Markey challenged the PCAOB to investigate
KPMG's ignorance in reporting and lack of consideration for the repercussions “of the fraud on the
company’s stock price,” the “reputational harm”, and the “flawed corporate structure” that the
independent board members identified as a “root cause of the scandal.”" (Knapp, 2022) In this case, I
believe the finding of "decentralization" to be an excuse of the outcome now, but in combination with
the other weaknesses in internal controls and a prior public sanction and fine, the decentralized
corporate structure should have qualified as a material weakness in Wells Fargo's ICFR initially, which
may have uncovered the fraud sooner. Corporate governance requires and is responsible for monitoring
internal controls, regardless of the claim of decentralization, the tone-at-the-top was still being conveyed
and received. As of August 2017, "an additional 1.4m unauthorized customer accounts and more than
500,000 bank customers were enrolled in online bill pay," proving that deficiencies in the internal
controls and ICFR continued to exist, even after the independent audit. (Knapp, 2022)
Does an audit firm of a public company have a responsibility to apply audit procedures intended to
determine whether the client has committed illegal acts that don’t directly impact its financial
statements? Explain. What responsibility does an auditor of a public company have if the auditor
discovers such illegal acts by the client?
I agree with the preparer's answer that," yes, an audit firm of a public company has the
responsibility if they are to determine whether the client has committed illegal acts that don't directly
impact the financial statements.". (Miezin, 2022) The support the assertion of responsibility, AS 2405
states "if specific information comes to the auditor's attention that provides evidence concerning the
existence of possible illegal acts that could have a material indirect effect on the financial statements,
the auditor should apply audit procedures specifically directed to ascertaining whether an illegal act has
occurred." (PCAOB, 1989) If an auditor detects illegal acts, they "should consider the effect on the
financial statements as well as the implications for other aspects of the audit", which may include
further investigation into the legality and materiality of the act, contacting an attorney for legal advice,
communicating findings with audit committee, provide an opinion on and provide disclosure in the
financial statements about the implications of the unlawful act on financial reporting. (PCAOB, 1989) The
preparer provided ethical reasoning to support the responsibility of audit firms and affirmed the public's
right to know.
While the Wells Fargo scandal was unfolding, several parties pointed out that KPMG had served as the
company’s audit firm since 1931. Explain how the length of an audit firm’s tenure may influence its ICFR
assessment for a public company client.
The length of an firm's tenure influences its ICFR assessment because the quality of an audit can
deteriorate over time due to complacency. An audit firm may rotate firm partners away from repetitive
audit clients to show an appearance of independence, but after a multi-decade relationship has been
established, the independence in fact comes into question. As the preparer discussed, the relationship
between Wells Fargo and KPMG may have been mutually beneficial but the inability to remain impartial
and honest created dilemmas that ruined the public's trust and cost Wells Fargo billions in fines and
reparations. I agree with the preparer's assessment that "auditors' independence and impartiality is of
the most critical importance in making audit judgments". (Miezin, 2022) The study conducted by Singer
& Zhang (2018), comparing former Anderson clients to control companies, suggested that "auditors with
shorter tenures are faster to discover financial misreporting" and "that the incumbent auditors were
slower in detecting the misreporting, which speaks to the benefit of a fresh view by a new auditor." (p.
316-317) The results of the study showed a positive correlation between shorter auditor tenure and the
speed in which misstatements are detected, which lends support that audit quality is reduced the longer
the auditor's tenure.
Christian Worldview Statement
I agree with the comparison between the obligation of an auditor to report illegal acts and the
obligation of Christians "to follow God's wisdom," referenced by Colossians 3:17, "and whatsoever ye do
in word or deed, do all in the name of the Lord Jesus, giving thanks to God and the Father by him."
(Miezin, 2022) In the case of Wells Fargo, the company's management, internal auditors, and KPMG
external auditors all acted illegally and unethically. Eventually, even the independent auditors of the
PCAOB became involved in a conspiracy with KPMG auditors. The assessment of the auditors, in my
opinion, may warrant further examples of the lack of or departure from Christian principles. Wells
Fargo's audit committee and senior executives are responsible for developing, implementing, testing,
and reporting on the effectiveness of the internal control system, especially the internal controls over
financial reporting. The longstanding relationship with KPMG proved to violate auditor independence
and created an environment apt for fraud. In 1 Peter 5:8, we are reminded to, "be sober-minded; be
watchful. Your adversary the devil prowls around like a roaring lion, seeking someone to devour," which
supports that complacency causes opportunities for internal control and audit failure. (English Standard
Version, 2001/2016) By 2013, "their clients had an average of 6.15 financial products per customer, 4
times industry average," showing an increase of 50% since 2000. (Miezin, 2022) Wells Fargo's growth
during this period should have been an indicator, used not only to gauge success, but to identify or
uncover possible deficiencies in the internal control system. The first phone call from a customer
explaining that they did not authorize an account to be opened on their behalf should have triggered an
investigation into all the newly opened accounts of existing customers and uncovered the fraud.
However, the branch managers had been instructed how to handle the customer inquiries to avoid the
customers from pressing the issue. In the Bible was are told, "do not be conformed to this world, but be
transformed by the renewal of your mind, that by testing you may discern what is the will of God, what
is good and acceptable and perfect," which contrasts the actions of the Wells Fargo executives and
auditors. (English Standard Version, 2001/2016, Romans 12:2) KPMG was aware that there were
internal control weaknesses and failed in their responsibilities to inform and protect the public. All of
the
auditors involved in the Wells Fargo failed to follow the most basic principles of a believer and in their
responsibilities and duties as audit professionals. In the end, Wells Fargo paid fines of $185m in 2016,
$640m in 2018, $3b in 2020, plus additional pending fines. From October 2016 to December 2017, the
aftermath led to the resignation of the CEO and termination of four executives at Wells Fargo, the
termination of five partners and one employee at KPMG, and the replacement of every member of the
PCAOB. The actions of the board members, executives, audit committee, internal auditors,
management, employees, external auditors, and independent auditors and the repercussions faced is
supported by the verse in Psalms 101:7, "no one who practices deceit shall dwell in my house; no one
who utters lies shall continue before my eyes." (English Standard Version, 2001/2016) The Wells Fargo
case is truly
astounding and speaks to how devoid of ethics, integrity, and faith those involved were. Thank you for
your comprehensive case analysis, it was well researched and presented clearly.
References
American Institute of Certified Public Accountants. (2009, December). AU section 325 communicating
internal control related matters identified in an audit. us.aicpa.org.
https://us.aicpa.org/content/dam/aicpa/research/standards/auditattest/downloadabledocuments/au-
00325.pdf
Committee of Sponsoring Organizations of the Treadway Commission. (2019, January). COSO internal
control – integrated framework. coso.org. https://www.coso.org/Documents/COSO-CROWE-COSO-
Internal-Control-Integrated-Framework.pdf
English Standard Version Bible. (2016). bible.com. https://my.bible.com/ (Original work published
2001)
Hurley, P. R., & Hurley, R. E. (2020). Lessons from Wells Fargo banking scandal. Academy of Business
Research Journal, 2, 78-91. http://ezproxy.liberty.edu/login?
qurl=https%3A%2F%2Fwww.proquest.com
%2Fscholarly-journals%2Flessons-wells-fargo-banking-scandal%2Fdocview%2F2472181117%2Fse-
2%3Faccountid%3D12085
Knapp, M. C. (2022). Contemporary auditing: Real issues and cases. (12th ed.). South-Western.
Public Company Accounting Oversight Board. (2007, November). AS 2201: An audit of internal control
over financial reporting that is integrated with an audit of financial statements. pcaobus.org.
https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201#_AppA
Public Company Accounting Oversight Board. (1989). AS 2405: Illegal acts by clients. pcaobus.org.
https://pcaobus.org/oversight/standards/auditing-standards/details/AS2405
Singer, Z., & Zhang, J. (2018). Auditor tenure and the timeliness of misstatement discovery. Accounting
Review, 93(2), 315–338. https://doi.org/10.2308/accr-51871
Witman, P. D. (2018). "What gets measured, Gets managed" The Wells Fargo account opening scandal.
Journal of Information Systems Education, 29(3), 131-138. http://ezproxy.liberty.edu/login?qurl=https
%3A%2F%2Fwww.proquest.com%2Fscholarly-journals%2Fwhat-gets-measured-managed-wells-fargo-
account%2Fdocview%2F2112126315%2Fse-2%3Faccountid%3D12085
