PFGBest and Audit Red Flags

The bankruptcy of PFGBest and attempted suicide of its founder have reporters writing some interesting stories. New York Magazine says there were obvious red flags such as this detail posted by Reuters:

Jeannie Veraja-Snelling has been certified in the state of Illinois since 1999.

However, she does not list having any public company clients in her 2011 annual filing with the PCAOB.

On Tuesday night, she came to the door wearing a green sleeveless shirt and blue denim shorts. A stack of cardboard filing boxes was sitting just inside the door.

Why should we accept that the size of an audit firm or the clothes of an auditor are red flag signs?

I mean you always have to account for (pun not intended) the Enron fraud fiasco taking down the entire 85,000 employees of Arthur Andersen. And you also have to consider applying the same logic about size to other professionals such as doctors or dentists. An exit from large headquarters and staff to run a small practice is not necessarily a step down.

The future, ever more fueled by social network tools, could be argued to be headed towards umbrella firms of peer relationships between independent but small practitioners. Lower overhead yet more personalized service is a trend. Peer respect or presence in the market is not set by size alone. The age of “giant” corporations made sense when you were talking about smelting iron but in the information age a small firm may be superior to large ones in many ways.

Large firms, meanwhile, tend to face pressure to make money to cover their overhead. That pressure can often lead to fraud. PFGBest, for example, was very large. We know that the founder of the firm confessed to fraud and was known for excessive displays of wealth. The external auditor’s appearance pales in comparison, in terms of signs of fraud, to the corporate jets, giant gifts, large construction projects of the PFGBest founder.

That being said the true worry in the story is the independent auditor’s lack of records and lack of awareness. Also of concern, although I haven’t seen anyone report on it, is a lack of a peer network with other auditors or professionals in her area of expertise. Regulators definitely could have picked up on that, especially if they tested her annually. Did her skill and reputation match her responsibilities?

The PCI SSC regulates its auditors closely by regular tests and reviewing the reports on compliance. It’s a decent model for other regulators to follow. The quality assurance program for assessments and assessors is one of the primary factors that makes PCI DSS so much more rigorous than other regulations.

Another aspect of the PFGBest story is how the founder managed to hide his crime, as revealed by New York Magazine.

“I was able to conceal my crime of forgery by being the sole individual with access to the US Bank accounts held by PFG. No one else in the company ever saw an actual US Bank statement. The Bank statements were always delivered directly to me when they arrived in the mail. I made counterfeit statements within a few hours of receiving the actual statements and gave the forgeries to the accounting department.”

[…]

Later in the note, Wasendorf detailed how he had falsified bank documents “using a combination of Photo Shop, Excel, scanners, and both laser and ink jet printers” in order to fool regulators into believing that his firm, which is now bankrupt, had adequate money in its accounts.

Sole control? Financial companies usually force annual vacation, as explained by businessfinancemag.com, to let others run the numbers and verify controls.

Job rotation/mandatory vacation ranked second in effectiveness; companies with this control in place experienced a median loss 61 percent lower than the median loss incurred by the other organizations in the sample.

Source: Association of Certified Fraud Examiners

How did PFGBest avoid that time-honored practice? The excessive displays of wealth coupled with dictatorial control — accumulation of wealth coupled with lack of transparency — are the common red flags for corruption. Denim shorts and low overhead may not inspire confidence on their own but they tend not to show up in anti-fraud research.

2012 BSidesLV: Big Data’s Fourth V

I will be presenting at the 2012 BSidesLV conference:

Big Data’s Fourth V: Or Why We’ll Never Find the Loch Ness Monster

When: 1400, Wednesday, July 25, 2012
Where: Breaking Ground
Cost: Free (as always!)
Link: http://bsideslv.com/talks.php#bg104

Variety, Volume, Velocity and Vulnerability. We know many different types of data are being generated at high speed but how much do we know about the new weakness they introduce? Security is often an issue in Big Data but rarely understood or discussed openly. This presentation brings forward the giant elephant in the room and offers the audience some real-world puzzles of big data to solve. Examples of humorous failures as well as some success are presented as examples. You might think your security problems are big until you are asked to help find some solutions for Big Data’s Fourth V.

Video of the presentation:

Some of my other BSides presentations:

USCG Arctic Shield Operation

After the end of WWII hostilities the U.S. Navy deployed “task forces” all over the world. From the South Pole to the North Pole there were military teams mapping territory, assessing risk and seeking out remnants of opposition.

At least a dozen ships with double that many aircraft were assigned to study “techniques” for operation in extreme conditions and remote locations, as well as gather information the military considered “interesting”. Whether fueled by fear, suspicion or curiosity, the missions and their findings kicked off a huge body of knowledge about survival and risk management.

One way to get a sense of the number and types of teams is to look at photographs from aviation archives. Here’s a 1947 photo from LogBookMag of a Navy Douglas R4D-5 Skytrain (AirForce C47A) launching from an air craft carrier in Operation Highjump. Note the snow skis and the use of jet-assistance (JATO bottles).

R4D-5 Skytrain Launches

JATO was effective not only for small carrier runways but apparently also came in handy after skis froze to the ground.

By 1951 some believed that the U.S. was at risk of attack by the U.S.S.R. from the north. The CIA Factbook map makes it pretty obvious why; the distance straight over the pole is far shorter than following a latitude.

North Pole

The threat of increased traffic warranted understanding the region, establishing forward bases and learning to operate there. The American military stepped up research on extreme temperature survival, early-warning systems and rapid-response above the Arctic Circle.

Innovations like the “flying laboratory” were developed and used in Project Skijump, although it had a landing-gear failure in 1952 and was lost to the Soviets.

Fast forward to today. The U.S. Coast Guard has announced a massive expansion of operations above the Arctic Circle and a forward base at the northernmost city in America. The Fairbanks Daily News gives their perspective on the need for assistance.

Barrow is surrounded by open tundra and the Arctic Ocean. As sea ice continues to disappear, the city will begin to experience increasing boat traffic, both from companies planning to drill for oil and travelers looking for a shortcut from the Atlantic to the Pacific.

That is why the Coast Guard sent an aviation team more than 900 miles from its home in Kodiak to Barrow: It needs to be prepared if something goes wrong.

I wonder how much of the preparation from the past is useful for future incidents. The NYT makes it sound like the USCG is starting from scratch.

“The Arctic has been identified as a priority,” said Cmdr. Frank McConnell, the operations coordinator for Arctic Shield, which includes in its initial phase two Coast Guard cutters and two smaller ships, in addition to the two helicopters that will be stationed here in Barrow. The first of 25 pilots, along with support crews, mechanics and communications personnel, began rotating through Barrow this month on three-week tours. “There’s a lot to learn,” Commander McConnell said.

That’s what they said in 1947.

Chinatown Sues over Shark Fin Ban

Chinese sentiment last year clearly turned against shark fin, as reported in xinhuanet.

A Chinese lawmaker has proposed that the country’s top legislature ban the trade of shark fin, a high-end delicacy consumed by wealthy people in China and East Asia.

Shark-fin trading generates enormous profits, but encourages overfishing and brutal slaughter of sharks, of which some 30 species are near extinction, said Ding Liguo, deputy to the National People’s Congress, the top legislature.

Just a few days ago, in a logical next step, China announced a shark fin ban at official receptions.

China’s Government Offices Administration of the State Council (GOASC) is to issue guidelines to ban serving shark fins at official receptions, according to a report by news website CNTV.cn on Monday.

An official with the GOASC said the guidelines, instructing all levels of government agencies to stop serving the delicacy at such events, will come out within one to three years, the report said.

Meanwhile, back in San Francisco the Chinatown Neighborhood Association (CNA) has filed a lawsuit against AB 376, the state law set to ban of shark fins in California by July 2013: Chinatown Neighborhood Association et al., v. Edmund Brown, et al.

CBS News points out that the lawsuit centers on racial bias.

Two Asian-American groups have challenged the state’s shark fin ban in a federal lawsuit in San Francisco, claiming it discriminates against Chinese Americans because it blocks cultural uses of shark fin soup.

“It discriminates against people of Chinese national origin by targeting and suppressing ancient cultural practices unique to people of Chinese national origin,” the lawsuit alleges.

[…]

Its use dates back to the Ming Dynasty in the 14th century, the lawsuit says.

The CNA arguments are not very convincing. First, as Chuck Thompson explains perfectly, the lawsuit fails rudimentary logic and simple historical checks.

“Shark fin soup is popular because it was learned from Hong Kong twenty years ago,” [Clement Yui-Wah] Lee told me. “And even if 500 years ago some Chinese were eating it, this doesn’t mean it’s a tradition we have to follow. Chinese people don’t bind women’s feet anymore because we know it’s wrong.”

Lee is right. The Chinese don’t bind women’s feet anymore. It is just as true that the menu for the wedding feast of the Guangxu emperor in 1889 included no shark product of any kind.

Eating shark fin is to Chinese what eating Caviar is to Americans. Refusing to eat shark fin soup because of documented harm does not make anyone less Chinese. It might actually be the opposite; a more traditional Chinese custom is to study, respect and honor nature. Here’s another perspective on this same issue from Chinese NBA star Yao Ming

While shark fins have been used to make soup for hundreds of years, until recently consumption was limited to a small elite, said Yao, who gave up eating shark fin in 2006 and says he avoids events where it is served.

Perhaps the California law should have been written to say “shark fin soup is prohibited unless you are the Ming Dynasty Emperor of China.” Since there just isn’t much chance of that happening might as well just say it is prohibited.

Second, how does the race card play if the Chinese are officially banning and publicaly avoiding shark fin soup? At this point we could say the California law supports and honors Chinese culture by calling for a ban. Kudos to California for supporting Chinese conservationists and trying to help prevent shark extinction.

Photo by me...swimming with friendly blacktip reef sharks.

Updated to add: A 2011 Pew report called “The Future of Sharks: A Review of Action and Inaction” gives some detailed market data and analysis

Sharks are particularly vulnerable to overexploitation because of their biological characteristics of maturing late, having few young and being long-lived.

Inside the report you can find who is killing the most sharks and who is buying fins

Given that the Top 20 account for about 80% of global reported shark catch, the future sustainability of shark populations is effectively in their hands.

The future of sharks?

Here is some of the data on U.S. shark kill, which emphasizes that fins are not well tracked but the exports primarily go to Hong Kong.

Frozen shark fin is not identified separately in U.S. trade data. However, Hong Kong import data indicate that in 2008, 251 t of dried and frozen shark fins were imported from the United States in 2008 (Oceana 2010). Given that only 8 t of dried fin were identified in the U.S. export data as exported to Hong Kong that year, it is assumed that the majority of fins is exported as frozen product and is included in the U.S. data as “sharks, frozen, nei.”

[…]

In 2008, the U.S. reported that of its 35 identified shark stock/complexes, four were subject to overfishing and four were overfished, and the status of about 20 others was unknown or unidentified (NMFS 2009). Shark finning was banned in U.S. Atlantic fisheries in 1993, and this ban was extended nationally in 2000. As of 2008, all sharks in the Atlantic Highly Migratory Species Fishery must be offloaded with fins naturally attached.