Seven Years of Standing Trustee Audit Findings Reflect Changes in Business Environment

This article originally appeared in NACTT Quarterly (January/February/March 2014)

Trustee Audit Findings

In the July/August/September 2012 issue of NACTT Quarterly, we wrote about the role annual standing trustee audits play in the United States Trustee’s oversight of standing trustee operations. As a follow-up to that article, here we take a look at annual audit findings since 2004 to see what has changed and what factors might have affected those changes.

Each chapter 13 standing trustee is audited by the same audit firm for up to five years. After a maximum of five years, a new audit firm is selected. While the audit firms perform audit services using the same statement of work, each firm has its own approach to risk analysis and particular areas of emphasis.

Generally, the largest number of audit findings is reported during a trustee’s first year with an audit firm. Standing trustees take auditor comments very seriously because they point out procedural weaknesses and are a good management tool to identify and mitigate risk. To the extent possible, trustees resolve identified issues or, at a minimum, mitigate risks using available staff or resources. As a result, by year five of an audit engagement, there generally are very few new findings. A new audit firm is then brought in to bring a “fresh” perspective to the review.

Recently, we took a look at how audit findings have changed over the years. Because of the tendency for findings to drop off in later years with the same audit firm, we compared the first year of several different audit cycles. Table 1 shows trustees’ top five first-year findings for Fiscal Years (FY) 2004, 2009 and 2011.

There are several findings that appeared during every audit cycle. One such finding, segregation of duties, showed up in each of the years examined, although its frequency decreased markedly over the seven-year period. In FY 2004, 36 percent of trustees in their first year of the audit had this finding; by FY 2011, the number had dropped to 14 percent. We suspect, in part, that this improvement was due to an increase in staff by trustees to handle a growing caseload. It is easier for larger offices to segregate duties than smaller offices, although small offices can mitigate risk with greater day-to-day involvement by the standing trustee. The other obvious reason, of course, is that, after discussions with the audit firm and the U.S. Trustee, standing trustees address and correct specific internal control concerns identified in audits. It makes sense that the finding would not reappear in future years unless there was a significant change in office organization.

A second recurring finding related to issues with expense accounts. This finding encompasses an assortment of issues including inadequate controls over disbursements, insufficient documentation for expenses, problems with payroll taxes, credit card issues and expenses paid in excess of the approved budget. In FY 2004, 40 percent of trustees in their first year of an audit cycle had this finding. In later cycles, the frequency dropped to between 26 percent and 28 percent. We conclude that the decrease after 2004 was due to improved expense controls in trust operations, and we hope to see this trend continue.

Decreases or Increases in Risk

Some risks have been virtually eliminated over the years as a result of changes in technology. Initial control over receipts is a good example. That finding includes items not received or reviewed under dual control, insufficient logs or an absence of logs, failure to have someone independent of the process review logs for completeness and accuracy, and insufficient controls over processing of miscellaneous receipts. In FY 2004, 39 percent of trustees in the first year of their audit cycle had some sort of problem in this area. This number dropped to 23 percent in FY 2009 and to 8 percent in FY 2011.

Why was initial control a more problematic area in FY 2004? At that time, debtor payments were made almost exclusively by paper checks—personal checks, bank checks and money orders—that were delivered to the lockbox at a third-party location, usually a bank. In addition, with the increased presence of certified public accountants on staff in trust operations, procedures for handling checks have strengthened. There can still be issues with initial receipt, but the reduced number of paper checks received in an office combined with strengthened controls means the opportunity for problems are more limited.

Interestingly, though the frequency of a finding may have remained unchanged, the risks associated with that finding may have increased over time due to emerging technologies. Computer system security is an example. This finding includes such issues as a trustee’s failure to review and/or test user profiles; employees with more access than required for their positions; and uncontrolled access to software systems by third parties (often software vendors). The percentage of trustees with this finding has remained fairly constant since FY 2004, but clearly the nature of the risk has evolved. Trustees have addressed the growing complexity of computer system security by increased use of expert consultants and improved reporting tools.

Sometimes a finding may become more prevalent based on information the U.S. Trustee Program provides in yearly calls with audit firms in which particular areas of concern are addressed. The audit firms incorporate that information into their audit programs and, as a result, there frequently is an increase in the number of related findings. For example, in FY 2000, the U.S. Trustee Program discussed with the audit firms an embezzlement that took advantage of weaknesses in suspense account procedures. With an enhanced focus on that particular area, that year the number of trustees with identified suspense account issues nearly tripled, going from 13 in FY 1999 to 38 in FY 2000.

Changes in Law and USTP Policy

Some trends in findings reflect changes in law or U.S. Trustee Program policy. For example, the Bankruptcy Abuse Prevention and Consumer Protection Act of 2005 included a new requirement for chapter 13 standing trustees to provide two written notices to the holder of a domestic support obligation (DSO) claim and the appropriate state child support enforcement agency. In 2008, the audit services statement of work was amended to require auditors to sample cases with DSO claims to ensure the appropriate notices were sent. An increase in the number of findings related to this new requirement was fully expected. Similarly, in 2009, the U.S. Trustee Program asked auditors to sample final reports filed in dismissed, converted and discharged cases to verify compliance with filing deadlines. While the filing deadlines had not changed, it was an issue that had been highlighted for the standing trustees in the October 2008 Instructions to the Standing Trustee’s Final Report and Account and the U.S. Trustee Program wanted to test compliance. Similarly, after the Handbook for Chapter 13 Standing Trustees was modified in 2010 to require trustees to review eight management reports every month, the auditors were asked to verify compliance.

The procedures described above are captured under the case monitoring finding, which also encompasses negative balances, case reconciliation and monitoring of case information entered into the computer system. As expected, the number of case monitoring findings jumped significantly after the U.S. Trustee Program requested verification of compliance. Table 2 shows the number of findings made after specified changes were made to the statement of work.  

Conclusion

Standing trustee audit findings are a window into the business environment in which the trust operates. The statement of work for trustee audits is annually reviewed to determine if revisions are necessary to reflect new trustee duties imposed by statute, new policies or specific events and trends. These duties often result in new or modified procedures in the trustee’s office. The annual audit and any subsequent findings are a means for the trustee and the U.S. Trustee Program to evaluate the adequacy of new procedures and determine if there are any deficiencies in controls so that any problems can be resolved quickly