Hidden risk for CPAs.

Implement Y2K risk management strategies for accounting services

Editor's note: In the May issue of Leaders' Edge, Part 1 of this article focused on risk considerations related to tax, accounting and consulting service engagements; computer software recommendations and management consulting.

As the year 2000 approaches, business losses resulting from Y2K system problems are likely to escalate. Litigation to recoup losses will soon follow, dramatically increasing risk for CPAs. The AICPA Professional Liability Insurance Program recommends communicating with clients to alert them to the need to assess their Y2K readiness, and implementing risk management strategies such as those outlined in this article.

The following hypothetical examples illustrate the Y2K liability risks that could arise even before the year 2000 and may extend for some time beyond from various engagements an accounting practice may undertake. These examples are not exhaustive, but rather highlight some of the issues CPAs may face.

Risk Scenario

Valuation Services

In 1997, a CPA firm is engaged by a client to perform a business valuation of a company the client is planning to acquire. The target company uses several proprietary computer software programs, which are not year 2000 compliant. The CPA requests and receives from company management a detailed implementation plan to achieve compliance, and an estimate of $1,000,000 to repair the system. The company had already evaluated the work needed to repair the software and compared it to the cost of replacing the system. The client purchases the company. By the end of 1999, the client must spend $1,800,000 to modify the systems of the acquired company. The client sues the CPA firm on the theory that the cost estimates supplied to the CPA firm at the time the valuation was performed were not reasonable and were not appropriately evaluated by the CPA firm. The client seeks recovery of a portion of the purchase price of the business.

Risk Management Considerations

While evaluating contingencies and uncertainties is an inherent part of performing valuation services, there are significant risks in attempting to evaluate prospective costs for year 2000 remediation. Surveys performed in mid-1998 indicate that in many cases, costs for the remediation projects proved to be substantially underestimated, in part, because the scope of the problem was not fully known at the time estimates were made, and in part because the cost of hiring technology consultants capable of performing the work had increased substantially.

* CPAs should consider including disclaimers explaining the costs of remediation may significantly exceed management's estimates due to the uncertainties associated with completing a year 2000 project.

* If the CPA firm lacks the technical expertise to evaluate representations made by client management regarding its plan to correct year 2000 problems, the firm should consider either engaging a specialist to assist with this task or resigning from the engagement.

Risk Scenario

Audit Engagements

Auditing a Publicly Traded Corporation. A CPA firm audits a corporation, which had gone public in 1995. The client prepares and initiates a year 2000 plan in 1997. The client first comments on the existence of the plan in the 1998 financial statements. The client completes the testing and remediation project during 1999. In January 2000, the client experiences serious operational difficulties as a result of a Y2K problem, which had not been identified and addressed during the project. As a result, the client suffers a 30 percent decrease in sales during the first quarter. When the stock price drops following the announcement of first quarter sales results, a shareholder class action suit is filed against the directors and officers of the corporation as well as the auditors. The suit alleges the auditors failed to adequately investigate representations made by management regarding its year 2000 plan, and that it should have identified problems associated with the plan which led to the business disruption.

Risk Management Considerations

Client acceptance and continuance procedures for audits of publicly traded companies should be carefully examined and followed prior to agreeing to perform auditing engagements.

* CPA firms should follow AICPA recommendations contained in the Audit Risk Alert- 1997/98 and in the AICPA report "The Year 2000 Issue Current Accounting and Auditing Guidance," revised October 19, 1998, regarding language to be included in engagement letters, management letters and management representation letters (accessible on the Internet at www.aicpa.org). Additionally, review SEC Release No. 33-7558, effective August 4, 1998 (accessible on the Internet at www.sec.gov/rules/concept/33-7558.htm).

* CPAs should carefully evaluate representations made by management regarding year 2000 plans, and consult with a specialist if necessary. Note that in a scenario such as the one described, the auditor's report on the 1998 financial statements will be under close scrutiny in the subject lawsuit.

Auditing a Closely Held Corporation. Over a 10 year period, a CPA firm audits a corporation which manages hotels and motels. In the 1999 audit, the CPA issues a management letter advising the corporation's board of directors of the need to investigate the ability of its computer systems to correctly process the year 2000 transactions. At that time, the corporation is not able to hire the necessary technical consultants to test and modify its custom software applications and to complete its Y2K remediation project on a timely basis. In the year 2000, the corporation's nationwide computerized reservation system fails due to a Y2K design defect. The corporation estimates that it lost 5,000 booked reservations that could not be retrieved and identified. The corporation incurs additional expenses developing and implementing a system to handle reservations manually until the system is corrected. In addition, the lost reservations cause the corporation a significant loss of customer goodwill.

The corporation subsequently sues the consulting firm that installed the network, the manufacturers and developers of the hardware and software used in the network and the CPA firm. The CPA firm is sued on the theory that it failed to advise the corporation's board of directors in a timely manner of the need to investigate, assess and correct possible year 2000 problems.

Risk Management Considerations

The officers or directors of closely held businesses frequently are family members or outside investors who have little working knowledge of a business being operated primarily by a few key people. Because they are the parties responsible for the management of the company, establishing that they received all reports issued by the auditor will be a critical element in defending such claims.

* In addition to the recommendations listed above concerning the audit of publicly traded companies, the CPA firm should consider providing copies of the audit report and management letter directly to each officer or member of the board of directors of a closely held corporation.

* Additionally, it is important that auditors of 1998 financial statements address the year 2000 issue, following the guidance published by the AICPA on its Web site and in the various Risk Alerts and other practice aids.

Continental Casualty Company, one of the CNA insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program. CNA is a registered service mark and trade name of CNA Financial Corporation. This article should not be construed as legal advice or a legal opinion on any factual situation. CNA does not recommend or endorse any particular approach or solution to the year 2000 issue. CNA also does not make any representations, endorsements or assurances about information contained on any of the listed web sites or the accuracy of any of the information contained on such web sites. The views, statements, and materials contained on the web sites are solely those of the owner of the web site. In addition, CNA makes no recommendations regarding the appropriate service provider or tools for any particular person, entity or situation. The AICPA Professional Liability Insurance Program is administered by Aon Insurance Services, a division of Affinity Insurance Services, Inc. In CA, MN, and OK, it is a division of AIS Affinity Insurance Agency, in NH and NY, it is a division of AIS Affinity Insurance Agency.

RELATED ARTICLE: GASB Revisits Year 2000 Disclosures

In March 1999, the Governmental Accounting Standards Board (GASB) issued a final Technical Bulletin (TB 99-1) addressing year 2000 disclosures made by state and local governments. It is effective immediately and allows retroactive application.

So far, state and local governments' disclosures about their Y2K efforts have been well received by financial statement users, according to GASB Chairman Tom Allen. "However," says Allen, "concern about the uncertainty of the year 2000 environment has led some governments to receive a qualified audit opinion on their financial statements."

The AICPA and GASB have been working together to resolve audit concerns. Disclosures remain basically the same, but the revised Bulletin makes clear the disclosures were not meant to assure Y2K compliance; rather, they were meant only to show what the government was doing to address the year 2000 issue. Also, the disclosures may now be put either in "required supplementary information" or the notes to the financial statements. Previously, they were required to be in the notes.

In anticipation of potential audit-related questions resulting from TB 99-1, the AICPA issued new guidance addressing Y2K disclosures presented as required supplementary information. The guidance also addresses situations where governmental entities decide to reissue their financial statements to retroactively apply the provisions of TB 99-1. The AICPA has also amended the TB 98-1 guidance it issued in October 1998.

The Technical Bulletin is available at www.gasb.org; AICPA guidance is available via Fax Hotline at (201) 938-3787, Document #474.