As I reported in my September 22, 2020, blog post, “SEC Focus on Municipal Securities: Disclosure and Enforcement – The Peculiar Structure of the Municipal Securities Disclosure Regime,” in March 2019, the U.S. Securities and Exchange Commission (“SEC”) filed a civil lawsuit against the former controller of the College of New Rochelle, a non-profit college in Westchester County, just north of New York City. The college had gotten in financial trouble due to declining enrollment and a falling collection of pledged donations. Beginning in 2013 the controller falsified financial records and failed to pay payroll taxes so that by 2015, the college’s financial statements overstated net assets by almost $34 million. In order to try to keep the college in operation, the controller began secretly using money from the college’s endowment funds to pay for operating expenses, and by 2015, the $30 million endowment was depleted to $8.8 million.

The ‘Education’ of KPMG at the College of New Rochelle

The college had issued bonds in 1999 that remained outstanding. It was obligated under the related Continuing Disclosure Agreement (“CDA”) to disclose its financial condition annually, including providing audited financial statements. There was no disclosure of the college’s deteriorating condition and tax obligations. While the SEC brought a civil case against him, the controller was also charged in a parallel criminal case for committing securities fraud; he pled guilty and is serving a three-year sentence in federal prison. In September 2019, the college filed for bankruptcy as a result of its continuing decline.

The college’s independent auditor, at least for the years 2013 through 2015, was KPMG LLP, one of the four largest accounting and audit firms in the world. Christopher L. Stanley, age 44, was the engagement partner of KPMG on the college’s 2015 audit and had final audit responsibility. Stanley joined KPMG as an Associate in 2001 at age 24, was promoted to Manager in 2004, to Managing Director in 2014, and to Partner in 2015. Stanley was a member of KPMG’s Higher Education, Research and Other Not-For-Profit dedicated practice group and, according to the SEC, “had extensive experience auditing higher education and not-for-profit entities.” Among other things, he knew that the annual financial statement required by the CDA would be submitted to the Municipal Securities Rulemaking Board for posting on its Electronic Municipal Market Access (“EMMA”). He resigned from KPMG in March 2020.

During the 2015 audit, the controller was evasive, failed to respond to requests for information, and would disappear for days at a time. Indeed, in emails, KPMG audit team members complained to each other (although not to Stanley) that the controller “just makes numbers up.” In September 2015, Stanley met with the College of New Rochelle Audit Committee to review a draft of the 2015 financial statements, which included a slide showing still open items and unanswered questions but did not inform them that the delay was caused by the controller’s erratic behavior. On November 30, 2015, the college’s President left a voicemail for Stanley that the college’s bank was demanding the 2015 audited financial statements, by December 1, 2015, or it would no longer advance funds. In response, Stanley and the Senior Manager on the engagement “reviewed the open items and [in the SEC’s words] UNREASONABLY concluded that none” of them “should prevent KPMG from issuing its audit report.” Stanley approved the issuance of the financial statements by mid-afternoon of November 30, 2015, and falsely certified that the audit had been performed in accordance with Generally Accepted Auditing Standards (“GAAS”), when it had not.

Being Held Accountable by the SEC

On February 23, 2021, the SEC instituted a disciplinary proceeding against Stanley under SEC Rule 102(e). Stanley made an offer of settlement, which the SEC accepted, finding any number of failures to obtain appropriate audit evidence, failures to prepare audit documentation properly, failures to examine journal entries for fraud (allowing the controller to override audit requests), failures to assess the risk of material misstatement, failures to communicate audit challenges to the Audit Committee, failures to supervise the audit properly, and failures to exercise due professional care and skepticism. As part of Stanley’s offer, he undertook not to serve as the engagement manager, engagement partner, or engagement quality control reviewer in connection with any audit to be posted on EMMA UNTIL reinstated to practice before the SEC as an independent accountant.

The SEC imposed a three-year suspension of Stanley’s ability to appear before the SEC as an accountant for a public company. He may file an application for reinstatement after three years if an audit firm regulated by the Public Company Accounting Oversight Board sponsors his application. In a related Rule 102(e) proceeding instituted by the SEC on the same day, the SEC brought similar charges against Jennifer M. Stewart, age 34, including the false certification of compliance with GAAS. Stewart made an offer of settlement which was also accepted. Stewart was the Senior Manager on the college’s 2015 audit. She had joined KPMG in 2008 as an Associate and was promoted to Senior Associate in 2010, Manager in 2013, and to Senior Manager in 2015. Her employment with KPMG ended in March 2020.

Similarly to Stanley, she undertook not to take on audit work expected to be posted on EMMA until reinstated by the SEC. The SEC imposed a one-year suspension of her ability to practice before the SEC, with otherwise similar conditions to obtaining reinstatement.

In this matter, two young auditors, notwithstanding their relatively rapid promotions at a prestigious accounting and audit firm, had their “licenses” to practice their profession before the SEC suspended for significant time periods, had their reputations for due care and professionalism permanently scarred, and lost their respective employment, not due to some corrupt misuse of professional status, but out of an over-concern for an audit client, emergent action to meet a bank’s demands, AND an inability to confront the controller’s behavior with skepticism.

As Herodotus ( c. 484-c.425 B.C.E., whom Cicero called “The Father of History”) wrote in The Histories, Book VII, ch. 10:

Haste in every business brings failures.