Think of her as the mother of 404. Not that that's a goal she ever imagined or one she has embraced. But the odyssey that began when Cynthia Cooper, the then–vice president of internal audit at WorldCom, decided to investigate anomalies in the company's accounting entries ended by inspiring critical — and heavily criticized — legislation: the U.S. Senate responded to revelations about massive accounting fraud at the telecom giant by adding Section 404, on the assessment of internal controls, to the Sarbanes-Oxley Act. For public companies, the rest is history. For executives, Cooper's experiences challenging then-CEO Bernie Ebbers and then-CFO Scott Sullivan, brought to life in her new book, Extraordinary Circumstances (John Wiley & Sons, February), offer lessons that are as fresh today as when the scandal first broke.
When did you first suspect that something might be wrong at WorldCom?
It was a process. My feelings changed from curiosity to discomfort to suspicion based on some of the accounting entries my team and I had identified, and also on the odd reactions I was getting from some of the finance executives.
For example, the CFO [Scott Sullivan] asked me to delay our capital-expenditure audit. When I received an E-mail from the controller telling me that I was wasting my time auditing capital expenditures, it made me uncomfortable. When I showed [our evidence] to the external audit partner, he wasn't initially concerned. In fact, the audit committee actually gave Scott the weekend to write a white paper supporting his position.
Nobody wants to believe that the CFO is perpetrating a multi-billion-dollar fraud, especially somebody as respected as Scott Sullivan. But as my suspicions grew, my team and I began working at night and behind closed doors because we didn't want to be detected. We were running so many queries of the accounting system that we were starting to crash it.
When did it come together for you?
Eventually we went door-to-door in the accounting department, working our way up the chain of command. When we finally confronted the controller, David Meyers, he confessed. His wife later told The Wall Street Journal that he had decided that if I came to him and confronted him directly he would tell me the truth. He also said he felt better that day than he had in years.
How long was it after the MCI merger before people thought, "Uh-oh, this is a mistake"?
I would say that there was a consensus across the company that it was a mistake. First of all, the company had to take on a huge debt load to acquire MCI. And a significant portion of MCI's business came from residential sales. Up until that point WorldCom's strategy — and Bernie Ebbers really kept to this philosophy — had been to stick to business customers, a market with higher margins and less turnover.
Who was really behind the decision — Ebbers or Sullivan?
Scott was the one who convinced Bernie to buy MCI, in addition to Jack Grubman and Salomon Smith Barney. Other than the CEO, the CFO at WorldCom had the greatest influence on the company's strategic decisions. Bernie had a great deal of respect for Scott. As much as anyone, Scott had influence on Bernie as well as on the board. At one point, Bernie was going to acquire a company called Nextel. Scott balked at that decision and actually threatened to quit, so Bernie backed out of the deal.
Was there anything about the culture of WorldCom that contributed to the scandal?
I think Bernie's personal propensity for taking risks contributed to both the rise and fall of the company. He loaded it with some $40 billion in debt to fund one acquisition after another. He followed the same strategy with his own investments, taking out loans and using his WorldCom stock as collateral. His personal decisions then affected his business decisions, because he ultimately saw his net worth disappear, and he was left owing WorldCom some $400 million for loans approved by the board.
In light of your experiences at WorldCom, what's your view generally of the internal audit function?
The reporting structure for the internal-audit function often presents a conflict of interest that, so far, Corporate America has been content to live with. Many chief audit executives still report to the CFO, who determines their compensation. If we want the most independent internal-audit function possible, internal audit should report both functionally and administratively to the audit committee. The next best option would be for it to report functionally to the audit committee and administratively to the CEO. That said, internal audit has come a long way.
In general, internal audit has better relationships now with the audit committee, and more chief audit executives are reporting functionally to the audit committee. The one problem I do see post-Sarbanes Oxley is that the role of internal audit has, in many departments, been narrowed because of Sarbanes Oxley 404 testing, which has been moved to internal audit, consuming their time and preventing them from performing risk based audits.
Section 404 wasn’t initially part of the Sarbanes Oxley Bill that passed the House. It was added in the Senate only after the WorldCom fraud. These two paragraphs in the act have proven to be an albatross for corporate America. What Worldcom and a lot of the recent corporate scandals have in common is collusion at the very highest levels of the company, which means most of the basic controls can be bypassed.
Has 404 had any positive effect?
One of the most positive impacts of 404 is that executive management and the board now recognize the importance of a strong internal-control framework, which means support for internal-audit departments that have often struggled for resources and stature. At one point early in my career I was told not to use the words internal controls in my audit reports because it aggravated Bernie; he didn't understand it. I doubt that there's a CEO in the country today who would say that.
What would you want to leave people with regarding the recent corporate scandals?
I encourage people not to give in to the thinking that fraud won't happen in their companies. History has a way of repeating itself, and based on human nature there will always be fraud. When there's increased pressure due to another boom-and-bust in the market, there may well be another rash of frauds. I think we have to do our best not to forget what we've been through and hold tight to the positive changes in corporate governance that so many people have worked to achieve.