One of the least noticed effects of the 2001�Sarbanes-Oxley law has been the subsequent moves by federal bank regulators to hold auditors and attorneys more accountable for maintaining an arms length relationship with their bank clients.

Several years after the enactment of Sarbanes-Oxley,�regulators took�action�to prohibit banks from indemnifying their audit firms, a move that has greatly enhanced the risk to accounting firms that perform reviews of bank financials. A very tangible example of this risk is provided by the case of Grant Thornton and First National Bank of Keystone, a national bank which failed as a result of a serious breakdown in internal controls and management fraud.

In December 2006, the Office of the Comptroller of the Currency announced that it would fine Grant Thornton $300,000 for its alleged role in the 1999 failure of the First National Bank of Keystone. The fine was imposed despite an administrative law judge's recommendation, following an extensive discovery process, that�the agency take no�action against the auditor.� Grant Thornton appealed the decision.

"The $1.1 billion-asset West Virginia bank failed seven years ago after massive fraud that ultimately led to convictions of its senior executives," according to the American Banker. � The OCC said Grant Thornton, called in to review Keystone's 1998 financial statements, overlooked "unequivocal, written evidence" that the bank was claiming more than $200 million of assets it did not actually possess.

"Grant Thornton's conduct demonstrated a disregard of, and evidenced a conscious indifference to, a known obvious risk of harm," Comptroller John C. Dugan wrote in a decision detailing the fine and a cease-and-desist order against Grant Thornton.� Yet the OCC has never explained, at least in public, why its examination and bank supervision personnel�missed the obvious warning signs at First National Bank of Keystone.�

In sworn testimony before Congress, former Comptroller John Hawke stated that the Keystone fraud had been "exceedingly difficult" to detect.� But�any reasonably competent observer, looking at the bank's financial statements provided to federal regulators, arguably should have known that something was amiss.

At year-end 1998, First National Bank of Keystone displayed a financial statement profile that was extraordinary to put it mildly.� Some 50% of the bank's asset base was deployed�in real estate loans, but these loans showed a gross spread or�yield of 1,700bp, three standard deviations ("SDs")�from the peer mean and well into subprime territory, according to data from the FDIC and calculations by the IRA Bank Monitor.� The relatively small WV�bank's reported ROA and ROE were also remarkable, in both cases several SDs above the peer mean.� Yet the bank showed a default rate of just 67bp, only�1.6 SDs above peer,�and a Loss Given Default of just 57%, extraordinary for a subprime lender.

Taken together, the year-end 1998 financial statements of First National Bank of Keystone seem to be littered with red flags, making us wonder whether the good public servants at the OCC and FDIC were caught�asleep at the proverbial switch and then decided to blame the Keystone�fiasco on the outside audit firm.� Keep in mind that First National Bank of Keystone had displayed erratic, above peer financial performance for years prior to the arrival of Grant Thornton in 1999.� As we say in the world of financial analytics, if it looks too good to be true, go find out why.

The OCC's enforcement action against Grant Thornton seems arbitrary and, to us,�illustrates the aggressive stance taken by regulators with respect to bank audits. In ignoring Administrative Law Judge Ann Z. Cook's�August 2005 ruling that the auditor bore only limited responsibility for Keystone's failure, the OCC was essentially taking an extreme position, especially given that administrative law judges frequently defer to and side with regulatory agencies in such matters.

In a commentary on the decision, former OCC lawyer Travis Nelson wrote that the standard for determining when a professional violates the OCC's rules regarding independence is not clear cut.

"The implications of the Grant Thornton decision are mixed,"�opined Nelson in the American Banker on December 29th. "The standard that the regulators must meet in bringing an enforcement action against a third-party consultant, accountant, or attorney -- conduct that constitutes 'disregard of, and evidencing a conscious indifference to, a known or obvious risk of substantial harm' -- is subjective. Though the regulators must measure the respondent's conduct against an established standard of care, determining how much deviation from that standard constitutes an unsafe and unsound practice is up to the examiners."

Nelson continued: "Ultimately, as practitioners and industry leaders have come to realize, what constitutes an unsafe and unsound practice is whatever the examiners say it is. This case is limited in providing insight on what regulators will view as reckless conduct by auditors and attorneys, because such cases are context-specific."

John Ziegelbauer, a partner at Grant Thornton's Washington office responsible for the firm's banking practice, argues that Grant Thornton's independence was never a true issue in the case. He opines in a letter to the editor published last week by the American Banker that the Keystone dispute "is about a bank whose entire senior management was involved in a fraudulent scheme that fooled dozens of sophisticated bank examiners and other regulators for years before Grant Thornton was retained to conduct an audit of Keystone."

"Did Grant Thornton, in its one audit of the bank, also miss the fraud?" asks Ziegelbauer. "Yes. How? Senior management and others forged hundreds, if not thousands, of documents and repeatedly lied to regulators, auditors, investment bankers, and anyone else who crossed their paths... The criminals who ran Keystone (all of whom received long prison sentences) also interfered with Grant Thornton's efforts to confirm Keystone's financial information with third-party loan servicers."

Ziegelbauer continues: "The enforcement 'principle' at work here is that what constitutes an unsafe and unsound practice is whatever the OCC examiners say it is, with the benefit of hindsight. This is a chilling proposition for those who believe in the rule of law."

The most important take away from the Keystone saga, which remains before the court in Washington DC, is that the federal regulators have raised the bar for auditors and other professionals very high indeed�when it comes to ensuring the safety and soundness of US banks. Not only have regulators imposed the same requirements of independence on auditors and attorneys who act for banks as exist under Sarbanes-Oxley for public companies, but violations of this standard are punishable by an enforcement action using the draconian safety and soundness provisions of federal banking laws.

In such proceedings, because of the broad powers granted to federal bank regulators to safeguard the solvency of�US banks, regulators are not held to the same standards of proof and fairness as apply in a civil or even criminal litigation.� Thus, as in the case of Keystone, the OCC was free to ignore the findings of fact�and recommendations of a federal judge.�� Indeed, as Grant Thornton has learned through painful experience, the accused in such federal enforcement actions are considered guilty until proven innocent.

Questions? Comments? [email protected]