August 25, 2011
NINA FOOTWEAR, INC., Plaintiff,
SALIBELLO & BRODER LLP, Defendant. Index No. 602340/2007
DECISION AND ORDER
JANE S. SOLOMON, J.S.C.:
This professional malpractice action arises from the audit by defendant Salibello & Broder LLP (S & B), an accounting firm, of the certified financial statements of plaintiff Nina Footwear, Inc. (Nina), for the years 2004 and 2005.
Nina alleges that S & B negligently failed to detect a fraudulent embezzlement scheme whereby Nina's accounts payable clerk, Dwight Ashe (Ashe), with the assistance of a mail room employee, Rovin Smith (Smith), stole in excess of $1.5 million by forging checks between June 2004 and August 2006.
S & B moves for summary judgment (CPLR 3212) dismissing the complaint in its entirety or, in the alternative, dismissing all claims for amounts embezzled prior to June 13, 2005, the date that S & B issued its audit report for 2004. S & B also moves for summary judgment on its counterclaim for contractual indemnification pursuant to a provision in the engagement letters.
Nina cross-moves for an order striking the first and second affirmative defenses in S S B's answer. The first affirmative defense asserts that Nina's damages were caused solely by its own negligence and culpable conduct. The second affirmative defense pleads comparative negligence on the ground that Nina's damages were caused in part by its own negligence or culpable conduct. Also, Nina withdraws its breach of contract claim, leaving only a single cause of action for malpractice.
S & B's motion for summary judgment is granted to the extent of dismissing all claims for amounts embezzled prior to June 13, 2005, the date of issuance of S & B's 2004 audit report, and otherwise is denied. Nina's cross-motion is denied.
Nina is a family-owned business begun in 1953. It has four divisions, each with its own president. The offices of chairman, CEO, secretary, and treasurer are all held by members of the founding Silverstein family, but only the CEO, Mr. Scott Silverstein (Silverstein), had a full-time management role during the 2004 through 2006 period. At that time, Nina had between 100: and 150 employees. Silverstein had no experience or involvement i in the financial side of the business.
The way the embezzlement scheme worked was that Ashe used his access to Nina's financial software programs to generate phantom invoices from regular vendors, obtain payment approval, and generate checks payable to that vendor. Ashe's access to that software enabled him to initiate, edit or cancel transactions without supervision or oversight. After these checks were duly signed by the two required signatories—the CFO, Gary Wool (Wool) and one of several other authorized persons, Ashe voided them, again by accessing the accounting software programs, and generated new checks for the same amounts payable to himself, one of his personal creditors, or one of six other persons who acted as depositors; Ashe forged the authorized signatures on these replacements. After they were cashed, Ashe again accessed the computer records of the checks and cancelled them. The final step was his physical removal of the fraudulent checks from the bank statements, which he intercepted from the mail room with Smith's assistance.
The scheme came to Nina's attention when one of Ashe's depositors attempted to withdraw funds before a check had cleared. A suspicious bank teller called Nina, and it was discovered that the payee on the check did not match the payee of record. Ashe confessed when he was then questioned by Wool. Ashe pleaded guilty to criminal charges following his arrest, and was imprisoned.
The total amount embezzled was $1, 585 million. It is undisputed that this amount constitutes a material discrepancy well beyond the tolerated margin of error: For 2004, the theft represented a 23% reduction in pre-tax profits. For 2005, it was; 16%. Nina's internal investigation into the embezzlement showed that one reason the scheme escaped detection for so long was that the Nina employee assigned to reconcile monthly bank statements did not do so properly. The employee did not ascertain that each check listed on the statement had been returned and conformed as to payee and amount, and did not compare the amounts and payees of the processed checks with the entries on the statement, or compare the number of checks identified on the statements with the number of returned and cleared checks.
As part of its 2004 and 2005 audits, S & B examined the December statements for each year, but did not discover that checks were missing. During the prior year's audit, that for 2003, S & B noted in its work papers a weakness in internal controls because one person, Ashe, handled both the check preparation and check releasing functions (see Rhee aff., ex. W), and recommended segregating them. But S & B did not treat this as a reportable event, which would have required a written notification to Nina. S & B alleges that it orally advised Wool of this issue. In his deposition testimony, Wool denied being so; informed (ex. G to mov. aff. at 115, 122), as did Silverstein (Silvertein aff., at ff 19-21).
S & B's workpapers for the 2004 audit contain a "Fraud Considerations Checklist, " dated December 31, 2003 (ex. B to Rhee reply aff.), which includes a form of questionnaire with important questions given to the CFO and containing his responses. To the question, "where are the weaknesses in the company's internal controls?" the handwritten response is "check preparer also releases check after approval of authorized personnel" (id. at 4554). This supports S & B's contention that Wool knew of the weakness in internal controls before the 2004 audit. Rhee asserts that it was unnecessary to repeat this advice in connection with the later audits, even though this weakness in internal controls had not been corrected (see Rhee reply aff., ¶ 32).
S & B also did not learn of Ashe's unfettered access to the accounting software. Gary Broder, S & B's supervising auditor, acknowledged in his deposition testimony that, if they had discovered that Ashe had the ability to change a payee name on a Nina check, it would have been a reportable event (ex. K to mov. aff. at 85-86). S & B alleges it was aware of the internal controls vulnerability in the accounts payable function, but determined that this weakness was sufficiently counteracted by what it characterizes as compensating controls: the two signature requirement for checks, a hands-on management environment, and the reconciliation process for Nina's monthly checking statements.
Nina alleges that S & B breached its duty of care in connection with the 2004 and 2005 audits by failing:
(1) to design and perform its audits in accordance with Generally Accepted Auditing Standards [GAAS], (2) to ' properly assess Nina's internal controls and advise Nina of the reportable weaknesses of such internal controls, and (3) to discover the looting scheme and advise Nina of its existence
(verified complaint ¶ 52) .
The complaint states further that a significant number of account balances and transaction classes for 2004 and 2005 were materially misstated in the certified financial statements, and that unusual variations in those accounts warranted further testing by S & B (id., M 24-26). Nina also alleges that S & B did not make appropriate inquiry of Nina's employees to account for these unusual variations and or to gain a sufficient understanding of Nina's internal controls against fraud. Nina states that S & B should have sent Nina what is called a "management letter" to advise it of the weakness noted in 2003.
A question of fact is presented about whether S & B's exercise of professional skill and judgment, in attempting to obtain a sufficient understanding of Nina's internal controls against fraud, and in designing and implementing an appropriate audit based on that understanding (see Cumis Ins. Society Inc. v Tooke, 293 A.D.2d 794 [3d Dept 2002]), constitutes a material departure from the accepted standards of auditing practice.
At issue is whether S & B complied with section 60 of the; Statement on Auditing Standards (SAS) of the American Institute of Certified Public Accountants (AICPA), which governs the reporting to management of "reportable conditions, " which are defined, as pertinent, as:
matters coming to the auditor's attention that, in his judgment, should be communicated to [the client] because they represent significant deficiencies in the design or operation of the internal control structure, which could adversely affect the organization's ability to record, process, summarize and report financial data consistent with the assertions of management in the financial statements
(id.). Nina contends that Ashe's theft was a "reportable condition" that ought to have come to S S B's attention had it performed its audit in accordance with professional standards.
S & B relies upon the 2004 and 2005 engagement letters, other correspondence, excerpts of deposition testimony, and the expert affidavit of Mark S. Warshavsky, CPA (Warshavsky), who opines that S & B's performance of the audits complied with all applicable generally accepted auditing standards, as codified by; the AICPA. It argues that the scope of its duty, in accordance with GAAS, was limited to investigating and rendering an opinion whether Nina's year-end balance sheets were fairly represented, and to auditing Nina's balance sheet and related statements of operations, retained earnings, and cash flows, and that its engagement did not extend to detecting fraud or auditing Nina's internal controls (see deft.'s mov. aff., If 11-12).
For this point, it relies on the provision in the engagement letters, signed by Wool, providing that:
[o] ur audit will include obtaining an understanding of internal control sufficient to plan the audit and determine the nature, timing, and extent of audit procedures to be performed. An audit is not designed to provide assurance on internal control or to identify reportable conditions, that is, significant deficiencies in the design or operation of internal control. However, during the audit, if we become aware of such reportable conditions, we will communicate them to you*
(ex. N to mov. aff. at 2).
Warshavsky maintains that S & B exercised the required level; of professional due care in planning and performing the 2004 and 2005 audits, listing six categories of field work undertaken by S & B auditors, and opines that these efforts provided the necessary information. He also opines that S & B properly supervised its audit team.
In response, Nina argues that S & B has failed to demonstrate that it satisfied its professional duty to plan and supervise the audits properly, and therefore has not met its burden to establish that no factual issues are presented (see Alvarez v Prospect Hosp., 68 N.Y.2d 320, 324 ). It submits the expert affidavit of Sam Rosenfarb (Rosenfarb), which contradicts Warshavsky in numerous respects. In his opinion, S & B's performance fell short in three principal respects: the ! partner in charge of the audit, Gary Broder, did not properly supervise the audit, as evidenced by the fact that he billed only 3.5 hours out of the total of 180 hours billed; S & B failed to communicate the reportable condition of the weakness in Nina's internal controls; and S & B failed to identify and respond to the risk that Nina's financial statements could be materially misstated (Rosenfarb aff., SI 13). In his opinion, S & B's audit planning and execution did not satisfy the criteria set forth in SAS § 55 (Ex. 1 to Selbst aff.). SAS § 55 requires that an auditor obtain a sufficient understanding of the internal control structure in order to plan the audit and determine the nature, timing and extent of auditing tests to be performed. Rosenfarb opines that S & B failed to obtain such an understanding of Nina's internal controls, which failure caused it to perform an inadequate audit.
In reply, S & B argues that Rosenfarb should be disregarded because Nina did not identify him as its expert until after the note of issue had been filed. In the absence of a showing of willfulness or actual prejudice, as here, the argument is unavailing (see Downes v American Monument Co., 283 A.D.2d 256 [1stDept 2001]).
A claim of professional negligence requires proof that there was a departure from the accepted standards of practice and that the departure was a proximate cause of the injury [citations omitted]" (Estate of Burke v Peter J. Repetti & Co., 255 A.D.2d 483; [2d Dept 1998]) .
Nina argues, supported by the opinion of its accounting expert, that a reasonably competent accountant would have detected and reported to Nina the theft and the shortcoming in Nina's internal controls, which are reportable conditions that should have been brought to Nina's attention. The alleged departure was in the exercise of professional skill and judgment in determining what testing to perform in light of the known weakness in internal controls, and the adequacy of the allegedly i compensating controls. The competing expert affidavits offer opposite opinions on the same facts and applicable AICPA standards. The experts disagree on the scope of an accountant's; duty in these circumstances, which presents a factual issue requiring a determination on their credibility. As such, the matter cannot be decided on a motion for summary judgment (CPLR 3212[b]).
However, S & B's motion to bar all claims for defalcations prior to the date it issued the 2004 report is granted because, j in an accounting malpractice action, the claim arises on the date that the accountant's work product is received by the client since this is the first time the client could rely on the alleged negligent work product (Ackerman v Price Waterhouse, 84 N.Y.2d 535, ; 538 ). There is no dispute that S & B did not deliver its audit report until June 13, 2005, and Nina would have sustained losses due to Ashe's theft up to that date even if S & B had discovered and reported his conduct.
S & B's counterclaim for indemnification is based on a provision in the engagement letters, that provides:
[Nina] hereby indemnifies [S & B] and holds them harmless from all claims, liabilities, losses, and costs arising in circumstances where there has been a knowing misrepresentation by a member of the Company's management, regardless of whether such person was acting in [Nina's] interest.
(ex. N to mov. aff. at 4). Summary judgment on the counterclaim is denied because S & B does not establish that any member of Nina's management made a knowing misrepresentation to S & B regarding Ashe's defalcation.
Finally, Nina's cross motion to strike S & B's first and second affirmative defenses is denied. Nina has not presented sufficient evidence to meet its burden of demonstrating that either affirmative defense is "without merit as a matter of law [citation omitted]" (Greco v Christoffersen, 70 A.D.3d 769, 771 [2d Dept 2010]). The affirmative defenses assert that Nina's loss was caused in whole or in part by its own culpable conduct, which, as discussed above, remains an issue of fact.
Accordingly, it hereby is
ORDERED that the motion for summary judgment by defendant Salibello & Broder LLP is granted to the extent of dismissing all claims for damages incurred prior to June 13, 2005, and otherwise: is denied; and it further is
ORDERED that the cross motion of plaintiff Nina Footwear
Corp. to dismiss the first and second affirmative defenses in the answer is denied; and it further is
ORDERED that counsel shall appear for a pre-trial conference in Part 55, 60 Centre Street, Room 432, New York, NY on September 26, 2011 at 2 PM.