The buck stops here

By now, every board of directors will be well aware that there is a potential problem with computers that cannot handle the date change from 1999 to 2000, but how many of them know exactly how bad that problem could be?

New guidance from the English ICA adds to the pressure on directors and suggests that it is time for auditors to ask some tough questions of management.

This won’t worry many UK companies who should already have the answers, but those who don’t have a grip on the problem could use the guidance as an opportunity to kickstart their preparations.

One commentator predicts it will cost tens of billions of pounds to fix UK systems. Another knocks this as fantasy. The governor of a US state is reported as predicting massive disruption to power supplies, transport systems and telecommunications. The utility companies say this is a doomsday exaggeration.

Why all this uncertainty? Mostly because too few people have actually done a rigorous impact analysis for their business. And, in the UK at least, those that have done the analysis aren’t saying much about the results.

Impact analysis is the key. Inaction often arises from uncertainty, and an effective impact analysis will reduce the uncertainty. The institute guidance suggests an impact analysis is one of the first things an auditor will want from directors. But it also makes clear that the impacts in which an auditor is interested are quite different to the those of interest to a business.

Auditors report on financial statements, so when auditors talk about impact analysis they mean financial statement impact. Working from first principles, the guidance recognises that financial statements could, in some cases, be materially affected by the year 2000 problem, for example because asset values are impaired, significant committed future costs may be require to be disclosed or, in extreme cases, because the going concern principle becomes an issue.

But a company is more immediately interested in operational impacts, such as inefficiency, disruption to the business, loss of profits or loss of competitive position and the costs of work to avoid these problems.

None of these things necessarily has any direct effect on the financial statements – they affect the underlying business which is reflected in the financial statements. The company therefore needs to undertake a business impact analysis.

The benefit of the auditor’s questions about financial statement impacts is that management can only form a view of the expected impact on the financial statements from a robust underlying analysis of business impacts and plans to address them. The precise information provided to auditors in support of the analysis and plans will vary, depending on the organisation.

Auditors will have to form a judgement, given their own understanding of the business, its systems and other audit risk assessment, as to whether they have been given sufficient and reliable information to support management’s views.

Questions about financial statement impacts, and whether auditors can do more to help, will go some way towards ensuring that directors at least take the problem seriously. Clearly, the larger audit firms can help in other ways, outside their statutory role as auditors.

The analysis is an important early milestone but not the ultimate answer.

Implementing planned solutions presents the next challenge. If the plan requires new systems, then IT specialists in the firm may provide valuable assistance.

A potential barrier in the current legal environment is the risk of confusion over roles. Auditors are worried that unrealistic expectations that auditors will help to ‘solve’ the problem are already getting out of control, and that further misunderstanding may arise from offers to help outside the statutory role.

An expectations gap is created where there is such misunderstanding and this increases the risk of litigation wrongly directed at the auditor. No wonder that internal risk management partners in the major firms insist on cautious policies when offering extra help – in anticipation that, come the millennium, the writs will start flying.

The institute’s guidance confirms that it is not the purpose of an audit to give assurance in relation to the year 2000 problem, so a lack of comment from the auditor, whether in reporting back to management or in the audit report does not mean that the business will have no problems.

Yet questions from the auditor during their assessment should at least mean that directors ensure they find the answers themselves.

Perhaps then, once they have these answers, companies should consider saying something to their shareholders about year 2000 impacts and their response. In particular, listed UK companies subject to Cadbury requirements might consider disclosure of year 2000 business risks and procedures to address them in their internal control reporting or elsewhere in their operating and financial review.

Mike Barkham is a partner in Coopers & Lybrand and was chairman of the English ICA working party on year 2000.