The writer is professor of accounting and control, Insead, in Singapore
When I handed over my card to pay for my morning coffee at a Starbucks in Singapore a few weeks ago, I was in for an unpleasant surprise: Visa and Mastercard were no longer accepted. The reason was that the authorities had shut down Germany-based Wirecard, the backbone of processing plastic payments, because of a financial scandal.
I love a good accounting scandal: it provides rich material for my courses for executives on earnings quality. But when it compromises my morning Americano, I really take notice.
What had happened, and what lessons can we learn about financial reporting risks in global companies? First, a disclaimer. There is still much we do not know. There is an opportunity for the German government to tell us even more about these risks. Yet there is much we already do know, thanks to deep reporting by the Financial Times, and an interim review of the case by accounting firm KPMG.
Despite relying on Wirecard every day for processing payments whenever I used plastic, I was unaware of the company until February 2019, when the FT reported on its alleged “round tripping” of payments in Asia. Cash raised from investors would be funnelled to an allegedly independent subsidiary, which would purchase Wirecard services and report them as “revenue”. Yet the transaction had no real substance — it was a fictitious deal within the company.
What caught my eye was the underlying rationale: not the greed of an executive trying to achieve a profit-based bonus, but rather the need to convince financial authorities in Hong Kong of the strength of the company in order to expand its operations there. While personal greed is always a threat to the integrity of financial reporting, the risk becomes more intense when an underlying contract with another party is linked to the numbers.
Read between the numbers
In this case, if the licence in Hong Kong was approved, it could lead to an inflow of cash that might cover the tracks of the fraud. A Ponzi scheme that leads to additional business is more logical than one that simply siphons funds from new investors to pay off older ones. The latter will eventually implode without new investors, but the former can continue if real business develops.
This is one lesson: when crucial contracts rely on accounting numbers, examine the integrity of such numbers really carefully.
Who is linked to who?
Over the past year, we learnt that much of Wirecard’s profit came from only a few key customers.
Although the company touted in its external reports the thousands of merchants that used its networks, these were funnelled through third party acquirers (TPAs), essentially subcontractors that dealt directly with the merchants. But these TPAs were the real customers that should have been identified in the company’s annual report given their concentration of the business.
Even if they had been, one of the hazards of doing business in Asia is the complicated ownership structure of many companies. Who is the ultimate controlling shareholder, and is it truly independent of the other party reporting transactions with it? This is often difficult to ascertain, but it is necessary in order to assess the quality of the underlying earnings.
That is the second lesson of Wirecard: the importance of understanding the counterparty. But a potential investor would have had difficulty in this case because of the company’s failure to highlight such relationships. That is something the auditor, Ernst & Young (EY), arguably should have compelled it to undertake but did not.
Global rules vary
This leads to the third lesson about companies operating globally: when the auditor must rely on its global affiliates, does the investor receive an appropriate level of assurance over the integrity of the numbers? EY did not disclose in its audit report how much it relied on the work of other firms either within or outside its global umbrella of partnerships.
This risk is ever more relevant as and when a network becomes wider. Ostensibly following reporting standards is one thing, but adherence is subject to the regulatory enforcement of the different countries under review. How effective is a country’s enforcement mechanism for punishing accounting or auditing transgressions? Research tells us that this affects the quality of the underlying report.
As the scandal unfolds, the German government could usefully consider the actions of the UK parliament following the insolvency of Carillion, the construction company and one of the UK government’s biggest contractors, in January 2018.
By May of that year, a transparent account of the case was presented to the public, and this provided several examples of bad corporate governance to be avoided by others.
Just as the operations of Carillion touched many Britons through the privatisation of public services, so Wirecard affected many merchants and customers across the world because of its pivotal role in handling payments.
While Starbucks could swiftly switch to an alternative provider, the same was not true of my barber. Two weeks after Visa and Mastercard were no longer accepted in Singapore, he still could not take credit card payments. His small business is paying the price of relying on a network that appeared to be like a reliable piece of machinery he could ignore — until it stopped and he was forced to become a cash business again.