[ by Howard Haykin ]

Senior Management, Outside Auditors Negligent in Not Confronting CFO on Apparent Gaps in Internal Control.

The SEC on Friday charged the the former CFO of a Minnetonka, MN-based manufacturer of computer networking devices for secretly diverting company funds that he used on unauthorized personal expenses and other employees’ entertainment expenses - all lacking any legitimate business purpose.

Profile of Defendant. Subramanian Krishnan, 58, a resident of Plymouth, MN, served as CFO and SVP of Digi from February 1999 until his resignation in May 2010.  He had been licensed as a CPA in Minnesota since 1983.

Related Parties. Digi International, Inc., a Delaware corporation HQ'd in Minnetonka, MN, at all relevant times, was registered with the SEC and traded on the Nasdaq.

SEC Findings and Allegations. Subramanian Krishnan, who created the company's internal controls, evaded the same in order to approve employees’ falsified T&E expense reports over a 5-year period - beginning in at least March 2005.  He also manipulated internal controls to review and approve his own expense reports that he filled with unauthorized hotel and entertainment expenses.

Krishnan built into the system of internal controls allowances for hotel and entertainment expenses to be submitted to and paid by the Asia Pacific Regional office - in Hong Kong, MN.  By doing this, Krishnan’s hotel and entertainment expenses bypassed the CEO, who thus could not approve the vouchers as required by company policy.  Essentially, that responsibility went de facto to himself, as CFO. 

And so, Krishnan usurped authorization and the final approval from the CEO, and no one commented or complained about it - at least for the 5 year run. 

[C-I Note:  The SEC says that these actions demonstrated the defendant's "lack of management integrity."  The SEC add that this was "a material weakness in Digi’s internal controls over financial reporting.

Well, my inclination is to point to senior management's serious deficiencies in running a company.  It was the CEO's obligation to know what his or her responsibilities are and, if he or she is not fulfilling them, then they should be asking who is?  That never came up, because senior management apparently had blind faith in their CFO and SVP.  You betcha!

And, in my opinion, the failure of the company's outside auditors to detect these twisted controls - rife with conflicts of interest, and bypassing firm policies and procedures - should have been picked up in phase one of every audit.  Since the audit work was probably done by "pinheads" or junior accountants, they likely accepted whatever Krishnan told and gave them.  (Not unlike the situation with Bernie Madoff, where he was able to "pull the rug over everyone's eyes" - in large part because people were afraid to challenge the GREAT BERNIE - who truly was a revered individual on Wall Street. 

So the take away or question that every firm should be asking is......   does the person who designed the procedures also carry them out?  Which is akin to the age old question, "Who's supervising the supervisors?"  A person who understands how the system works can cheat the company for quite a long period.  Therefore - don't put all your eggs in one basket - i.e., don't rely too heavily on one individual - always bring in a competent "devils advocate."  In the end, the firm has much more to lose.]

Settlement.  Krishnan has agreed to settle the SEC’s charges and consent to an officer-and-director bar and financial penalties that will be determined in court at a later date. 

"Krishnan diverted company dollars for activities that were personal entertainment expenses," said Kenneth Israel, Director of the SEC’s Salt Lake Regional Office.  "Krishnan basically reviewed and approved his own expense reports by thwarting self-designed internal accounting controls that are supposed to detect such misuse of corporate assets."

According to the SEC’s complaint filed in U.S. District Court for the District of Minnesota, Krishnan’s scheme began as early as March 2005 and continued until May 2010, when he resigned. Digi’s internal controls required the CFO’s expense reports to be approved by the CEO. In order to circumvent this internal control, Krishnan arranged for the Hong Kong office to submit his expenses as belonging to other employees. This way, Krishnan had the final authorization to approve the expenses and reimburse the Hong Kong office directly, rather than needing CEO approval.

The SEC alleges that as the scheme went undetected, Krishnan submitted or approved large numbers of fraudulent expense reports for purported work and travel expenses.  Krishnan knew the expenditures violated Digi’s travel and entertainment policies because he personally drafted and approved these internal policies.  Despite this knowledge that he was evading Digi’s internal controls, Krishnan signed each of Digi’s annual and quarterly reports over a 5-year period and, as part of those filings, certified that Digi’s internal controls were effective.  He also signed 20 management representation letters to auditors that falsely asserted he had no knowledge of fraud involving management having a significant role in internal controls over financial reporting.

The SEC’s complaint alleges that Krishnan, who lives in Plymouth, Minn., violated the antifraud, issuer reporting, internal controls, books and records, filing certification and lying to auditors provisions of the federal securities laws.  Krishnan has consented to the entry of an injunction from future violations of those provisions, with disgorgement, prejudgment interest, financial penalties as well as the duration of the officer-and-director bar to be determined by stipulation of the parties or motion of the SEC at a later date.

It's interesting to note that no estimated cost figure appears in the SEC Press Release or Complaint.  But you can bet the numbers were large - 5 years' worth of travel and entertainment.  Got to admit - Minnesotans know how to have a good time - particularly on someone else's dime.

For further details, go to:  [SEC PR 12-203, 9/28/12]   and   [ SEC Complaint].