Grant Thornton v. OFFICE OF COMPTROLLER, CURRENCY

United States Court of Appeals

FOR THE DISTRICT OF COLUMBIA CIRCUIT

Argued November 8, 2007 Decided February 8, 2008

No. 07-1003

GRANT THORNTON, LLP,

PETITIONER

v.

OFFICE OF THE COMPTROLLER OF THE CURRENCY,

RESPONDENT

On Petition for Review of a Final Decision and Orders of the

Office of the Comptroller of the Currency

Stanley J. Parzen argued the cause for petitioner. With

him on the briefs were Mark W. Ryan, Andrew J. Morris, and

Miriam R. Nemetz.

Jerome A. Madden, Counsel, U.S. Department of

Treasury, argued the cause for respondent. With him on the

brief was Horace G. Sneed, Director of Litigation.

Before: HENDERSON and TATEL, Circuit Judges, and

WILLIAMS, Senior Circuit Judge.

Opinion for the Court filed by Senior Circuit Judge

WILLIAMS.

2

Opinion concurring in the judgment filed by Circuit

Judge HENDERSON.

WILLIAMS, Senior Circuit Judge: Grant Thornton, LLP,

an accounting firm, appeals a final decision and order of the

Comptroller of the Currency that requires the firm to pay

$300,000 in civil penalties for recklessly failing to meet

Generally Accepted Auditing Standards (“GAAS”) in its audit

of the First National Bank of Keystone. Grant Thornton also

appeals the Comptroller’s cease and desist order mandating

that the firm comply with a host of conditions whenever it

audits depository institutions. We vacate the final decision

and both orders, finding that when an accounting firm merely

performs an external audit aimed solely at verifying the

accuracy of a bank’s books, it is not “participat[ing]” or

“engaging” in “an unsafe or unsound practice in conducting

the business” or “the affairs” of the bank, as those terms are

used in 12 U.S.C. §§ 1813(u)(4)(C), 1818(b)(1), and

1818(i)(2)(B)(i)(II).

* * *

In 1992 the First National Bank of Keystone, then a small

rural bank in West Virginia, sought to increase its revenues,

launching an ambitious loan securitization program. The bank

bought subprime or high loan-to-value loans from large

originators throughout the country. It then pooled these loans

with loans it had originated itself. The bank bundled the loans

into securities and sold them to institutional investors.

Keystone hired asset servicers to collect the principal, interest,

and penalties on the loans and to issue monthly checks of

interest income to Keystone. By 1999 the bank’s assets of

approximately $100 million had apparently skyrocketed to

about $1 billion.

3

Examiners from the Office of the Comptroller of

Currency (“OCC”) scrutinized the bank’s records periodically

from 1992 through 1999. In a 1997 report, the examiners

criticized the accuracy of the bank’s statements and the

effectiveness of the securitization program’s management.

Using a standard rating system, the OCC gave the bank very

low marks for its overall condition and management quality.

Because of Keystone’s failure to address these concerns,

the OCC initiated an enforcement action against the bank in

May 1998. As a result, Keystone and the OCC formally

agreed that the bank would retain a nationally recognized

independent accounting firm to audit the bank’s mortgage

operations, assess the accuracy of its financial statements, and

determine the validity of the bank’s accounting for loans it

purchased and bundled into securities. In July 1998 the bank

hired Grant Thornton to conduct the agreed-upon external

audit. In April 1999 Grant Thornton issued its audit opinion.

The opinion acknowledged the firm’s duty to “obtain

reasonable assurance about whether [Keystone’s] financial

statements [for 1997 and 1998] are free of material

misstatement,” and in effect stated that it had found such

assurance.

In August 1999 OCC examiners uncovered Keystone’s

fraud. The bank had inflated its interest income by nearly $98

million and its assets by about $450 million. These $450

million in assets supposedly belonging to Keystone were in

reality those of another bank. The scheme masked the fact

that Keystone had been insolvent since 1996. Several

members of Keystone management were convicted of felonies

for falsifying bank financial records, loan servicer reports, and

remittances, as well as lying to auditors and regulators. After

the OCC determined that Keystone was insolvent, it closed

the bank.

4

On March 5, 2004 the OCC invoked the Financial

Institutions Reform, Recovery, and Enforcement Act

(“FIRREA”) of 1989, Pub. L. No. 101-73, 103 Stat. 183, and

initiated an administrative proceeding claiming that Grant

Thornton, in auditing Keystone’s financial statements, had

“recklessly engag[ed] in an unsafe or unsound practice in

conducting [Keystone’s] affairs.” 12 U.S.C. § 1818(b)(1); see

also §§ 1813(u)(4), 1818(i)(2)(B). The government’s

evidence showed, among other things, that Grant Thornton

had relied on oral representations as to Keystone’s ownership

of approximately $236 million of the $450 million at issue,

even in the face of written communications suggesting the

opposite. At the end of the hearing, however, the

administrative law judge recommended that all charges be

dismissed because she found that Grant Thornton had not

acted recklessly.

On December 7, 2006 the Comptroller rejected the ALJ’s

recommendation and fined Grant Thornton. Relying or

purporting to rely on the evidence introduced by Harry Potter,

the OCC’s audit wizard, the Comptroller found that Grant

Thornton participated in an unsafe or unsound practice by

recklessly failing to comply with GAAS in planning and

conducting the Keystone audit. In a cease and desist order,

the Comptroller limited Grant Thornton’s freedom to accept

and conduct audits independently, hire accountants, and

handle working papers.

Grant Thornton attacks the Comptroller’s decision and

orders on multiple grounds. We need address only one. We

find that the Comptroller exceeded his statutory authority in

characterizing Grant Thornton’s external auditing activity as

“participat[ing] in . . . [an] unsafe or unsound [banking]

practice,” see § 1813(u)(4), and as “engaging . . . in an unsafe

or unsound practice in conducting [Keystone’s] business,” see

5

§ 1818(b)(1), and in “conducting [Keystone’s] affairs,” see

§ 1818(i)(2)(B)(i)(II). Those conclusions end the case.

* * *

We review the OCC’s interpretation of FIRREA and

related statutory provisions de novo because multiple agencies

besides the Comptroller administer the act, including the

Board of Governors of the Federal Reserve Board, the Federal

Deposit Insurance Corporation, and the Office of Thrift

Supervision in the Treasury Department. See Proffitt v.

FDIC, 200 F.3d 855, 863 n.7 (D.C. Cir. 2000); Rapaport v.

Department of Treasury, 59 F.3d 212, 215-17 (D.C. Cir.

1995); Wachtel v. Office of Thrift Supervision, 982 F.2d 581,

585 (D.C. Cir. 1993) (“[§ 1818(b)] is … also administered by

the Federal Reserve Board, the Comptroller of the Currency,

and the FDIC, and thus deference under Chevron … is

inappropriate.”); see also Collins v. NTSB, 351 F.3d 1246,

1253 (D.C. Cir. 2003) (noting Congress’s observation that

“more than one agency may be an appropriate Federal

banking agency with respect to any given [type of banking]

institution,” citing § 1813(q)).

The relevant statutory structure is unusual to say the least.

It is a bit as if provisions penalizing theft started by defining a

“thief” as “a person who commits theft, to wit, one who

intentionally takes away the property of another,” etc., and

then imposed penalties on any “thief who intentionally takes

away the property of another,” etc. The upshot obviously

involves a good deal of linguistic duplication; and imposition

of a penalty requires that the accused be shown both to fit the

statutory definition and to have committed the acts actually

triggering punishment.

6

Here the crucial definition is that of an “institution-

affiliated party” (“IAP”), which includes

(4) any independent contractor (including any attorney,

appraiser, or accountant) who knowingly or recklessly

participates in –

…

(C) any unsafe or unsound practice, which caused or

is likely to cause more than a minimal financial loss

to or a significant adverse effect on, the insured

depository institution.

12 U.S.C. § 1813(u)(4). We assume without deciding that an

accounting firm like Grant Thornton can qualify as an

independent contractor.

The relevant substantive provisions of FIRREA echo the

definition. Under 12 U.S.C. § 1818(b)(1), the Comptroller of

the Currency may issue a cease-and-desist order if a bank or

IAP “is engaging or has engaged . . . in an unsafe or unsound

practice in conducting the business of [an] insured depository

institution”; and under § 1818(i)(2)(B)(i)(II) the Comptroller

may impose civil monetary penalties when a depository

institution or IAP “recklessly engages in an unsafe or unsound

practice in conducting the affairs of [an] insured depository

institution” which causes a more than minimal loss to the

bank or meets other aggravating circumstances.

While the definitional section doesn’t specify that the

accused must have engaged in the “unsafe or unsound

practice” in “conducting the business of” the bank,

§ 1818(b)(1), or in “conducting the affairs of” the bank,

§ 1818(i)(2)(B)(i)(II), the OCC doesn’t dispute that, to prevail

under the substantive provisions, it must show that Grant

7

Thornton’s audit activity amounted to such “conducting.” See

OCC Br. at 4.

Nor does the Comptroller contest that the phrase “unsafe

or unsound practices,” in all its appearances here, means

“unsafe or unsound banking practices.” The latter is, indeed,

the formulation that the Comptroller uses in his Notice of

Assessment of a Civil Monetary Penalty, at 17-18 and his

Final Decision and Order, at 17. That reading (besides being

undisputed and according with conventional banking

terminology) harmonizes the definitional section,

§ 1813(u)(4), with the two substantive sections penalizing one

who recklessly participates or engages in “an unsafe or

unsound practice in conducting the business” or “the affairs”

of a depository institution. § 1818(b)(1), (i)(2)(B)(i)(II).

Although the OCC’s Notice of Charges for Issuance of an

Order to Cease and Desist might be read as claiming that the

“unsafe or unsound practice” in which Grant Thornton

allegedly engaged was Keystone’s own fraud, see id. at 20, its

final decision identified the practice as Grant Thornton’s

conduct of the audit: “Clearly, Grant Thornton itself

‘participated’ in an unsafe or unsound practice when it

violated GAAS in carrying out its audit.” Final Decision and

Order, at 17; see also id. at 20. Thus, the Comptroller’s orders

rest on the idea that recklessly conducting a non-GAAS audit

of a bank constitutes participation in an unsafe or unsound

practice in conducting the business or affairs of the bank. But

however incompetently or recklessly the audit may have been

performed, conduct of the audit cannot be shoehorned into the

controlling statutory language.

First, Grant Thornton didn’t participate in an “unsafe or

unsound [banking] practice” because an audit of the sort

conducted here is not a banking practice. Grant Thornton was

fulfilling the classic reporting function of external auditors—

8

examining the company’s books from the outside and

verifying the accuracy of its records and the adequacy of its

internal controls. This sort of outside look into a bank’s

activity is not a “practice” of a depository institution or bank.

FIRREA defines a “depository institution” as “any bank or

savings association.” § 1813(c)(1). It defines a “bank” as

“any national bank and State bank, and any Federal branch

and insured branch.” § 1813 (a)(1)(A). As this definition is

in part circular, itself depending on the meaning of the word

“bank,” Congress evidently relied on common understanding

to fill the gap. The language of Webster’s Third New

International Dictionary (1981), identifying a bank as “an

establishment for the custody, loan, exchange, or issue of

money, for the extension of credit, and for facilitating the

transmission of funds by drafts or bills of exchange,” id. at

172, seems apt. A review of a bank’s books is quite distinct

from the “custody, loan, exchange, or issue … of money” or

“facilitating the transmission of funds.” Id. We do not

attempt to define the full universe of activities that encompass

“banking practices.” Yet we are certain that an external

auditor whose sole role is to verify a bank’s books cannot be

said to be engaging in a “banking practice.” We do not

answer the question of whether an internal auditor with an

equally limited role (if there be any such) is conducting the

bank’s business.

In oral argument, Comptroller’s counsel advanced the

idea that because § 1831m(f)(1) requires that banks, in order

to stay in business, undergo GAAS-compliant audits on an

annual basis, it follows that such audits are necessarily part of

a bank’s business. See Oral Argument, 45:24-45:38; see also

§ 1831m(a)-(f). This seems to us a complete non-sequitur.

That a bank must engage outsiders to perform services does

not necessarily turn such providers into bankers. In the case

of auditors, of course, the need to enlist their services comes

in part from the law, in part from the practicalities of raising

9

the bank’s own capital, but it is hard to see why the element of

legal compulsion should change the matter. It makes as much

sense to say that Grant Thornton was conducting Keystone’s

business as it is to say that an Underwriters Laboratories

representative who inspects a toaster is “engaged in

conducting the manufacture of toasters,” or that a Department

of Agriculture representative checking a smokehouse for

compliance with meat safety laws is “engaged in conducting

the operation of a smokehouse.”

Second, we have some assistance from the Supreme

Court on the meaning of a phrase closely parallel to those in

question here. In Reves v. Ernst & Young, 507 U.S. 170

(1993), the Court construed the following language from

RICO: “to conduct or participate, directly or indirectly, in the

conduct of [an enterprise’s] affairs.” Id. at 177-79 (discussing

18 U.S.C. § 1962(c)). Reasoning that Congress meant

something broader than “conduct [the enterprise’s] affairs,”

but narrower than merely “participate in [its] affairs,” the

Court concluded that a covered party “must have some part in

directing [the enterprise’s] affairs.” Id. at 179. Grant

Thornton played no such directive role in Keystone’s affairs.

A directing role can, of course, be a minor one. In

Cavallari v. Office of Comptroller of the Currency, 57 F.3d

137, 140-41 (2d Cir. 1995), the court affirmed the

Comptroller’s classification of an attorney as an IAP because

he provided oral and written advice to a bank that exchanging

loan guaranties, resulting in the bank’s gaining an interest in a

financially unsound company, was in the bank’s best interest.

The court’s holding also rested on the fact that the lawyer

drafted the paperwork needed to complete the transaction.

Thus he advised the bank, in a forward-looking capacity, on

how to conduct the bank’s own business—lending. By

actively encouraging a dubious transaction, he played a part in

conducting the bank’s business in a way that was “contrary to

10

accepted standards for banking operations.” Id. at 143. In

contrast, while Grant Thornton’s audit may have been

“strikingly incompetent,” as described at length by the

concurring opinion, it neither proffered advice on nor assumed

any directive role in Keystone’s conduct of its affairs. The

Comptroller nowhere suggests that Grant Thornton was in

cahoots with Keystone’s fraudulent managers.

Judge Henderson’s concurrence describes our opinion as

a “rejection” of accountant liability as an IAP under

§ 1818(b)(1) and § 1818(i)(2)(B)(i)(II). Op. of Henderson, J.,

at 2. Insofar as she may suggest a categorical rejection, the

description is wide of the mark. Our discussion above makes

clear that an accountant who plays an active role in directing a

bank’s unsafe or unsound practices, or its wrongful

transactions, as the lawyer in Cavallari did, can be sanctioned

as an IAP; he would then have actually participated in an

unsafe or unsound practice in conducting the business or

affairs of a bank.

The concurring opinion also invokes legislative history to

cast doubt either on our interpretation of the relevant

provisions, or possibly on our opinion’s non-existent

categorical rejection of accountant liability. In any event, the

proposed use of legislative history doesn’t work. First, the

text of the statute is clear enough that resort to legislative

history is unnecessary. See Claybrook v. Slater, 111 F.3d

904, 907 (D.C. Cir. 1997) (“If statutory language is clear … it

is both unnecessary and inappropriate to track legislative

history.”). Second, even if mining legislative history were

necessary to interpret the provisions, the section of the House

Report commenting directly on § 1813’s IAP definition

unsurprisingly tracks the statute’s actual language. It notes

that “[a]ppraisers, accountants, and attorneys have

participated in some of the serious misconduct in banks and

thrift institutions.” H.R. Rep. No. 101-54(I), at 466 (1989),

11

reprinted in 1989 U.S.C.C.A.N. 86, 262 (emphasis added);

see also id. (stating that independent contractors are liable

under the provisions “only if they participate in the conduct of

the affairs of . . . insured financial institutions”). Then it

distinguishes between an attorney who provides a bank advice

or services in good faith and an attorney who also “knowingly

participates in other activities which result in serious

misconduct,” saying that the former is not a target for

enforcement action, whereas the latter is. Id. at 467.

Third, the legislative history cited in the concurring

opinion, highlighting the role of “poor quality audit work” in

the banking scandals of the late 1980s, appears in the

preliminary, narrative sections of the House Report; it doesn’t

specifically comment on particular provisions of FIRREA, let

alone any part of §§ 1813 or 1818. Id. at 300-01. Nothing

links Congress’s apparent concern that poor auditing “delayed

regulatory action” and thus “raised the . . . cost of resolving

thrift failures” to the sections at issue here. Id. at 301.

Certainly other provisions of FIRREA seem responsive to this

general concern. Some, for example, imposed stricter

auditing requirements on banks and required banks to give the

Comptroller access to “books, records, accounts, reports, files,

and property . . . used by . . . an independent certified public

accountant retained to audit” banks or their funds. 12 U.S.C.

§ 1827(d)(2); see also 12 U.S.C. § 1441a(k)(1)(B) (1989) (a

FIRREA provision that contained language identical to that of

§ 1827(d)(2), though the language was removed in a 1991

amendment); FIRREA, §§ 220, 501. And Congress’s

commissioning of a feasibility report on means of enhancing

transparency between audits and the bank regulatory agencies,

id. § 1001, 12 U.S.C § 1811 note, also appears aimed in part

at reducing the risk of defective audits. In short, assigning the

provisions in dispute their ordinary-language meanings

creates no inconsistency with the House Report.

12

Finally, we note that Congress has given the Comptroller

wide latitude to punish accountants who transgress GAAS in

their audits of depository institutions:

In addition to any authority contained in [12 U.S.C.

§ 1818], the Corporation or an appropriate Federal

banking agency may remove, suspend, or bar an

independent public accountant, upon showing of good

cause, from performing audit services required by this

section.

12 U.S.C. § 1831m(g)(4)(A). While Congress added this

provision after adoption of FIRREA (as part of the Federal

Deposit Insurance Corporation Improvement Act, Pub. L. No.

102-242, § 36, 105 Stat. 2236, 2244 (1991)), its presence

makes clear that giving the words of FIRREA their ordinary

meaning leaves the banking authorities ample power to

sanction delinquent auditors. Here, of course, we need not

address the application of § 1831m(g)(4)(A) to Grant

Thornton, as the Comptroller has not tried to rest its case on

that section.

* * *

We vacate the Comptroller’s final decision and orders

for the reasons stated.

So ordered.

KAREN LECRAFT HENDERSON, Circuit Judge, concurring in

the judgment:

I agree with my colleagues that we should vacate the civil

monetary penalty and cease and desist order the Office of the

Comptroller of the Currency (OCC) imposed on Grant

Thornton; however, I am not persuaded by their reasoning and

therefore concur in the judgment only. The Congress enacted

the Financial Institution Reform, Recovery and Enforcement Act

of 1989 (FIRREA), Pub. L. 101-73, 103 Stat. 183 (1989), as a

direct response to the savings and loan crisis of the late 1980s.

See H.R. Rep. No 101-54, at 291–92 (1989), as reprinted in

1989 U.S.C.C.A.N. 87. The House Banking, Finance and Urban

Affairs Committee Report (House Report) accompanying the

legislation discusses the causes of that crisis. Among them, the

Report highlights “poor quality audit work” as one of the

primary ones. The House Report explains:

The public accounting industry and certified public

accountants (CPAs) played a major role in masking the

insolvency of many failed thrifts, and often did not

report fraud and insider abuse by thrift managements to

thrift regulators. In a study of failed S & L’s [sic] under

the supervision of the Federal Home Loan Bank of

Dallas, the GAO reported,

For six of the eleven failed S & L’s [sic] we

reviewed, CPA’s [sic] did not adequately audit

or report the S & L’s financial condition or

internal control problems in accordance with

professional standards.

Independent audits are an integral part of the system of

controls designed to identify and report problems in

thrift’s [sic] when they arise. A lack of professionalism

and poor quality audit work by CPA’s [sic] helped mask

the presence of fraud at a number of failed thrifts. In

many instances auditors did not notify regulators about

poor management practices at failing thrifts, which

2

ultimately delayed regulatory action against many

unscrupulous thrift managements. This delay has

significantly raised the . . . cost of resolving thrift

failures.

Id. at 301. In light of the Congress’s express conclusion that

“poor quality audit work” played a large role in causing the

savings and loan crisis, which crisis produced FIRREA, I cannot

join in the majority’s holding that “when an accounting firm

merely performs an external audit aimed solely at verifying the

accuracy of a bank’s books, it is not ‘participat[ing]’ or

‘engaging’ in ‘an unsafe or unsound practice in conducting the

business’ or ‘the affairs’ of the bank as those terms are used in

12 U.S.C. §§ 1813(u)(4)(C), 1818(b)(1), and

1818(i)(2)(B)(i)(II).” Maj. Op. at 2. As the majority itself

notes, the statutory interplay among these subsections is

“unusual to say the least” and “obviously involves a good deal

of linguistic duplication.” Maj. Op. at 5. But 12 U.S.C.

§ 1818(b)(1) and 12 U.S.C. § 1818(i)(2)(B)(i)(II) expressly

include an Institution Affiliated Party (IAP) within their

respective sanctions so that there must be some way in which an

IAP accountant “participates” or “engage[s]” in “an unsafe or

unsound practice in [the] conduct[]” of the “business”/“affairs”

of a bank. The Second Circuit has decided as much with regard

to an IAP attorney. Cavallari v. OCC, 57 F.3d 137, 142–43 (2d

Cir. 1995). Because an IAP accountant can be sanctioned under

section 1818(b)(1) and section 1818(i)(2)(B)(i)(II), I believe that

the majority’s rejection of such a result here is wrong.

The OCC’s sanctions levied against Grant Thornton should

nonetheless be vacated. The same House Report makes clear

that the Congress did not intend FIRREA to be used to levy a

firm-wide penalty against an IAP unless “most or many of the

managing partners or senior officers of the entity have

participated in some way in the egregious misconduct.” H.R.

3

Rep. No. 101-54, at 467. During the hearings before the House

Banking, Finance and Urban Affairs Committee (Committee),

several organizations, including the American Institute of

Certified Public Accountants and the American Bar

Association’s Business Law Section, expressed

[c]oncern . . . that [the OCC] could obtain enforcement

orders against a corporation, firm, or partnership, such as

a large accounting, appraisal, or law firm, since the term

“person” includes entities as well as individuals, and that

therefore enforcement orders would not be limited to

those individuals who may have been responsible for the

wrongful action.

Id. at 466–67. In response, the Committee explained:

[T]he Committee expects the [OCC] to limit

enforcement actions in the usual case to individuals who

have participated in the wrongful action, to prevent

unintended consequences or economic harm to innocent

third parties.

However the Committee strongly believes that [OCC]

should have the power to proceed against such entities if

most or many of the managing partners or senior

officers of the entity have participated in some way in

the egregious misconduct. For example, a removal and

prohibition order might be justified against the local

office of a national accounting firm if it could be shown

that a majority of the managing partners or senior

supervisory staff participated directly or indirectly in the

serious misconduct to an extent sufficient to give rise to

an order. Such an order might well be inappropriate if

it was taken against the entire national firm or other

geographic units of the firm, unless the headquarters or

4

these units were shown to have also participated, even if

only in a reviewing capacity.

Id. at 467 (emphases added).1 At the time of the Keystone audit,

Grant Thornton had approximately 300 partners and 3,500 other

employees in 40 offices throughout the United States. Hr’g Tr.

2160, Nov. 23, 2004. The failure of Grant Thornton’s Keystone

audit, however, was caused by the actions of only two

individuals. The OCC made no finding that the flaws in the

Keystone audit resulted from any systemic problem within Grant

Thornton. Nor is there any evidence in the record that “most or

many of the managing partners or senior officers of [Grant

Thornton] . . . participated . . . in the egregious misconduct”

which produced the deficient audit. See H.R. Rep. No. 101-54,

at 467. Therefore, I agree that the sanctions against Grant

Thornton should be vacated.

I also firmly disagree with the majority’s vacillating

assessment of the audit Grant Thornton conducted. See Maj.

Op. at 10 (“while Grant Thornton’s audit may have been

‘strikingly incompetent,’. . .” (emphasis added)). A fuller

exposition of the facts will prove my point: The First National

Bank of Keystone (Keystone) had operated for years as a small,

1

The OCC argues that this language limiting firm-wide liability

applies only to “12 U.S.C. § 1818(e)’s removal and prohibition

sanctions against professional firms . . . . There was no hint in the

House Report that professional firms were not subject to [other]

enforcement actions or that it would be inappropriate to impose non-

prohibition remedial actions and [civil monetary penalties] against

professional firms acting as IAPs.” OCC’s Br. 33. Not so. The

House Report makes clear that the discussion of removal and

prohibition sanctions is offered as simply one example of the “special”

circumstances under which firm-wide liability might be applied. See

H.R. Rep. No. 101-54(I), at 467.

5

community bank in Keystone, West Virginia. In the early

1990s, however, Keystone changed its business focus and

became heavily involved in the business of purchasing and

securitizing sub-prime mortgages. Its new business, so it

appeared, increased the value of its loan portfolio from $100

million in 1992 to over $1 billion by 1997. Reality was much

different—Keystone was losing money as it was being looted by

its management. To preserve the illusion of profitability,

Keystone’s management fraudulently misrepresented its

financial condition. At the center of the fraud was a business

arrangement Keystone entered into with United National Bank

(United) of Wheeling, West Virginia. Under the arrangement

Keystone was to act as a mortgage purchasing agent for United.

Keystone canvassed the market for available mortgages and

notified United on a daily basis of its findings. When suitable

mortgages were available, United provided Keystone with the

funds to purchase the mortgages on United’s behalf. Keystone

then arranged for two outside firms, Compu-Link and Advanta,

to service the mortgages for United while the mortgages were

prepared for securitization.2 After purchasing the mortgages

with funds provided by United and arranging for servicing and

securitization, Keystone included the mortgages on its books as

assets despite the fact that United owned them. See OCC Dec.

at 4–5.

During the 1990s, the OCC repeatedly investigated

Keystone. The investigations never uncovered the full extent of

the Keystone fraud; however, they did reveal irregularities in

Keystone’s management and accounting practices reflected in

the quarterly reports Keystone was required to file with the

2

In 1998 alone, Keystone purchased over $960 million in

mortgages for United.

6

OCC. On May 8, 1998 the OCC informed Keystone that it was

considering imposing a civil monetary penalty after Keystone

filed an inaccurate report for the third quarter of 1997; however,

Keystone forestalled the penalty by entering into a formal

Supervisory Agreement with the OCC which required Keystone

to strengthen internal accounting controls and retain a national

accounting firm to “audit the bank and correct the accounting

and internal control deficiencies” the OCC had noted during its

earlier examinations of Keystone. OCC Dec., Findings of Fact

(FF) 133.3

In July 1998, Keystone hired Grant Thornton to perform the

required audit. Before performing any work, Grant Thornton

representatives attended a meeting between the OCC and

Keystone to discuss the OCC’s earlier investigations of

Keystone. The OCC representatives explained that Keystone

had overstated its assets by about $90 million (almost 10% of its

reported assets) in three earlier quarterly reports. Grant

Thornton assigned one partner, Stanley Quay, and one associate,

Susan Buenger,—both from its Cincinnati office—to perform

3

The Supervisory Agreement required that Keystone retain a

national accounting firm to, inter alia,

(1) “perform an audit of the Bank’s mortgage banking

operations and determine the appropriateness of the Bank’s

accounting for purchased loans and all securitizations”;

(2) reconcile Keystone’s records and loan servicer records;

and

(3) assess the appropriateness of all carrying values of entries

on the balance sheet and income statement.

FF 133 (quoting OCC Ex. 353) (internal citations omitted).

7

the Keystone audit.4 During the pre-audit planning the two

became aware of several additional facts manifesting that the

Keystone audit required heightened scrutiny, to wit:

(1) in a short period of time Keystone had grown rapidly

in asset size and profitability (FF 82, 83); (2) Keystone

was heavily involved in significant and complex

securitizations (FF 82–114); Keystone faced significant

liquidity risk (FF 148, 149, 167); (4) Keystone was

troubled and undercapitalized (FF 135, 167); (5) Grant

Thornton had been retained by Keystone in order to

comply with the OCC Formal Agreement that required

the bank to retain an external auditor to resolve the

bank’s accounting inaccuracies and deficiencies and to

establish an internal control structure (FF 132–134); (6)

The OCC had just downgraded the bank to an

unacceptable composite “4” CAMELS rating, and

downgraded Keystone’s management to the lowest

rating of “5” (FF 150); (7) the FBI had investigated

[Keystone’s “senior vice president” and “controlling

officer”] Ms. Church with respect to illegal “kickbacks”

related to the bank’s residential lending (FF 171); (8)

Mr. Michael Graham, a vice president of KMC

[Keystone Management Company (a Keystone

subsidiary)], was cited by the OCC as being responsible

for an unexplained $31 million “input error” in the

bank’s accounting for residual assets (FF 139); (9)

Keystone recently had recorded ownership of $44

million in trust accounts even though they were not

4

At that time Quay had worked on over 600 financial institution

audits. Tr. 2159, Nov. 23, 2004. Buenger had over four years of

auditing experience with Grant Thornton. See Tr. 2590, Nov. 24,

2004.

8

Keystone assets (FF 139); (10) Keystone also recently

had claimed ownership of $16 million in residual

interests in securitizations even though Keystone had

pledged those interests to other parties (FF 139); (11) the

bank had a history of filing inaccurate Call Reports, key

insiders had been assessed CMPs [civil monetary

penalties] in connection with those inaccuracies, and the

OCC was considering additional CMPs against these

same insiders (FF 151); and (12) the OCC examiners

had accused Ms. Church of manipulating Call Reports so

that the bank’s “well capitalized” status under FDICIA

[the Federal Deposit Insurance Corporation

Improvement Act] continued to be reported even though

inaccurate (FF 140).

OCC Dec. 10–11. Despite these obvious red flags, Quay and

Buenger began with what Grant Thornton’s audit manual termed

a “Basic” audit. FF 176–77, 182–83. Performing only a

“Basic” audit, Quay and Buenger were to (1) obtain written

confirmation from Compu-Link and Advanta that they were in

fact servicing the loans Keystone had reported on its balance

sheet and (2) verify Keystone’s claimed $98 million in interest

income for the year 1998.5 The original Keystone audit plan

called only for a “test of reasonableness.” OCC Dec. 38. At

5

Interest income can be verified in at least two different ways. See

OCC Dec. 27–28 (discussing tests). The first method, a “test of

reasonableness,” requires only that the auditor examine the bank’s

self-reported figures and evaluate their reasonableness based on

“expected relationships” with other information in the bank’s financial

statements. See FF 66–68, 180. The more searching method, a “test

of details,” requires the auditor to review the bank’s “primary financial

documents such as . . . remittances and cash receipts” and to “trace[]

those items into bank records.” FF 63–65.

9

some point after the audit plan was prepared, however, a Grant

Thornton supervisor in a different local office reviewed the plan

and determined that Keystone should be classified “maximum

risk.” See FF 184, 186, 188. According to Grant Thornton’s

audit manual, in auditing a maximum risk client, an auditor is

required to perform a “Comprehensive” audit, including a “test

of details” to verify the accuracy of the client’s interest income.

FF 185–89. Despite Keystone’s classification as “maximum

risk,” the original audit plan was not amended and Quay and

Buenger proceeded with the “Basic” audit.

At the commencement of the audit, Buenger attempted to

independently verify the size of Keystone’s mortgage portfolio.

Keystone’s records indicated that, as of December 31, 1998,

Compu-Link and Advanta had serviced Keystone-owned

accounts worth, according to Keystone, approximately $227.2

million and $242.6 million respectively. In reality, however,

Compu-Link had serviced approximately $14 million in

Keystone accounts and Advanta had serviced approximately

$6.3 million. Buenger asked Compu-Link and Advanta in

writing to verify the size of Keystone’s loan portfolios. Compu-

Link verified, without explanation, that it had serviced just over

$227 million “of Keystone loans.”6

After receiving no response from Advanta for several weeks,

Buenger followed up by telephone and fax. The Advanta

manager in charge of the Keystone accounts, Patricia Ramirez,

then sent Buenger a statement via FedEx indicating that Advanta

had serviced only approximately $6.3 million in Keystone

6

The Administrative Law Judge suggested that the reason for the

discrepancy was that Keystone management influenced Compu-Link

to pool the Keystone and United accounts when responding to Grant

Thornton’s request. See ALJ Dec. 9–10.

10

mortgages in 1998—a figure less than 1/38 of the $242 million

Keystone reported.7 Several weeks later Buenger again

telephoned Ramirez. Ramirez told Buenger that she had located

another pool of “Keystone” mortgages worth approximately

$236 million. Immediately after the call, however, Ramirez

emailed Buenger stating that the $236 million in mortgages were

owned by “Investor # 406,” identified in the email as “United

National Bank.” Notwithstanding the titanic discrepancy,

Buenger did not request a written clarification as required under

Generally Accepted Auditing Standards (GAAS).8 Instead,

relying on the earlier telephone call with Ramirez, Buenger

simply concluded that the $242 million figure was accurate.

7

Most of the mortgages were “high-loan-to value . . . second and

third mortgage loans.” FF 83.

8

The American Institute of Certified Public Accountants (AICPA)

adopted Generally Accepted Auditing Standards to govern the

performance of a financial audit. See Ferriso v. NLRB, 125 F.3d 865,

871 (D.C. Cir. 1997). Under 12 U.S.C. § 1831m(f)(1) an auditor

examining a federally insured depository institution is required to

comply with GAAS. GAAS requires, inter alia, that an auditor

exercise “due professional care” and “professional skepticism” in

conducting an audit. See GAAS § .02 (2007); AICPA, Codification

of Statements on Auditing Standards (AU) § 230.07 (2007). GAAS

also specifies that “[w]henever the auditor has concluded that there is

significant risk of material misstatement . . . of the financial statements

. . . more experienced personnel[,] more extensive supervision [or] . . .

expand[ed] . . . [auditing] procedures” may be required. See AU

§ 312A.17. GAAS also requires that all “significant” confirmations

of financial data be obtained in writing. See AU § 330.29. Buenger’s

reliance on her telephone conversation with Ramirez that Ramirez had

located an additional $236 million in “Keystone loans” flagrantly

violated the requirement that all “significant” confirmations of

financial data be in writing.

11

This was only the most eye-popping deficiency in the

Keystone audit. Despite Keystone’s classification as “maximum

risk,” Quay and Buenger used only the “test of reasonableness”

to verify Keystone’s self-reported interest income figures. Their

test of “reasonableness” was based on fraudulent financial

information Buenger obtained directly from Keystone. They

made no effort to independently verify the accuracy of the

figures as they were required to do under GAAS and Grant

Thornton’s own internal audit manual.9 In reality almost the

entire $98 million that Keystone reported in interest income for

1998 did not exist—a fact that could have quickly been verified

by requesting the monthly remittances Keystone received from

its loan servicers.10 See FF 220–27. Nor does it appear that the

9

See, e.g., FF 225 (“Grant Thornton did not follow the

requirements of its audit manual to conduct a ‘Comprehensive’ audit

that called for primary reliance upon a ‘test of details’ in connection

with the audit of interest income from loans serviced by third-party

servicers.”); FF 230 (“Before an analytical test could be used for

substantive purposes in place of a ‘test of details,’ GAAS, as described

in Grant Thornton’s auditing manual, required Grant Thornton’s

auditors to identify and describe the internal controls pertinent to the

assertions to be audited, test the controls to be relied upon, and

re-evaluate such controls in light of the results to determine if reliance

would be warranted.”); FF 232 (“Where an entity’s internal controls

have not been tested for reliability, GAAS imposes a duty upon the

auditor to independently verify all financial data generated internally

or otherwise provided by the client’s management before that data

may be used for auditing purposes.”); see also FF 166, 179, 185–86,

233–36.

10

Had Quay and Buenger applied a “test of details” instead of a

“test of reasonableness,” they would have almost certainly detected the

Keystone fraud. When, some months after the Grant Thornton audit,

the OCC learned from Compu-Link and Advanta that Keystone’s

12

auditors confirmed that any of the reported interest income was

in fact deposited in Keystone’s account by reviewing Keystone’s

general ledger. Compare Tr. 2502–10, Nov. 24, 2004 with FF

257.

Having failed to detect the Keystone fraud, Grant Thornton

issued an unqualified audit opinion in April 1999 confirming

that “the audit had been conducted pursuant to GAAS and that

Grant Thornton had obtained reasonable assurance that the

bank’s financial statements were free from material

misstatements.” FF 253. Only four months later, however—in

August 1999—OCC examiners discovered that Keystone had

fraudulently reported over $98 million in interest income, FF

259, and over $450 million in assets (approximately 50% of the

total assets reported by Keystone), id., and was “hopelessly

insolvent,” OCC Dec. 1. In September 1999, OCC ordered

Keystone closed and appointed the Federal Deposit Insurance

Corporation (FDIC) as receiver. The Keystone collapse cost

the FDIC approximately $600 million to resolve.11 Tr. 351,

Nov. 12, 2004.

The conduct of the two Grant Thornton auditors can only be

described as strikingly incompetent. They failed to comply with

GAAS as required under 12 U.S.C. § 1831m(f)(1). They failed

to assess, in Grant Thornton’s own words, the “maximum risk”

mortgage portfolios were grossly overstated, the OCC contacted Grant

Thornton. Grant Thornton performed a “test of details” and uncovered

the fraud in under one hour. See OCC. Dec. 30 (citing FF 226).

11

Recent litigation in the District of West Virginia resulted in the

entry of a $25 million judgment against Grant Thornton for losses that

“ ‘but for’ Grant Thornton’s gross negligence, the FDIC would have

avoided.” Grant Thornton LLP v. FDIC, Nos. 1:00-0655 et al., 2007

U.S. Dist. LEXIS 19379, at *100 (D. W. Va. Mar. 14, 2007).

13

Keystone represented. They relied upon a telephone

conversation regarding the loan amount Advanta had serviced

despite the fact that Advanta advised them in writing at least

twice that Advanta had serviced only a fraction of the amount of

loans Keystone’s records showed. They failed to amend their

audit plan to require a “test of details”—in violation of Grant

Thornton’s own manual—after Keystone was classified a

“maximum risk” audit.

Accountants and auditors perform a critical role in insuring

the integrity of financial institutions. See H.R. Rep. No. 101-54,

at 301 (“Independent audits are an integral part of the system of

controls designed to identify and report problems in thrift’s [sic]

when they arise.”). Although I recognize that “[a]uditors do not

function as insurers and their reports do not constitute a

guarantee,” OCC Dec. 2, nonetheless “bank regulators, the

bank’s shareholders and the public,” id., expect to rely on an

auditor’s professional competence and deserve better than what

happened here.