Cynthia Cooper just wanted to live a quiet life working for the pride of Mississippi - WorldCom. But as vice president of internal audit she discovered some suspicious entries in the company's books. Her tenacious investigations uncovered the largest fraud in corporate history.
"Don't ever allow yourself to be intimidated," Patsy Ferrell would say to her young daughter, Cynthia, after a grade-school bullying incident. Cynthia remembered that exhortation years later when she discovered fraud of huge proportions at WorldCom. Faced with the decision of vigorously investigating suspicious transactions or looking away, she did the honorable thing and pursued the crimes to the end - but not without months of trepidation, a queasy stomach, and shaking hands. "In many ways, this story is about human nature, about people and choices," writes Cynthia in the epilogue of her new book, "Extraordinary Circumstances: The Journey of a Corporate Whistleblower." "It shows how power and money can change people, and how easy it is to rationalize, give in to fear, and cave under pressure and intimidation.
It speaks of the importance of living a life of integrity and making decisions we can look back on without regret. It illuminates the value of developing strong boundaries, keeping our paths straight, and guarding against the temptations and trappings of material success."
In 1994, Cynthia landed a job in internal audit at WorldCom - then known as LDDS - in Jackson, Miss. When the company moved to her hometown of Clinton, Miss., population 23,000, she thought she would settle into a comfortable niche, surrounded by her husband, children, extended family, and lifelong friends. But her nightmare started in the summer of 2002 when, as the vice president of internal audit, she grew increasingly suspicious of some accounting entries. "The more we investigated, the stranger the reactions from some of our colleagues became," she writes. "No one would give us a straight answer." Cynthia tells her story to Fraud Magazine from her home in Jackson.
Why did you write the book "Extraordinary Circumstances"? What does it cover?
I wanted to share the story because I believe there are valuable lessons that can be gleaned and shared with the next generation. I also hope that it might encourage others who find themselves going through one of life's storms or faced with tough choices. I have written the book in an autobiographical style and tried to tell it from a human perspective that looks beyond the accounts and numbers. I also wrote in present tense to help readers experience the events in real time along with my team and me. I was fortunate to work with a group of well-qualified auditors who held steady in the face of tremendous pressure. Hopefully, readers will see the important role that each auditor played and why it is so critical to have auditors on staff with diverse skill sets. As I write in the book, my team and I were ordinary people who found ourselves faced with extraordinary circumstances.
The book takes readers behind the scenes by placing them in the meetings and buildings and settings where the fraud occurred. It allows readers to live the extraordinary rise and fall of WorldCom and think about what decisions they may have made along the way. Through the story, readers will be able to answer questions such as: What went wrong at WorldCom? How was the fraud perpetrated? Why did some employees choose to participate in the fraud? What did employees do to hide the fraud from auditors and analysts? What happens to someone when they become a whistle-blower? What is it like to testify in a federal criminal trial? What were key points of the prosecution and defense cases in Bernie Ebbers' trial? Why did the jury ultimately decide to convict him and why did he receive a 25-year sentence?
During a talk at California State, Bakersfield, you said, "Neither the fraud nor the discovery of it caused WorldCom's collapse. In fact, the fraud simply masked the true state of the business, and WorldCom should have gone into bankruptcy long before it did." Before we delve into specifics, what basically went wrong at WorldCom?
WorldCom was once the fifth most widely held stock in the country and was listed as No. 1 for return to shareholders over a 10-year period. Scott Sullivan, the CFO, was once the highest-paid in the country and praised on Wall Street. In the late 1990s, he received the CFO Excellence Award from CFO Magazine for his work in mergers and acquisitions. WorldCom did everything bigger. For example, it once boasted the largest debt offering and the largest acquisition in corporate history when it acquired MCI, a company three times larger. Then, the company seemingly collapsed overnight.
When WorldCom reported that it would restate its financials by $3.8 billion related to improper capitalization of operating expenses, its stock price had already fallen from a high of $64 in June 1999 to 83 cents. To understand what went wrong at WorldCom from a business perspective, you have to understand the impact of executive and strategic decisions such as rapid growth through acquisition, taking on a heavy debt load, and a lack of integration. It's also important to analyze how external factors came into play.
The telecom industry experienced one of the most massive booms and busts in history, both in terms of scale and speed. In the late 1990s, deregulation of the telecom industry - which opened the market for long distance companies to sell local service, and vice versa - combined with Internet mania, created a winner-take-all mentality in the telecom industry. These factors, along with others, such as the belief that there was a new economic paradigm and conflicts of interest between analysts and investment bankers, created a dangerous cocktail. There was an enormous influx of new telecom competitors and dot-com companies. With easy access to cheap capital driven by low interest rates over a sustained period, telecom companies rushed to expand their networks. The mantra in the industry was - "build it and they will come." Jack Grubman, one of the most prominent telecom analysts at the time, compared telecom network capacity to the attic of a house, saying that no matter how large the attic, it would get filled. In the end, Jack Grubman's theory did not hold. The attic was simply too big.
In March 2000, the dot-com bubble burst, followed by the telecom bubble, which was even larger in scale. Scores of dot-com, Web hosting, and new telecom companies went bankrupt and canceled orders for fiber-optic capacity with the large carriers like WorldCom, AT&T, and Sprint. Telecom carriers and suppliers fell like a circle of dominoes. Hundreds of thousands of telecom workers lost jobs. Billions of dollars in market cap disappeared.
As is often the case, history had simply repeated itself. In the nineteenth century, as the West was being settled, several railroad companies laid rail from East to West. Then, scores of new companies followed suit. Eventually, over 80 of them went bankrupt, sending the country into a recession, burdened with tremendous excess rail capacity.
What do the recent sub-prime crises and WorldCom have in common?
I think there a number of parallels between what happened in the telecom industry and the recent sub-prime crisis - excessive risk-taking, massive market bubbles, and inadequate regulations to protect investors and consumers. In telecom, the excessive risk-taking took the form of companies borrowing billions to expand networks. Warren Buffett once said, "It's only when the tide goes out that you learn who's been swimming naked." When the dot-com and telecom bubbles burst, the industry excesses quickly became apparent. When the housing bubble burst, it exposed excessive risk-taking by mortgage companies that lowered lending standards and gave loans to high credit-risk buyers.
As with Enron and WorldCom, some of the Wall Street investment banks are again at the center of the storm, writing off billions in sub-prime loans. Investment banks purchased mortgage loan portfolios, securitized them, and sold the investments to the public. The New York attorney general has launched an investigation into why credit rating agencies gave strong ratings on some of these risky portfolios and whether investment banks properly disclosed information regarding risks associated with mortgage loans backing securities sold to the public. This may well be the tip of the iceberg.
While it is true that our capital markets are resilient and that there will always be economic cycles, we can't afford to continue down a path of inadequate regulation. Just as balanced controls are important within companies, we must have a more appropriate balance between regulation to protect the capital markets and enough freedom to spur innovation and promote healthy economic growth.
Some experts believe that deregulation of telecom, energy, and banking played a role in the crises within each of those industries. For example, the portion of the Glass-Steagall Act - passed in the 1930s after the stock market crash of 1929 and banking crisis - that disallowed commercial and investment banking within the same company, was repealed in the late 1990s, and left us with the same conflicts of interest that led to some of the early banking failures. I write in the book about the impact of this regulatory roll-back in the WorldCom case.
We continue to see a cycle - lack of regulation followed by some disaster in the capital system, which brings a public outcry for regulators to take action. When the markets are rising and investors and consumers are content, there often isn't an adequate mandate for the Fed or other regulatory bodies to step in. Time and again, regulators find themselves reacting, stepping into the gap when there is a disaster. Regulating in crisis mode can result in the pendulum swinging too far. We must find the political will to proactively institute balanced regulation, and require greater transparency and disclosure to minimize excessive market bubbles and better protect consumers and investors.
What were top management's early reactions to your campaign to emphasize internal controls?
I faced a multitude of challenges. The WorldCom executives were entrepreneurs who were praised on Wall Street for their focus on growing the company rapidly through acquisition. It was difficult to get approval to grow the department. When I started with WorldCom in January 1994, I was given two staff auditors who had very little audit experience. My team and I had to educate management on the importance of implementing internal controls and developing a strong internal audit function.
Bernie Ebbers, the CEO, didn't start his career in business. He had a degree in physical education. He simply hadn't been exposed to internal audit or the concept of internal controls. At one point in the early years of my career, I was told by my boss not to use the term "internal controls in any more audit reports because Bernie didn't understand what it meant and it aggravated him. Of course, we continued to use the term "internal controls" and instead worked to educate Bernie on why controls were important.
I understand that your department did something quite unusual for internal audit; without authorization, you and your people put in long hours at night looking at the company's financials. Basically you repeated Andersen's work but dug much deeper. What did you find initially?
When companies perpetrate financial statement fraud, they often begin by manipulating areas that require judgment. During an internal audit of the wireless division, a senior vice president expressed concern that while accountants reporting to him were booking entries to increase the division's allowance, accountants reporting to the CFO were reversing the entries. He said the CFO assured him that the total company allowance was adequate. After investigating, we determined that the allowance appeared low by as much as several hundred million dollars. By going into the accounting system, we identified a number of allowance accounts with balances going in the wrong direction and traced the entries that were being reversed through the system.
You went to Andersen, WorldCom's accounting firm at the time to ask them about the wireless reserve issue. What happened then?
The Andersen partner wasn't concerned about the fact that corporate accounting was reversing the allowance entries. He indicated that based on its audit testing, the company's allowance was over-reserved in other areas of the company, and so, from a total company perspective, it was adequate.
What was the reaction of Scott Sullivan, WorldCom's then CFO, when you asked him about the reversal of wireless accounting entries?
Scott was adamant that, from a total company perspective, the allowance was proper. He also maintained that while it might be short in the wireless area, it was over in other areas of the company. His behavior vacillated from being aggressive and hostile to trying to convince me that he had taken a close look at the situation, and that the allowance was appropriate. At one point, he tracked me down outside of the office and chastised me for asking Arthur Andersen about the allowance.
What made you persist when both Andersen and Sullivan told you to leave the issue alone?
As an auditor, when someone is hostile or acting in a manner that is out of character, you should ask yourself why. My instinct from ACFE fraud training and years of audit experience told me to take another look. I decided to review Arthur Andersen's audit work papers detailing its allowance testing. Though we initially had conflict with the Andersen partner, he did provide the work papers. I, along with several auditors on my staff, walked through the testing. We concluded that the allowance was not over in other areas of the company as we had been led to believe. Ultimately, we pushed the issue and management increased the allowance.
Can you describe what you discovered after receiving an e-mail from Mark Abide, the manager in charge of keeping the books for the company's property, plants, and equipment?
Glyn Smith, one of the internal audit directors, received an e-mail from Mark Abide telling him that he might want to take a look at the allegations in an attached article. The article, which ran in the Fort Worth Weekly, discussed Kim Emigh, a former WorldCom engineer, who had made a number of allegations against his superiors. For example, he believed that some vendors were overcharging WorldCom. He also said that his boss asked him to expense labor hours that should have been capitalized because his division was over its capital budget. Ultimately, Emigh was laid off in what he believed was retaliation for raising concerns. He and his family struggled financially, and he was unable to find employment.
Though the allegations in the article had nothing to do with the fraud we ultimately identified, the article did cause us to kick off a capital expenditure audit that was on the schedule for later in the year. During the audit, we identified a number of accounting entries with a description of prepaid capacity. When we asked what prepaid capacity represented, no one could give us an adequate answer or provide support.
How did you get access to the full accounting system?
When I asked one of the internal auditors to trace accounting entries related to the wireless allowance, he was only able to see the balance sheet side of the entries. The controller later testified in federal court that he had intentionally cut my team's system access to try and keep us from finding the fraudulent accounting entries. During our allowance testing, we decided to use a new home-grown program, developed by one of the information technology employees, who was looking for someone to beta-test it. The program was a valuable tool that allowed us to trace journal entries.
What were the major results of your investigation at this point?
The initial prepaid capacity entries we identified were in the first quarter of 2002. As we continued to delve, we found 49 prepaid capacity entries that went back to the first quarter of 2001 and totaled $3.8 billion. In addition, we later identified entries in which several accountants inappropriately drew down on excess reserves.
How did Sullivan react when you told him of your audit?
Scott called one morning and asked me to be in his office in 10 minutes to discuss what I was working on. He was a very busy man and we did not spend a lot of time together, so the request was odd. During the meeting, he asked me to delay the audit. He also said he was going to hold some of my staff's promotions until he knew more about what they were working on. He told me that the audit committee chair, who I had reported to for the past eight years, would no longer be on the committee. I think, in hindsight, he was trying to tell me that the person who provided internal audit with some independence might not be there for me. I again felt that his demeanor and reactions were out of character.
Can you describe what happened when you then approached other WorldCom executives?
When we approached some of the accountants involved in making the fraudulent entries, they acted as if they didn't know what we were talking about. The controller sent me an e-mail telling me that we were wasting our time auditing capital expenditures and should instead be auditing other areas of the company. The audit committee chair instructed me not to ask for support for the entries and to instead wait for Scott Sullivan to call me. He said he had spoken to Scott and he believed that he would have a good explanation.
On June 20, 2002, you and Glyn Smith traveled to Washington, D.C., to present your definitive results at an audit committee of WorldCom's board, attended by Sullivan. What did you report? What was Sullivan's reaction and defense?
We provided the audit committee chair with schedules detailing each of the prepaid capacity entries, quarter by quarter, as well as a schedule of what profits would have been without the entries. The chair confronted Scott. Glyn and I sat across from Scott as he tried to defend the entries. He provided a business rationale, cited the matching principle of accounting, and argued that with the implosion of the telecom industry, he should not be required to restate the financials but should instead be allowed to take an asset impairment charge in the current period. The audit committee gave him several days to provide support from the accounting literature. Scott then spent the weekend writing a white paper to defend his position.
On June 24, the audit committee told Sullivan and controller David Myers that they would be fired if they didn't resign before the board meeting the next day. Sullivan refused and the board terminated him. Myers resigned. The next day, WorldCom announced that it had inflated profits by $3.8 billion over the previous five quarters. What were your thoughts when all this was coming down?
It all seemed so surreal. I felt like I had been hit by a train. Many people had worked extremely hard to build this company. Shareholders lost all, or portions of, their retirement. Many Mississippians had invested heavily in WorldCom because it was the only Fortune 500 company headquartered in my state. WorldCom truly was a Cinderella story for what has long been one of the poorest states in the nation. The company had been headquartered in Clinton, a small college town of 25,000, where I was raised and my parents still live today. The headquarters was moved to Ashburn, Va. Tens of thousands of our co-workers were laid off. In addition, the people who committed the fraud weren't just numbers to my team and me. Many of us had worked with them for years. We knew their spouses and children. I think members of my team felt many negative emotions, from heartbreak to disbelief to betrayal. Many were afraid they would lose their jobs and struggle to replace them in Jackson.
What was the total cost of the WorldCom fraud?
The prosecution cited more than $5 billion in fraud during Bernie Ebbers' criminal trial. Though the restatement was much larger and included billions in asset write-downs, the company didn't distinguish what portion of the restatement was fraud. They left that to the Justice Department.
Can you describe some of the specific methods the perpetrators used to commit the financial transaction fraud and the ways you and your people discovered those crimes?
They made sure to perpetrate the fraud in such a way that key ratios reviewed by Andersen as part of its quarterly review or by Wall Street analysts would be in line with expectations. The accounting entries were on-top post-close entries, meaning that management closed the books each quarter, compared the results to the quarterly earnings guidance that had previously been given to Wall Street, and booked accounting entries on top to make up the difference. The accountants involved in the fraud made additional journal entries to spread amounts across a multitude of fixed asset accounts in smaller dollar increments so that the fraud would be less detectable during the external audit. They also ran amounts in and out of various accounts each quarter and changed the pattern of movement from quarter to quarter.
Since 1988, ACFE Chairman Wells has preached the message of fraud deterrence and a multidisciplinary approach to fighting fraud. How did your CFE training aid you in your fraud examinations? How has the ACFE helped you in your career?
Chairman Wells and the ACFE staff have been extremely supportive. Joe Wells was one of the first people to reach out to my team and me in the fraud's aftermath. The ACFE fraud training I have received over the years has been immensely helpful to my team and me, and I would encourage all internal audit departments to make sure that they have CFEs on staff. When I left the company, more than 90 percent of my staff had at least one professional certification and most had multiple designations. I think my training helped throughout the process as I studied accounting entries, interviewed staff, confronted various executives, and reviewed external audit work papers.
Fraud examiners have always known that the tone at the top from the executive suite affects a corporation positively or negatively. In the aftermath of WorldCom, how has that concept solidified for you?
I've come to appreciate more than ever the impact the tone at the top can have on an organization. Of course, WorldCom employed thousands of people, most of whom were honorable, came to work every day, and tried to do the right thing. There is no question that Bernie very much set the tone at WorldCom. He was an aggressive entrepreneur. His growth through acquisition strategy and propensity for taking risk in the market were factors in the spectacular rise of WorldCom as well as its fall. It was the gambler's curse.
Did the firm ultimately incorporate many of your internal control recommendations?
Over the years, the internal audit department made scores of recommendations to strengthen controls and many were implemented. However, WorldCom acquired more than 60 entrepreneurial, fast-growth companies one after another. It moved from being a simple reseller of AT&T long distance in Mississippi to an international behemoth selling local, international, data, Internet, and wireless. Each company had its own systems and processes that were never fully integrated. One result was, for example, that WorldCom didn't have a single billing system; it had more than 60 billing systems. When I went to work for WorldCom, revenues were $1.5 billion. Six years later, revenues exceeded $38 billion. You don't see that kind of growth, especially through piling acquisitions one on top of another, without having significant challenges, from internal control weaknesses to redundant systems to a complex environment that is constantly changing.
What motivated you to persist when there were so many roadblocks and looming consequences?
For me, I think a combination of values - instinct based on years of public accounting and internal audit experience, fraud training, and an obligation I felt to shareholders all came into play in my decision. I wish I could tell you that I was a pillar of strength throughout this process. But I wasn't. There were times when I was scared - when my hands were shaking and my heart was pounding. I certainly knew there was a very real possibility I would lose my job, and I also worried at times that I was overreacting. I had no interest in making accusations that might be wrong and cause unnecessary damage to others' reputations, so we had to be sure our conclusions were accurate.
Regardless of new business controls and regulations, fraud examiners and internal auditors will always discover internal fraud - much of the time perpetrated by top executives - and then will be faced with ethical decisions. What kind of encouragement and advice can you give them as they try to honestly and diligently work at their jobs?
Listen to your instinct. If something doesn't feel or seem quite right, it might not be. If people are acting out of character or appear to be working to head you in another direction, step back and ask yourself why. Auditing can often be a plodding process of developing facts, checking and re-checking theories, and connecting the dots. Continue to ask for support and dig until you are satisfied that you've gotten it right. Don't allow yourself to be intimidated by superiors.
What are a few of the lessons you've learned and are teaching to students and business people?
It's critical that we decipher not only the business lessons but the personal lessons. Going through these events has made me more aware of the importance of making sure I instill strong ethical values in my own daughters who are now 18 and 6. Most of us can recall points in our lives when we felt pressured to do something we didn't think was right. Several of the mid-level managers at WorldCom came under such pressure and became complicit with the fraud even though they knew it was wrong.
I want to make sure that when my daughters come to tough ethical dilemmas in life, I've given them the tools to think through the issues and make the right decisions. I've devoted the epilogue of the book to "10 Steps to Sorting Through Tough Decisions and Making the Right Choices." While we can all apply these methods, I am primarily including them to reach young people, because I spend a lot of time talking about ethics to both high school and college students.
It appears that WorldCom was the final impetus for the passing of SOX. Do you feel SOX is living up to its potential?
I feel very positive about many aspects of Sarbanes Oxley. Internal audit departments are getting more support. External auditors have adjusted their audit methodologies so that they are more geared toward fraud detection. Public companies have implemented hotlines. Boards are more independent and becoming more focused on understanding not just financial reporting risk but broader business risks. We'll always have fraud, but I think the combination of many of the governance improvements will have a positive impact on fraud prevention and detection.
One of the most significant benefits of Section 404 is that executives and board members have a greater appreciation for the importance of having a strong internal control framework. I'm often asked whether SOX 404 could have prevented the WorldCom fraud. It is, of course, theoretical, but I think some of the entity-level controls such as having an effective ethics office and independent fraud hot-line could have had an impact. But it's important to recognize that many of the recent financial statement frauds have involved collusion at the highest levels of the company. In these cases, most of the basic internal controls can be bypassed. For auditors, I think overreliance on internal controls in lieu of detailed substantive testing is risky. In the case of WorldCom, Arthur Andersen vouched for less than 10 capital additions based on their reliance on internal controls.
Internal controls are important, but the costs shouldn't outweigh the benefits. As is often the case, I think the pendulum simply swung too far. The results were that companies and auditors spent too much time implementing and testing detailed transactional controls that aren't likely to prevent or detect these high-level collusive frauds. I'm hopeful that with the SEC's new guidance and the PCAOB's AS5 - which is scalable, less prescriptive, and encourages a top-down, risk-based approach - we are headed towards a better balance. We need adequate controls to protect the capital markets without weighing down the economy or quashing innovation and entrepreneurial risk-taking.
Why did you decide to finally leave MCI (formerly WorldCom)? What are your plans for the future?
I stayed with the company for more than two years after the fraud was reported and until it successfully emerged from bankruptcy. Corporate headquarters moved from Clinton to Ashburn, Va., and when I left, I was the last WorldCom vice president in Clinton. Except for my small internal audit team and a few remaining employees, the entire floor where we worked in Clinton was a sea of empty cubicles. I wanted to start my own company and share this story with professionals and students. I also wanted to write "Extraordinary Circumstances," which has taken much of my time over the past few years. Because this is not a path I ever expected to be on, I'll have to wait and see what the future holds.
The Association of Certified Fraud Examiners assumes sole copyright of any article published on www.fraud-magazine.com or www.ACFE.com. ACFE follows a policy of exclusive publication. Permission of the publisher is required before an article can be copied or reproduced. Requests for reprinting an article in any form must be e-mailed to: FraudMagazine@ACFE.com.