One of the great fallacies within Grace Church is that “there is complete financial transparency” and an annual audit, which provides assurances that financial statements are accurate. These claims are absolutely untrue, and here is why.
First, in an Agreed-Upon Procedures (AUP) review, attestation is the responsibility of the client, or an independent third party under certain circumstances. What does that mean? It means that all the client receives from the CPA is a finding of fact. For example, if Grace’s contract with the CPA asks the latter to verify that there is $100000 in the checking account, that’s exactly the report that will come back, nothing more and nothing less. Or, in other words, it is the client who attests that information is accurate, not the CPA.
Second, the very fact that the client specifies the scope of the engagement makes it both risky and meaningless. Thus, if Grace only asks the CPA to review whether it has counted pledges correctly, someone could be embezzling right and left, and the CPA would never know as long as the relevant pledges are indeed counted correctly, nor would the auditors have any responsibility to know. In short, an AUP is intended to help organizations make internal business decisions. It does not, nor is it intended to, provide independent assurances.
Third, vestry members have not generally seen the scope of engagement, so it is unclear what is covered. That said, a number of factors suggest that it is very limited, including numerous errors in the church’s accounts payable, receivable, and even payroll. Moreover, the vestry’ minutes (last April) make clear that errors in church financial records date back at least three years. Thus, the vestry is aware of the problems, but has yet to fulfill its fiduciary obligations to safeguard parish assets. Even in my case, I still don’t have an explanation to this day as to what happened to my 2012 pledge payment.
Fourth, these issues mesh with Bob Malm’a obligation to provide complete financial records adequate to permit the vestry to fulfill its fiduciary obligation. Church canons and civil law both require that vestry members see financial reports for all parish accounts and ministries. The fact that Grace Episcopal School records are not available could result in personal liability for vestry members, Bob Malm, and parish employees alike.
Fifth, the information Bob Malm provides to the vestry is, at best, misleading. By presenting the AUP as an audit, and stating, as I have heard firsthand, that the auditors’ letter had very few suggestions, parishioners are lulled into a false sense of security. Indeed, this should engender alarm, given the chaotic nature of the church’s financial reporting. And national church policy requires that the vestry get a copy of the nonexistent audit report.
It gets worse. As recognized by the Manual of Business Methods for Church Affairs, one of the most common bases on which to hold vestry members, including the rector, personally liable for losses is failure to conduct an audit when doing so would likely have resulted in detecting a loss.
Moreover, there’s a practical issue, which is that those of us with legal and accounting backgrounds can’t tell Bob Malm anything. Nothing. Zip. Nada. Bob will treat any such conversation as criticism and argue, distort facts, pretend he doesn’t understand the plain meaning of words, and more, versus recognizing that folks are trying to keep his sorry backside out of the wringer.
And that leads me full circle, which is that for years parishioners have suspected that there’s a rat in the woodpile. I mean, why all the secrecy? More than one person has speculated that the office staff had or have something on Bob. Otherwise, why would he fight tooth and nail to protect employees who, inter alia, were verbally abusive, bullied other people, and did a mediocre job at best?
It’s interesting, too. If you think about the purpose of an audit, which is to provide assurances about the integrity of church finances and financial reporting, why wouldn’t Bob be the first person to insist on an audit? Does he recognize that his personal assets, including those he received as bequests from his parents, could be at risk? Surely even Bob is not so pig-headed as to put himself and his family at risk.
Moreover, I still remember clearly Bob’s seeming alarm when I suggested we get Church Steeples, or another forensic church accounting firm, in to finally set financial reporting on a stable track. Add in the lack of an audit; the church’s deposits, which allegedly have been off numerous times; the loose cash and stale checks in Charlotte’s office; the one known major payroll error, the fact that the loan for the down payment on Bob’s personal residence was treated as “off budget” for many years, and there’s plenty of reason to be deeply concerned.
Wake up folks. You have a serious issue on your hands. You need to insist on a real audit, preferably a forensic one, and if Bob won’t do it, you need to go to the diocese. If that doesn’t produce results, you need to get a court order and get it done.
.