Internal Audit At JPMorgan Chase: Not High Profile Enough Yet

Earlier this week I wrote a column at Forbes.com about the new Chief Auditor, or CAE, at JPMorgan Chase. Silly me, I thought after all that had happened at the bank last year – for example, billions in losses from the “whale” trade, investigations into Libor and AML illegal acts, multiple lawsuits including by the New York Attorney General for foreclosure fraud – it was time to take a close look at the function and maybe make some changes.

The “Task Force Report”, a bank internal investigation into the “whale” trade losses says the bank did shake things up.

The Firm has put in place a new CIO leadership team. Matthew Zames, who had served as co-Head of Fixed Income in the Investment Bank, replaced Ms. Drew as the Firm’s Chief Investment Officer. He occupied that role from May 14, 2012 through September 6, 2012. Mr. Zames is now the co-Chief Operating Officer of the Firm and oversees, among other things, both the CIO and Treasury functions. Craig Delany replaced Mr. Zames as Chief Investment Officer and currently reports to him. Other key appointments include Marie Nourie (CFO for CIO); Chetan Bhargiri (Chief Risk Officer for CIO, Treasury and Corporate); Brendan McGovern (CIO Global Controller, a position that had been open since January 2012); Diane Genova (General Counsel for CIO and General Counsel for Markets in the Corporate and Investment Bank); Pat Hurst (Chief Auditor); and Ellen Yormack (Senior Audit Manager).

I thought the bank had replaced their Chief Audit Executive. I asked two different JPM spokespersons, in writing over the course of five days including a weekend, about the change, including questions about the fate of Lauren Tyler, the current CAE. They did not correct my mis-impression nor provide any further information about Hurst or a comment on my story.

I published the story after getting no response – and no further information about Hurst’s qualifications to be Chief Auditor – from the two spokespersons. That got the bank’s attention finally and I had to make a quick correction. (It seems people instantly flooded Lauren Tyler with calls thinking she had stepped down. Testament to the power of the pen, and Forbes.com, I guess.)

(Correction: I pursued a comment from two JPM spokespersons since Friday, Jennifer Zuccarelli and Mark Kornblau. They did not correct my impression, based on the Task Force Report, that Pat Hurst got a promotion to overall Chief Auditor.  Joe Evangelisti, chief bank spokesman, has now informed me, after this was published, that Pat Hurst is General Auditor for the Corporate division only, not the whole bank. Lauren Tyler is still Chief Auditor of the whole bank. I apologize for the error.)

My first thought was that I’d been “punked” – deliberately allowed to print incorrect information by the bank so they could undermine my credibility with a correction. The alternative – that two senior corporate communications folks would not immediately know who the bank’s General Auditor was and spot my erroneous impression that a change had been made – was too incredible to imagine.

You be the judge.

I corrected the column. It looks a bit messy, but I think the rest of it speaks volumes.  I’ve described the bank’s lack of information about the CAE and the internal audit function and what its Audit Committee charter says about the board’s lack of authority over the CAE.

There’s also a good quote from IIA CEO Richard Chambers about how things should be.

Do a little experiment. See if you can easily find the name of the Chief Audit Executive for each of the systemically important US banks on the banks websites. (No peeking at the annual report.)

I dare you.

That quick test should tell you how much work banks still need to do to put internal audit in its proper place, as well as comply with new Fed rules about its structure, role and responsibilities in large banks.

JP Morgan Chase’s Audit Committee Charter says it, “shall review and concur in the appointment, replacement, reassignment, or dismissal of the General Auditor.” It’s not apparent to whom JPMorgan Chase’s Chief Auditor reports. But it’s clear from the charter that the Audit Committee does not approve the hiring, firing or reassignment of a Chief Auditor but merely reviews and concurs. That doesn’t sound tight enough to me.

Read the rest at Forbes.com.

Update: JPMorgan Chase did replace its Chief Compliance Officer Martha Gallo and its Chief Risk Officer, John Hogan. According to New York Times DealBook:

Cindy Armine, who joined the bank fromCitigroup, has taken over the compliance role. Ms. Gallo was well regarded within the bank, in part for her strong relationships with regulators. JPMorgan has changed the chain of command for Ms. Armine’s role so that she will report directly to the bank’s chief operating officers, Matt Zames and Frank Bisignano.