Curtis Packaging Corp. v. Kpmg, No. X06-Cv-99-0156558-S (Jul. 31, 2002) , 2002 Conn. Super. Ct. 9777 ( 2002 )

[EDITOR'S NOTE: This case is unpublished as indicated by the issuing court.]

MEMORANDUM OF DECISION RE: COMPLAINT FOR DAMAGES The plaintiff Curtis Packaging Corporation (Curtis) is a manufacturer of folding packaging material, such as golf ball sleeves. The defendant KPMG, LLP, formerly, KPMG Peat Marwick, LLP (KPMG), is a major public accounting firm employed as Curtis' auditor from the 1950's until the relationship was terminated in 1999. This action claiming tort and contract damages by Curtis against KPMG was filed in 1999. Curtis claims that KPMG was negligent in the performance of its professional duties owed to Curtis, and breached its contractual obligations to Curtis by failing to detect an ongoing scheme whereby Payroll Express, as Curtis' outsourced payroll service, stole approximately $2.5 million during the 1990's from Curtis' payroll account.

The case was tried to the court from December 4, 2001 through December 14, 2001. The parties also filed post-trial and reply memoranda of law. Curtis prevails on the basis of the following findings of fact and conclusions of law.

Sometime in the late 1980's, Payroll Express had performed services for Curtis, including preparation of its W-2 forms for Internal Revenue Services (IRS) purposes. Commencing in April of 1991, Payroll Express assumed Curtis' payroll function. Payroll Express wrote and signed payroll checks on behalf of Curtis by using checks bearing authorized facsimile signatures supplied by Curtis. Payroll Express used these same presigned checks for payment of taxes to federal and state authorities on behalf of Curtis, delivered such checks to the appropriate authorities, and produced check registers. Payroll Express prepared quarterly reports and filed them on behalf of Curtis as its payroll administrator.

Curtis' payroll account was with Union Trust Bank, which maintained account balances and statements. Payroll Express routinely notified Curtis of the funds necessary to meet its payroll, including tax obligations, and Curtis then deposited the appropriate funds into the payroll account.

Payroll Express' thievery involved payments of withholding taxes to the IRS. Payroll Express had responsibility for preparing Curtis' tax withholding forms, IRS form 941. The

principal of Payroll Express, David Kast, routinely prepared two different 941 forms, one being the correct form, which was provided to Curtis, and a second set of forms that reported a lower total wage and withholding amount. This second set of forms was sent at the appropriate CT Page 9779 time to the IRS, without a copy to Curtis. Kast would pay the reduced amount of withholding taxes, or none at all, and would pay the balance of funds to Payroll Express.

To facilitate this fraud, Kast intentionally changed the address on the company's tax form so that any IRS notice of underpayment would be sent to Payroll Express, not to Curtis. Using the signature authority on the payroll account, Payroll Express was able to write checks directly to itself, rather than to the IRS depository.

Curtis first discovered the theft on August 6, 1998, as a result of an IRS investigation and Payroll Express bankruptcy. Potentially liable for the full $2.5 million which should have been paid to IRS, Curtis was able to negotiate a compromise with the IRS on or about October 29, 1998. The compromise agreement required Curtis to pay to the IRS $300,000, forego recognizing a $404,000 net operating loss, and pay to the IRS a portion of its insurance claim against The Hartford Insurance Group. The insurance claim eventually resulted in an additional payment of $146,865.57 to the IRS.

The relationship between Curtis and KPMG was contractual in nature, by means of an engagement letter which was entered into annually over the relevant period. The agreement retained KPMG to conduct a yearly audit of Curtis' financial statements in accordance with generally accepted auditing standards (GAAS). Those standards required KPMG to state with "reasonable assurance" that the financial statements prepared by Curtis were free from material misstatements.

The professional negligence claim is based on KPMG's status as a professional accounting firm. The plaintiff in a professional negligence or malpractice action must demonstrate "(1) the relevant standard of care in the circumstances; and (2) that the defendant deviated from the standard of care and that the deviation caused harm to the plaintiff."Pisel v. Stamford Hospital, 180 Conn. 314, 334-42, 430 A.2d 1 (1980). There was substantial expert evidence to establish the standard of care in this case. The standard of care for the accounting profession is GAAS, which is a product of the U.S. Auditing Standards Board and American Institute of Certified Public Accountants. Also see Vosgerichianv. Commodore Int'l, 862 F. Sup. 1371, 1373 (E.D. Pa. 1994) and FDIC v.Schoenberger, 781 F. Sup. 1155, 1157 (E.D. La. 1992).

GAAS contains ten generally accepted auditing standards: three general standards, three standards of fieldwork, and four reporting standards. The three general standards are focused on auditor qualifications and address training and proficiency, independence and professional due care. The three fieldwork standards govern the performance of GAAS audits CT Page 9780 and include: (4) audit planning and supervision; (5) understanding and evaluation of internal controls; and (6) obtaining sufficient evidential matter necessary to support the auditor's opinion. The four reporting standards are: (7) adherence to generally accepted accounting principles (GAAP); (8) obligation to report on the consistent application of generally accepted accounting principles from year to year; (9) adequate disclosure in financial statements; and (10) requirement of the expression of an opinion, or the reasons why one cannot be expressed.

The plaintiff's expert, Conrad Kappel, testified as an expert witness that GAAS and statements of auditing standards (SAS) delineated the standard of care for accountants performing audits such as those performed by KPMG on Curtis' financial statements. Kappel was of the opinion that KPMG violated the general standard of due care, all three standards of fieldwork, and the standard (10) requiring an opinion or the reasons why one cannot be expressed.

Whether KPMG met the GAAS obligations is dispositive of the case. The engagement letters only obligated KPMG to perform a GAAS audit. This fact was conceded by the Curtis' principal and owner, Donald Droppo.¹ Both the breach of contract and negligence claims are based on proof of deviations from the GAAS standard of care.

It is not the auditor's responsibility under GAAS to detect thefts. A GAAS audit "in most cases is not to disclose defalcations but to render an opinion on the financial statements as audited by the accountant through following accepted accounting procedures." Cereal Byprods. Co.v. Hall, 8 Ill. App. 2d 331, 334, 138 N.E.2d 27 (1956). "Auditors are not required to be detectives hired to ferret out fraud." Cenco Inc. v.Seidman Seidman, 686 F.2d 449, 454 (7th Cir. 1982), cert. denied459 U.S. 880 (1982). "An accountant's good faith compliance with GAAS discharges the accountant's professional obligation to act with reasonable care." Monroe v. Hughes, 31 F.3d 772, 774 (9th Cir. 1994);Mishkin v. Peat, Marwick, Mitchell Co., 744 F. Sup. 531, 538 (S.D.N.Y. 1990); In Re: CBI Holding, Co., 247 B.R. 341, 362 (Bankr. S.D.N.Y. 2000). The AICPA audit guides indicate that "management is responsible for the prevention and detection of fraud." AU § 316.02.

A basic principle of accounting and auditing is risk assessment. Audit risk is the risk that auditors may unknowingly fail to appropriately modify their opinions on materially misstated financial statements. AU § 312.02. Audit risk is composed of three elements:

(1) inherent risk — the susceptibility of an assertion to a material misstatement assuming there are no related internal controls. Simply stated, this CT Page 9781 is a risk that errors or irregularities may occur in the accounting process.

(2) control risk — the risk that the company's system of internal control will fail to detect and correct material errors or irregularities that occur in the accounting process in a timely manner.

(3) detection risk — the risk that the auditor's audit procedures will fail to detect material errors or irregularities that were not detected and corrected by the company's internal control system.

Inherent risk and control risk exist independently of the audit of financial statements. Detection risk relates to the auditor's procedures and is subject to an auditor's control. SAS 47 deals with the risk assessment. If an auditor considers inherent risk to be less than the maximum, he must have an appropriate basis for his assessment, and any reliance he places on his assessment. SAS 47, ¶ 24.

With respect to the audits in issue, KPMG assessed inherent risk as low for all financial statement assertions, except inventory valuation, accounts receivable valuation and debt compliance. Thus, payroll transactions and payroll tax transactions were rated as low inherent risk. The statement in support of this assessment is the following:

Based upon information and knowledge obtained in prior years and preliminary discussion with the VP-Finance, KPMG has assessed overall inherent risk as moderate at a company wide level. However, at the financial statement level, inherent risk has been assigned as low for all financial statement assertions, except Inventory Valuation — LIFO calculation, Accounts Receivable Valuation and Debt compliance. These areas have been assessed at high inherent risk due to the involvement of complex calculations and judgment.

K-10, p. 2. That seems to be the extent of the explanation for the risk assessment of payroll inferentially as low inherent risk. Significantly, there is no reference in the audits to the outsourcing of the Curtis payroll system to Payroll Express beginning on April 1, 1991.

KPMG assessed control risk as "moderate" for all objectives on the basis of its analysis of Curtis' internal control environment. See KPMG's work paper WP-530 Control Overview document (Exhibits K-10, P-66 and E-5). CT Page 9782

The internal control structure of a company consists of the control environment, the accounting system and the control procedures (SAS 55). In all audits, the auditor must obtain a sufficient understanding of each of the three elements to plan the audit by performing procedures to understand the design of policies and procedures and whether they have been placed in operation. (Exhibit 101, SAS 55 at ¶ 319.02). The auditor then must assess control risk. The risk must be assessed at the maximum unless the auditor obtains evidential matter about the effectiveness of both the design and operation of a control policy procedure that supports a lower assessed level of risk. (SAS 55 at ¶ 319.03).

It appears that KPMG only evaluated Curtis' control environment, and not its accounting system or control procedures. An evaluation that a lower level of risk exists requires evidential matter about the effectiveness of both the design and operation of a control policy or procedure that supports the lower assessed level of control risk. There is no evidence in this case of such evidential matter having been obtained by KPMG.

An assessment of risk at lower than maximum when assessing the accounting system control procedures as they relate to the payroll function is a violation of GAAS. A violation of GAAS is found in this case, even though in its audits KPMG used a substantive audit approach, rather than a systems based approach. A substantive audit approach requires the auditor to obtain all of its audit evidence from substantive testing. A systems based approach relies, in part, on a client's system of internal control for audit evidence. KPMG determined that Curtis' internal control structure was not supportive of a systems based approach for routine transactions.

Any assessment of the Curtis internal control structure that was necessary in planning and performing the audit should have revealed the following with respect to the tax and miscellaneous checks in the payroll account: Payroll Express made the payroll tax calculation from data in its own computer, not Curtis'; Payroll Express signed checks with a facsimile signature for checks intended for payment of payroll taxes to the federal government and the States of Connecticut, New York and New Jersey; Payroll Express delivered the checks to the recipients or the bank depository (Union Trust) for the federal government; Payroll Express delivered a check register to Curtis listing the numbers of each check and the amount of each check; Payroll Express prepared the payroll tax returns for Curtis, including form 941 with respect to federal withholding taxes; and Payroll Express signed Curtis' 941's with a facsimile signature and filed them with the federal government on Curtis CT Page 9783 behalf. A control assessment would have recognized that Payroll Express was in a position to initiate unauthorized transactions, and there were no adequate safeguards over Payroll Express' access to and use of the payroll account.

KPMG's substantive testing of Curtis' payroll cycle consisted of the following: confirming the cash balance in the payroll account; comparing the current year's payroll and payroll tax expense to the prior year's expenses; performing daily bank reconciliations for April of each audit year; and calculating Curtis' year-end accruals for accrued payroll and unaccrued payroll taxes.

The materials examined disclose substantial evidence of theft. Checks that cleared the payroll account did not appear on Curtis' check registry (the checks to Payroll Express), while checks appearing on Curtis' check register did not clear the bank. In the month of March 1996 alone, four checks written to Payroll Express cleared the bank, none of which appeared on Curtis' check register (Exhibits 88 and 40, checks 2688 through 2707). Twelve checks appearing on Curtis' check register in March 1996 never cleared the bank (the checks reportedly written to Union Trust and the States of Connecticut and New York). Id.

KPMG's failure to detect Payroll Express' scheme of thievery is attributable to KPMG's decision to forego performance of significant substantive testing of the Curtis payroll cycle. The confirmation by KPMG of cash balance and accruals was accomplished merely by the firm's adoption of bank reconciliations for March and April of each audit year, which reconciliations KPMG obtained from Curtis' bank. No comparison was made of the check register with the checks returned from the bank, even for the months of March and April. KPMG had no basis for treating Curtis' payroll account so lightly, in light of the fact that payroll had been outsourced to an unknown (no SAS 70 audit) payroll service. Payroll was Curtis' second largest expenditure, after purchasing, and it had a material effect on the financial statements. A high control risk assessment was required, and would have mandated a thorough understanding of Payroll Express' performance. Lack of such understanding violated SAS 55 relating to segregation of duties. Clearly, Mr. Kast of Payroll Express was in a position to both perpetrate and conceal errors or irregularities in the normal course of his duties.

KPMG did not understand Curtis' internal control structure as it related to the payroll account and, thus, was not able to identify potential misstatements, evaluate risk, and design substantive testing. The substantive audit was an appropriate approach, but could not be accomplished without an understanding of Curtis' internal control structure. CT Page 9784

In its defense, KPMG argues that Curtis is equally, if not more, responsible for failing to detect the theft by Payroll Express. Concerning accounting malpractice, however, the majority rule is that the contributory negligence of the client is a defense only where the client's negligence prevented the accountant from performing his duties.Lincoln Grain, Inc. v. Coopers Lybrand, 216 Neb. 433 (1984); Shapirov. Glekel, 380 F. Sup. 1053 (S.D.N.Y 1974); National Surety Corp. v.Lybrand, 256 A.D. 226, N.Y.S. 2.d 554, 563 (1939).

Connecticut's comparative negligence statute, General Statutes §52-572h, would not apply in this case under its terms. See also WilliamsFord, Inc. v. The Hartford Courant Co., 232 Conn. 559, 584, 657 A.2d 212 (1995). In any event, the breach of contract claim which encompasses the malpractice claim prevents the application of the comparative negligence doctrine. See Center Court Associates LTD v. Maitland/Strauss Behr, Superior Court, judicial district of New Haven, Docket No. 252381 (May 4, 1994, Healey, JTR).

KPMG also raises a statute of limitation defense. Curtis, however, is not seeking relief with respect to the 1992 audit year; its claims commence with the fiscal year ending March 31, 1993, thereby falling within the six-year contract statute of limitations. Considering the application of the three-year professional malpractice negligent claims statute of limitations, General Statutes § 52-577, the court views the continuing course of conduct doctrine applicable to commence the running of the statute upon the completion of the course of the conduct by the discovery of the fraud in 1998. See Handler v. Remington ArmsCo., 144 Conn. 316, 321, 130 A.2d 793 (1957); Hall Co. v. Steiner Mondore, 543 N.Y.S.2d 190 (1989); Wilkin v. Dana R. Pickup Co.,347 N.Y.S.2d 122 (1973). A review of the engagement letters confirms the continuing relationship between the client and auditor.

KPMG also argues that if it is held liable, then it should receive credit for the funds Curtis received from its insurance carrier. The court finds no reason to abdicate the traditional collateral source rule. Bay State Moving Systems Inc. v. Bowman, 24 Conn. App. 531, 534,590 A.2d 462 cert. denied, 220 Conn. 904, 593 A.2d 969 (1991); Acamporav. Ledewitz, 159 Conn. 377, 384, 269 A.2d 288 (1970).

Curtis claims damages in the full amount of the money stolen, plus interest on the aggregate of approximately $5 million. Such an award would not be appropriate under contract theory. See Gazo v. City ofStamford, 255 Conn. 245, 264-65, 765 A.2d 505. In a breach of contract action, the rule of damages is that the award should place the injured party in the same position as he would have been in, had the contract been CT Page 9785 performed. Similarly, the negligence claim would only justify damages to compensate the plaintiff for his injuries. Waterbury Petroleum ProductsInc. v. Canaan Oil Fuel Co., 193 Conn. 208, 236, 477 A.2d 988 (1984) and Champagne v. Raybestos-Manhattan, Inc., 212 Conn. 509, 532,562 A.2d 1100 (1989).

There is no basis for a punitive damage award. See Venturi v. Savitt,Inc., 191 Conn. 588, 592, 468 A.2d 933 (1983).

The fair award of consequential damages to Curtis would include recognition of the 1998 payment to the IRS in the amount of $300,000, and the 1999 payment to the IRS in the amount of $146,865.57. Curtis has established other consequential damages, as follows: 1998 payment to Continental Investigative Consultants retained to assist in investigating the theft and locating the stolen funds (these payments are in a total amount of $2,846.10); payments to Frederick Lindeberg, a certified public accountant retained by Curtis to assist in dealing with the IRS regarding the back taxes and offer in compromise (these payments were in the amount of $14,755); payment in the amount of $1,391.25 in 1998 to Andrea Obstin Marketing Communications for assistance in dealing with the press and with adverse publicity stemming from the theft; and copy machine costs in the amount of $710.20 to copy records for the IRS and the U.S. Attorney's Office for the criminal investigation of Payroll Express and David Kast.

Curtis was required, as part of its compromise with the IRS, to reduce or give up a net operating loss in the amount of $404,970. Curtis argues that 40% of that amount would be its corporate tax rate which it will eventually suffer. Between the 1998 settlement and the 2002 date of trial, Curtis has not paid any additional taxes to the IRS as a result of the reduction in its net operating loss carry forwards. Its net operating loss has not dropped below $762,612 (Exhibit 96) since the settlement with the IRS. Droppo testified that he might suffer an impact from the agreement not to use the net operating losses if and when Hemingway Packaging, a subsidiary of Curtis, were liquidated. It is uncertain, however, that Hemingway will ever be liquidated, as the liquidation is dependent upon unrelated events, such as the termination of a defined benefit pension plan and the resolution of a Superfund claim. Thus, the potential net operating loss impact is too speculative and is not awarded as damages under the negligence or contract theory.

Curtis also claims payments to various law firms as consequential damages. The amount of $20,957.70 was paid to the law firm of Reid Riege, which served as corporate counsel to Curtis. The services relate to Reid Riege's work in documenting the theft by Payroll Express and participating in Curtis' motion for the appointment of a trustee in Payroll Express' bankruptcy. This expenditure in the amount of $20,957.70 CT Page 9786 has been established and is awarded as damages.

The claims for fees charged by the law firms of Halloran Sage and Montstream May are not established, as they contain work on other lawsuits, including claims against the defendant KPMG for which Curtis is not entitled to an award of fees. At trial, Curtis withdrew its claim with respect to funds paid to Simione Scillia Larrow Dowling, as they had been refunded.

Judgment hereby enters for Curtis, awarding damages in the amount of $487,525.62. Interest is not awarded.

ROBERT F. McWEENY, J.