Internal Audit

Enron’s internal audit function was not a standalone department but a distributed organization spread across Risk Management, Global Operations, and external auditor Arthur Andersen. Chief Risk Officer Rick Buy held nominal oversight, Shawn Kilchrist coordinated audit activities, and Sally Beck’s Global Operations team served as the primary implementation arm. Arthur Andersen, already Enron’s external auditor, performed much of the actual internal audit work – an arrangement that eliminated the independence internal audit requires to function.

The email corpus contains 318 messages mentioning “internal audit,” 388 mentioning “audit committee,” and 267 mentioning “internal controls” across the 1999-2002 period. No dedicated PST archive exists for the internal audit function, and neither Buy nor Kilchrist has a personal archive in the corpus, likely because their emails were segregated for legal proceedings. The picture that emerges from surviving correspondence is of a function that developed sophisticated methodologies for trading controls but operated in a structural blind spot that left it unable to detect or prevent the accounting fraud at the company’s core.

Organizational Structure

Chief Risk Officer

Rick Buy, as Chief Risk Officer, sat at the top of the internal audit reporting chain. He appears in 4,246 emails across the corpus, a volume that reflects his central role in risk oversight. When the LJM partnerships were proposed to Enron’s board in 1999, Buy and Chief Accounting Officer Rick Causey were assigned to review all Enron transactions with LJM. Vince Kaminski warned Buy about concerns with the LJM structure; Buy relayed those concerns to upper management but did not block the first transaction. The officer charged with overseeing internal audit controls was, in this instance, overruled by the executives he was supposed to check.

Shawn Kilchrist – Audit Coordinator

Shawn Kilchrist appears in 108 emails across the corpus, identified in calendar entries and meeting invitations as the person coordinating internal audit activities. A September 20, 2000 calendar entry labels him “BRM Communications for Audit Committee – Shawn Kilchrist,” linking him to the Business Risk Management framework that fed into board-level reporting. A June 12, 2000 entry references a meeting in “EB3015 Shawn Kilcrist re: internal audit.” No formal title announcement for Kilchrist exists in the corpus, and his exact reporting relationship – whether to Buy, Causey, or another executive – remains unclear.

Sally Beck and Global Operations

Sally Beck was the most active figure in internal audit correspondence, sending 53 emails and receiving 61 that mentioned internal audit. Her Global Operations team provided the operational backbone: coordinating audit findings meetings, scheduling reviews of completed audit projects, and managing the interface between Enron’s business units and the auditors.

In May 2000, Beck hired Shona Wilson from PricewaterhouseCoopers to lead controls and standards work across all trading locations. Beck introduced Wilson to the organization:

Wilson quickly became the second most active internal audit correspondent in the corpus, appearing in 45 emails as a recipient and sending 16. She attended internal audit findings meetings in Beck’s absence and worked directly with Kilchrist and Arthur Andersen on audit methodologies.

The Arthur Andersen Dependency

Arthur Andersen was not just Enron’s external auditor – it also performed internal audit work. As the Washington Post reported in December 2001, “Arthur Andersen was not just the outside auditor for bankrupt energy trader Enron Corp., it was also the company’s internal auditor. Andersen’s new team of internal auditors shared floor space with Enron’s information systems department.”

The same firm issuing Enron’s external audit opinion was executing the internal audit work that was supposed to provide independent assurance. This created a closed loop: Arthur Andersen was, in effect, auditing its own work. The email corpus shows Andersen coordinating with Kilchrist and Beck’s team on audit plans, findings, and methodology, but only from the Enron side of the conversation – no Andersen employee archives exist in the corpus.

Audit Methodologies

Doorstep Reviews

Enron developed a systematic methodology called “Doorstep Reviews” for auditing trading offices worldwide. A June 5, 2000 email from Brent A. Price, forwarding a message from Naomi Connell, described the approach:

The Doorstep methodology deployed Enron employees with audit or risk control backgrounds to remote trading offices, using standardized questionnaires to evaluate whether trading activities met control requirements. For offices like those of the recently acquired MG (Metallgesellschaft) trading operations, the reviews also coordinated with the subsidiary’s existing internal auditor to understand existing audit plans and coverage.

The “Transparently Controlling” Framework

In October 2000, Mike Jordan proposed a comprehensive methodology for embedding internal audit into Enron’s trading operations. His proposal, sent to Kilchrist and Wilson, laid out a layered system of accountability, self-assessment, and independent review:

Jordan proposed a monthly self-assessment cycle: business controllers would rate areas within the trading transaction cycle as red, amber, or green, with trend indicators showing static, improving, or declining conditions. Arthur Andersen would then leverage this internal database to form its own internal controls audit opinion, rather than conducting fully independent testing.

The framework was methodologically sophisticated for operational risk. Its limitation was its scope: it focused on trading process controls – deal execution, settlement, position reconciliation – rather than on accounting fraud risk. The problems that destroyed Enron were not in how trades were processed but in how financial results were reported.

Key Audit Activities

Audit Committee Reporting

The board-level Audit Committee received regular presentations from management. Calendar entries document the cadence: an “Audit Committee teleconf. w/ Andy Fastow + Mr. Winokur in EB5022” on April 24, 2000; an “Audit Committee mtg. – Boardroom” on August 7, 2000; and a series of preparation meetings in late 2000. A November 30, 2000 calendar entry shows “Rick Causey re: Final budget & Audit Committee presentation,” followed by a “Pre-Audit Committee Meeting” on December 5 organized by James Derrick, and a “Prep Meeting before Audit Committee in R Causey’s Office” on December 8.

The pattern of multiple preparation meetings before each Audit Committee session suggests careful management of what information reached the board. Whether these pre-meetings served legitimate preparation or selective filtering of findings is unknowable from the email evidence alone.

Annual Audit Planning

A February 5, 2001 calendar entry in Maureen McVicker’s archive records a meeting with Terry Wheeler regarding the “2001 Internal Audit Plan.” Wheeler appears in only this single email across the entire corpus, making it impossible to determine whether he was an Enron employee, an Arthur Andersen consultant, or an outside advisor. The meeting’s existence confirms that formal annual audit planning took place, but the plan itself is not preserved in the corpus.

Compliance Audits

Doug Gunthert conducted formal compliance audits in the fall of 2001, issuing final reports with findings and management action plans. On October 5, 2001, Gunthert released a “Final Report for Audit of Employee Expense Reports.” On the same day, he completed an audit of conflicts of interest and business conduct for Northern Border Partners:

The finding of “no material control weaknesses” in conflicts of interest policies was issued on October 5, 2001 – three weeks after Enron unwound the Raptor structures at a $600 million loss, two weeks before the SEC opened its investigation, and less than two months before bankruptcy. Andrew Fastow’s LJM partnerships had been running conflicted transactions with Enron for over two years. Whether Gunthert was an Enron employee or an Arthur Andersen auditor cannot be determined from the email evidence, but the audit’s narrow scope – Northern Border Partners rather than Enron Corp. – may explain how it could find “no material control weaknesses” during a period of active fraud.

Conflicts of Interest Policy

The company maintained formal conflicts of interest policies distributed under the names of Ken Lay and Jeff Skilling jointly. Emails from November 16, 1999 and November 12, 2000 regarding “Conflict of Interest Policy Mailing to Vendors” appear across multiple PST archives, indicating company-wide distribution. The existence of formal policies made the failure to enforce them against Fastow’s LJM arrangements a failure of execution rather than of policy design.

The Collapse Period

October 2001: Business as Usual

Internal audit activity continued on routine compliance matters even as the company entered its terminal crisis. Gunthert’s expense report audit and conflicts of interest review were both issued on October 5, 2001. On October 18, a calendar entry in Lisa Sutton’s archive scheduled an Arthur Andersen internal audit findings meeting for October 26:

This meeting was scheduled for six days after the SEC opened its informal inquiry into Enron on October 22. Whether it took place as planned is unknown, but its scheduling reflects either institutional compartmentalization – routine audit work proceeding in isolation from the executive-level crisis – or a deliberate effort to maintain normal operations while the company negotiated its survival.

Email Activity Pattern

The monthly distribution of internal audit emails reveals the function’s rhythm and the collapse of activity in the crisis period.

The October 2000 peak corresponds to Mike Jordan’s “transparently controlling” proposal and the intensive audit planning cycle that produced the highest volume of internal audit discussion in the corpus. The October-November 2001 activity, while lower, shows the function operating through the crisis – though on routine compliance matters rather than the existential threats facing the company.

Key Personnel

Structural Failures

The internal audit function failed to detect or prevent the fraud that destroyed Enron. Several structural factors explain why:

Compromised independence at the top. Rick Buy, the Chief Risk Officer overseeing internal audit, was assigned to review LJM transactions but approved them despite warnings from Kaminski. Congressional testimony and news accounts later identified Buy as one of the executives who “instigated and/or approved” the accounting irregularities. An internal audit function cannot work when its senior oversight officer is complicit in what it should be detecting.

The Arthur Andersen conflict. Having the external auditor also perform internal audit work eliminated the independent check that internal audit is supposed to provide. Arthur Andersen could not objectively evaluate controls that its own personnel had helped design and implement. This structural conflict was well understood in the auditing profession but was not prohibited by regulation until the Sarbanes-Oxley Act of 2002.

Scope limited to operational risk. The surviving emails show an internal audit function focused on trading controls: deal testing at remote offices, settlement processes, position reconciliation. The fraud occurred not in trade execution but in financial reporting – the Raptor structures, reserve account manipulation, and off-balance-sheet treatment of SPEs. Internal audit’s methodological innovations addressed the wrong category of risk.

Missing archives. The absence of PST archives for Buy and Kilchrist – the two people most central to internal audit oversight – limits what can be known about the function’s actual awareness of fraud risk. Their emails were likely segregated for legal proceedings, which itself suggests they contained material relevant to the investigations.

Legacy

Enron’s internal audit failures were a primary catalyst for the Sarbanes-Oxley Act of 2002. Section 201 of SOX prohibited auditing firms from providing internal audit services to their audit clients, directly addressing the Arthur Andersen dual-role problem. Section 404 required management to assess and report on the effectiveness of internal controls over financial reporting, with external auditor attestation – the kind of independent evaluation that Enron’s internal audit function had failed to provide. The Public Company Accounting Oversight Board, created by SOX, took over regulation of auditors from the profession’s self-regulatory bodies, reflecting the judgment that the existing system had failed.

The PCAOB later cited Enron’s internal audit collapse as a foundational lesson: the importance of audit independence was not merely theoretical but had demonstrated, catastrophic consequences when violated.

See Also

• Rick Buy – Chief Risk Officer with nominal oversight of internal audit
• Sally Beck – VP of Global Operations; primary coordination point for audit activities
• Rick Causey – Chief Accounting Officer who presented to the Audit Committee
• Arthur Andersen – External and internal auditor whose dual role compromised independence
• Accounting Department – The function where the fraud internal audit failed to detect occurred
• Risk Management – The broader function under which internal audit nominally operated
• Sarbanes-Oxley Act – Post-Enron legislation that reformed internal audit requirements
• LJM Partnerships – The conflicted transactions that Buy was assigned to review
• Raptor Structures – SPE hedging vehicles that internal audit failed to flag

References

This article is based on analysis of 318 emails mentioning “internal audit,” 388 mentioning “audit committee,” and 267 mentioning “internal controls” across the Enron email corpus, spanning 1999 through 2002. Additional searches covered Shawn Kilchrist (108 emails), Rick Buy (4,246 mentions), and related terms including “doorstep review,” “audit findings,” and “internal controls.” Secondary sources include the Washington Post (December 14, 2001, on Arthur Andersen’s dual audit role), congressional hearing transcripts on Enron’s financial collapse, CPA Journal analyses, and PCAOB speeches on accounting oversight lessons. No dedicated PST archive exists for the internal audit function; all primary evidence comes from references across other employees’ archives.