0:00:08.066,0:00:11.033
In this lesson we are going to look at fraud in the
context of the audit.
0:00:11.033,0:00:14.033
So let’s put our auditor hats back on.
0:00:14.033,0:00:18.000
Audit standards require us to maintain a level of
professional skepticism,
0:00:18.000,0:00:21.066
which doesn’t mean that we need be paranoid of
fraud.
0:00:21.066,0:00:27.066
Instead, we should simply assume that
management is neither dishonest nor honest as
we conduct our audit.
0:00:27.066,0:00:32.033
This requires us to set aside any predispositions
we might have about management.
0:00:32.033,0:00:40.000
Remember that we are responsible for obtaining
reasonable assurance that the financial
statements are free from material misstatement,
0:00:40.000,0:00:43.000
whether arising from either errors or fraud.
0:00:43.000,0:00:48.033
So how do we demonstrate that we have
exercised professional skepticism during the
audit?
0:00:48.033,0:00:52.033
Well, first by simply considering the potential for
fraud during the current audit
0:00:52.033,0:00:56.000
Second, by scrutinizing all documents for
authenticity,
0:00:56.000,0:01:02.000
and unless there is evidence of tampering, then
we can accept the documents as genuine.
0:01:02.000,0:01:11.033
Third, by following up on any inconsistencies
between audit evidence and inquiries with senior
management and the board of directors.
0:01:11.033,0:01:18.000
Representations of management alone are not
sufficient evidence and require us to corroborate
from other sources.
0:01:18.000,0:01:24.000
The audit team must maintain and display a
level of fraud awareness throughout the different
phases of the audit.
0:01:24.000,0:01:28.033
During the preplanning phase, we will consider
the potential for management bias.
0:01:28.033,0:01:34.066
We will also document in the engagement letter
than management is responsible for fraud.
0:01:34.066,0:01:41.066
During the client risk profile assessment, we will
note any pressures or business practices that
could lead to a rationalization of fraud.
0:01:41.066,0:01:45.033
We will evaluate the client’s risk management
processes.
0:01:45.033,0:01:52.033
During preliminary analytical review procedures,
any unusual transactions or trends that might be
indicative of fraud will be identified.
0:01:52.033,0:01:57.066
And these finding will be discussed with
management to obtain their view of the risk of
potential fraud.
0:01:57.066,0:02:05.033
We will listen to what they have to say and
determine whether the fraud measures the client
has in place adequately mitigate the risks.
0:02:05.033,0:02:11.033
During the audit planning phase, we will
document the fraud controls and evaluate the
effectiveness of these controls.
0:02:11.033,0:02:16.033
We will assess the risk of fraud in an overall
context,
0:02:16.033,0:02:20.033
as well as in areas where fraud represents a
potential risk of material misstatement.
0:02:20.033,0:02:27.066
Fraud risk factors do not indicate that fraud
exists, only that the likelihood of fraud is higher.
0:02:27.066,0:02:34.033
In situations where the risk of material
misstatement due to fraud is high, we may call
upon a fraud specialist to join the audit team.
0:02:34.033,0:02:39.066
Finally, the audit team will briefed on the risk of
fraud in the current engagement.
0:02:39.066,0:02:41.066
The briefing will include:
0:02:41.066,0:02:44.066
How and where in the financial statements might
be susceptible to fraud.
0:02:44.066,0:02:46.000
How management could perpetrate and conceal
fraud.
0:02:46.000,0:02:48.033
How assets could be misappropriated.
0:02:48.033,0:02:53.066
Circumstances that might lead to earnings
management and fraudulent reporting.
0:02:53.066,0:02:57.033
Any internal or external factors that might
pressure management to commit fraud.
0:02:57.033,0:03:00.066
Opportunities for fraud to be perpetrated.
0:03:00.066,0:03:06.033
Any conditions present that might allow
management to rationalize fraud- remember the
elements of the fraud triangle!
0:03:06.033,0:03:10.000
And finally, how the audit team should respond.
0:03:10.000,0:03:13.000
The audit programs will be tailored to include
procedures that address the risk of fraud.
0:03:13.000,0:03:18.000
There are several areas that are always
assumed to have a significant risk of fraud,
0:03:18.000,0:03:21.033
unless there is evidence to the contrary
including:
0:03:21.033,0:03:25.033
First of all, revenue recognition,
0:03:25.033,0:03:28.033
as we discussed in our previous lesson, there
are lots of ways to manipulate revenue including:
0:03:28.033,0:03:36.066
Misrepresenting bill and hold arrangements,
channel stuffing, manipulating return allowances,
understating the bad debt allowance...
0:03:36.066,0:03:41.033
Management override is perhaps the most
significant fraud risk of a material misstatement,
0:03:41.033,0:03:45.000
and we tend to focus procedures to address this
risk.
0:03:45.000,0:03:51.033
We will study the internal controls over journal
entries, inquire of personnel of any unusual
activity,
0:03:51.033,0:03:56.033
and test the journal entries to ensure each
adjustment is adequately supported.
0:03:56.033,0:03:59.033
Accounting estimates are particularly easy for
management to manipulate.
0:03:59.033,0:04:06.033
We will look at the consistency of the
methodology applied from year-to-year for any
indications of bias.
0:04:06.033,0:04:10.000
For any unusual transactions, we will want to
understand the business rationale.
0:04:10.000,0:04:16.033
We are looking for transactions that require
incremental disclosure or lack commercial
substance, such as:
0:04:16.033,0:04:20.033
wash trades, or specific related party
transactions etc.
0:04:20.033,0:04:27.066
In the test of control phase, we will test the fraud
controls and reassess fraud risk if necessary
based on the results of the testing,
0:04:27.066,0:04:32.000
i.e. the same story as we have talked about
previously in the context of relying on internal
controls.
0:04:32.000,0:04:38.000
During the substantive testing, the auditor will
perform procedures that address areas of
significant fraud risk.
0:04:38.000,0:04:44.066
During the field work, the auditor will be alert for
red flags that might be indicative of fraud, such
as:
0:04:44.066,0:04:48.066
Discrepancies in the accounting records,
conflicting or missing evidence.
or
0:04:48.066,0:04:51.066
uncooperative management in gathering
evidence.
0:04:51.066,0:04:55.066
Keep the old adage, “Where there is smoke,
there may be fire” in mind as you are conducting
your work.
0:04:55.066,0:04:59.000
In the evaluation phase, the reviewer will look for
any inconsistencies,
0:04:59.000,0:05:06.033
or unusual results that could be indicators of
fraud and ensure adequate investigations have
been carried out by the audit team.
0:05:06.033,0:05:11.033
And lastly, during the reporting phase, we will
communicate with the audit committee and
management any findings pertaining to fraud.
0:05:11.033,0:05:15.000
Fraud can be uncovered through a variety of
common audit procedures.
0:05:15.000,0:05:19.000
The auditor will make inquires of management
and the audit committee.
0:05:19.000,0:05:25.033
The auditor will ask how management has
addressed previously identified weaknesses, if
at all.
0:05:25.033,0:05:32.066
The auditor will ask whether management or the
board of directors has knowledge of any frauds
or suspected frauds within the company.
0:05:32.066,0:05:35.000
The auditor will make a similar inquiry with the
internal audit function,
0:05:35.000,0:05:41.000
and discuss the extent to which internal audit
has performed any work to identify fraud during
the year.
0:05:41.000,0:05:45.000
As the auditor talks to more and more people
around the organization,
0:05:45.000,0:05:56.000
evidence is gathered that should corroborate the
initial inquiries or trigger follow up procedures to
support or refute the original risk assessment.
0:05:56.000,0:06:00.033
Analytical procedures are also a good way of
uncovering potential frauds.
0:06:00.033,0:06:05.066
Take revenue for example.
If management
overstates revenue, then the gross profit would
be higher than expectation,
0:06:05.066,0:06:08.000
which by itself might be explained away.
0:06:08.000,0:06:14.000
However, because of the nature of double entry
book keeping, the other side of the entry is often
to accounts receivable,
0:06:14.000,0:06:18.000
of which an increase in and of itself, can be
explained away.
0:06:18.000,0:06:26.033
However, if you calculate accounts receivable
turnover and notice that it has slowed at the
same time as gross profit has increased,
0:06:26.033,0:06:29.066
this is a potential indication of a sales
overstatement.
0:06:29.066,0:06:35.066
The same sort of combination of analytical
procedures can be used to uncover an inventory
overstatement.
0:06:35.066,0:06:40.000
Ending inventory is higher, reducing cost of
sales, leading to an increase in gross profit
margin.
0:06:40.000,0:06:48.033
However, at the same time, there is a decrease
in inventory turnover could be an indication of an
inventory overstatement.
0:06:48.033,0:06:52.066
Since fraud perpetrators are often
knowledgeable about audit procedures,
0:06:52.066,0:06:59.066
one way to counteract this risk is to incorporate
unpredictability into the audit plan, even if such
amounts are immaterial.
0:06:59.066,0:07:06.033
For instance, smart fraudsters know that it’s
harder to detect a series of smaller thefts than it
is one large theft.
0:07:06.033,0:07:12.033
So auditors need to maintain an awareness
beyond what is simply prescribed by the audit
program,
0:07:12.033,0:07:20.033
so that when they notice something odd, such
as a series of small payments to an obscure
vendor, they follow their curiosity.
0:07:20.033,0:07:26.033
Because fraud schemes are so widely varied,
detecting them requires equally varied audit
procedures.
0:07:26.033,0:07:31.066
The response to each fraud risk is often unique
depending on the specific circumstances.
0:07:31.066,0:07:36.066
Computer auditing is also an effective way of
uncovering potential frauds.
0:07:36.066,0:07:39.033
The procedures the auditor can perform using a
CAAT include:
0:07:39.033,0:07:43.066
Extracting unusual transactions for further
scrutiny.
0:07:43.066,0:07:47.033
Detecting gaps in the serial numbers of invoices
or purchase orders.
0:07:47.033,0:07:50.000
Recalculations of such things as aging.
0:07:50.000,0:07:54.066
Matching of different pieces of information
looking for any inconsistencies.
0:07:54.066,0:08:05.066
So for instance, if you have an address in the
vendor master file matching an address in an
employee master file, there may be fraud.
0:08:05.066,0:08:08.066
You may also perform statistical and trend
analysis.
0:08:08.066,0:08:13.066
Benford’s law is a cool way of looking for
fraudulent transations that have been buried in
the accounts.
0:08:13.066,0:08:21.066
This law suggests that certain digits, i.e. those
from 1-9 appear disproportionately in a given
population.
0:08:21.066,0:08:30.000
For instance, the number 1, or the digit 1,
should appear 30% of the time, whereas the
digit 9 should appear on 5% of the time.
0:08:30.000,0:08:32.033
How would you apply this to an audit?
0:08:32.033,0:08:39.000
Well you could use the CAAT to calculate the
distribution of digits in the general ledger and if
you see a disproportionate number of digits,
0:08:39.000,0:08:42.033
it too could indicate that someone has been
fixing the books.
0:08:42.033,0:08:48.000
When someone starts making up numbers, the
tendency is to equally distribute the digits in the
fraudulent entries.
0:08:48.000,0:08:54.066
So as you can see, the auditors are well
immersed in looking for fraud during and
throughout the audit.
0:08:54.066,0:08:56.000
So what happens when fraud is detected?
0:08:56.000,0:08:59.033
What is the auditor’s responsibility?
0:08:59.033,0:09:03.033
The auditor should discuss the suspected fraud
with the appropriate level of management,
0:09:03.033,0:09:07.000
which is generally speaking, one level above
those suspected of the fraud.
0:09:07.000,0:09:12.000
If senior management is suspected of the fraud,
then the discussion should be with the audit
committee.
0:09:12.000,0:09:16.033
If the audit committee is believed to be corrupt,
then the auditor should consider withdrawing
from the engagement.
0:09:16.033,0:09:21.066
Normally, the auditor does not report suspicions
of fraud outside of the client organization.
0:09:21.066,0:09:28.066
In completing the audit, the auditors will
communicate certain fraud matters to the audit
committee as they pertain to:
0:09:28.066,0:09:31.033
Management integrity, or the lack thereof,
0:09:31.033,0:09:34.000
any fraud involving management,
0:09:34.000,0:09:38.000
any fraud involving employees involved in the
financial and internal control process,
0:09:38.000,0:09:42.066
any frauds that while not material now, could
become material in the future.
0:09:42.066,0:09:44.033
Okay, we’ve covered a lot of ground in the
lesson.
0:09:44.033,0:09:51.000
Even though fraud is primarily a management
responsibility, that does not absolve the auditor
of assessing the risk of a fraud...
0:09:51.000,0:09:53.066
causing a material misstatement.
0:09:53.066,0:09:57.033
This in turn has implications throughout the
course of the audit engagement,
0:09:57.033,0:10:00.066
and requires the audit team to maintain an
alertness for potential fraud.
0:10:00.066,0:10:03.066
Until next time, don’t stop until you get to the
top and when you get to the top, don’t stop.