Auditor responsibility for fraud detection under SAS 99

AUDITOR'S RESPONSIBILITY FOR DETECTION OF FRAUD

The objective of this work is to describe the various types of fraud that the auditor may encounter and provide examples of actual fraud and to describe the auditor's responsibility under GAAS. This work will incorporate a discussion of SAS 99 and summarize key points. The auditor's responsibility for detection of fraud prior to SAS 99 will be contrasted with the responsibility of the auditor as set out in SAS 99. Further, this work will describe PCAOB guidance in Standard 5 regarding fraud. This work will additionally discuss how knowledge of the company's control environment can assist the auditor in detecting fraud. This work will further discuss the risk factors that could assist in identifying the existence of fraud and will discuss what the auditor should do when fraud is detected. Also discussed will be the 'expectation gap' in relation to the responsibility of the auditor in detecting fraud and what the auditor should do when fraud is detected and the public perception of the responsibility of the auditor and the required standards. The 'fraud triangle' will be discussed as well as the AICPA ethics guidance for auditors.

I. TYPES OF FRAUD & THE AUDITOR'S RESPONSIBILITY

Corporate fraud is stated in the work of Apostolou and Crumbley (2008) to be a "pervasive problem." In fact it is reported by the Association of Certified Fraud Examiners' (ACFE) 2006 in the work entitled: "Report to the Nation on Occupational Fraud and Abuse" that a "typical organization loses 5% percent of its annual revenues to fraud, or about $4,500 per employee each year." (Apoustolou and Crumbley, 2008) Apostolou and Crumbley states that the majority of fraud is due to "a lack of adequate internal controls (opportunity), the need to maintain an expensive lifestyle or pressure to meet goals (incentive), and the perpetrators' lack of awareness that their actions are wrong (self-rationalization) or simple lack of integrity." (2008) The responsibility of the auditor under GAAS is 'reasonable assurance' standards in accounting and auditing for detection of fraud. Farrell and Franco, 1999)

III. PCAOB GUIDANCE IN STANDARD 5 REGARDING FRAUD

The work of Apostolou and Crumbley (2008) entitle: "Auditors' Responsibilities with Respect to Fraud: A Possible Shift?" states that the SEC makes it a requirement of companies whose shares are publicly traded to obtain an audit by and independent auditor. The audit is stated to involve an examination in order to make an assessment of whether the "…financial statements and accompanying notes present fairly a company's financial position, results of operations and cash flows in accordance with the generally accepted accounting principles." (Apostolou and Crumbley, 2008) The responsibilities of the auditor is to give an opinion and according to the Public Company Accounting Oversight Board (PCAOZB), AU section 110.02 (Responsibilities and Functions of the Independent Auditor) the auditor "…has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud." (Apostolou and Crumbley, 2008)

On January 22, 2007, the PCAOB is stated to have issued a report entitled: "Observations on Auditors' Implementation of PCAOB Standards Relating to Auditors' Responsibilities with Respect to Fraud (PCAOB Release No. 2007-001" and reported is that the auditor's responsibility is defined in AU section 316 (Consideration of Fraud in a Financial Statement Audit). The PCAOB placed an emphasis on the fact that existing standards were not going to be changed however, the PCAOB stated a belief that further "explication of the standards that relate to fraud would be constructive" and that this involved five primary emphases:

(1) Auditor's overall approach to the detection of financial fraud;

(2) Required brainstorming sessions and fraud-related inquiries;

(3) Auditor's response to fraud risk factors;

(4) Financial statement misstatements; and (5) Fraud associated with management override of controls. (Apostolou and Crumbley, 2008)

IV. RISK FACTORS FOR IDENTIFICATION OF FRAUD

Ramos (2003) writes that the key to incorporation of audit testing which are effective in detection fraud risks involves performing "an effective synthesis of the identified risks." Ramos (2003) defines synthesis as "the assembling of a complex whole from originally separate parts." The illustration as follows adapted from the work of Ramos (2003) illustrates the audit process from identification of risk to audit test design.

Figure 1

Risk Identification to Audit Test Design

When risk synthesis is eliminated from the process the chain is broken resulting in no link to risk identification. This is illustrated in the following figure which has been adapted from the work of Ramos (2003).

Figure 2

The goal is to conduct an assessment or to "…synthesize the identified risks for the purpose of determining where the entity is most vulnerable to material misstatement due to fraud, the types of fraud that are most likely to occur and how those material misstatements are likely to be concealed." (Ramos, 2003)

V. RESPONSIBILITIES OF AUDITOR WHEN FRAUD IS DETECTION

The auditors' response to detection of fraud is described in PCAOB AU section 316.48 which states the auditor should respond in the following ways: (1) A response that has an overall effect on how the audit is conducted -- that is, a response involving more general considerations apart from the specific procedures otherwise planned; (2) A response to identified risks involving the nature, timing, and extent of the auditing procedures to be performed; and (3) A response involving the performance of certain procedures to further address the risk of material misstatement due to fraud involving management override of controls, given the unpredictable ways in which such an override could occur. (Apostolou and Crumbley, 2008)

VI. PUBLIC PERCEPTION OF AUDITOR'S RESPONSIBILITY

In 2006 the work entitled: "Global Capital Markets and the Global Economy: A Vision from the CEOs of the International Audit Networks" was published which represents the view of the CEOs of six leading international audit firms and is a comprehensive discussion "of how public company auditing procedure must adapt to better serve capital markets around the world." (Apostolou and Crumbley, 2008) identified in this report are six vital elements stated to include the following: (1) Investor needs for information are well defined and met; (2) The roles of the various stakeholders in those markets (preparers, regulators, investors, standards setters, and auditors) are aligned and supported by effective forums for continuous dialogue; (3) The auditing profession is vibrant, sustainable, and provides sufficient choice for all stakeholders in these markets; (4) A new business-reporting model is developed to deliver relevant and reliable information in a timely way; (5) Large, collusive frauds are more and more rare; and (6) Information is reported and audited pursuant to globally consistent standards. (Apostolou and Crumbley, 2008)

V. REQUIRED STANDARDS OF AUDITOR

The nature of the obligations of auditors in detection of fraud or what is termed as 'intentional material misstatement of financial information by public companies' is reported and stated is that an expectation gap exists "between what various stakeholders believe should be done to detect fraud and what auditors are actually doing because of the fees that companies are willing to pay for audits. The expectations gap occurs because many investors and policy makers expect auditors to detect all fraud, and if they do not, the auditors are presumed to be at fault." (Apostolou and Crumbley, 2008)

The specific requirements of auditors are included in SAS 99 AU 31 and IAS 240 and in summary includes the following requirements: (1) Considering a company's internal controls and procedures, and how these are actually implemented, when planning the audit; (2) Designing and conducting audit procedures to respond to the risk that management could override internal controls and procedures; (3) Identifying specific risks where fraud may occur; (4) Considering whether any misstatement uncovered during the audit may be indicative of fraud; (5) Obtaining fraud-related written representations from management; and (6 Communicating with appropriate managers and the board if the auditor finds an indication that fraud may have occurred. (Apostolou and Crumbley, 2008)

VI. FRAUD TRIANGLE

The fraud triangle is comprised by the: (1) incentive or pressure in that management or other employees may have an incentive or be under pressure providing a motivation to commit fraud; (2) opportunity in that circumstances exist that provide an opportunity for fraud to be perpetrated; (3) rationalization in that those involved in fraud are able to rationalize a fraudulent act as being consistent with their personal code of ethics. (Ramos, 2003b) There are stated to be individuals in possession of an "attitude, character or set of ethical values that allows them to knowingly and intentionally commit a dishonest act." (Ramos, 2003b)

VII. AICPA ETHICS GUIDANCE FOR AUDITORS

AICPA ethics for auditors is comprised of rules concerning the integrity and objectivity of auditors as well as the obligations of the auditor to their employer's external accountant and other additional ethics considerations. The AICPA .01 Rule 102 'Integrity and Objectivity' states that the auditor shall "in the performance of any professional service…maintain objectivity and integrity, shall be free of conflicts of interest, and shall not knowingly misrepresent facts or subordinate his or her judgment to others." (American Institute of CPAs, Inc., 2008) Rule .04-102-3 'Obligations of a member to his or her employer's external accountant' states that under rule 102 (ET section 102.01) that the auditor must "maintain objectivity and integrity in the performance of a professional service. In dealing with his or her employer's external accountant, a member must be candid and not knowingly misrepresent facts or knowingly fail to disclose material facts. This would include, for example, responding to specific inquiries for which his or her employer's external accountant requests written representation." (American Institute of CPAs, Inc., 2008) Rule .5 102-4 'Subordination of a Judgment by a Member' Rule 102 (ET section 102.01) "prohibits a member from knowingly misrepresenting facts or subordinating his or her judgment when performing professional services. Under this rule, if a member and his or her supervisor have a disagreement or dispute relating to the preparation of financial statements or the recording of transactions, the member should take the following steps to ensure that the situation does not constitute a subordination of judgment." (American Institute of CPAs, Inc., 2008)