The CPA as Fraud-Buster
The fraud auditing standard hit the financial community in April 1997 with more fanfare than any of its 81 predecessors. Designed to give the auditor guidance in detecting material misstatements caused by fraud, SAS no. 82 also clarifies the auditor's responsibilities. It affects audits of multinational manufacturers in New York and car dealerships in Montana. And its effective date--audits of financial statements for periods ending on or after December 15, 1997--means you have to know how to apply it now. An earlier article, "The Auditor and Fraud" (JofA, Apr. 97, page 32), discussed the standard's major provisions. However, the auditor continues to need practical implementation guidance. Note the case study (pages 72-73) illustrates how the auditor may comply with the steps shown in the flowchart (page 71) in the audit of a small business. It should help clarify how practitioners might consider the presence of risk factors, assess the risk of material misstatement due to fraud, develop a response, document the performance of their assessment and meet their communication responsibilities. The fraud SAS is upon us; it's time to know it and time to use it. DETECTING AND DETERRING FRAUD RISK SAS no. 82, Consideration of Fraud in a Financial Statement Audit, recognizes the auditor should be part of a broad, comprehensive effort that attempts to minimize fraud risk. Management is responsible for the prevention and detection of fraud and plays a significant role in deterring fraud by establishing a positive control environment and appropriate control activities. Essentially, the auditor and management are responsible for several areas, or methods, of fraud control: Control environment. The control environment sets the tone of an organization, influencing the control consciousness of its people. The tone at the top is largely responsible for determining the attitude and performance expectations of others within the organization. A management that takes its responsibility seriously and establishes a positive control environment mitigates fraud risk. Conversely, fraud risk generally increases when management conveys the impression that internal control is unimportant or a necessary evil or that it provides only minimal benefits. Control activities. Since financial statement fraud can occur even in a positive control environment, management needs control activities--the policies and procedures that help ensure the entity addresses risks. For example, consider an entity with a large inventory of computer chips. Control activities--including periodic physical counting of this inventory and prompt reconciliation of the resulting count to perpetual inventory records--reduce the potential for undetected material defalcation. Entities that do not reconcile the count results to the perpetual inventory records face an increased likelihood of material defalcation. Auditor skepticism. SAS no. 82 also is designed to make the auditor more skeptical. If a control environment is not positive or if management has not established relevant control activities, the potential for fraud may be high. The auditor needs to be more sensitive to the possible existence of fraud. He or she may have to probe deeper, challenge management's explanations of significant matters and extend audit procedures. This article largely addresses this third and final line of defense. SAS 82's APPROACH In clarifying the auditor's responsibility for detecting fraud, SAS no. 82 requires the auditor to perform certain steps throughout the audit. For example, it requires the auditor to consider the presence of fraud risk factors relating to fraudulent financial reporting and misappropriation of assets, Paragraphs 16 and 18 of the statement describe specific categories under those two risk factors. The standard also establishes specific auditor responsibilities for the assessment of fraud risk, documentation of performance and communication to management. …