 |
||||||||||||||||||
|
AWR Articles
Statement On Auditing Standards No. 99 – Consideration Of Fraud In A Financial Statement Audit The Next Step In Fraud Detection Responsibility
Enron. Worldcom. Freddie Mac. All well-known, well-respected giants in their industries. What else are they? They are also victims of fraud. Or, should we say their investors, clients, and the American public have been the victims of corporate fraud. With investor confidence low and with the government and the public focusing on integrity in corporate governance and financial reporting, the responsibility of independent auditors has never been more scrutinized. The accounting profession has responded to this scrutiny by heightening the responsibility of auditors for detecting fraud either through fraudulent financial reporting or through misappropriation of assets.
Several years ago, the Auditing Standards Board (ASB) issued Statement on Auditing Standard No. 82 – Consideration of Fraud in a Financial Statement Audit (SAS 82). SAS 82 outlined the auditor’s responsibility for consideration of, detection of, and communication of fraud in a financial statement audit. Since SAS 82, and due in no small part to the rash of fraudulent financial reporting by corporations and failures in corporate governance, some of which were previously mentioned, the ASB felt the need to update the auditors’ responsibility as outlined in SAS 82.
The ASB gathered academic research, gathered information from auditors and corporate boards, and utilized the findings of the Public Oversight Board on audit effectiveness. Information gathered through this process proved that the guidance in SAS 82 was fundamentally sound. However, what was shown was that auditor’s professional skepticism, the design of their audit procedures and the ability to link fraud risk factors
to those procedures, and auditors training in forensic techniques were all lacking. Furthermore, an expectation gap still exists between the true responsibility of the independent audit process and the public’s expectation of the responsibility of the independent audit.
Using these findings, the ASB developed Statement on Auditing Standards No.99 – Consideration of Fraud in a Financial Statement Audit (SAS 99). SAS 99 supercedes SAS 82. SAS 99, effective for audits of fiscal years beginning after December 15, 2002, requires auditors to integrate consideration of fraud into their audit process and monitor and update that consideration through the time the audit is completed and the audit report issued.
This article provides insight into what changes in your audit can be expected because of SAS 99 and what will remain the same.
The New Day
The extensive new guidance of SAS 99 focuses on addressing the weaknesses of the audit process. The new guidance, followed by a discussion of each topic, follows:
- Professional skepticism is the most fundamental change. Yet, SAS 99 really says nothing new about professional skepticism. Auditors have always been required to maintain a healthy professional skepticism.
- SAS 99 requires the audit team to conduct a Brainstorming session in the planning stage of each audit. Every member of the audit team is to be in attendance and the goal of this session is to discuss, as a team, the fraud risks of an entity or how fraud might be committed and concealed by the client. Active discussion and participation at all team levels is expected and the results of this brainstorming session must be documented in audit workpapers.
- Information gathering during audits after implementing SAS 99 will look radically different than the same process during audits prior to SAS 99. SAS 99 requires auditors to move away from the typical comfort zones of preprinted internal control checklists and discussions with only accounting department personnel. SAS 99 requires interviews of others within an organization that have knowledge of the business, its unusual or complex transactions, and with specific knowledge of critical operating areas or transaction cycles. Candidates for interview will not necessarily be limited to management personnel. Furthermore, candidates should expect the questions to be critical and open-ended, intended to illicit more than yes and no answers.
- These interviews and the informationgathering process is one step in a process, defined by SAS 99, of identifying specific risks of material financial statement misstatement due to fraud. Another step in that process is the identification of and assessment of fraud risk factors. Fraud risk factors are events or conditions that track against the three conditions generally present when a fraud occurs: incentive, opportunity, and rationalization. These fraud risk factors and the fraud conditions exist in every organization and vary within industries. Expect your auditors to evaluate the fraud risk factors in your organization and more importantly, how management identifies and addresses them.
- SAS 99 sets two required risk assessments. First, auditors must now assume that improper revenue recognition is a high fraud risk. Generally, most fraudulent financial reporting schemes involve improper revenue recognition, and thus, the industry gives auditors very little judgment in addressing the fraud risk from improper revenue recognition. Second, since management is in the best position to commit fraud, management override of internal controls to prevent and deter fraud is also considered a high fraud risk.
- Auditors implementing SAS 99 will look at internal controls put in place by management with a different focus. They will supplement their existing understanding of internal control with a new perspective that considers fraud risk.
- After the information gathering and internal control review described above, your auditors will design procedures to respond to these identified risks. SAS 99 requires certain procedures, including:
- Auditing procedures designed to test journal entries
- Annual retrospective review of accounting estimates
- Critical evaluation of accounting principles and application of GAAP
- Evaluating the business rationale for significant unusual transactions
Other judgments that auditors may consider in responding to these identified risks include assigning more experienced or higher-level auditors to the engagement and planning unpredictability into audit procedures.
In summary, the practical impact of SAS 99 on organizations under audit is that audits will look and feel different, and be more detailed and greater in scope than they have been in the past. For auditors, SAS 99 will require an inherent change in attitude, a more detailed audit planning process, and more time spent conducting the audit. However, if greater confidence in the financial reporting process can be achieved through the increased diligence, hopefully the result will be worth the extra effort mandated by SAS 99.