How to Educate Children in the Art of Theft

A real-time case study may not be best

In teaching any academic subject, case studies are a powerful way to educate. The unraveling of facts and circumstances–especially in real time–is an effective way to illuminate any topic. The children in Floyd County, Georgia, are getting such an education. Only this study is not academic. It’s real.

School Fraud

The picture is courtesy of AdobeStock.com

In May 2015, Leigh Patterson, the Rome Judicial Circuit District Attorney, filed a complaint in Floyd County Superior Court alleging that Floyd County school employees engaged in fraudulent practices. The primary individual named in the complaint is the school’s former director of maintenance, Derry Richardson, but as many as a dozen school employees may have been complicit. So how much was potentially stolen? Possibly over $3 million according to the Rome News-Tribune. The FBI and Georgia Bureau of Investigation are still performing the investigation, so we don’t know the full damage at this point. And as always, we are dealing with allegations until the cases are adjudicated.

What do we know presently?

Several school employees resigned just after the complaint was filed. The positions vacated included:

  • Maintenance director
  • Lead maintenance specialist
  • Director of school improvement
  • Operations coordinator
  • Chief of operations

School officials have not said whether the resignations were related to the D.A.’s complaint. The D.A.’s filing also named relatives of Derry Richardson and family owned businesses (namely, a building and supply company and local contracting companies).

The Allegation

Prosecutors are accusing Richardson and others of using inflated purchase orders to defraud the school system.

Purchase order theft

Picture is courtesy of AdobeStock.com

The Association of Certified Fraud Examiners has repeatedly found that asset misappropriations are a common means of theft. The use of fake or inflated purchase orders is considered an asset misappropriation scheme.

Why is this method of fraud so common? Because it’s easy to pull off. Once someone has the power to purchase, they can direct large sums of money to outside parties or themselves. You see this same dynamic in governments where checks are physically signed; the signing of the check is the “power to purchase.” So in some asset misappropriation schemes, the check signer simply makes out a check to himself or a friend (with the money later being split up between the check signer and the friend).

Collateral Damage

Though the superintendent of Floyd County schools was not involved in the alleged thefts, it appears Jeff McDaniel lost his job as a consequence of the errant activity. McDaniel did receive a severance package in a deal approved by the school board in August 2015. (I can’t say I agree with the Board’s decision. I am not sure how the superintendent can be held accountable for the losses since fraud can surface in hundreds of ways.)

Take Away

All entities should pay lots of attention to those who have the power to purchase. Persons with this authority include:

  • Department heads
  • Purchasing agents
  • Elected officials
  • School superintendents
  • Finance directors
  • Controllers

Most people don’t recognize the threats related to someone’s ability to authorize or approve a purchase, especially if that person can’t sign checks. But understand that checks are sometimes signed electronically with computer-printed signatures. Once a purchase is approved, the check will often be issued without any questions.

How can you combat this threat?

Implement a surprise audit policy. Periodically, review purchases. Here are a few suggestions for doing so:

  • Call vendors (see if they are real)
  • Review bids
  • Examine payees on checks
  • Examine signatures on checks (and endorsements)
  • Review for compliance with purchasing policies

The element of surprise is critical. If fraudsters know someone will examine their documents, they will cover up or destroy the evidence. So don’t tell anyone when the audits will be performed. While you don’t want to advertise when the inspections will occur, you do want all parties to know that their work will potentially be reviewed. The threat of being found out is the deterrent. I think of surprise audits as first a preventive measure and then a means of detection.

Finally, make sure the surprise audits occur. If we say they’ll happen, and they don’t, then the threat of being caught (the deterrent) diminishes.

Fraud Prevention Guidance

For more information about fraud prevention, check out my book on Amazon. Click the book cover below.

 

I’d Rather Look Stupid and Be Right

Asking timely questions will keep you safe

Pride goes before a fall.

The saying is true in life and public accounting.

How many times have I had a question, but I was afraid to ask it for fear of being found out, for fear that someone might think that I’m not very bright. But through the years, I’ve learned–though I still struggle with this–to get over my pride and just ask the question. Go ahead and look dumb if necessary, but get the right answer, regardless.

Ask Questions

In one way, this struggle increases as I get older. After all, if I have experience, I should know the answers. And if I have plenty of experience, I should, all the more, have the goods. Or so the thinking goes. But just because my hair is graying does not mean I possess all knowledge. Often I find that those much younger than I know things that I don’t, especially regarding technological issues. There are times when I let my pride get the best of me, and I don’t ask the question. Later, after I wipe the egg off my face, I realize humility is the better course. So I’ve come up with a phase just for me.

I’d rather look stupid and be right than to look smart and be wrong.

Otherwise, I might be saying with Forest Gump, “Stupid is as stupid does.”

Is Your Audit Pricing Risk-Adjusted?

Why riskier audits should be priced higher

Risk increases price. At least, it should.

Top view of an auditor making calculations on adding machine with a sheet of paper with Audit sign in front of him and digital tablet on his left hand.

Picture is courtesy of AdobeStock

Factors that increase audit risk include:

  • Entity (audit client) that is about to be sold
  • Records not reconciled on a timely basis (including bank accounts, inventory, accounts receivable, and accounts payable)
  • Business with a high debt load and covenant violations
  • Known existence of fraud
  • Inexperienced management in a complicated business
  • Known legal proceedings against the company
  • Unusual estimates (e.g., environmental liabilities)
  • Complex transaction cycles with varied accounting systems (systems differ at each location)
  • Group audit situations with subsidiaries audited by other audit firms (especially if the components are foreign entities)
  • Entities with severe cash flow deficiencies

A Risk Perspective

Pretend, for a moment, that you are a representative of a professional liability insurance carrier, and you’ve been assigned the duty of reviewing an audit firm’s book of business. How would you rate–from an insurance perspective–audits of the following entities?

  1. The City of Perfect has a CPA as its finance director. For the last twenty years, they have received the financial reporting Government Finance Officer’s Certificate of Achievement. They have never had a significant fraud. The city’s net position is strong, and it has no debt.
  2. Shazaam, Incorporated, is a high-tech company funded with venture capital. Operations began two years ago. Shazaam has weak cash flow, but the company has successfully created one new whiz-bang product, making it a highly desirable acquisition target. Potential suitors have already made visits to the company’s headquarters inquiring about a purchase.
  3. Sterling Parts, Incorporated, sells auto parts mainly in the United States, but it also has manufacturing operations in Germany. The company has eight subsidiaries, one of which is the German production component. This entity has been cited for contaminating the Rhine river. The cost of cleanup and damages are not known. The foreign entity uses an accounting system that is entirely different from the other companies. A German accounting firm audits the manufacturing component.

Would you price the insurance for all three engagements the same? Certainly not. The City of Perfect is…well perfect. The second and third audits have risk elements.

So if we–as auditors–examine prospective audit clients purely with an eye on risk, there should be a premium (higher fee) for those with increased risk. Why? There is a higher probability that the audit firm will suffer loss. The inherent risks in examples 2 and 3 increase the chance of faulty financial reporting, which increases the possibility a suit against the audit firm.

From a project management perspective, will all three engagements take the same amount of time? Obviously no. The higher risk engagements will require more resources, effort, and time.

Risks Require More Time

You might think of the additional time element in this way:

Risk = Additional Time = Higher Price

Too often, CPA firms fish for audits without giving appropriate consideration to risk. Then, the flat fee creates pressure to ignore risks, because, after all, the audit firm wants to make a profit. It is critical that auditors incorporate a pricing premium for identified risks.

Unidentified Risks

But what about unknown risks (those that exist before starting the engagement)?

Well, that’s another story. Discovering fraud, for example, may require an expansion of the engagement scope. As with any project, when the scope increases, price increases. But the price increase is dependent upon the size and complexity of the theft. If the fraud is nominal and requires little additional time, then no price increase is necessary. But if the theft is broad and complex, a contract amendment may be needed.

Client Acceptance And Continuance

Does your firm use any type of risk score in accepting a new client or in the annual continuance decision? If yes, would you share how you do this?

10 Post-Busy-Season Questions to Lower Next Year’s Stress

Evaluation is best done when thoughts are fresh

So how many 70 hour weeks did you put in this year? More importantly, is there any way to lower your stress next year?

CPA's Stress Reduction

Picture is courtesy of AdobeStock

It is best to do your post-mortem just after busy season while the pain points are fresh in your mind. Consider taking a half day off just to review your most recent tumult. Here are ten questions to ask.

  1. What can I do before the busy season? Anything–and I mean ANYTHING–that can be done before the storm hits will help.
  2. Can I hire temporary help? Can I outsource certain duties?
  3. Do I need to redesign my workflow? Maybe I need to move to a cloud-storage system.
  4. Do I need to purchase new technology (software, computers, scanners, copy machines, monitors)? If my software always runs slow, maybe it’s time to change.
  5. Should I add an extra monitor? Multiple monitors can greatly enhance your efficiency.
  6. Do I need to change my open office days? Some CPAs–especially smaller practices–close their offices on certain days so they can work without interruption.
  7. Should my book of business be leaner? Some clients are demanding. They might bring work in late and require short turn-a-rounds. They might be slow to pay, or they don’t pay at all.
  8. Do I need to replace any staff members? If an employee always works slow or is absent, it may be time to let that person go.
  9. Should I sell a part of my business so I can focus more on the more profitable sections?
  10. Will anything be different next year? You may have a partner or key staff member retiring this year. Now is the time to think about how to replace that team member. Maybe your lease runs out this year. Consider if a new location will be better.

How to Document the Use of a Specialist

Documentation requirements for auditor's specialist and management's specialist

As an auditor, you often use the work of specialists such as actuaries, appraisers, and engineers. Such work can seem mystical, like something conjured up from a mathematical soup. And since we don’t always understand their incantations, we wonder, “Can we rely on the information?” Thankfully, the audit standards provide guidance.

Picture is courtesy of DollarPhotoClub.com

Picture is courtesy of DollarPhotoClub.com

A specialist can be hired by your audit firm or by management. If you audit banks, you might hire an appraiser to assist with loan collateral reviews–an example of an auditor’s specialist. If your client uses an actuary, then you will obtain audit evidence from a specialist hired by management. As we begin our look into the use of specialists, let’s define the terms auditor’s specialist and management’s specialist.

Definitions

AU-C 620 provides the following definitions:

Auditor’s specialist. An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor in obtaining sufficient appropriate audit evidence. An auditor’s specialist may be either an auditor’s internal specialist (who is a partner or staff, including temporary staff, of the auditor’s firm or a network firm) or an auditor’s external specialist.

Management’s specialist. An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the entity to assist the entity in preparing the financial statements.

Now let’s take a look at audit considerations for both the auditor’s specialist and management’s specialist.

Use of Auditor’s Specialist

AU-C Section 620–Using the Work of an Auditor’s Specialist provides guidance on the use of an auditor’s specialist.

Is the Specialist Needed?

AU-C 620.07 states, “If expertise in a field other than accounting or auditing is necessary to obtain sufficient appropriate audit evidence, the auditor should determine whether to use the work of an auditor’s specialist.” Before using the services of a specialist, consider the significance of the information for which you might need a specialist. If the (specialist) information has little impact on the financial statements, then the specialist issue will be of less importance.

Specialist Considerations

AU-C 620.09 says, “The auditor should evaluate whether the auditor’s specialist has the necessary competence, capabilities, and objectivity for the auditor’s purposes.” So if you hire an investment pricing specialist, you want to know if she is reputable, what her experience is, whether she can perform the work appropriately, and whether she can be objective.

Auditor's Specialist

Picture is courtesy of Adobe Stock

According to AU-C 620.A16, information regarding the competence, capabilities, and objectivity of an auditor’s specialist may come from the following:

  • Personal experience with previous work of that specialist
  • Discussions with that specialist
  • Discussions with other auditors or others who are familiar with that specialist’s work
  • Knowledge of that specialist’s qualifications, membership in a professional body or industry association,   license to practice, or other forms of external recognition
  • Published papers or books written by that specialist
  • The quality control policies and procedures of the auditor’s firm and such other procedures the auditor considers necessary in the circumstances

If you’ve previously worked with the aforementioned pricing specialist, you have personal experience with her work. This helps. You might call her with regard to current year issues, and since you already know her, you probably already know her qualifications.

Regarding objectivity, the auditor should inquire about any relationships that the specialist may have with the client, and if necessary, obtain a signed representation letter– from the specialist–concerning their objectivity. Continuing with our pricing specialist illustration, you want to ask her if she has any business relationships with the auditee. Are there any family relationships? Is there any reason her objectivity might be lessened?

Engagement Letter with Specialist

Does the audit firm need an engagement letter with its specialist?

Though not required, the auditor can use a written engagement letter to define the work of the specialist. AU-C 620.A45 provides suggestions for the engagement letter as follows:

  • Nature, Scope, and Objectives of the Auditor’s External Specialist’s Work
  • The Respective Roles and Responsibilities of the Auditor and the Auditor’s External Specialist
  • Communications and Reporting
  • Confidentiality

When an engagement letter is not used, document the work of the specialist in a memorandum or other audit work papers such as an audit program.

Adequacy of the Specialist’s Work

Auditors must evaluate the adequacy of the specialist’s work.

AU-C 620.12 says:

The auditor should evaluate the adequacy of the work of the auditor’s specialist for the auditor’s purposes, including:

  1. The relevance and reasonableness of the findings and conclusions of the auditor’s specialist and their consistency with other audit evidence.
  2. If the work of the auditor’s specialist involves the use of significant assumptions and methods,
    • obtaining an understanding of those assumptions and methods and
    • evaluating the relevance and reasonableness of those assumptions and methods in the circumstances, giving consideration to the rationale and support provided by the specialist, and in relation to the auditor’s other findings and conclusions.
  3. If the work of the auditor’s specialist involves the use of source data that is significant to the work of the auditor’s specialist, the relevance, completeness, and accuracy of that source data.

Bottom line: Does the work of the specialist provide sufficient and appropriate audit evidence with regard to the issue at hand (e.g., investment pricing)?

When to Start Thinking About a Specialist

When should an auditor begin to think about the use of a specialist? Before the engagement is accepted. Why? If we accept an audit without the necessary skill sets, we have a problem. As we consider our acceptance of an audit, we should consider if there is a need to hire a specialist–and whether such a specialist is available at a reasonable price.

Reference to a Specialist in an Auditor’s Opinion

AU-C 620.14-15 says the following about references to a specialist’s work in an audit opinion:

The auditor should not refer to the work of an auditor’s specialist in an auditor’s report containing an unmodified opinion.

If the auditor makes reference to the work of an auditor’s external specialist in the auditor’s report because such reference is relevant to an understanding of a modification to the auditor’s opinion, the auditor should indicate in the auditor’s report that such reference does not reduce the auditor’s responsibility for that opinion.

What does this mean? Regardless of the use of a specialist, the opinion is the auditor’s (and not the specialist’s). We may use the specialist’s work as audit evidence, but the audit opinion is ours.

The audit standards do allow auditors to reference the work of a specialist when the opinion is modified, but if you do so, get the specialist’s permission (consider getting written authorization).

Confidentiality Language in the Client Engagement Letter

When an auditor hires an external specialist, should the audit engagement letter change?

Picture is courtesy of AdobeStock

Picture is courtesy of AdobeStock

When an audit firm hires an external specialist, the firm should follow the Code of Conduct section ET 1.700.040, Disclosing Information to a Third-Party Service Provider. How can you comply with this ethical requirement? By including additional language in your engagement letter advising the client that you might provide confidential information to an outside party; in effect, you are gaining consent to share client information. If you are not using an outside specialist, but someone who works for your firm, then no such consent is necessary.

Use of Management’s Specialist

AU-C Section 500–Audit Evidence provides guidance on the use of information from management’s specialist.

Your audit client might use their own specialist such as a pension plan actuary. To rely on the actuary, you need to know if she is competent and objective. You also need to understand–at least in a general sense–what the actuary is doing.

Specialist Considerations

AU-C 500.08 states:

If information to be used as audit evidence has been prepared using the work of management’s specialist, the auditor should, to the extent necessary, taking into account the significance of that specialist’s work for the auditor’s purposes,

  1. evaluate the competence, capabilities, and objectivity of that specialist;
  2. obtain an understanding of the work of that specialist; and
  3. evaluate the appropriateness of that specialist’s work as audit evidence for the relevant assertion.

AU-C 500.A39 provides the following insights into evaluating competence, capabilities, and objectivity:

Information regarding the competence, capabilities, and objectivity of management’s specialist may come from a variety of sources, such as the following:

  • Personal experience with previous work of that specialist
  • Discussions with that specialist
  • Discussions with others who are familiar with that specialist’s work
  • Knowledge of that specialist’s qualifications, membership in a professional body or industry association, license to practice, or other forms of external recognition
  • Published papers or books written by that specialist

Representation Letter

Exhibit B of AU-C 580, Written Representations, provides the following example of language that an auditor might include in the representation letter:

We agree with the findings of specialists in evaluating the [describe assertion] and have adequately considered the qualifications of the specialists in determining the amounts and disclosures used in the financial statements and the underlying accounting records. We did not give or cause any instructions to be given to specialists with respect to the values or amounts derived in an attempt to bias their work, and we are not otherwise aware of any matters that have had an effect on the independence or objectivity of the specialists.

Conclusion

So how do you document your use of a specialist? As you can tell, the audit standards provide a framework, and the documentation will vary depending on the type of specialist used and the importance of the information. At a minimum, consider documenting:

  1. Why you need the specialist (or their work product)
  2. The abilities, reputation, and experience of the specialist
  3. The objectivity of the specialist
  4. The adequacy of the work provided

At the end of the day, auditing is all about obtaining reasonable assurance by obtaining audit evidence. As you consider the use of a specialist, ask yourself how their work impacts your risk assessment, your audit procedures, and finally your opinion.