C hapter 12: Fraud Schemes & Fraud Detection

1. Chapter 12:Fraud Schemes & Fraud Detection IT Auditing & Assurance, 2e, Hall & Singleton

2. FRAUD • Asset misappropriation fraud • Stealing something of value – usually cash or inventory (i.e., asset theft) • Converting asset to usable form • Concealing the crime to avoid detection • Usually, perpetrator is an employee • Financial fraud • Does not involve direct theft of assets • Often objective is to obtain higher stock price (i.e., financial fraud) • Typically involves misstating financial data to gain additional compensation, promotion, or escape penalty for poor performance • Often escapes detection until irreparable harm has been done • Usually, perpetrator is executive management • Corruption fraud • Bribery, etc. IT Auditing & Assurance, 2e, Hall & Singleton

3. ACFE 2004 REPORT TO THE NATION IT Auditing & Assurance, 2e, Hall & Singleton

4. FRAUD SCHEMES • Fraudulent financial statements {5%} • Corruption {13%} • Bribery • Illegal gratuities • Conflicts of interest • Economic extortion • Asset misappropriation {85%} • Charges to expense accounts • Lapping • Kiting • Transaction fraud Percentages per ACFE 2002 Report to the Nation – see Table 12-1 IT Auditing & Assurance, 2e, Hall & Singleton

5. COMPUTER FRAUD SCHEMES • Data Collection • Data Processing • Database Management • Information Generation IT Auditing & Assurance, 2e, Hall & Singleton

6. AUDITOR’S RESPONSIBILITY FOR DETECTING FRAUD—SAS NO. 99 • Sarbanes-Oxley Act 2002 • SAS No. 99 – “Consideration of Fraud in a Financial Statement Audit” • Description and characteristics of fraud • Professional skepticism • Engagement personnel discussion • Obtaining audit evidence and information • Identifying risks • Assessing the identified risks • Responding to the assessment • Evaluating audit evidence and information • Communicating possible fraud • Documenting consideration of fraud IT Auditing & Assurance, 2e, Hall & Singleton

7. FRAUDULANT FINANCIAL REPORTING • Risk factors: • Management’s characteristics and influence over the control environment • Industry conditions • Operating characteristics and financial stability IT Auditing & Assurance, 2e, Hall & Singleton

8. FRAUDULANT FINANCIAL REPORTING • Common schemes: • Improper revenue recognition • Improper treatment of sales • Improper asset valuation • Improper deferral of costs and expenses • Improper recording of liabilities • Inadequate disclosures IT Auditing & Assurance, 2e, Hall & Singleton

9. Risk Assessment Information / Communication Monitoring What Is Internal Control? Control Environment Sets the tone of an organization. Influences control consciousness Foundation for all other components Provides discipline and structure Control activities IT Auditing & Assurance, 2e, Hall & Singleton

10. Why Did It Take So Long to Find Out? IT Auditing & Assurance, 2e, Hall & Singleton

11. Risk Assessment Information / Communication Monitoring What Is Internal Control? Control Environment Identification and analysis Relevant risks to objective achievement Forms basis of risk management Control activities IT Auditing & Assurance, 2e, Hall & Singleton

12. Risk Assessment Information / Communication Monitoring What Is Internal Control? Control Environment Policies and procedures Help ensure achievement of management objectives Control activities IT Auditing & Assurance, 2e, Hall & Singleton

13. Risk Assessment Information / Communication Monitoring What Is Internal Control? Control Environment Information identification, capture, and exchange Forms and time frames Enables people to carry out responsibilities Control activities IT Auditing & Assurance, 2e, Hall & Singleton

14. Lack of management oversight Inadequate job applicant screening • Poor recordkeeping • Poor segregation of duties or independent checks Risk Factors Misappropriation of Assets IT Auditing & Assurance, 2e, Hall & Singleton

15. Inappropriate transaction authorization and approval • Poor physical safeguards • Lack of timely and appropriate transaction documentation No mandatory vacations for control function employees Risk Factors Misappropriation of Assets IT Auditing & Assurance, 2e, Hall & Singleton

16. Risk Factors Susceptibility of Assets to Misappropriation • Large amounts of cash on hand or in process. IT Auditing & Assurance, 2e, Hall & Singleton

17. Risk Factors Susceptibility of Assets to Misappropriation • Inventory that is small in size, high in value, or in high demand. IT Auditing & Assurance, 2e, Hall & Singleton

18. Risk Factors Susceptibility of Assets to Misappropriation • Easily convertible assets IT Auditing & Assurance, 2e, Hall & Singleton

19. Risk Factors Susceptibility of Assets to Misappropriation • Fixed assets that are small, marketable, or lack ownership identification. IT Auditing & Assurance, 2e, Hall & Singleton

20. Risk Factors Material Misstatements Due to Fraud • Transactions improperly recorded or not recorded completely / timely. • Unsupported/unauthorized balances or transactions. • Last-minute adjustments significantly affecting financial results. IT Auditing & Assurance, 2e, Hall & Singleton

21. Risk Factors Conflicting or Missing Evidential Matter • Missing documents or photocopies where originals should be. • Missing significant inventory or physical assets. IT Auditing & Assurance, 2e, Hall & Singleton

22. Risk Factors Conflicting or Missing Evidential Matter ? • Unusual discrepancies between records and confirmation replies. • Significant unexplained items on reconciliations. IT Auditing & Assurance, 2e, Hall & Singleton

23. Risk Factors Conflicting or Missing Evidential Matter • Inconsistent, vague, or implausible responses to inquiries or analytical procedures. IT Auditing & Assurance, 2e, Hall & Singleton

24. MISAPPROPRIATION OF ASSETS • Common schemes: • Personal purchases • Ghost employees • Fictitious expenses • Altered payee • Pass-through vendors • Theft of cash (or inventory) • Lapping IT Auditing & Assurance, 2e, Hall & Singleton

25. ACFE 2004 REPORT TO THE NATION IT Auditing & Assurance, 2e, Hall & Singleton

26. AUDITOR’S RESPONSE TO RISK ASSESSMENT • Engagement staffing and extent of supervision • Professional skepticism • Nature, timing, extent of procedures performed IT Auditing & Assurance, 2e, Hall & Singleton

27. AUDITOR’S RESPONSE TO DETECTED MISSTATEMENTS DUE TO FRAUD • If no material effect: • Refer matter to appropriate level of management • Ensure implications to other aspects of the audit have been adequately addressed • If effect is material or undeterminable: • Consider implications for other aspects of the audit • Discuss the matter with senior management and audit committee • Attempt to determine if material effect • Suggest client consult with legal counsel IT Auditing & Assurance, 2e, Hall & Singleton

28. AUDITOR’S DOCUMENTATION • Document in the working papers criteria used for assessing fraud risk factors: • Those risk factors identified • Auditor’s response to them IT Auditing & Assurance, 2e, Hall & Singleton

29. FRAUD DETECTION TECHNIQUES USING ACL • Payments to fictitious vendors • Sequential invoice numbers • Vendors with P.O. boxes • Vendors with employee address • Multiple company with same address • Invoice amounts slightly below review threshold IT Auditing & Assurance, 2e, Hall & Singleton

30. FRAUD DETECTION TECHNIQUES USING ACL • Payroll fraud • Test for excessive hours worked • Test for duplicate payments • Tests for non-existent employee IT Auditing & Assurance, 2e, Hall & Singleton

31. Chapter 12:Fraud Schemes & Fraud Detection IT Auditing & Assurance, 2e, Hall & Singleton IT Auditing & Assurance, 2e, Hall & Singleton