CPA Exam AUD: Fraud Detection and SAS 99 (AU-C 240)

Fraud Detection and the Auditor's Responsibility: CPA Exam Guide

Fraud detection is a critical topic on the AUD section. AU-C Section 240 (Consideration of Fraud in a Financial Statement Audit), which superseded the original SAS 99, establishes the auditor's responsibility related to fraud in a financial statement audit. While the auditor is not responsible for preventing fraud, the auditor must plan and perform the audit to obtain reasonable assurance about whether the financial statements are free from material misstatement, whether caused by fraud or error.

Types of Fraud Relevant to the Auditor

Two types of fraud are relevant to the auditor's consideration: fraudulent financial reporting (intentional misstatements or omissions of amounts or disclosures in financial statements to deceive users, often involving management override of controls) and misappropriation of assets (theft of an entity's assets, sometimes called defalcation). Fraudulent financial reporting may involve manipulation of accounting records, misrepresentation or omission of events or transactions, or intentional misapplication of accounting principles. Both types involve intentional acts by one or more individuals among management, those charged with governance, employees, or third parties.

The Fraud Triangle

The fraud triangle describes three conditions that are generally present when fraud occurs:

1. Incentive/Pressure: Management or employees have a reason to commit fraud. This could be financial pressure on the entity to meet analyst expectations, compensation tied to financial results, or personal financial pressures on an individual.
2. Opportunity: Circumstances exist that provide the opportunity for fraud, such as inadequate internal controls, ineffective oversight by those charged with governance, or complex or unusual transactions that are difficult to audit.
3. Rationalization/Attitude: Those involved in the fraud are able to rationalize committing a dishonest act, or possess an attitude or set of ethical values that permits them to do so. A culture of aggressive accounting or management's disregard for internal controls suggests a problematic attitude.

Required Fraud Risk Assessment Procedures

AU-C 240 requires the auditor to perform specific procedures to identify the risks of material misstatement due to fraud. The engagement team must hold a brainstorming session to discuss the susceptibility of the entity's financial statements to material misstatement due to fraud. This discussion should occur with an attitude of professional skepticism and should include all key members of the engagement team. The auditor must make inquiries of management regarding their assessment of the risk of fraud, their knowledge of actual or suspected fraud, their process for identifying and responding to fraud risks, and their communications to employees about business practices and ethical behavior. The auditor should also inquire of the audit committee (or equivalent), internal audit, and others within the entity who may have information about fraud risks.

Presumed Fraud Risks

AU-C 240 establishes certain presumptions. Revenue recognition is presumed to be a fraud risk. If the auditor does not identify revenue recognition as a risk of material misstatement due to fraud, the auditor must document why. Management override of controls is always presumed to be a fraud risk and cannot be rebutted. Because management is in a unique position to override controls, this risk exists regardless of the auditor's assessment of the entity's control environment.

Required Audit Procedures Addressing Management Override

Regardless of the overall fraud risk assessment, the auditor must perform certain procedures to address the presumed risk of management override of controls:

• Journal entry testing: The auditor must test the appropriateness of journal entries recorded in the general ledger and other adjustments made in preparing the financial statements. This includes examining journal entries at the end of a reporting period, entries made to seldom-used accounts, and entries with no apparent business purpose.
• Accounting estimates review: The auditor must review accounting estimates for bias that could result in material misstatement. A retrospective review of prior-year estimates is also required.
• Unusual transactions evaluation: The auditor must evaluate the business rationale for significant unusual transactions, particularly those outside the normal course of business or that otherwise appear unusual.

Responding to Identified Fraud Risks

When the auditor identifies risks of material misstatement due to fraud, the auditor must design and perform further audit procedures responsive to those risks. Overall responses may include assigning more experienced or specialized personnel, evaluating whether the selection of accounting policies may indicate fraudulent financial reporting, and incorporating an element of unpredictability in the selection of audit procedures. Responses at the assertion level involve modifying the nature, timing, or extent of procedures to be more responsive to the specific fraud risk.

Communication Requirements

If the auditor identifies or suspects fraud, the auditor must communicate the matter to the appropriate level of management on a timely basis, even if the matter is inconsequential. Fraud involving senior management must be communicated to those charged with governance. If the auditor identifies a fraud risk factor that indicates a material weakness in internal control, the auditor must communicate it in writing to management and those charged with governance.

Exam Tips for Fraud Detection

• Revenue recognition is a presumed fraud risk that can be rebutted with documentation; management override cannot be rebutted.
• The fraud triangle elements are incentive/pressure, opportunity, and rationalization/attitude.
• Journal entry testing, estimate reviews, and evaluation of unusual transactions are always required.
• The brainstorming session is required and should occur with professional skepticism.
• The auditor communicates suspected fraud to management and governance, not directly to external parties (except as required by law).