I am not fooled by all those smiles I see when I show up to do an audit. Those people are not happy to see me. An audit is a nerve wracking and painful experience. It’s disruptive and takes time and energy away from the normal business routine. People don’t know what to expect.
The Association of Certified Fraud Examiners’ 2022 Report on Occupational Fraud indicates that 50% of Fraud is found by sources of discovery that come from outside a company’s system of checks, balances and internal controls. The Report quantifies that only 4% of Fraud is found by external audit; nevertheless, the #1 anti-fraud measure, listed by 82% of companies surveyed, was external audit. Does anybody else sense a disconnect here?
So, why don’t external audits find Fraud? Let me start by saying that I have the highest regard for the Accounting Profession, but the fact is that an attest audit is one of the most difficult challenges in business.
The first rule in finding Fraud is that the Fraud has to exist.
Usually, the external auditor has no reason to suspect Fraud. In spite of everything we’ve talked about, the vast majority of business transactions are legitimate. I don’t mind looking for a needle in a haystack if I have reason to believe that the needle is there. It takes a very special mindset to review hundreds (and sometimes thousands) of transactions and spot the few that might be a little irregular, especially when there’s no reason to suspect that something might be wrong. Moreover, the Fraudsters are usually very good at hiding what they do. I have actually encountered situations where the indication of Fraud was that the records were too pristine.
It has to be Material.
The external auditor has to make a “battlefield” decision to determine the extent that an irregularity should be pursued. Often this decision is influenced by materiality.
We were auditing a small bank. I was budgeted four hours to review the Inter-Branch Clearing Account. I determined that the account was out of balance by $10,000. It should have been a simple reconciliation, but I couldn’t find the difference and it was driving me crazy. The Audit Senior came to me and said, “It’s immaterial. We can’t spend any more time on it. Move on.” The item did not affect our Audit Opinion but was included in our Management Report.
The President of the bank was a third-generation banker. He treated every dime in the bank as if it were his own and, come hell or high water, he was going to find that $10,000. He assigned a Senior Vice President to the task. The poor guy spent countless hours and he couldn’t find it either.
Six months later, the bank clerk who had embezzled the $10,000 had to take vacation. Somebody else was going to be doing her job while she was gone. She made a move to cover the Fraud someplace else and that’s when they caught her.
Word got back to our office and the Audit Manager came to me and said, “Congratulations! Is that the first notch in your gun?” I asked him what he meant. He said, “You get credit for finding that Fraud.”
I replied, “Credit for finding the Fraud? Go back and look at my work papers. Look at what you made me write: ‘Difference deemed immaterial. No further work required.’”
I was talking to an internal auditor for a large bank. I asked him what it was like working for an organization where $1 million couldn’t get anybody’s attention. He replied, “$1 million? Our external auditor’s threshold for materiality is $50 million.”
That leads to the unsettling question: If Fraud happens and it’s not big enough to matter, is it really Fraud? Our conclusion should be that Fraud always leaves traces of itself along a numerical highway. Whether it is material or immaterial, and to what extent it should be pursued, are degrees of business perception.
The auditor has to look for it.
An external audit requires a spirit of cooperation. The external auditor may see many different companies over the course of a year; nevertheless, they are expected to be experts on the company and business segment that that they are currently auditing. How can they be an expert if nobody tells them what the company does?
A $1 billion company asked me to design and implement an internal audit function for them. Accounting geek that I am, this was a bucket list item for me. The company had a small operation in Maine, and it was chosen as the place to launch the project.
I met with the site manager and his bookkeeper. After 15 minutes of small talk, the site manager asked where I wanted to start. Since this was my first stop, my plan was to develop procedures on the fly; however, not wanting to appear unprepared, I threw out the first thing that popped into my head. “I like to start at the beginning. Let’s go count petty cash.”
As I followed the bookkeeper down the hall, I was laughing to myself. I hadn’t counted petty cash in over 25 years. I hoped I could remember how to do it.
The bookkeeper produced a small metal box. I counted out roughly $100 and made note of some receipts I found in the box. Then I asked for the bank reconciliations. She handed me a stack of manilla folders. As I walked out of her office, I opened the top folder and the first line read, “Cash on hand - $3,500.” I turned and said, “Mary, I’m not exactly the sharpest tool in the shed, but this says, ‘Cash on hand - $3,500’ and I just counted $100. Can you explain the difference?”
She said, “I took the money.”
I replied, “Hold that thought. I’ll be right back.”
45 minutes into the first internal audit in the company’s 100-year history and the most trusted person in the whole organization was being led out the door. The point of this story is that I was scheduled to be in Maine for two weeks, but for all I was able to accomplish, I could have left right then and there. Nobody blamed me for what Mary did, but they were afraid to talk to me. They thought, “If Mary was stealing, anybody could be stealing. Maybe I’m stealing and I don’t even know it and this guy is going to find it!”
Audits require a spirit of cooperation. The external auditor cannot give the least hint that they are looking for Fraud, or that cooperation is lost, and completion of a satisfactory audit becomes near impossible.
The auditor has to stay until they find it.
External audits are expensive. There is an incentive to be timely and efficient and a disincentive to cause trouble. The client has a pretty good idea how much each audit hour costs and may get perturbed if they sense that the auditors are following vague leads of little or no consequence.
Sometimes I think that the term “independent audit” is an oxymoron. Who is writing the check for the external auditor? How far is the external auditor willing to push the entity that’s writing that check? There can be legitimate differences of opinion on financial statement presentation. There can be differences of opinion on what is Fraud.
Integrity can be a relative thing. Everybody’s moral compass points in a little bit different direction.
Comments