Two types of fraud
| Type | Who typically commits it | Example |
|---|---|---|
| Fraudulent financial reporting | Management (override of controls) | Recording fictitious revenue, improper estimates |
| Misappropriation of assets | Employees | Stealing cash, lapping receivables, ghost employees |
Fraudulent financial reporting is usually more material; misappropriation is usually more frequent.
The fraud triangle
- Incentive/pressure — meet analyst forecasts, earn a bonus, personal financial trouble
- Opportunity — weak controls, management override ability, complex transactions
- Rationalization/attitude — "everyone does it," "I'll pay it back," aggressive tone at the top
Required fraud procedures in every audit
- A brainstorming session among the engagement team about how and where fraud could occur
- Inquiries of management, those charged with governance, internal audit, and others
- Consideration of fraud risk factors and unusual/unexpected analytical relationships
- Procedures to address management override: test journal entries, review accounting estimates for bias (including a retrospective review of prior-year estimates), and evaluate the business rationale for significant unusual transactions
IMPORTANT: The presumption of a fraud risk in revenue recognition can be rebutted, but the auditor must document the reasons. The presumption that management override is a risk in every audit can never be rebutted.
Reporting fraud
Any fraud (even immaterial) involving management or employees with significant control roles goes to those charged with governance. Immaterial employee fraud goes to at least one level above where it occurred. Disclosure to outside parties is generally barred by confidentiality — with exceptions such as a subpoena, a successor auditor inquiry (with client permission), a funding agency in a compliance audit, or an SEC Form 8-K requirement.
EXAM TIP: The auditor is responsible for reasonable assurance that the financial statements are free of material misstatement, whether caused by error or fraud — not absolute assurance, and not for detecting immaterial fraud.