Understand the role of the external auditor

The role of the external auditor has often been misunderstood. This “expectation gap” has long been explained as being the gap between what the actual requirements and standards required of the auditor and audit process as compared to the expectations of the public as to what an auditor does in the audit process.

It has often been thought that the audit provides certainty as to the accuracy of the financial statements by the auditor undertaking a 100% check of the organisation’s accounts. It has also been thought that auditors should be able to provide early warning if there are solvency problems with the organisation and lastly, it is thought that a primary role of the auditor is to detect fraud.

An example of this can be seen in the BDO Not-for-Profit Fraud Survey 2008. 61% of respondents to the survey gave a reason they did not perceive fraud to be a problem for their organisation was that fraud had not been discovered by the external audit process.

It is important that not-for-profit organisations understand the role of the audit and not to relying solely on the external audit process as a way of detecting fraud. It is also important to consider that auditors, while conducing an audit as per the auditing standards, they are also conducting the audit on a fee paying basis. To undertake an appropriate audit, an appropriate fee is required to be paid.

Auditing standards provide us with guidance as to the auditors’ responsibilities regarding fraud. For example:

• “The primary responsibility for the prevention and detection of fraud rests with both those charged with governance of the entity and management. It is important that management, with the oversight of those charged with governance, place a strong emphasis on fraud prevention, which may reduce opportunities for fraud to take place, and fraud deterrence, which could persuade individuals not to commit fraud because of the likelihood of detection and punishment. This involves a commitment to creating a culture of honesty and ethical behaviour which can be reinforced by an active oversight by those charged with governance.” Paragraph 4 of ASA240 (Australian Auditing Standard – The Auditor’s Responsibilities Relating to Fraud in an Audit of a Financial Report)

• “The auditor has a responsibility to plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement, whether caused by error or fraud. Because of the nature of audit evidence and the characteristics of fraud, the auditor is able to obtain reasonable, but not absolute, assurance that material misstatements are detected. The auditor has no responsibility to plan and perform the audit to obtain reasonable assurance that misstatements, whether caused by errors or fraud, that are not material to the financial statements are detected.“ – SAS99 (US Auditing Standard – Consideration of Fraud in a Financial Statement Audit).

Understand what can and cannot be done to the audit trail of the accounting software

The audit trail of accounting software can be a very useful tool when conducting a fraud investigation, especially when combined with an appropriate and effective IT Policy. An audit trail provides a history of who has accessed the accounting software and what transactions those people have conducted in the accounting software.

An audit trail allows for the examination of access history by users of the software. It shows what users have accessed or attempted to access as well as what those users have changed. An audit trail can also show when someone attempts to by-pass the security that has been put in place. It can act as a method of detecting fraud if people are aware it is reviewed regularly.

Audit trails can also be used as a method of detecting fraud. By reviewing the audit trail it can show patterns of when a person conducts transactions or even potentially turn the audit trail on and off. When fraud investigations have been undertaken, it has been discovered that the audit trail would be turned off and within a short period of time turned back on. During this time the fraudulent transactions were processed.

An organisation needs to understand the security measures attached to the audit trail, if the audit trail can easily be turned on and off and how to protect the data collected by the audit trail.

If the accounting package being used allows, the organisation should have the IT administrator turn the audit trail on and password protect it so that no user of the software can turn the audit trail off or delete transactions within the audit trail.

Develop appropriate controls over events

Risk

Funds are lost due to theft during the hectic operations of a special event.

Methods to Mitigate the Risk

Many not-for-profit organisations run large fund raising events which can involve the receipt of large quantities of cash.

Such an event can provide a hectic time with potential for large quantities of cash to be stolen. To ensure all cash received is properly accounted for during such an event, the following safeguards may be of assistance:

• Encourage all donations and purchases to be made by credit card.
• If donations and purchases are made by cash, ensure controls are in place to control the money that is received (eg. having two people receipting the cash).
• Have a separate person register donations and purchases to the receipt of funds so that the two can be reconciled at a later time.

Determine if the organisation wants insurance for fraud

Fraud can cause significant financial stress to an organisation, including significant cash flow problems. Obtaining fidelity insurance may help with that problem. Fidelity insurance covers an organisation for losses caused as a result of fraud.

An organisation needs to make an informed decision as to whether it wants to maintain fidelity insurance or not. When considering this issue, questions to consider include:

• What will the insurer require to enable a payment to be made (ie. Will it require a full investigation to be completed, will the insurer require a conviction?)
• How long will it take for the insurer to make a payment? The longer the time it would take, the longer the organisation could suffer financial stress as a result of the fraud.
• What is the excess of the claim and what is the maximum payout?
• What is excluded from the policy? For example, one policy I saw excluded forgery – this could potentially exclude fraud where an employee forges a signature on an organisations cheque.
  

Again, an organisation needs to make an informed decision considering the cost of the policy and the benefits that may flow from the policy if a claim is needed to be made.

Develop and maintain a fraud risk register

Many organisations maintain a Risk Register, but few of these incorporate specific fraud risks and the associated review undertaken for a risk to be placed on the register.

A Fraud Risk Register can usually be developed from the completion of a Fraud Risk Assessment and should incorporate the following:

· A description of the risk;
· Explain the impact of the risk on the organisation if the risk is not mitigated;
· Assessment of the likelihood of the fraud occurring;
· Assessment of the seriousness / consequence of the fraud;
· What actions need to be taken to mitigate the loss;
· Who will be responsible for implementing the actions to mitigate the loss;
· What is the timeline to implement these actions; and
· The checklist for implementing the actions.

A Fraud Risk Register should be updated on a regular basis (preferably on a yearly basis) or at such times as when there is a change in such things as technology (eg. a new computer system) or a change in services provided or grants received.

Develop a fraud recovery plan

Planning is the key to dealing with any issue. Fraud is no exception – actually planning what your organisation will do if fraud occurs is best done before the event. When fraud occurs it can be very emotional – it is reasonably common that the person who has committed the fraud is a trusted employee / volunteer and considered a ‘friend’. So planning when people are ‘thinking straight’ (ie. Before the fraud has occurred) is the best option.

Many organisations have a Disaster Recovery Plan (and if they don’t they need to develop one of these also!). For example, a Disaster Recovery Plan can set out what should be done if the computer system fails – where can the server be hosted until a new server is purchased, installed and made operational again. Think of a Fraud Recovery Plan in the same way.

So what should an organisation include in a Fraud Recovery Plan. It should be noted that for a Fraud Recovery Plan to work appropriately, the board will need to pre-approve the use of the plan if fraud does occur. This means that the person who is responsible for the plan needs to be able to implement the plan as soon as fraud is discovered without need to first seek approval from the board – the longer it takes to commence an investigation, the increased likelihood of losing evidence.

Following are some ideas of what should be included:

• Does the organisation have the internal skills to investigate the fraud. If not, are resources available externally to conduct the investigation and will those skills be available at short notice;
• As per the Fraud Control Policy, the matter should be reported to the police. Therefore, who will liaise with the police in relation to the fraud;
• Who will deal with the terminating of the employment of the person who committed the fraud. Will the organisation request the assistance of their lawyers in this regard.
• If the organisation has insurance against fraud, what is the excess on the policy, what is the maximum amount able to be claimed and when does the insurer need to be notified of the fraud;
• Will the organisation be at risk of losing funding such as government grants;
• Will the organisation be at risk of having cash flow problems? If so, is it possible to gain a temporary increase in any overdraft facility;
• How will other employees and volunteers be advised of what has happened; and
• How do you manage any reputation risk that the organisation may suffer, such as how will the organisation deal with the media should it become known that fraud has occurred or should the organisation issue a media release about the issue.

Clearly set out what your organisation defines fraud to mean

There are many definitions of fraud. However, to deter and detect fraud, an organisation needs to clearly define what fraud means to them and maintain a consistent definition across the Fraud Control Policy and any other policy or Code of Conduct where the definition may appear.

Examples of definitions of fraud are as follows.

Butterworths Concise Australian Legal Dictionary defines fraud as:

An intentional dishonest act or omission done with the purpose of deceiving.

Paragraph 9 of ASA 240, the Australian Auditing Standard on The Auditor’s Responsibility to Consider Fraud in an Audit of a Financial Report states:

The term “fraud” refers to an intentional act by one or more individuals among management, those charged with governance, employees, or third parties, involving the use of deception to obtain an unjust or illegal advantage. Although fraud is a broad legal concept, for the purposes of this Auditors Standard, the auditor is concerned with fraud that causes a material misstatement in the financial report. Auditors do not make legal determinations of whether fraud has actually occurred. Fraud involving one or more members of management or those charged with governance is referred to as “management fraud”; fraud involving only employees of the entity is referred to as “employee fraud”. In either case, there may be collusion within the entity or with third parties outside of the entity.

Australia Standard AS8001-2008, Fraud and Corruption Control, defines fraud as:

Dishonest activity causing actual or potential financial loss to any person or entity including theft of moneys or other property by employees or persons external to the entity and where deception is used at the time, immediately before or immediately following the activity. This also includes the deliberate falsification, concealment, destruction or use of falsified documentation used or intended for use for a normal business purpose or the improper use of information or position for personal financial benefit.

Section 408C of the Queensland Criminal Code (this is the definition I work with mostly as Queensland is my home state) defines the criminal offense of fraud as follows:

A person who dishonestly applies to his or her own use or to the use of any person:

• Property belonging to another; or
• Property belonging to the person, or which is in the person’s possession, either solely or jointly with another person, subject to a trust, direction or condition or on account of any other person; or
• Obtains property from any person; or
• Induces any person to deliver property to any person; or
• Gains a benefit or advantage, pecuniary or otherwise, for any person; or
• Causes a detriment, pecuniary or otherwise, to any person; or
• Induces any person to do any act with the person is lawfully entitled to abstain from doing; or
• Induces any person to abstain from doing any act which that person is lawfully entitled to do; or
• Makes off, knowing that payment on the spot is required or expected for any property lawfully supplied or returned or for any service lawfully provided, without having paid and with intent to avoid payment;

commits the crime or fraud.

When selecting a definition of fraud to use in your anti-fraud program, you need to select a definition that best suits the size and type of your organisation. Do not be afraid to use the definition of fraud as it appears in the criminal legislation in your country or state if a criminal charge of “fraud” is clearly defined.

Develop a series of exception reports and act on any exceptions

There are often many red flags which, in hindsight, are obvious to those who are left to deal with the aftermath of the fraud.

Risk

The risk is that fraud could be discovered but is not, as the organisation does not recognise the red flags associated with the fraud due to not having approriate exception reporting in place.

Methods to Mitigate the Risk

An organisation should be prepared to develop a series of exception reports that highlight red flags of fraud.

It must be remembered that red flags are just that. They indicate a potential problem. However, if the potential problems are not recognised and then investigated the fraud, if it is occuring, will continue to occur. For that reason, any red flags that are highlighted by the exception reports, need to be investigated.

An example of an exception report is to consider if employees have created false creditors which are being paid by the organisation. To do this involves electronically comparing employee and creditor bank account numbers, street addresses, postal addresses, post codes/zip codes, telephone numbers and mobile / call phone numbers (especially those employees in the accounts payable and payroll departments).

Another simple exception report is to consider variances between actuals to budgets for income that is below budget and expenses that are above budget.

It should be noted that there are numerous exception reports that can be utilised by an organisation. Each organisation should determine which exception reports are appropriate to them.

To make exception reporting easier, it can be computerised. An organisation should take the time to set up the exception reports that are appropriate. Once this initial investment of time has been made, the exception reports can easily be run on a regular basis. Then the investment of time will be investigating exceptions as they arise.

Utilise an Exit Checklist when Employees Leave

Many organisations use an exit checklist when an employee and/or volunteer leave. However, it needs to be comprehensive so that it covers all areas that could cause detriment to the organisation.

When employees and / or volunteers leave the organisation, it is important that they no longer have access to the organisation’s information and no longer have possession of assets of the organisation.

Risk

The risk is that someone who leaves uses their previously provided information and/or assets to cause detriment to the organisation. This can be done in a number of ways. For example:

• Remotely accessing a member list and deleting important information or obtaining a copy of the information for future use;
• Remotely access client information that should remain confidential and allow that information to be released to the public damaging the reputation of the organisation;
• Accessing the organisation’s premises to cause physical damage;
• Keeping assets they are not entitled to keep; or
• Incurring expenses after they have ceased employment.

Methods to Mitigate the Risk

A checklist should be established for when an employee (and in some instances a volunteer) leaves the organisation. The checklist should include all items that need to be returned to the organisation, all authorisations that need to be cancelled and any other matters that should be addressed. This is so an ex employee (or volunteer) cannot defraud the organisation after they leave.

The following is a list (but not an exhaustive list) of matters that should be included:

· Items to be handed back to the organisation:

o Corporate Credit Card

o Laptop / computer / modem / AV equipment etc

o Thumb drives / external hard drives and any other external storage devices

o Software

o Mobile phones and accessories

o Internet connection equipment

o Manuals

o Car and car keys (including all items that should be in the car (eg. First aid kit)

o Fuel card

o Keys / access card to the building, office, cupboards and filing cabinets

o Security tokens for online banking, email access and any other remote access requirements

o Staff identification card and name tag

o Uniforms

· To be changed / closed

o All computer access restricted both in the office and remotely

o Taken off the bank accounts as a signatory

o Password for online banking cancelled

o Security codes for access to the office / building cancelled

It must be remembered that the above are examples only, and a full list of items included on an Exit Checklist will vary from organisation to organisation.

Maintain appropriate controls over assets

Assets can be a significant investment for many organisations. Ensuring the security of those assets is important, especially considering the different types of assets an organisation has.

Risk

The risk is that assets are taken by employees and / or volunteers and / or external parties of the organisation for personal use and not returned (in effect, the theft of the assets).

Methods to Mitigate the Risk

When developing controls over assets, the following should be considered:

• Small assets should be secured by using locks or similar security measures where appropriate (for example, a security lock attaching a laptop to a desk);
• All assets should be tagged with an Asset Number;
• An Asset Register should be maintained. The Register should include the following information - Asset Tag number, Description of the asset, Date of purchase, Warranty information, Location of the asset.
• Stock takes of assets should be undertaken at least yearly and any discrepancies to the Asset Register should be investigated. The stock take and investigation of discrepancies should be undertaken by a person who is not responsible for the recording of assets in the Asset Register.
• If an asset is to be disposed of, it can only be removed from the Asset Register with a properly authorised Asset Disposal Form having been completed as required by the Asset Disposal Policy. Refer to my Blog post on 26 January 2009.