1. Fraud: An Auditor’s Perspective
Lindsey McGuire, CPA
Brown Armstrong Accountancy Corporation

3. Evaluating the risks of Fraud
Understanding the nature and characteristics of fraud
Apply the knowledge on an entity level
Evaluate the risk under existing system and controls
Developing preventive internal controls
Detect fraud systematically

4. Types of Fraud Misappropriation of Asset Corruption Schemes
Most common type of fraud and usually involves cash
Corruption Schemes
More difficult to protect against
Collusion increases opportunities for fraud
Fraudulent Financial Reporting
Generally higher level perpetrators involved
Largest loss per incident

5. Characteristics of Fraud
Pressure
Greed
Reason
Opportunity
Lack of controls
Ability to override controls
Rationalization
Not wrong
No choice
Tone at the top

6. Who typically commits fraud?
Characteristics
Reason – greed, enhanced lifestyle, pressure
Opportunity – lack of controls or ability to circumvent or override controls
Rationalization- victim is at fault
Approach
Establish relationship
Put up a great façade
Don‘t take or rarely take vacation
Limit exposure

7. Red Flags Living beyond means Financial difficulty
Divorce or family problems
Excessive pressure from family, peers or boss
Control issues, not wanting to share duties
Refusal to take vacation
Defensiveness, excessive complaints
Irritability and inability to relax

8. Could this type of fraud occur here?
What conditions are necessary for it to occur?
Example 1
Expense reimbursement
Example 2
Check tampering
Example 3
Information Technology weakness

9. Expense reimbursement
Perpetrator was responsible for petty cash reconciliation and accounts payable
Experienced employee with positive reputation
Insisted on complete and accurate documentation
Was always timely with the audit requirements
Almost too nice
Never took time off

10. Double trouble payments
Cash for estimated expenses were given to employees before trips
Receipts were returned and kept in the petty cash drawer
When petty cash drawer was full of vouchers
Perpetrator would prepare reimbursement and Treasurer would provide check to perpetrator to cash at the bank
Invoices were paid both with check and through petty cash
Incorrect totals on vouchers, duplicated or alerted receipts, original and “corrected” invoices submitted for payment

11. Discovery & Lessons Learned
Boss sought out information during perpetrator’s vacation
Noticed petty cash disbursement to supplier was normally paid by check and started an investigation resulting in $100K in uncovered losses
Lessons learned
Offsite cash collections site have higher risk due to volumes of cash flow.
Need segregation of duties in all areas
Supervision
Need control activities to ensure that reimbursement procedures are written and followed.

12. Check Tampering
Perpetrator had experience but no higher education background.
Moved up the chain from clerk to accounts payable over the course of 10 years
Almost too nice again
Appeared to be a loyal employee and capable of performing duties
Responsible for payments to vendors and the bank reconciliation
Prepared check requests for tax payments
Altered payee to benefit himself
Some checks were written to bank credited to perpetrator’s benefits

13. Discovery & Lessons Learned
After the employee left the agency, auditors performed an audit of the books
Identified two checks to agency when they knew only the agency had only received one.
Found cancelled checks written to bank instead of government
Segregation of duties
Don’t allow person responsible for issuing checks to be the person reconciling the bank accounts
Control activities
Reassess controls on a regular basis and have the controls in writing
Trust employees, but create safeguards through cross trainings

14. Information Technology weakness
CPA firm provides services to a client
A wire transfer of $100K was authorized from the client’s bank to a bank in another state through the use of a “spear-phishing” scheme
Occurred when CPA accessed the firm’s resources and opened an containing a virus.

15. Discovery Discovered during the month end bank reconciliation.
After investigation, each bank disclaiming responsibility for the hackers gaining access to the client’s electronically stored passwords and user IDs, and the client asserted that the CPA firm failed to take adequate steps to protect the client’s assets.

16. Lessons Learned
Always do timely cash reconciliations on a daily basis and on a monthly basis for all bank accounts (even clearing or zero balance)
IT Fraud is on the rise with this ever growing technology age
Make sure your IT security is up to par
Perform IT risk assessments and security audits timely
Verify that any services provider has adequate security over your information
Provide adequate IT fraud training for your employees

17. Examples of other Fraud and Defalcation claims
Former president of a CPA’s audit client was convicted of colluding with the client’s bookkeeper to embezzle $2.6M over a 15 year period. The embezzlement was uncovered by the client.
A long-time auditor’s check request resulted in a client uncovering an embezzlement by its accountant. The client lost track of a signature stamp. Embezzler use to stamp to forge an authorized signature on checks and falsified the system to indicate a legitimate vendor for checks made payable to the embezzler.
Fraudster embezzled money by inflating checks to pay the company’s credit card and applying the excess to make payments on their own personal credit card charges.

18. Other comment areas of risk
Related party transactions through funds or component units, intergovernmental transfers
Inflating transactions to manipulate financials
Contract or CIP change orders
Issuing a contract to a vendor under the threshold for Board approval and then preparing a change order to move the amount over the threshold but not obtaining Board approval.
Federal/state awards funds or Special revenue funds are not being properly used for their purpose.
No proper review of transactions in detail for allowable costs/purpose in addition to accuracy.
System ability to manipulate or delete transaction after they have been posted.

19. Evaluating risk Understand core systems Initiation process
Authorization
Execution
Recording
Verification
Documentation
Are controls documented in detail?
Narratives
Flow Charts
Screen Prints

20. Identify Control Activities
Identify areas affected by system
Evaluate actions within the system
Determine control activity when action supports assertion

21. Evaluate Control Deficiencies
Review control activities
What could go wrong?
Type of issues
Design
Operating effectiveness
Nature of issue
Was it an error or was it fraud?

22. Develop Preventive Internal Controls
Conventional controls
Performance indicators
Information processing controls
Physical controls
Segregation of duties
Management review and approval
Tone at the top
How are the importance of ethical behavior and appropriate business practices communicated to employees?

23. How is it Found? Tips – 43% Management review- 16%
Internal audit – 14%
Accident - 7%
Account reconciliation – 7%
Document examination – 4%
External audit & surveillance – 3% each
Law enforcement notification – 2%
IT controls, confession & other – 1%

24. Create Fraud Finding Procedures
Identify the highest risk areas
Target signs of fraud using different approaches
Analytical procedures- what should be versus what it is
Inspection
Observation
Inquiry
Confirmation
Recalculation
Re-performance

25. Fraud: An Auditor’s Perspective
Questions?
Lindsey McGuire