1. SAS 99: Consideration of Fraud in a Financial Statement Audit Based upon AICPA 2003 overview available at http://www.aicpa.org/antifraud/educators_students/Un derstanding_SAS99/Requirements_of_SAS99_edupkg_ classroom_use/93.htm

2. The Perpetrators – Who They Are  Typical perpetrator is a first-timer On average, employees tend to be 30% honest, 30% dishonest, 40% potentially dishonest if conditions exist Small businesses are ripe with conditions Often the least expected employee  Hints? What to look for? Changes in financial situation (new cars, jewelry, clothes) Excessive lifestyle given position and pay Life events, drugs, gambling, divorce  Ease of opportunity brings rationalization  Never forget background checks – good client recommendation!

3. SAS 99 Overall Requirement An audit should be planned and performed to obtain reasonable assurance about whether the financial statements are free of material misstatements, whether caused by error or fraud. An audit requires due professional care, which in turn requires that the auditor exercise professional skepticism.

4. Causes of Misstatements Causes Fraud Errors Misappropriation of Assets Financial Reporting

5. Two Types of Fraud Considered in an Audit Fraudulent financial reporting (“cooking the books”)--examples Falsification of accounting records Omissions of transactions Misappropriation of assets--examples: Theft of assets Fraudulent expenditures

6. Professional Skepticism An attitude that includes a questioning mind and a critical assessment of audit evidence The engagement should be conducted recognizing possibility of material misstatement due to fraud An auditor should not be satisfied with less than persuasive evidence (more than just inquiry)

7. Fraud Conditions (“Fraud Triangle) Incentive (Pressure) Opportunity Rationalization (Attitude)

8. Steps involved in Considering the Risk of Fraud 1. Staff discussion 2. Obtain information needed to identify risks 3. Identify risks 4. Assess identified risks 5. Respond to results of assessment 6. Evaluate audit evidence 7. Communicate about fraud 8. Document consideration of fraud

9. Step 1—Staff Discussion of the Risk of Fraud Usually led by engagement leader Brainstorm Consider how and where financial statements might be susceptible to fraud Exercise professional skepticism

10. Step 2—Obtain information needed to identify risk of fraud Inquiries of management, the audit committee, internal auditors and others (various levels of the organization!) Consider results of analytical procedures Consider fraud risk factors Consider other information

11. Step 3—Identify Risks that may Result in Fraud and Consider Type of risk Significance of risk (magnitude) Likelihood of Risk Pervasiveness of risk

12. Step 4—Assess the identified risks after considering programs and controls Consider understanding of internal control Evaluate whether programs and controls address the identified risks Assess risks taking into account this evaluation

13. Step 5—Respond to Results of the Assessment As risk increases Overall responses More experienced staff More attention to accounting policies Less predictable procedures Specific responses Consider need to increase evidence by altering the nature, timing and extent of audit procedures (might move from a moderate to high necessary level of comfort for certain audit areas)

14. Step 5—Respond to Results of the Assessment (concluded) On all audits, the auditor should consider the possibility of management override of controls and examine: Adjusting journal entries Accounting estimates Unusual significant transactions

15. Step 6—Evaluate Audit Evidence Assess risk of fraud throughout the audit Evaluate analytical procedures performed as substantive tests and at overall review stage Evaluate risk of fraud near completion of fieldwork Respond to misstatements MUST included element of unpredictability – what is this???

16. Step 7—Communicate about Fraud Communicate All fraud to an appropriate level of management All management fraud to audit committee All material fraud to management and audit committee Determine if reportable conditions related to internal control have been identified; communicate them to the audit committee

17. Document Consideration of Fraud Document steps 1 -7 Staff discussion Information used to identify risk of fraud Fraud risks identified Assessed risks after considering programs and controls Results of assessment of fraud risk Evaluation of audit evidence Communications requirements If improper revenue recognition was not considered a risk, why it wasn’t