For full functionality of this site it is necessary to enable JavaScript. Here are the instructions how to enable JavaScript in your web browser.

CPE for Government Auditors

My comments to the GAO on the 2017 exposure draft of GAGAS

Here is the short response that I sent to the GAO on the 2017 exposure draft of GAGAS.  The deadline for comments is July 6.  Please send your comments to YellowBookComments@gao.gov.

6/20/17

GAO GAGAS Team –

Thank you for giving the audit community a chance to comment.  I am in the relatively unique position of having the privilege to work with teams using every chapter of the Yellow Book.  I work with CPA firms who apply the financial audit standards in the conduct of the Single Audit, internal audit shops and monitors in government who follow the performance audit standards, and legislative auditors who apply both financial and performance standards.  I also work with shops that don’t want to hear anything about the Yellow Book at all (!) and instead follow only IIA or AICPA standards.

Here are a half-a-dozen items I ask you to consider for the finalized 2017 revision:

1. Disclose all auditor responsibilities and the corresponding results and conclusions in the audit report

Please require auditors to include a more direct statement regarding the auditor’s responsibilities for all five reportable conditions in the audit report as well as the auditor’s results or conclusions regarding those responsibilities. 

In the proposed revision, an auditor is responsible for five reportable conditions – fraud, internal control weaknesses, non-compliance, waste, and abuse – but per the reporting standards the auditor need only describe their responsibilities regarding two of these conditions – internal control and compliance – to the reader of the audit report.  The reporting requirements have not evolved along with the audit standards to include statements regarding fraud, waste and abuse.

The AICPA’s canned audit reports regarding internal controls and compliance are opaque and user-unfriendly.  I know that you do not have the power to revise these letters, but I also know that you can influence the content of the AICPA’s letters and encourage clarity and transparency in all auditors’ reports if you decide to alter the required disclosures.

2. Revive the report quality elements
Please revive the ‘report quality elements’ listed in the 2011 version of the Yellow Book at A7.02.  I use the report quality elements quite a bit in my teaching – especially the guidance reminding auditors about timeliness and conciseness.

3. Revive the clear reference to the Single Audit
The 2007 version of the Yellow Book contained a clear reference to the Single Audit that was removed in the 2011 version.  Will you please add it back so there is no doubt that the Single Audit is classified as a financial audit?  It was in section 1.22(b) of the 2007 version and said “(5) auditing compliance with regulations relating to federal award expenditures and other governmental financial assistance in conjunction with or as a by- product of a financial statement audit. “

4. Define the term ‘performance aspect’ and remind auditors of the danger of vague performance aspects
Would you please define the term ‘performance aspects’? Section 8.08 mentions ‘performance aspects’ but does not define the term. The International Standards for Supreme Audit Organizations defines the term ‘performance aspect”, but most auditors I work with are unaware of those standards.

It would be very helpful if you would go on to remind auditors that the terms effectiveefficient and economical are very general and vague and that the auditor would benefit from using a more specific performance aspect in their objective – such as timeliness or accuracy.  I have witnessed countless audit teams suffering from scope creep and messy audit reports when they include the words efficient and effective in their audit objectives.

5. Simplify the peer review requirements
Please simplify and shorten the peer review requirements by including only the minimum requirements at the “Requirements for Audit Organizations Not Affiliated with Recognized Organizations” in paragraphs 5.80 through 5.113.   By mentioning specific organization’s peer review programs in section 5.64, you are creating more work for yourself and the audit community because now you will need to approve these organization’s approaches each time you revise the Yellow Book.  You will also have to screen other organization’s systems before inclusion in the Yellow Book. This can easily become political and bureaucratic and can be completely avoided by mentioning the minimum requirements only.

6. Revise an awkward sentence
This sentence is a bit convoluted:
6.20 Auditors should consider potential internal control deficiencies in their evaluation of identified findings when developing the cause element of the identified findings when significant to the audit objectives.
Maybe just say - Auditors should consider whether an internal control deficiency is the cause for identified findings.

Thank you again for the chance to comment, and thank you for working to make the Yellow Book the most comprehensive and clear audit standard in existence today.

Leita

Fraud Risk per the GAO’s Green Book

Just because you’re unaware of the risk, doesn’t mean it isn’t there

Just because you aren’t conscious of something dangerous, doesn’t mean it isn’t lurking.   One of the most important themes of the GAO’s Green Book (and the 2013 COSO model it is sourced from) is consciousness.  Instead of just playing along with the crowd without regard to the risk, the Green Book encourages you to become conscious of risk, imagine the worst, and then plan to prevent it.

Do you think that people in the 1940’s had a sneaking suspicion that smoking was unhealthy?  Or do you think their desire to be glamorous like all those smoldering (forgive the pun) Hollywood movie stars overrode their common sense?

And in the 70’s my mom and dad slathered themselves with olive oil and lay in the sun to get a reddish brown ‘tan’.  Coppertone products promised to magnify the power of the sun.  Now my dad gets skin cancer removed from his face, arms, and hands every six months or so.

Everybody went nuts buying non-stick cookware in the 80’s only to find out that the Teflon emits dangerous gasses into your food when heated.  In the 90’s we all started drinking bottled water with no concern for the environmental impact, and in the 2000’s we went ‘wireless’ and may be exposing our brains to harmful radio waves.  Lately, we all have to concede that if we transact with the world at all, our personal data is out there and available to criminals in Russia.

I am thinking of that classic parental line here, “If your crazy friend Carl jumped off a bridge, would you do it to?”  Going along with the crowd can be dangerous.

Sometimes you can pre-empt negative consequences

It is all very nice to look back in hindsight and realize that you shouldn’t have followed the crowd and jumped off that bridge.  But sometimes, you can work ahead of a problem to prevent bad results.

For instance, I opened a new business account at a bank recently.  And I know that it is dangerous to give my bank account number to folks who are making deposits into my account and/or who have the power to withdraw money from my account.  But I put the risk out of my mind because I didn’t think I could do anything about it.

Hand me the Coppertone, I’ll play along!  My thinking was, “That’s how business is done and I want to play.”

But my new bank has thought about this risk and offered me not one, but two checking accounts.  I can share one checking account number with vendors and customers who are coming in and out of my account and the other account – where the bulk of my money is – is accessible and known only to me and my bookkeeper.  Nice.

Fraud is real but it isn’t entirely unavoidable

The Certified Fraud Examiners estimate that 5% of an organization’s annual revenue is lost to fraud.   http://www.acfe.com/rttn2016/docs/Staggering-Cost-of-Fraud-infographic.pdf

And although the Certified Fraud Examiners don’t say it outright, they are implying that most organizations suffer fraud.   If an organization grows to over 100 employees, someone is probably doing something squirrely.

I spent a year writing a self-study book on Fraud for Government Auditors.  Unfortunately, I wrote it in 2008 as our economy was crashing.   As I wrote, I became hyper-aware of bad behavior and fraud everywhere I went.  It was exhausting and disheartening to see fraud every time I left the house or read the news, so 8 years later, I have turned the consciousness dial down quite a bit and become mostly numb to it once more. There is only so much moral outrage you can muster day after day after day.

The Green Book asks the leaders of the organization to think about fraud before it happens.  It is asking them, for at least a few days while they prepare a risk assessment, to muster some moral outrage before the organization actually suffers fraud so that they can plan around it, just like my new bank.

Fraud risk specifically

So in our last chapter, we discussed inherent risk in general and how the Green Book encourages us to think about the risk of death, injury, shame, loss of money or non-achievement of goals.

Now, we are going to focus on fraud risk specifically.  Fraud can cause injury, shame, loss of money, or non-achievement of goals.  But occupational fraud, the fraud discussed in the Green Book, is not likely to cause death.

The GAO dedicates a good portion of the chapter in the Green Book on risk assessment to assessing fraud risk.

Principle 8 states: 8.01: Management should consider the potential for fraud when identifying, analyzing, and responding to risks. 

Luckily, the GAO’s green book doesn’t stop there, but instead, shares several models that will help us be more conscious of fraud as we are assessing fraud risk: the fraud tree and the fraud triangle. We are going to discuss each in turn.

Like a good spiritual guide, the fraud tree and fraud triangle enhance consciousness

Both the fraud tree and the fraud triangle have helped me see fraud where I didn’t see it before.  And once your consciousness has been raised, you see new things everywhere.

You may have experienced this with your car.  I am the happy owner of a plain white Lexus sedan.  Before I owned a Lexus, I was oblivious to how many were on the road. Now I see them everywhere.  You remember that weird movie called The Sixth Sense… where the lead declares “I see dead people!”?  I see Lexi.

A broad overview of the fraud tree

As a supplement to this article, I am also going to publish a series of chapters from my book on fraud so you can get to know the fraud tree in more detail.  Be looking for those over the next few weeks. But in this short article, we are just going to do a broad overview of the fraud tree.

So don’t read any of those newsletters or read the rest of this newsletter unless you want to see fraud everywhere.

THE FRAUD TREE

A fraud investigator once told me, fraud is lyin’, cheat’n, and steal’n.  But the Certified Fraud examiners are more formal about classifying fraud and use much better grammar.  The Certified Fraud Examiners came up with a whole taxonomy of occupational fraud which they dubbed the ‘fraud tree.’  If you are having a hard time reading the graphic below, visit the Certified Fraud Examiners page at http://www.acfe.com/fraud-tree.aspx for a clearer graphic.

Fraud Tree

The fraud tree divides fraud into three categories:

Corruption

Misappropriation of assets

Fraudulent reporting

Corruption includes bribery and extortion – which are flip sides of the same coin.  When a person without power pays a person in power for a favor, it is a bribe. When a person in power demands payment from someone who needs a favor, it is extortion.

A contractor with a Texas county told me that he and all of the other contractors knew that in order to win contracts, they would have to give expensive gifts to the county purchaser. Whenever requests for proposals were discussed with contractors, the purchaser would mention things he needed for his house – like a new grill or a lawnmower.  The contractors knew that whoever was first to buy the grill or lawnmower would win the contract. Eventually, the purchaser’s requests became more extravagant and frequent. The contractors had to take turns bidding on contracts, so they could distribute the extra expense more evenly among them.

Corruption also includes illegal gratuities.  An illegal gratuity is when you reward or pay someone in advance in hope of future favor. This is the way the US Congress works. Corporations and lobbyists support campaigns and slather favors on Congressmen in hopes that the Congressman’s decisions on future legislation will be favorable to them.

The last category in corruption is conflict of interest.  This is a wide category of bad behaviors where favors are granted to friends and family.  My friend has recently been elected treasurer of her homeowner’s association.  She has already found out that the chairman of the board is awarding work to companies that his daughters own.  My friend suspects, but cannot prove yet, that the chairman owns the companies and that the daughters are owners on paper only.

The second branch of the tree is misappropriation of assets. Misappropriation of assets is when cash or other assets of the organization are stolen or misused.  Notice that the fraud tree has two main branches under misappropriation of assets – 1. cash and 2. inventory and other assets.

fraud2

Cash can be stolen in three ways; cash can be taken after it has been captured in the accounting records (larceny), or before it hits the accounting records (skimming), or it can be disbursed in what looks like legitimate transactions for illegitimate purposes, like payments to fake (ghost) emplo

yees or fake (shell) companies.  As you can tell from the tree, cash misappropriation includes a wide variety of creative categories for fraudsters to choose from.

Other assets, like inventory and fixed assets can be stolen or misused.  The mail clerk in a state agency I worked for was using the state’s van on weekends to deliver pizzas!

And the last category is fraudulent statements.  We are all aware of the infamous financial statement fraud scandals at Enron and WorldCom that wreaked havoc on our national economy.  But we might not be as well acquainted with non-financial statement fraud.  A false claim or statement for personal gain falls into this category.  Fifty-eight percent of hiring managers said they’ve caught a lie on a resume per a Career Builder Survey concluded in 2014. http://www.careerbuilder.com/share/aboutus/pressreleasesdetail.aspx?sd=8%2F7%2F2014&id=pr837&ed=12%2F31%2F2014  And many governments use performance measures to convince grantors and the citizenry that they are doing a good job handling public resources. But as you can imagine, sometimes these performance measures are altered, manipulated, or even completely made up.

One of my favorite stories about fraudulent performance measures is about the Public Works Department in the City of San Deigo. Their Public Works Department said they filled potholes within a week, when the truth is most potholes took months to repair.  When asked about the discrepancy, the Public Works Department said that their definition of repaired does not meet most people’s definition of repaired.  Tricky?  Yes.  Fraudulent?  I’d say so because the managers in the Public Works Department benefited from exaggerating the Department’s effectiveness.  See the amusing article about this fraud here: http://www.voiceofsandiego.org/topics/government/the-citys-false-pothole-pledge/

When I audited performance measures at a state department of criminal justice (the state prison system), I found that most measures were pulled directly out of the sky.  They were estimates that made the department look good, not measures of real results.

If you were reading closely, you might have noticed a small difference in wording

I don’t really know why the GAO and the COSO model chose to leave out non-financial statement fraud from their literature, but they did.  Here is the quote referring to the fraud tree in the Green Book:

Green Book 8.02 Management considers the types of fraud that can occur within the entity to provide a basis for identifying fraud risks.  Types of fraud are as follows:

  • Fraudulent financial reporting - Intentional misstatements or omissions of amounts or disclosures in financial statements to deceive financial statement users. This could include intentional alteration of accounting records, misrepresentation of transactions, or intentional misapplication of accounting principles.
  • Misappropriation of assets - Theft of an entity’s assets. This could include theft of property, embezzlement of receipts, or fraudulent payments.
  • Corruption - Bribery and other illegal acts.

See how the Green Book doesn’t talk about fraudulent statements in general but fraudulent financial statements only.

If you are an aficionado of SAS 99 (now AU 316), the AICPA’s guidance on an auditor’s responsibility for detecting fraud, you may recognize that the AICPA focuses their discussion of fraud on fraudulent financial statement reporting only.  This makes sense because the AICPA is clear about its audit objective – to opine on whether the financial statements are created in accordance with an accounting standard (usually GAAP).  But the Green Book – because it covers an entire organization, should include all components of the fraud tree.

If you know the reason for this, please share.  Otherwise, I am going to say it is a flaw of the Green Book until someone can convince me otherwise.

Next time, we will discuss the fraud triangle and do an example fraud risk assessment.

Stay Up-To-Date

Sign up here to have the lastest from Yellowbook-CPE.com delivered right to your inbox.

Just provide your name and email information below, and as an introductory “Thank You”, you’ll be able to view and download a free copy of our Audit Objectives whitepaper.

×

Login

Lost your password?