For full functionality of this site it is necessary to enable JavaScript. Here are the instructions how to enable JavaScript in your web browser.

CPE for Government Auditors

Chapter 12: Information and Communication

                        Might be a rock n’ roll addict, prancing on the stage

                        Might have money and drugs at your command, women in a cage

                        You may be a business man or some high degree thief

                        They may call you Doctor or they may call you Chief

 

                        But you’re gonna’ have to serve somebody, yes indeed

                        Your gonna’ have to serve somebody.

                        Well, it may be the devil, or it may be the Lord

                        But you’re gonna’ have to serve somebody.

Bob Dylan, Gotta’ Serve Somebody

 

My business is minuscule, but that doesn’t exempt me from having to formalize my information processes and comply with reporting requirements of oversight entities.

Every year, I send a detailed report of my CPE offerings to the National Association of State Boards of Accountancy (NASBA).  They want to know how many classes I offered, who taught them, where they were offered and for what group, the date of the classes, and the number of hours granted.

The first year I prepared the report, I suffered.  I had to dig up physical files from earlier in the year and reconstruct all of the data, so I could input it into the report.  Slog!  It took days to put it together, and when I was finished, NASBA sent it back to me because it wasn’t formatted correctly.  Really?  More time, more suffering.

The State of Texas Board of Accountancy requires similar information, but their report has to be handwritten!  Hand… friggin… written… with an ink pen.  That takes a while to complete…

I realized after that first fiasco that I needed to go paperless and track the information I needed throughout the year rather than wait to gather the data at the last minute.  My assistant Chelsea and I have a checklist of all of the documents we must collect after each class, and we maintain a running spreadsheet of the data I am required to report.  All of the information is kept in a Dropbox file that she and I share and update each time I teach.  No more messy paper files.

This year, I only spent a few hours creating both reports!  And on top of that fabulous achievement, I also feel more confident in the information I am reporting because Chelsea and I double-check each other throughout the process.

I also have to report my income to the IRS every year.  When I first started my business, I reasoned that I could keep the books myself because I am a CPA. The only problem is, I do not enjoy bookkeeping.  I waited until the end of the year to force myself to sit down and input transactions into QuickBooks.

As you can imagine, I forgot the purpose of several payments that occurred early in the year and had to SWAG a description of the transactions.  SWAG stands for Sophisticated Wild Ass Guess.   After about five SWAGS, I decided I needed to stop the madness and hired a real bookkeeper, Carol, who keeps contemporary information on my business.  Carol sends me up-to-date financials every Monday, and when it is time to report to the IRS, all the transactions are there, ready to report.  No SWAGs necessary.

I have learned the hard way that thinking of the info you need to accumulate and share in advance is better than trying to gather it – and guess at it – months or even a year later.

The Green Book is Out to Save You from Suffering

The authors of the COSO model and Green Book must have gone through similar experiences.  So, they advise us to think ahead about the information that needs to be shared and to make sure the data shared is valid.

In the chapter on Information and Communication they ask us to apply three principles:

13. Management should use quality information to achieve the entity’s objectives.

14. Management should internally communicate the necessary quality information to achieve the entity’s objectives.

15. Management should externally communicate the necessary quality information to achieve the entity’s objectives.

Principle #13 – no SWAGs

Auditors are trained to never take anyone’s word on anything.  Auditors are trained to seek convincing evidence and not base any conclusions on testimony.  Because both of my above reports could be audited, I am prepared to back up all of my data with original documents!  For instance, the information I send to NASBA about the classes I offer is backed up with sign-in sheets from attendees.  And the transactions in my accounting records are backed up with receipts and bank statements.

The first principle under the Information and Communication component advises us to put controls in place to make sure all of the information in the reports is valid and backed up with evidence.  Three attributes apply to this principle:

13.01 Management should use quality information to achieve the entity’s objectives.

Attributes

The following attributes contribute to the design, implementation, and operating effectiveness of this principle:

  • Identification of Information Requirements
  • Relevant Data from Reliable Sources
  • Data Processed into Quality Information

Attribute 1: Figure out who wants the information and what information they need

This attribute asks “Who cares about whether your work succeeds or whether your controls are functioning?”  Our case study objective, is Do controls prevent the coach from using his purchasing card for personal purchases as defined by Grace School District Policy #C7.459?   I imagine that the following folks will care if the coach is making personal purchases:

  • The director of the athletic department
  • The executive team of the school
  • The school board
  • The citizens of the school district

Once we have a sense of who we will be sharing information with, we need to find out what they want to know.  We can inquire of the stakeholders directly, or we can make some assumptions about what they need. Knowing what they want rather than guessing what they want is best because the frequency and accuracy of information costs time and money; it is a waste of resources to generate and report information they don’t need.

Section 13.03 says that the process of identifying what stakeholders need is an iterative process… in other words, you will have to redesign the content of your reports several times before you hit on content that is meaningful to the stakeholders.

Here is what the Green Book has to say about this attribute.

Identification of Information Requirements

13.02 Management designs a process that uses the entity’s objectives and related risks to identify the information requirements needed to achieve the objectives and address the risks. Information requirements consider the expectations of both internal and external users. Management defines the identified information requirements at the relevant level and requisite specificity for appropriate personnel.

13.03 Management identifies information requirements in an iterative and ongoing process that occurs throughout an effective internal control system. As change in the entity and its objectives and risks occurs, management changes information requirements as needed to meet these modified objectives and address these modified risks.

Attribute #2: Who you get the information from matters

It is always preferable to get your evidence – or the back-up for your reports – from objective third parties.  So, instead of asking the coach to describe his own transactions, source your information from the credit card statement.  The credit card company has no reason to disguise the purpose of purchases, but the coach does.  If any transaction looks iffy, you could ask for original receipts from the coach.

From the Green Book:

Relevant Data from Reliable Sources

13.04 Management obtains relevant data from reliable internal and external sources in a timely manner based on the identified information requirements. Relevant data have a logical connection with, or bearing upon, the identified information requirements. Reliable internal and external sources provide data that are reasonably free from error and bias and faithfully represent what they purport to represent. Management evaluates both internal and external sources of data for reliability. Sources of data can be operational, financial, or compliance related. Management obtains data on a timely basis so that they can be used for effective monitoring.

Attribute #3: Don’t let anyone doctor the report before it is published

The last attribute addresses how the evidence is processed.  The true financial results for Enron, which were created from reliable and relevant evidence by the Enron accounting department, didn’t look that attractive, so the Enron executives made a few fraudulent changes to the reports before they were published.  Obviously, we don’t want to allow bogus changes to our reports in order to make the results look more acceptable.

This is what the Green Book has to say about processing data.

Data Processed into Quality Information

13.05 Management processes the obtained data into quality information that supports the internal control system. This involves processing data into information and then evaluating the processed information so that it is quality information. Quality information meets the identified information requirements when relevant data from reliable sources are used. Quality information is appropriate, current, complete, accurate, accessible, and provided on a timely basis. Management considers these characteristics as well as the information processing objectives in evaluating processed information and makes revisions when necessary so that the information is quality information.  Management uses the quality information to make informed decisions and evaluate the entity’s performance in achieving key objectives and addressing risks.

13.06 Management processes relevant data from reliable sources into quality information within the entity’s information system. An information system is the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information.

Answering Who, What, When, Where & How

So, now that the Green Book has prompted you to answer the who and what questions –who you need to communicate with and what information they need –  principles 14 & 15 prompt us to answer the when, where, and how questions.

The content of principle  14 & 15 are very similar.  Principle 14 focuses on internal reporting and principle 15 focuses on external reporting.  Both ask that we consider:

  • Audience - The intended recipients of the communication
  • Nature of information - The purpose and type of information being communicated
  • Availability - Information readily available to the audience when needed
  • Cost - The resources used to communicate the information
  • Legal or regulatory requirements - Requirements in laws and regulations that may impact communication

A report for our case study

Let’s make up a report for our case study example.  Remember our control objective is:

Do controls prevent the coach from using his purchasing card for personal purchases as defined by Grace School District Policy #C7.459? 

Thinking through each of the prompts given in section 14.07 and 15.07:

Audience

The intended recipients of the communication

The school board and the public.

Nature of information

The purpose and type of information being communicated

This report will contain a bar graphic for each user of the purchasing card and will look something like this:

chart1

It will also include a detailed list of transactions for each cardholder that will include the date of the transaction, the vendor, the amount of the purchase, and the items purchased.

Availability

Information readily available to the audience when needed

The board will receive the report every month via email and the report will be available to the public on the school’s website after the board has reviewed it.

Cost

The resources used to communicate the information

Accounting has the transaction information readily available in the general ledger, but it is not separated by user.  So, the initial cost to set up individual accounts for each user will require some customization of the accounting software.  But, once it is set up, the report should only take an accountant an hour to create and email to the board.  The webmaster will have to post the report to the site, and that should take about 30 minutes.

Legal or regulatory requirements

Requirements in laws and regulations that may impact communication

This report will not help satisfy any regulatory requirements imposed by the state or federal government. However, the Comptroller of the State will award us a ‘Transparency’ award and will feature our report on their website if we meet their award criteria.

Information and Communication is the most straightforward component

The information and communication component of the COSO model/Green Book advises us to make sure that the information we share is valid and communicated in a manner that is helpful to stakeholders.  In my opinion, it is the most straightforward and clear component of the COSO model/Green Book.

So far, we have covered three components of the COSO model/Green Book – the risk assessment component, the control activities component and the information and communication component.  In the next chapter, we will cover the monitoring component.

Fraud Risk per the GAO’s Green Book

Just because you’re unaware of the risk, doesn’t mean it isn’t there

Just because you aren’t conscious of something dangerous, doesn’t mean it isn’t lurking.   One of the most important themes of the GAO’s Green Book (and the 2013 COSO model it is sourced from) is consciousness.  Instead of just playing along with the crowd without regard to the risk, the Green Book encourages you to become conscious of risk, imagine the worst, and then plan to prevent it.

Do you think that people in the 1940’s had a sneaking suspicion that smoking was unhealthy?  Or do you think their desire to be glamorous like all those smoldering (forgive the pun) Hollywood movie stars overrode their common sense?

And in the 70’s my mom and dad slathered themselves with olive oil and lay in the sun to get a reddish brown ‘tan’.  Coppertone products promised to magnify the power of the sun.  Now my dad gets skin cancer removed from his face, arms, and hands every six months or so.

Everybody went nuts buying non-stick cookware in the 80’s only to find out that the Teflon emits dangerous gasses into your food when heated.  In the 90’s we all started drinking bottled water with no concern for the environmental impact, and in the 2000’s we went ‘wireless’ and may be exposing our brains to harmful radio waves.  Lately, we all have to concede that if we transact with the world at all, our personal data is out there and available to criminals in Russia.

I am thinking of that classic parental line here, “If your crazy friend Carl jumped off a bridge, would you do it to?”  Going along with the crowd can be dangerous.

Sometimes you can pre-empt negative consequences

It is all very nice to look back in hindsight and realize that you shouldn’t have followed the crowd and jumped off that bridge.  But sometimes, you can work ahead of a problem to prevent bad results.

For instance, I opened a new business account at a bank recently.  And I know that it is dangerous to give my bank account number to folks who are making deposits into my account and/or who have the power to withdraw money from my account.  But I put the risk out of my mind because I didn’t think I could do anything about it.

Hand me the Coppertone, I’ll play along!  My thinking was, “That’s how business is done and I want to play.”

But my new bank has thought about this risk and offered me not one, but two checking accounts.  I can share one checking account number with vendors and customers who are coming in and out of my account and the other account – where the bulk of my money is – is accessible and known only to me and my bookkeeper.  Nice.

Fraud is real but it isn’t entirely unavoidable

The Certified Fraud Examiners estimate that 5% of an organization’s annual revenue is lost to fraud.   http://www.acfe.com/rttn2016/docs/Staggering-Cost-of-Fraud-infographic.pdf

And although the Certified Fraud Examiners don’t say it outright, they are implying that most organizations suffer fraud.   If an organization grows to over 100 employees, someone is probably doing something squirrely.

I spent a year writing a self-study book on Fraud for Government Auditors.  Unfortunately, I wrote it in 2008 as our economy was crashing.   As I wrote, I became hyper-aware of bad behavior and fraud everywhere I went.  It was exhausting and disheartening to see fraud every time I left the house or read the news, so 8 years later, I have turned the consciousness dial down quite a bit and become mostly numb to it once more. There is only so much moral outrage you can muster day after day after day.

The Green Book asks the leaders of the organization to think about fraud before it happens.  It is asking them, for at least a few days while they prepare a risk assessment, to muster some moral outrage before the organization actually suffers fraud so that they can plan around it, just like my new bank.

Fraud risk specifically

So in our last chapter, we discussed inherent risk in general and how the Green Book encourages us to think about the risk of death, injury, shame, loss of money or non-achievement of goals.

Now, we are going to focus on fraud risk specifically.  Fraud can cause injury, shame, loss of money, or non-achievement of goals.  But occupational fraud, the fraud discussed in the Green Book, is not likely to cause death.

The GAO dedicates a good portion of the chapter in the Green Book on risk assessment to assessing fraud risk.

Principle 8 states: 8.01: Management should consider the potential for fraud when identifying, analyzing, and responding to risks. 

Luckily, the GAO’s green book doesn’t stop there, but instead, shares several models that will help us be more conscious of fraud as we are assessing fraud risk: the fraud tree and the fraud triangle. We are going to discuss each in turn.

Like a good spiritual guide, the fraud tree and fraud triangle enhance consciousness

Both the fraud tree and the fraud triangle have helped me see fraud where I didn’t see it before.  And once your consciousness has been raised, you see new things everywhere.

You may have experienced this with your car.  I am the happy owner of a plain white Lexus sedan.  Before I owned a Lexus, I was oblivious to how many were on the road. Now I see them everywhere.  You remember that weird movie called The Sixth Sense… where the lead declares “I see dead people!”?  I see Lexi.

A broad overview of the fraud tree

As a supplement to this article, I am also going to publish a series of chapters from my book on fraud so you can get to know the fraud tree in more detail.  Be looking for those over the next few weeks. But in this short article, we are just going to do a broad overview of the fraud tree.

So don’t read any of those newsletters or read the rest of this newsletter unless you want to see fraud everywhere.

THE FRAUD TREE

A fraud investigator once told me, fraud is lyin’, cheat’n, and steal’n.  But the Certified Fraud examiners are more formal about classifying fraud and use much better grammar.  The Certified Fraud Examiners came up with a whole taxonomy of occupational fraud which they dubbed the ‘fraud tree.’  If you are having a hard time reading the graphic below, visit the Certified Fraud Examiners page at http://www.acfe.com/fraud-tree.aspx for a clearer graphic.

Fraud Tree

The fraud tree divides fraud into three categories:

Corruption

Misappropriation of assets

Fraudulent reporting

Corruption includes bribery and extortion – which are flip sides of the same coin.  When a person without power pays a person in power for a favor, it is a bribe. When a person in power demands payment from someone who needs a favor, it is extortion.

A contractor with a Texas county told me that he and all of the other contractors knew that in order to win contracts, they would have to give expensive gifts to the county purchaser. Whenever requests for proposals were discussed with contractors, the purchaser would mention things he needed for his house – like a new grill or a lawnmower.  The contractors knew that whoever was first to buy the grill or lawnmower would win the contract. Eventually, the purchaser’s requests became more extravagant and frequent. The contractors had to take turns bidding on contracts, so they could distribute the extra expense more evenly among them.

Corruption also includes illegal gratuities.  An illegal gratuity is when you reward or pay someone in advance in hope of future favor. This is the way the US Congress works. Corporations and lobbyists support campaigns and slather favors on Congressmen in hopes that the Congressman’s decisions on future legislation will be favorable to them.

The last category in corruption is conflict of interest.  This is a wide category of bad behaviors where favors are granted to friends and family.  My friend has recently been elected treasurer of her homeowner’s association.  She has already found out that the chairman of the board is awarding work to companies that his daughters own.  My friend suspects, but cannot prove yet, that the chairman owns the companies and that the daughters are owners on paper only.

The second branch of the tree is misappropriation of assets. Misappropriation of assets is when cash or other assets of the organization are stolen or misused.  Notice that the fraud tree has two main branches under misappropriation of assets – 1. cash and 2. inventory and other assets.

fraud2

Cash can be stolen in three ways; cash can be taken after it has been captured in the accounting records (larceny), or before it hits the accounting records (skimming), or it can be disbursed in what looks like legitimate transactions for illegitimate purposes, like payments to fake (ghost) emplo

yees or fake (shell) companies.  As you can tell from the tree, cash misappropriation includes a wide variety of creative categories for fraudsters to choose from.

Other assets, like inventory and fixed assets can be stolen or misused.  The mail clerk in a state agency I worked for was using the state’s van on weekends to deliver pizzas!

And the last category is fraudulent statements.  We are all aware of the infamous financial statement fraud scandals at Enron and WorldCom that wreaked havoc on our national economy.  But we might not be as well acquainted with non-financial statement fraud.  A false claim or statement for personal gain falls into this category.  Fifty-eight percent of hiring managers said they’ve caught a lie on a resume per a Career Builder Survey concluded in 2014. http://www.careerbuilder.com/share/aboutus/pressreleasesdetail.aspx?sd=8%2F7%2F2014&id=pr837&ed=12%2F31%2F2014  And many governments use performance measures to convince grantors and the citizenry that they are doing a good job handling public resources. But as you can imagine, sometimes these performance measures are altered, manipulated, or even completely made up.

One of my favorite stories about fraudulent performance measures is about the Public Works Department in the City of San Deigo. Their Public Works Department said they filled potholes within a week, when the truth is most potholes took months to repair.  When asked about the discrepancy, the Public Works Department said that their definition of repaired does not meet most people’s definition of repaired.  Tricky?  Yes.  Fraudulent?  I’d say so because the managers in the Public Works Department benefited from exaggerating the Department’s effectiveness.  See the amusing article about this fraud here: http://www.voiceofsandiego.org/topics/government/the-citys-false-pothole-pledge/

When I audited performance measures at a state department of criminal justice (the state prison system), I found that most measures were pulled directly out of the sky.  They were estimates that made the department look good, not measures of real results.

If you were reading closely, you might have noticed a small difference in wording

I don’t really know why the GAO and the COSO model chose to leave out non-financial statement fraud from their literature, but they did.  Here is the quote referring to the fraud tree in the Green Book:

Green Book 8.02 Management considers the types of fraud that can occur within the entity to provide a basis for identifying fraud risks.  Types of fraud are as follows:

  • Fraudulent financial reporting - Intentional misstatements or omissions of amounts or disclosures in financial statements to deceive financial statement users. This could include intentional alteration of accounting records, misrepresentation of transactions, or intentional misapplication of accounting principles.
  • Misappropriation of assets - Theft of an entity’s assets. This could include theft of property, embezzlement of receipts, or fraudulent payments.
  • Corruption - Bribery and other illegal acts.

See how the Green Book doesn’t talk about fraudulent statements in general but fraudulent financial statements only.

If you are an aficionado of SAS 99 (now AU 316), the AICPA’s guidance on an auditor’s responsibility for detecting fraud, you may recognize that the AICPA focuses their discussion of fraud on fraudulent financial statement reporting only.  This makes sense because the AICPA is clear about its audit objective – to opine on whether the financial statements are created in accordance with an accounting standard (usually GAAP).  But the Green Book – because it covers an entire organization, should include all components of the fraud tree.

If you know the reason for this, please share.  Otherwise, I am going to say it is a flaw of the Green Book until someone can convince me otherwise.

Next time, we will discuss the fraud triangle and do an example fraud risk assessment.

Stay Up-To-Date

Sign up here to have the latest from Yellowbook-CPE.com delivered right to your inbox.

Just provide your name and email information below, and as an introductory “Thank You”, you’ll be able to view and download a free copy of our Audit Objectives whitepaper.

×

Login

Lost your password?