The Difference Between Fraud, Waste and Abuse

The difference between fraud, waste and abuse is a matter of degrees. Only fraud is a reportable condition under Yellow Book standards.

If the auditee exhibits any of the following three conditions, and these conditions are significant or material, the auditor should describe them in their audit report in the form of a “finding” and recommend corrective action:

1. Internal control weaknesses
2. Noncompliance
3. Fraud

But those aren’t the only less than stellar conditions an auditor may come across; the auditor may also see that the auditee is abusing their power or wasting government resources. In years past, the GAO considered abuse as a reportable condition and did not mention the concept of waste.

In the 2018 version of the Yellow Book, abuse is no longer a reportable condition. Instead, abuse is joined to waste and together they are described as indicators that the other reportable conditions exist.

Our Responsibility Is Limited

The Yellow Book repeatedly points out that we are responsible for the reportable conditions only within the context of our audit objectives. So, we are not responsible for fraud, noncompliance, and internal control weaknesses throughout the client’s operations (thank goodness!). We are only responsible for those three conditions as they relate to our audit objectives.

Definitions of the Reportable Conditions

Let’s define each of the reportable conditions in more detail. First, internal control weaknesses, next noncompliance, and then fraud.

Here is how the GAO defines an internal control weakness:

8.53: … A deficiency in internal control exists when the design, implementation, or operation of a control does not allow management or personnel to achieve control objectives and address related risks. A deficiency in design exists when a necessary control is missing or is not properly designed so that even if the control operates as designed, the control objective would not be met. A deficiency in implementation exists when a control is properly designed but not implemented correctly in the internal control system. A deficiency in operating effectiveness exists when a properly designed control does not operate as designed or the person performing the control does not have the necessary competence or authority to perform the control effectively.

Here is how the GAO defines non-compliance:

8.68 … instances of noncompliance with provisions of laws, regulations, contracts, and grant agreements …

Here is how the GAO defines fraud:

8.73    Fraud involves obtaining something of value through willful misrepresentation.

Each of the Reportable Conditions Has Criteria:

One thing that makes auditors very happy is audit criteria. Without audit criteria, we don’t have anything objective to measure our audit subject against.

• Internal controls can be evaluated against the COSO model or the Green Book.
• Compliance can obviously be evaluated against some of our favorite audit criteria: law, regulations, contracts, or grant agreements.
• Fraud must be evaluated against statute. A fraudster cannot be brought to court unless the prosecution can prove that a crime—per statute—was committed.

So, for each reportable condition, an auditor can comfortably bring issues up in a finding because they will have some firm criteria to base their finding on. And as you know if you read my blog posts at all, criteria is also one of the five elements of a finding.

Abuse and Waste Are Subjective

In the case of the concepts of abuse and waste, the auditor must apply their judgment instead of firm criteria. This is not a happy spot for auditors to be in.

Because abuse does not involve any firm criteria, it has been downgraded from a reportable condition to a “concept.”

Here is the definition of abuse:

6.23    Abuse is behavior that is deficient or improper when compared with behavior that a prudent person would consider reasonable and necessary business practice given the facts and circumstances, but excludes fraud and noncompliance with provisions of laws, regulations, contracts, and grant agreements. Abuse also includes misuse of authority or position for personal financial interests or those of an immediate or close family member or business associate.

Who is this prudent person? You’ve got me! I’ve never met one, so we won’t be able to give them a call or refer to their judgment when we are trying to decide if someone is acting abusively.

We have a similar problem with waste, which is defined for the first time in the 2018 version of the Yellow Book.

6.21    Waste is the act of using or expending resources carelessly, extravagantly, or to no purpose. Importantly, waste can include activities that do not include abuse and does not necessarily involve a violation of law. Rather, waste relates primarily to mismanagement, inappropriate actions, and inadequate oversight.

This time, this non-existent prudent person is not mentioned, although we still aren’t left with any firm criteria to hang our hats on.

I am sure that you have had unresolvable conflicts with your loved ones over what constitutes waste. What my husband thinks is wasteful, I think is normal or necessary, and vice versa.

For instance, I insist on using Orville Redenbacher raw popcorn kernels when I make popcorn. Orville Redenbacher is expensive compared to the cheap bags of generic popcorn. Several times he has snuck cheap popcorn into my Orville Redenbacher jar to make a point, but I busted him! He thinks I am being wasteful. I think Orville Redenbacher is necessary. Who is right? Me, of course!

He insists on Coke Zero and refuses to drink generic diet cola brands. He sees no hypocrisy in this.

This is exactly the kind of silly debate that auditors should not get into! Without firm criteria, limiting the amount that should be spent on popcorn or sodas is a no-win situation.

The GAO recognizes that abuse and waste are difficult for auditors to work with because of the lack of firm criteria, so they downgraded abuse from a reportable condition. They married the concept of abuse to the newly defined concept of waste and point out that abuse and waste can be indicators that fraud, non-compliance, or internal control weaknesses have occurred.

6.20    Given the concept of accountability for use of public resources and government authority, evaluating internal control in a government environment may also include considering internal control deficiencies that result in waste or abuse. Because the determination of waste and abuse is subjective, auditors are not required to perform specific procedures to detect waste or abuse in financial audits. However, auditors may consider whether and how to communicate such matters if they become aware of them. Auditors may also discover that waste or abuse are indicative of fraud or noncompliance with provisions of laws, regulations, contracts, and grant agreements.

Thinking through Some Examples May Help Us

Let’s walk through two scenarios involving of less-than-stellar behavior and see whether these are one of the three reportable conditions (fraud, noncompliance, internal control weaknesses), abuse and waste, or something else.

Scenario 1: First let’s consider the case of a government employee who works for a retirement system in Massachusetts. Let’s say she wants to visit her daughter in California soon. She sees an opportunity to have the retirement system pay her way when a seminar relevant to her job is offered only a half-hour’s drive from her daughter’s home. This same seminar will be available near her offices in Massachusetts in a few months and the state will not have to pay travel costs for her to attend.

Here is the scale of less-than-stellar behavior in government – from bad… so bad you want to see the person behind bars (fraud) – to just plain silly.

• Fraud
• Noncompliance
• Internal Control Deficiency
• Abuse
• Waste
• Unethical
• Silly/stupid

Abuse and waste are not reportable conditions; neither are unethical, silly, or stupid behaviors.

Let’s go from the bottom of our list up. Yes, this is pretty stupid and obvious upon examination. Unethical? Yes. Is she wasting government resources: Yes. Abuse…maybe not. An internal control deficiency? Maybe. Someone should be reviewing her choices and making sure that the expenditure is worthy. Non-compliance? No, I don’t think so. Fraud? Should she go to jail? No, I think jail time is a little too harsh.

Yes, she is wasting the government’s resources, but we are going to have a hard time writing a finding from that perspective because we don’t have any criteria. The Yellow Book tells us that waste and abuse can indicate that another reportable condition is present.

6.20    Given the concept of accountability for use of public resources and government authority, evaluating internal control in a government environment may also include considering internal control deficiencies that result in waste or abuse… Auditors may also discover that waste or abuse are indicative of fraud or noncompliance with provisions of laws, regulations, contracts, and grant agreements.

If this issue is relevant to my audit objective and I want to bring it up in my audit report, I would frame this issue as an internal control weakness. Someone should have prevented her from traveling unnecessarily by reviewing her travel plans.

Scenario 2: Let’s go through another scenario. Let’s say that we are auditing prisoner accounts at a county jail. And we find that the jail clerk has not been returning funds to inmates after they are released.

Let’s go through this one from the top! Is this fraud? Well, aren’t you eager to throw someone behind bars? I didn’t say the jail clerk took the funds home with her! I only said she just didn’t return the fund to inmates. If she took it home, yes, it would be fraud.

If she just left it sitting in the county’s bank account, we are not dealing with fraud but instead noncompliance or an internal control weakness. Is it waste or abuse? No. Unethical? Yes, if it was intentional. Silly or stupid? Maybe she just has too much to do and let this task slip. I don’t think I’d call that stupid.

I’d probably frame the finding as noncompliance in this scenario. Maybe an internal control weakness.

For more on the reportable conditions and an auditor’s responsibility to uncover them, enjoy the self-study Essential Auditing Skills and Techniques for the Government Auditor. 9 hours of relevant CPE for only $120.