What four words cause public accountants to cringe more than, "Where were the auditors?"
That's the question when financial fraud comes to light, especially when someone other than the auditors found it. It happened at Enron. It happens frequently in both small companies and governments across the country.
In an attempt to make audits more effective at detecting fraud, in 2002 the American Institute of CPAs issued Statement on Auditing Standards No. 99, Consideration of Fraud in a Financial Statement Audit.
The statement didn't change the auditor's overall responsibilities. CPAs still are not required to detect fraud, but they are expected to plan and perform audits in such a way as to obtain reasonable assurance that financial statements are free of material misstatement.
In some cases, that responsibility may call for the use of a forensic accountant, who may or may not be a CPA.
Forensic accounting is quite a bit different from the usual perusal of paperwork. Many CPAs are not prepared to perform forensic audits, and many non-CPAs may be very well prepared to do so.
SAS 99 allows, but does not require, the use of forensic specialists when advisable. The questions, then, are how to use forensic accounting specialists in an audit, and how to apply SAS 99 effectively.
Sandra Johnigan, a CPA and Certified Fraud Examiner who until recently chaired the AICPA's Forensics and Litigation Services Committee, oversaw the drafting of a discussion memorandum that offered suggestions and elicited comments.
The paper asks several fundamental questions: What is forensic accounting? What are the qualifications of a forensic accountant? What forensic procedures should become a part of an audit? What authoritative guidance governs the work of these specialists?
"We started thinking about this when SAS 99 was still in the exposure process," Johnigan said. "We were thinking how we, as fraud examiners and litigation experts, might be involved in the process of forensic accounting."
The paper also asked whether SAS 99 needs more guidance on forensic audits. The statement includes many procedures, but not necessarily enough to guide untrained CPAs, corporate accountants and audit committees.
Written responses to the memorandum found a strong majority believing that existing guidance is sufficient, but that a significant number still favored additional guidance. Many saw the profession needing standards on forensic services.
Johnigan said that one of the main discoveries in comment letters and a round table discussion was a general call for more education on forensic services and accounting. "People wanted to know what [forensic accountants] are, what our skill sets and experience levels are, how we do what we do, what our procedures are," Johnigan said. "I heard, 'Educate me, educate me, educate me.'"
Johnigan said that from comments and press coverage of accounting fraud, she heard a broad variety of concepts of what a forensic accountant does. Some see it as criminal investigation. Some see it as no more than a standard audit. And many, of course, fall between those extremes.
Although Johnigan's committee is still assessing the memorandum comment letters, she is perceiving little call for formal guidance, and more call for education. "To me, educating people about the specific ways to do something to produce the results they are looking for may be more helpful than writing standards about what needs to be done," she said.
David Richards, president of the Institute of Internal Auditors, said that while internal auditors are the primary forces against fraud, the public generally believes that external auditors are responsible for detecting any existing fraud.
"The public thinks [external auditors] are doing this, but the reality is, they aren't as astute at it as they should be, so action needs to be taken to improve the testing of, and follow-up on, potentially fraudulent behavior," Richards said. "The people who are doing the grunt work, the actual detail work, in a financial audit are probably less experienced individuals, so their knowledge is going to be somewhat impeded because they probably haven't done any kind of forensic accounting."
Richards noted that external auditors are charged with finding materially significant reporting problems, but the materiality of fraud, which can extend to the financial impact caused by investor reaction to a reported fraud, has not been defined.
"SAS 99 presents a good framework, but additional guidance seems to be necessary," Richards said. "The real question is around the qualification of a general financial auditor to be equipped with the proper tools and knowledge with which to test fraud."
Steve McEachern, managing shareholder of Houston-based Fitts, Roberts & Co. PC and chair of the AICPA's Technical Issues Committee, said that it's too soon to say whether more guidance is necessary.
"I think the concept of [more guidance] isn't giving SAS 99 a chance to see whether its implementation will be appropriate and will sufficiently address the problem," McEachern said. "I think that auditors in general are becoming more aware of the need for more forensic procedures and that there may be a need for training in areas where, traditionally, auditors have not been trained."
McEachern also expressed concern that additional guidance or standards might lead to a requirement that all audits include the input or opinions of forensic accountants. In many cases, a forensic audit would increase costs unnecessarily.
"There may be audits where you need professionals with specific skills in that area, but if you try to apply that to any audit, you're going to get confusion, people asking whether they need a handwriting expert or whether CPAs have been trained in those kinds of things," McEachern said.
Toby Bishop, president of the Association of Certified Fraud Examiners, agreed that education was the best solution and that mandatory use of forensic accountants was probably an unnecessary expense.
"The ACFE's wish is to focus on educating all auditors to better prevent, deter and detect fraud, rather than overly relying on a very small group of forensic accountants," Bishop said.
