Protecting against claims of failure to detect theft

Professional liability claim data for claims asserted against CPA firms in the AICPA Professional Liability Insurance Program in 2017 show that — as in previous years — many clients believe that a CPA’s duties include spotting evidence of theft or fraud in company records, regardless of the type of service the CPA firm is engaged to deliver. This erroneous belief is a major concern for CPAs who could face professional liability risks due to the misperception.

“Most CPA firm services don’t have any responsibility related to fraud detection,” said Sarah Beckett Ference, CPA, a risk control director for CNA. “Nevertheless, we see claims in all areas of practice, including tax, bookkeeping, consulting, and other services.” (See the chart, “Unlikely Claims.”)

These claims may arise, in part, due to a mismatch between the client’s perception of the duties of CPAs and their actual responsibilities, Ference said.

“The public’s expectation of what’s involved in CPA services may be different from what is required by the professional standards,” she said. “We often call this anomaly the expectation gap.”

Although claims asserted against CPA firms for failure to detect theft or fraud may be unsuccessful, being subject to a claim, irrespective of its merit, is a hassle. “It still takes time away from your firm,” Ference said, so it’s in a firm’s best interests to take measures to help avoid — or at least improve the defensibility of — any claims, which includes managing the client’s expectations and maintaining detailed documentation.

All firms should use engagement letters on every engagement that outline the services to be provided and the client’s and the CPA firm’s responsibilities. Where applicable, include a disclaimer that the firm’s services are not intended or designed to detect fraud, Ference said.

She offered the following example of an engagement letter provision that could be used for a nonattest service: “Our engagement does not include any procedures designed to detect errors, fraud, or theft. Therefore, our engagement cannot be relied upon to disclose such matters.”

KNOW YOUR ROLE — AND STICK TO IT

It’s also important that the firm adhere to its agreement to provide only the services outlined in the engagement letter, and that it doesn’t stray beyond that scope by adding any other services without amending the engagement letter, Ference advised, not even for a trusted longtime client.

“An engagement letter helps put a box around the services you will provide. Yet, when you provide services or activities beyond the scope of that letter — that can make it ineffective,” she said. Tacking on extra services may cause the firm to see something — or overlook something — that, in hindsight, represents a red flag or other evidence of fraud. The client could blame the CPA firm for not bringing the evidence to its attention.

Firms can also address this risk by educating all firm employees about what fraud looks like, including familiarity with common schemes and the “fraud triangle” — the three factors that are present in most thefts. These are financial or other pressure on the perpetrator, opportunity, and the thief’s rationalization for committing the crime.

THE IMPORTANCE OF DOCUMENTATION

If in the course of providing any type of services a CPA notes something unusual or problematic — such as a lack of internal controls, failure to segregate duties, or someone having unchecked access to funds — the matter should be communicated to the client.

“The CPA should bring anything unusual to the attention of the client — even in the absence of a formal responsibility to do so — and do so in writing,” Ference said. In the case of a claim, a client’s attorney will probably assert that the firm had a responsibility to highlight red flags, if they are discovered, so it’s best for any firm employee to speak up about something unusual and document that process.

“At the end of the day, just because a firm is not performing audit services doesn’t mean the risk of a failure to detect theft or fraud doesn’t apply,” Ference said. “If they see something, they should bring it to the attention of management or the owner.”

Defending against any claim starts and ends with good documentation, she said.

“You may not be able to prevent someone from filing a claim against you, but a sound engagement letter and documentation improves the defensibility of the case,” Ference said.

Unlikely claims

Claims made against CPA firms in the AICPA Professional Liability Insurance Program asserting a failure to detect theft or fraud, by area of practice:

Source: CNA Claim Database, underwritten by Continental Casualty Co. Copyright © 2017. All rights reserved.

Samiha Khanna is a freelance writer based in Durham, N.C. To comment on this article, contact Sarah Beckett Ference, CPA, (sarah.ference@cna.com) a risk control director at CNA.

Continental Casualty Company, one of the CNA insurance companies, is the underwriter of the AICPA Professional Liability Insurance Program. Aon Insurance Services, the National Program Administrator for the AICPA Professional Liability Program, is available at 800-221-3023 or visit cpai.com.

This article provides information, rather than advice or opinion. It is accurate to the best of the author’s knowledge as of the article date. This article should not be viewed as a substitute for recommendations of a retained professional. Such consultation is recommended in applying this material in any particular factual situations.

Examples are for illustrative purposes only and not intended to establish any standards of care, serve as legal advice, or acknowledge any given factual situation is covered under any CNA insurance policy. The relevant insurance policy provides actual terms, coverages, amounts, conditions, and exclusions for an insured. All products and services may not be available in all states and may be subject to change without notice.