A refresher on fraud and the responsibility for its detection

Fraud is a serious concern that can have devastating consequences. With uncertainty about the economy — be it a recession, a soft landing, or something else — there may be no better time than now to have a quick refresher on the practitioner’s responsibilities relating to fraud in an assurance engagement.

Remember, there is no substitute for the AICPA Professional Standards, and this discussion is not intended to cover all the requirements contained in the relevant sections of that authoritative guidance.

The accountant’s responsibilities relating to fraud are dependent on the type of engagement being performed. Our discussion will cover engagements covered by AICPA Statements on Standards for Accounting and Review Services (SSARSs) and AICPA Statements on Auditing Standards (SASs). Let’s begin with the SSARSs.

Similar to an audit of financial statements, when performing a preparation, compilation, or review engagement, the accountant begins with engagement acceptance or continuance procedures. These procedures include obtaining (usually via an engagement letter) the agreement of management, where management acknowledges and understands its responsibilities with respect to fraud. These responsibilities include the prevention and detection of fraud as well as the design, implementation, and maintenance of a system of internal control relevant to the preparation and presentation of financial statements that are free from material misstatement, whether due to fraud or error, unless the accountant decides to accept responsibility for such internal control.

Responsibilities for fraud in a preparation or compilation engagement

When performing a preparation engagement, where the objective is to prepare financial statements pursuant to a specified financial reporting framework, the requirement to obtain management’s agreement that it acknowledges and understands its responsibility for preventing and detecting fraud is the auditor’s main responsibility. This is equally true in the case of a compilation engagement, when the objective is to apply accounting and financial reporting expertise to assist management in the presentation of the financial statement and to report in accordance with AR-C Section 80, Compilation Engagements, without undertaking to obtain or provide any assurance that there are no material modifications that should be made to the financial statements for them to be in accordance with the applicable financial reporting framework.

In detailing the accountant’s responsibilities in the engagement letter, it is recommended (but not required) that, in the interest of transparency, the accountant convey to management that a preparation or compilation engagement cannot be relied on to identify or disclose any financial statement misstatements, including those caused by fraud or error, or to identify or disclose any wrongdoing within the entity or noncompliance with laws and regulations.

Responsibilities for fraud in a review engagement

Recall that in conducting a review of financial statements, the accountant’s objectives include obtaining limited assurance as a basis for reporting whether they are aware of any material modifications that should be made to the financial statements for the statements to be in accordance with the applicable financial reporting framework.

In obtaining limited assurance, AR-C Section 90, Review of Financial Statements, requires the accountant to make inquiries of management who have responsibility for financial and accounting matters, and of others within the entity, as appropriate, about the existence of any actual, suspected, or alleged fraud. Inquiry procedures are most effective when the accountant uses their understanding of the entity to drive what questions to ask, remain inquisitive throughout the review engagement, and carefully evaluate the responses in the context of the specific engagement while maintaining appropriate professional skepticism.

When there are indications that fraud has or might have occurred — the effects of which should be considered when preparing the financial statements — the accountant is required to communicate such as soon as practical either to the appropriate level of senior management, preferably at a level above those involved with the suspected fraud, or to those charged with governance. As appropriate, the accountant should request management’s assessment of the effects, if any, on the financial statements; consider the effect, if any, of management’s assessment of the effects of fraud on the accountant’s conclusion on the financial statements and the accountant’s report; and determine whether they, as the accountant, have broader communication responsibilities to any parties outside of the entity. Because potential conflicts with the accountant’s ethical and legal obligations regarding confidentiality may be complex, the accountant may consult with legal counsel before having any discussions with parties outside the entity.

If the fraud either results in a material misstatement of the financial statements or involves senior management, the accountant is required to communicate the matter directly to those charged with governance.

In a review engagement, the accountant is required to obtain specific written representations from management regarding fraud, including that management has disclosed to the accountant significant facts relating to any fraud or suspected fraud known to management that may have affected the entity, involving management, employees who have significant roles in internal control, or others, when the fraud could have a material effect on the financial statements.

Finally, the written review report is required to include an explanation that management is responsible for the preparation and fair presentation of the financial statements in accordance with the applicable financial reporting framework. This responsibility includes the design, implementation, and maintenance of a system of internal control relevant to the preparation of the financial statements so that they are free from material misstatement, whether due to fraud or error.

Responsibilities for fraud in an audit engagement

AU-C Section 240, Consideration of Fraud in a Financial Statement Audit, addresses the auditor’s responsibilities relating to fraud in an audit of financial statements. Specifically, it expands on how AU-C Section 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, and AU-C Section 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained, are to be applied regarding risks of material misstatement due to fraud.

AU-C Section 240.04 notes that the primary responsibility for fraud prevention and detection lies with the entity’s management, including the entity’s system of internal control. Furthermore, those charged with governance have an oversight responsibility, which includes considering the potential for override of controls or other inappropriate influence over the financial reporting process.

Auditor responsibilities

As we know, the auditor is responsible for obtaining reasonable assurance in an audit that the financial statements are free of material misstatements, whether due to fraud or error. Although reasonable assurance is a high level of assurance, there is an unavoidable risk that some material misstatements in the financial statements may not be detected, even though the audit is properly planned and performed in accordance with generally accepted auditing standards (GAAS). The inherent limitations of an audit are particularly significant in the case of misstatement resulting from fraud, and more so when management is the source of the potential fraud.

When performing the engagement, consider the fraud risk triangle and how it may be present within the specific client. Are there events or conditions that indicate an incentive or pressure to perpetrate fraud, provide an opportunity to commit fraud, or indicate attitudes or rationalizations to justify a fraudulent action?

To meet the GAAS requirements, auditors are generally required to:

• Maintain professional skepticism.
  • Discuss among key engagement team members how and where the entity’s financial statements might be susceptible to material misstatement due to fraud. Don’t forget to document the fraud brainstorming session identifying client-specific fraud risks.

As a part of risk assessment procedures and related activities in accordance with AU-C Section 315:

• Make inquiries of management …

• regarding management’s assessment of the risk that the financial statements may be materially misstated due to fraud, its identification and monitoring processes, and any related communications regarding fraud. Be sure to watch for nonverbal cues during fraud interviews and be alert for internal control changes due to a remote or reduced work force.
• about whether the entity has entered into any significant and unusual transactions and, if so, their nature, terms, and business purpose.

• Make inquiries of management and others within the entity about whether they have knowledge of any actual, suspected, or alleged fraud.
• Evaluate unusual or unexpected relationships identified during analytical procedures.
• Evaluate whether there are indications of fraud risk factors.
• Identify and assess the risk of material misstatement due to fraud.
• Respond to assessed risks of material misstatement due to fraud, in accordance with AU-C Section 330.
• Document the linkage between the assessed risk and response.
• Consider other audit procedures not required by AU-C Section 240, as appropriate, to respond to identified risks of management override.
• Communicate required information to management and to those charged with governance and, if determined to be required, to regulatory and enforcement authorities.
• Include documentation as required by AU-C Sections 240, 315, and 330, as well as that required by any other relevant AU-C sections.

Note that an auditor may consider the necessity of withdrawing from an engagement if, as a result of identified or suspected fraud, the auditor encounters circumstances that bring into question the auditor’s ability to continue performing the audit.

In an audit engagement, similar to a review engagement, the auditor will obtain representations from management regarding fraud. Specifically, management will represent that it has notified the auditor of any known significant facts relating to actual or suspected fraud and any allegations of known or suspected fraud that may have affected the entity’s financial statements.

The auditor’s report

Finally, the auditor’s report will include a section, with the heading “Responsibilities of Management for the Financial Statements,” that includes an explanation that management is responsible for the preparation and fair presentation of the financial statements and is responsible for the design, implementation, and maintenance of a system of internal control relevant to the preparation and fair presentation of the financial statements that are free from material misstatement, whether due to fraud or error.

In addition, a section, with the heading “Auditor’s Responsibilities for the Audit of the Financial Statements,” will include discussion of the limits of reasonable assurance and that this level of assurance is not a guarantee that an audit will always detect a material misstatement when it exists.

— Dave Arman, CPA, MBA, is the Senior Manager — Audit Quality at AICPA & CIMA, together as the Association of International Certified Professional Accountants. To comment on this article, contact Jeff Drew at jeff.drew@aicpa-cima.com.