Rita Crundwell
Jul 19

Rita Crundwell Story: Why Some Ranches Stink

By Charles Hall | Asset Misappropriation

Is it possible for one person to steal over $53 million from a city with an annual budget of less than $10 million? Yes. The Rita Crundwell story provides a cautionary tale for small businesses, governments, and nonprofits.

The Rita Crundwell Theft

Rita Crundwell, comptroller, and treasurer of Dixon, Illinois stole $53 million over a twenty-year period. The city of 16,000 residents held Crundwell in high esteem. One friend described her as “sweet as pie.” Another said: “You could not find a nicer person.”

So why did she steal? It appears Rita just enjoyed the good life. She used the money to fund one of the top quarter horse ranches in the country, and she did it with style: Some of the funds were used to purchase over $300,000 of jewelry and a $2.1 million motor coach vehicle.

Rita Crundwell
Her annual salary? $80,000.

The city’s annual budget? $6 to $8 million

Were yearly audits performed? Yes.

Were budgets approved? Yes.

But even with budgets and audits, the Dixon, Illinois scandal happened. 

Too Much Trust

So how did this happen? Rita Crundwell won the trust of those around her—especially that of mayor and council. In April 2011, finance commissioner and veteran council member, Roy Bridgeman, praised Crundwell calling her “a big asset to the city as she looks after every tax dollar as if it were her own.” Too much trust in a bookkeeper can lead to huge problems. 

It was a disturbing moment when Dixon Mayor James Burke presented the FBI with evidence of Crundwell’s fraud. Burke later recalled his emotions and words: “I literally became sick to my stomach, and I told him that I hoped my suspicions were all wrong.” Such a response is understandable given that Crundwell had worked for the city for decades. She had fooled everyone.

Secret Bank Account

According to the mayor, the city’s annual audits raised no red flags, and the city’s primary bank never reported anything suspicious. So how did she steal the money? In 1990, Crundwell opened a secret bank account in the name of the city (titled the RSDCA account: the initials stood for reserve sewer development construction account). Crundwell was the only authorized check signer for the account, and the RSDCA bank account was never set up on the city’s general ledger. The City’s records reflected none of the RSDCA deposits or disbursements.

Crundwell would write and sign manual checks from a legitimate city capital project fund checking account, completing the check payee line with “Treasurer.” (Yes, Crundwell had the authority to issue checks with just her signature—even for legitimate city bank accounts.) She would then deposit the check into her secret account. From the bank’s perspective, a transfer had been made from one city bank account to another (from the capital projects fund to the reserve sewer development construction fund).

Accounting Cover-up

While the capital project fund disbursement was recorded on the city’s books, the RSDCA deposit was not. A capital project fund journal entry was made for each check debiting capital outlay expense and crediting cash. But no entry was made to the city’s records for the deposit to the RSDCA account. Once the money was in the RSDCA account, Crundwell wrote checks for personal expenses—and she did so for over twenty years.

To complete her deceit, Crundwell provided auditors with fictitious invoices from the Illinois Department of Transportation; these invoices included the following notation: Please make checks payable to Treasurer, State of Illinois. (So the canceled checks made out to Treasurer agreed with directions on the invoice, but the words “State of Illinois” were conveniently left off the check payee line.) Remember Crundwell was the treasurer of Dixon. 

Those invoices and the related checks were often for round dollar amounts (e.g., $250,000) and most were for more than $100,000. In one year alone, Crundwell embezzled over $5 million.

Vacation Leads to Arrest

So how was she caught? While Rita was on an extended vacation for horse shows, the city hired a replacement for her. For some reason, Crundwell’s substitute requested all bank account statements from the city’s bank. As the bank statements were reviewed, the secret bank account was discovered. And soon after that, the mayor contacted the FBI.

The Control Weakness

Why was Rita Crundwell able to steal $53 million? Wait for it. A lack of segregation of duties.

Rita could:

  • Write checks
  • Approve payments
  • Create and monitor the budget
  • Enter transactions into the accounting system
  • Reconcile the bank statements

The Accounting Fix

Multiple people should perform accounting duties, not just one.

Moreover, accounting employees should annually take a one-week vacation (or longer). And while they are gone, someone else should perform the vacant person’s duties. The vacation itself is not the key to this control. The performance of the absent accountant’s duties is. Why? Doing so allows the replacement person to understand the work of the vacant employee. But, more importantly, the substitute can note any unusual or fraudulent activity.

Here’s another action to take: Periodically contact your organization’s bank and ask for a list of all bank accounts. Then compare the list to the bank accounts in your general ledger. If a bank account is not on the general ledger, see why. And request a copy of the related signature card from the bank.

What Happened to Rita Crundwell?

So, what happened to Rita? She was sentenced to 19.5 years in prison. Here are pictures from the Chicago Tribune that shed light on the fraud.

All the Queens Horses

Kelly Richmond Pope has masterfully captured the Rita Crundwell tale in the movie All the Queen’s Horses, available on Amazon. Think auditing is boring? Then watch the movie. It does a better job of explaining the psychological and financial damage of fraud than any textbook. 

GASB 87 Lease Accounting
Jul 15

GASB 87 Lease Accounting

By Charles Hall | Accounting , Local Governments

Are you looking for GASB 87 lease accounting information? Are you a government that leases assets? Then you're in the right place. Below I provide information about lease terms, discount rates, accounting entries, and disclosure requirements.

GASB 87 Lease Accounting

Removal of Bright-Line Criteria

Historically governments have followed the guidance in FASB 13, Accounting for Leases. Lease classifications (i.e., operating or capital) were based on bright-line criteria such as whether the government leased an asset for more than 75% of its economic life. 

GASB 87, Leases, removes the bright-line criteria and calls for more judgment. (The words reasonably certain appears thirty-nine times in GASB 87.)

The new lease standard provides for various accounting alternatives. Let's see what they are.

Three Potential Accounting Alternatives

Regarding leases, there are now three accounting alternatives:

  1. Short-term leases
  2. Contracts that transfer ownership
  3. Contracts that do not transfer ownership

Before we dive deeper, here are three quick points about these alternatives:

First, know that short-term leases do not create a lease liability.

Second, understand that contracts that transfer ownership are a financed sale.

Third, know that contracts that do not transfer ownership create a lease liability. This third category is a catchall for arrangements that don't qualify for short-term lease treatment and don't transfer ownership.

Now, let's see how GASB defines a lease.

Definition of a Lease

GASB defines a lease this way:

A lease is defined as a contract that conveys control of the right to use another entity’s nonfinancial asset (the underlying asset) as specified in the contract for a period of time in an exchange or exchange-like transaction.

There are five points to this definition:

First, the lease must be a contract. 

Second, the contract must provide control of the right to use.

Third, this control is in relation to a nonfinancial asset.

Fourth, the control of the nonfinancial asset must be for a period of time.

And finally, the lease is an exchange or exchange-like transaction.

I think the terms contract, period of time, and exchange are easily understood. But the terms control and nonfinancial assets might cause some confusion. So let's clarify those.

Control

A government controls an asset if it has the right to the present service capacity and the right to determine the nature and manner of use of the asset.

In other words, the government must have the right to the benefits generated from the asset. A city can drive a leased police car. That is the benefit, the present service capacity.

Additionally, Nature and manner address whether the government controls the use of the asset. A city police officer can, for example, drive a leased police car at 3:00 a.m. And she can drive it as far as she likes. The police department determines the nature and manner of use.

Nonfinancial Asset

And what is a nonfinancial asset? It's generally anything that is not a financial asset (e.g., cash, receivable). Examples of nonfinancial assets include buildings, land, vehicles, and equipment. There are exceptions, however. 

GASB 87 Scope Exclusions

GASB 87 does not apply to:

  • Leases of intangible assets (e.g., rights to explore for oil and gas)
  • Leased biological assets (e.g., timber)
  • Inventory that is leased
  • Service concession arrangements
  • Leases in which the underlying asset is financed with outstanding conduit debt (unless the underlying asset and the conduit debt are reported by the lessor)
  • Supply contracts (e.g., power purchase agreements)

Now let's see how to determine the lease term.

Lease Term

Prior to GASB 87, the minimum lease payments determined the lease term. Not so any more. In some cases, GASB 87 provides for a more subjective determination of a lease's term, one based on what is reasonably certain.

Lease Options

Under GASB 87, lease terms are not just the noncancelable portion of the agreement. Governments add the following to the noncancelable period:

  • Periods covered by a lessee’s option to extend the lease if it is reasonably certain, based on all relevant factors, that the lessee will exercise that option 
  • Periods covered by a lessee’s option to terminate the lease if it is reasonably certain, based on all relevant factors, that the lessee will not exercise that option 
  • Periods covered by a lessor’s option to extend the lease if it is reasonably certain, based on all relevant factors, that the lessor will exercise that option  
  • Periods covered by a lessor’s option to terminate the lease if it is reasonably certain, based on all relevant factors, that the lessor will not exercise that option.
Reasonably Certain Factors

In determining what reasonably certain is, the government considers factors such as the economic impact of not exercising an option or how the government has acted in the past.

Once the lease term decision is made, document your basis for doing so. Why? So there is a record of the decision. (Your auditors may want to see this. Additionally, the record provides valuable information regarding future lease term decisions.)

Fiscal Funding Clauses Affect on Term

Additionally, you may be wondering if fiscal funding clauses affect leases. (Fiscal funding clauses allow a government to cancel a lease if the government does not appropriate funds for the payments.) If a government is reasonably expected to exercise such a provision, then this factor can impact the lease term. Personally, however, I've never seen a government terminate a lease through such a provision. Fiscal funding clauses will usually not affect lease terms.

So, should governments ever reassess the term period?

Reassessment of Term

Government will generally not reassess the lease term decision. 

Nevertheless, reassessment will occur in some cases. Consider this example. The government enters into a fifteen-year lease with a five-year lease extension. The government believes that it will not exercise the five-year extension. But then in year fifteen, it does so. Now the government binds itself for another five years. Therefore, the lease is extended. And the additional five years is added to the lease term. 

Now that you know about lease terms, you may be wondering about short-term leases. How does a government account for those?

Short-Term Leases

Treat leases with a maximum possible term of twelve months or less as short-term leases. And do not capitalize such leases. 

One word of caution: if there are renewal options, include those in making the short-term lease classification decision, regardless of probability. If, for example, the lease is for twelve months with an option to renew for another six months, then the lease is not short-term. Even if the government believes it will not exercise the option.

So, how do you record short-term lease payments? As expenses.

Contract that Transfers Ownership

If an agreement transfers ownership of the asset to the lessee by the end of the contract, then the contract is a financed purchase. For the lessee, the government records the purchased asset (not an intangible) and the related debt (not a lease liability).

So, what about a lease agreement with a bargain purchase option? Should it be treated as financed purchase? The answer is no. The presence of a bargain purchase option in a lease contract is not the same as a provision that transfers ownership of the underlying asset.

Multiple Components of a Lease Contract

If an agreement has lease and non-lease components, split the transaction. 

A government might, for example, lease floors four and five of a ten-story building. In doing so, it is required to pay for common area maintenance. Split this transaction into a lease and a maintenance contract. Record the lease exclusive of the maintenance payments. If, however, it is not practicable to determine the separate price allocation, the government should account for the transaction as a single lease.

If a lease involves multiple underlying assets (say a police car and a water tank), the government should account for each as a separate lease component. 

Lessee Accounting

If the government is leasing an asset, then it will use the following guidance. (An exception exists if the lease is short-term as explained above.)

GASB 87 Lessee accounting

Initial Recognition

At commencement, the government recognizes an (1) intangible right-to-use asset and (2) a lease liability. 

So the government does not recognize the asset itself (e.g., tractor), but the right to use the asset. This is an intangible asset.

Now let's see how to compute the lease asset.

1. Lease Asset 

So. what goes in the lease asset calculation?

The government should include:

  • Initial lease liability (see below)
  • Payments made to lessor at or before commencement less any lease incentives received from the lessor at or before the commencement of the lease term
  • Initial direct costs that are ancillary charges necessary to place the lease asset into service

So what costs are not included in the intangible asset? Governments should exclude any debt issuance costs.

Notice that the lease asset can be greater than the lease liability. The lease asset starts with the lease liability and increases if, for example, the government makes a payment to the lessor prior to commencement of the lease term.

In governmental funds (e.g., general fund), the initial accounting entry is a debit to capital outlay and a credit to other financing sources. In full accrual funds (e.g., enterprise fund), the initial entry is a debit to the intangible lease asset and a credit to the lease liability.

So, how should the lease asset be amortized?

Lease Asset Amortization

Amortize the lease asset in a systematic and rational manner over the shorter of the lease term or the asset's useful life. Usually this will be straight-line amortization.

And what are the journal entries for recording the lease asset?

Lease Asset Accounting

The government records the lease asset and then amortizes it using an entry such as the following (for full-accrual funds; e.g., water and sewer fund):

Account
Amortization Expense
Accumulated Amortization - Right-of-Use Asset
Debit
XX


Credit


XX

GASB 87 says to report the amortization as an outflow of resources (e.g., amortization expense). The amortization expense can, for financial reporting purposes, be combined with the depreciation expense of other capital assets. 

Modified accrual funds (e.g., general fund) will not record an amortization entry. Why? The asset does not appear on the balance sheet.

2. Lease Liability 

How does a government compute the lease liability?

Simply put, the lease liability is the present value of everything you think you're going to pay. Prior to GASB 87, governments used the present value of minimum lease payments. Now governments include payments that are reasonably certain. (See information above regarding what is reasonably certain.)

The computation is made up of the present value of:

  • Fixed payments
  • Variable payments that depend on an index or a rate (e.g., consumer price index) measured using the index or rate as of the commencement of the lease
  • Variable payments that are fixed in substance
  • Amounts that are reasonably certain of being required to be paid by the lessee under residual value guarantees
  • The exercise price of a purchase option if it is reasonably certain that the lessee will exercise that option
  • Payments for penalties for terminating the lease
  • Any lease incentives receivable from the lessor
  • Any other payments that are reasonably certain of being required based on an assessment of all relevant factors
Variable Payments Based on Future Performance

Governments will not include payments based on future performance or usage in the lease liability. Expense such payments in the period incurred. 

For example, if a government leases a vehicle with a provision for 12,000 miles annually but the car is driven 15,000 miles, expense the payment for the additional mileage as incurred.

So, where does the discount rate come from?

Discount Rate

Use the rate charged by the lessor if specified in the agreement. If not specified, use the incremental borrowing rate for the government. This is the estimated rate the government would pay if, during the life of the lease, it borrowed the funds for those lease payments.

Lease Liability Accounting

Once the initial lease is recorded as a liability, the government will begin making periodic payments to the lessor. The effective interest rate method will be used. Record the payments as follows (for full-accrual funds; e.g., water and sewer fund):

Account
Lease liability
Interest Expense

Cash

Debit
XX

XX

Credit


XX

Post the payments to principal and interest expenditures in modified accrual accounting funds (e.g., general fund).

GASB 87 Disclosures

The following disclosures are required for lessees:

  • A general description of its leasing arrangements 
  • The total amount of lease assets, and the related accumulated amortization, disclosed separately from other capital assets
  • The amount of lease assets by major classes of underlying assets, disclosed separately from other capital assets
  • The amount of outflows of resources recognized in the reporting period for variable payments not previously included in the measurement of the lease liability
  • The amount of outflows of resources recognized in the reporting period for other payments (e.g., termination penalties) not previously included in the measurement of the lease liability
  • Principal and interest requirements to maturity, presented separately, for the lease liability for each of the five subsequent fiscal years and in five-year increments thereafter
  • Commitments under leases before the commencement of the lease term
  • The components of any loss associated with an impairment 

Transition

Apply GASB 87 retroactively, if practicable, for all periods presented. Use the facts and circumstances existing at the beginning of the implementation period to record the leases.

The notes to the financial statements should disclose the nature of the restatement and its effect. 

GASB 87 says that the provisions of this statement need not be applied to immaterial items.

GASB 87 Effective Date

The effective date of GASB 87 is for reporting periods beginning after December 15, 2019. On May 8, 2020, the Governmental Accounting Standards Board (GASB) issued Statement No. 95Postponement of the Effective Dates of Certain Authoritative Guidance. This standard postponed GASB 87 by eighteen months.

So GASB 87 is effective for fiscal year-ends of June 30, 2022 (years starting after June 15, 2021) and calendar year-ends of December 31, 2022 (again, years starting after June 15, 2021). 

earnings manipulation
May 30

Earnings Manipulation with Accounting Tricks

By Charles Hall | Financial Statement Fraud

Earnings manipulation is easy with the right–or should I say wrong–accounting tricks such as cookie jar reserves. In this article, we explore how businesses inflate profits and sometimes decrease the same, depending on what the company desires. Financial statement fraud is common, so let’s see how these schemes work. 

One Wall Street Journal article said a California company used “a dozen or more accounting tricks” including “one particularly bold one: booking bogus sales to fake companies for products that didn’t exist.” These machinations inflated earnings, making the company look more profitable than it really was. 

Today I show you how fraudsters use financial statement fraud to magically transform a company’s appearance. Then you will better know how to prevent these earnings manipulations.

earnings manipulation

What does it mean to inflate earnings? Inflating earnings means a company uses fraudulent schemes to make their earnings look better than they really are. 

Financial Statement Fraud

Companies can magically create earnings by:

  • Accruing fictitious income at year-end with journal entries
  • Recognizing sales for products that have not been shipped
  • Inflating sales to related parties
  • Recognizing revenue in the present year that occurs in the next year (leaving the books open too long)
  • Recognizing shipments to a re-seller that is not financially viable (knowing the products will be returned)
  • Accruing projected sales that have not occurred
  • Intentionally understating receivable allowances

Think about it: A company can significantly increase its net income with just one journal entry at the end of the year. How easy is that?

You may be thinking, “But no one has stolen anything.” Yes, true, but the purpose of manipulating earnings is to increase the company’s stock price. Once the price goes up, the company executives sell their stock and make their profits. Then the company can, in the subsequent period, reverse the prior period’s inflated entries.

Earnings Manipulation Control Weakness

Such chicanery usually flows from unethical owners, board members, or management. The “tone at the top” is not favorable. These types of accounting tricks usually don’t happen in a vacuum. Normally the top brass demands “higher profits,” often not dictating the particulars. (These demands are typically made in closed-door meetings with no recorders or written notes.) Then years later, once the fraud is detected, those same leaders will plead ignorance saying their lieutenants worked alone.

This why the control environment, an entity-level control, is so important. Codes of conduct and conflict of interest statements do matter. Moreover, communicating appropriate ethical requirements is critical to an organization’s integrity. 

Lower the Risk of Earnings Manipulation

The fix is transparency. This sounds simple, but transparency will usually remove the temptation to inflate earnings. If you work for a company (or a boss) that is determined to “win at any cost,” and repeatedly hides things (“don’t tell anyone about what we’re doing”), it is time to look for another job. When people hide what they are doing, they know it’s wrong–otherwise, why they wouldn’t hide it?

A robust internal audit department can enhance transparency. The board should hire the internal auditors. Then these auditors should report directly to the board (not management). The company’s internal auditors should know that the board has their back. If not, then you’ll continue to have opaque reporting processes. Why? The internal auditors’ fear of reprisal from management (or the board itself).

And what if the leaders of an organization won’t allow transparency? If possible, remove them. Unethical leadership will destroy a business.

Deflating Earnings (Cookie Jar Reserves)

Though much less likely, some businesses intentionally decrease their earnings with fraudulent accounting. Why would they do so? Maybe the business has an exceptionally good year, and it would like to save some of those earnings for future periods. For instance, management bonuses might be tied to profit levels. If those thresholds have already been met, it’s possible that the company will defer some current year earnings in order to ensure bonuses in the following year.

Deferring earnings is often called a cookie jar reserve. For example, if a company’s allowance for uncollectibles accounts is acceptable within a range (say 1% to 2% of receivables), it might use the higher percent in the current year. The higher reserve decreases current year earnings (the allowance is credited and bad debt expense is debited, increasing expenses and decreasing net income). Then in the following year, the company might use 1% to increase earnings (even though 1.75% might be more appropriate). This is called smoothing. 

Honest companies record their numbers based on what is correct, not upon desired results. But not all companies are honest. 

See my full article regarding how to audit receivables and revenues.

test of controls
May 29

Test of Controls: When to Perform and How

By Charles Hall | Auditing

Most auditors don’t perform a test of controls? But should they? Below I explain when such a test is required. I also explain why some auditors choose to use this test even when not required. 

test of controls

Once risk assessment is complete, auditors have three further audit procedures they can use to respond to identified risks:

  1. Test of details 
  2. Substantive analytics
  3. Test of controls

This article focuses on the third option.

Below you will see:

  • The Right Response
  • Not Testing Controls (including video about the same)
  • The Decision Regarding Testing 
  • How to Test Controls
  • Required Tests
  • Which Controls to Test
  • Three-year Rotation of Testing
  • Interim or Period-End Testing

The Right Response 

Which responses to risks of material misstatement are best? That depends on what you discover in risk assessment.

If, for example, your client consistently fails to record payables, then assess control risk for completeness at high and perform a search for unrecorded liabilities (a substantive procedure).

By contrast, if the internal controls for receivables are strong, then assess control risk for the existence assertion at less than high, and test controls for effectiveness. (You do, however, have the option to perform substantive tests rather than test controls, even when controls are appropriate. More about this in a moment.)

Not Testing Controls

Many auditors assess control risk at high (after risk assessment is complete) and use a fully substantive approach. That is fine, especially in audits of smaller entities. Why? Because smaller entities tend to have weaker controls. As a result, controls may not be effective. Therefore, you may not be able to assess control risk at less than high. 

Control risk assessments of less than high must be supported with a test of controls to prove their effectiveness. But if controls are not effective, you must assess control risk at high. This is one reason why you might bypass testing controls: you know, either from prior experience or from current-year walkthroughs, that controls are not effective. If your test reveals ineffectiveness, you are back to square one: a control risk assessment of high. Then substantive procedures are your only option. In such a situation, the initial test was a waste of time. 

The Decision Regarding Testing 

But if controls are effective, why not test them? Doing so allows you to reduce your substantive procedures. There is one reason, however, why you might not test controls even though they appear appropriate: substantive tests may take less time.

Once risk assessment is complete, your responses—the further audit procedures—are based on efficiency and effectiveness. If control testing takes less time, then use this option. If substantive procedures takes less time, then perform a test of details or use substantive analytics. But, regardless of efficiency considerations, address all risks with appropriate responses.

How to Test Controls 

Suppose you’ve decided to test controls for effectiveness. But how? Let’s look at an example starting with risk assessment.

control test

Risk Assessment

Your approach to testing controls depends on risk. 

For example, suppose your billing and collections walkthrough reveals appropriate segregation of duties. You see that authorized personnel issue receipts for each payment received. Additionally, you determine that total daily cash inflows are reconciled by the collections supervisor to the online bank statement, and she signs off on a reconciliation sheet as evidence of this procedure. Lastly, you note that a person not involved in cash collections reconciles the monthly bank statement. In other words, controls are properly designed and in use. 

Furthermore, you believe completeness is a relevant assertion. Why? Theft of incoming cash is a concern since the business handles a high volume of customer checks. If checks are stolen, cash collections would not be complete. Consequently, the inherent risk for completeness is high. The fraud risk is a significant risk which requires a test of details in addition to the test of controls.

Test Supports Effectiveness

Now it’s time to test for effectiveness. 

Test the receipt controls on a sample basis. But before doing so, document the controls you desire to test and the sample size determinations. (See AICPA’s Audit Sampling standard, AU-C 530.)

The first control you are testing is the issuance of receipts by an authorized person and your sample size might be sixty. 

The second control you are testing is the daily reconciliation of cash to the bank statement. For example, you could agree total daily receipts to the bank statement for twenty-five days. As you do so, you review the daily sign-offs on the reconciliation sheets. Why? The collection supervisor’s sign-off is the evidence that the control was performed. 

The third control you are reviewing is the reconciliation of the bank account by a person not involved in the receipting process. So, you review the year-end bank reconciliation and confirm that the person that reconciled the bank statement was not involved in cash collections. 

Once the tests are performed, determine whether the controls are effective. If they are, assess control risk for the completeness assertion at less than high. Now you have support for that lower assessment. 

And what about substantive tests?

You need to perform a test of details since a significant risk (the fraud risk) is present. You might, for example, reconcile the daily total receipts to the general ledger for a month.

Test Doesn’t Support Effectiveness

If your tests do not support effectiveness, expand your sample size and examine additional receipts. Or skip the tests (if you believe the controls are not effective) and move to a fully substantive approach. Regardless, if controls are not effective, consider the need to communicate the control deficiency to management and those charged with governance. 

So, when should you test controls? First let’s look at required tests and then optional ones. 

Required Audit Tests of Controls

Here are two situations where you must test controls:

  • When there is a significant risk and you are placing reliance on controls related to that risk
  • When substantive procedures don’t properly address a risk of material misstatement

Let me explain.

Auditing standards allow a three-year rotation for control testing, as long as the area tested is not a significant risk. But if the auditor plans to rely on a test of controls related to a significant risk, operating effectiveness must be tested annually. 

Also a test of controls is necessary if substantive procedures don’t properly address a risk of material misstatement. For example, consider the controls related to reallocation of investments in a 401(k). The participant goes online and moves funds from one account to another. Other than the participant, there are no humans involved in the process. When processes are fully automated, substantive procedures may not provide sufficient audit evidence. If that is your situation, you must test of controls. Thankfully, a type 2 service organization control report is usually available in audits of 401(k)s. Such a report provides evidence that controls have already been tested by the service organization’s auditor. And you can place reliance upon those tests. In most cases, substantive procedures can properly address risks of material misstatement. So this test requirement is usually not relevant. 

Optional Audit Test of Controls

We just covered the two situations when testing is required. All other control testing is optional.

internal controls

Prior to making the decision about testing, consider the following:

  • Do you anticipate effectiveness? There’s no need to test an ineffective control. 
  • Does the control relate to an assertion for which you desire a lower control risk? 
  • Will it take less time to test the control than to perform a substantive procedure? Sometimes you may not know the answer to this question until you perform the test of controls. If the initial test does not prove effectiveness, then you have to expand your sample or just punt—in other words, use a fully substantive approach. 
  • Will you use the control testing in conjunction with a test of details or substantive analytics? How would effective controls reduce these substantive tests? In other words, how much substantive testing time would you save if the control is effective?
  • Is the control evidence physical or electronic? For example, are the entity’s receipts in a physical receipt book or in a computer? It’s usually easier to test electronic evidence.
  • How large will your sample size be? Some controls occur once a month. Others, thousands of times in the period. The larger the population, the larger the sample. And, of course, the larger the sample size, the more time it will take to perform the test. 
  • Can you test the population as a whole without sampling? Data analytics software—in some instances—can be used to test the entire population. For example, if a purchase order is required for all payments above $5,000, it might be easy to compare all payments above the threshold to purchase orders, assuming the purchase orders are electronic. 

Three-Year Rotation of Testing

As I said earlier, audit standards allow a three-year rotation for testing. For example, if you test accounts payable controls in 2020, then you can wait until 2023 to test them again. In 2021 and 2022, you need to ensure that these controls have not changed. You also want to determine that those controls have continuing relevance in the current audit. How? See if the controls continue to address a risk of material misstatement. And as you perform your annual walkthroughs, inquire about changes, observe the controls, and inspect documents. Why? You want to know that everything is working as it was in 2020, when the initial test was performed. And, yes, you do need to perform those walkthroughs annually, if that is how you corroborate your understanding of controls.

In short, testing for effectiveness can, in most cases, occur every three years. But walkthroughs are necessary each year. If you tested sixty transactions for an appropriate purchase order in 2020, then you can wait until 2023 to do so again. But review of the purchase order process each year in your annual walkthroughs. 

So should you test controls at interim or after year-end?

Interim or Period-End Testing

Some auditors test controls after the period-end (after year-end in most cases). Others at interim. Which is best?

It depends.

interim audit test

Perform interim tests if this fits better in your work schedule. Here’s an example: You perform an interim test on November 1, 2021. Later, say in February 2022, consider whether controls have changed during the last two months of the year. See if the same people are performing those controls. And consider performing additional tests for the November 1 to December 31 period. Once done, determine if the controls are effective. 

Testing on an interim date is not always the answer. For example, if management is inclined to manipulate earnings near year-end, then interim tests may not be appropriate

If you choose to test after period-end, then do so for the full period being audited. Your sample should be representative of that timeframe.

So should you ever test controls at a point in time and not over a period of time? Yes, sometimes. For example, test inventory count controls at year-end only. Why? Well those controls are only relevant to the year-end count, a point in time. Most controls, however, are in use throughout the period you are auditing. Therefore, you need to test those controls over that period of time (e.g., year).

Conclusion

As I said above, many auditors tend to rely fully on substantive responses to the risks of material misstatement. But, in some cases, that may not be the best or wisest approach. If controls are designed well and functioning, why not test them? Especially if it takes less time than substantive procedures.

Finally, take a look at my two related articles regarding responses to the risk of material misstatement: (1) Test of Details: Substantive Procedures and (2) Substantive Analytical Procedures: Power Up.

Substantive Analytical Procedures
May 06

Substantive Analytical Procedures: Power Up

By Charles Hall | Auditing

Are you using substantive analytical procedures in your audits? Many auditors rely solely on tests of details when a better option is available. Substantive analytics, in some cases, provide better evidential matter. And they are often more efficient than tests of details.

In this article, I provide:

  • Substantive Analytics – A Video Overview
  • Analytics in Three Stages
  • Substantive Analytics
  • Responses to Risk of Material Misstatement
  • Substantive Analytical Assurance Level
  • Examples of Substantive Analytics
  • Documenting Substantive Analytical Procedures
  • Other Substantive Analytical Considerations

Professional standards define analytical procedures as evaluations of financial and non-financial data with plausible relationships. An example of such a relationship is salaries may be expected to be a certain percent of total expenses. In other words, numbers behave in particular ways. Because they do, we can use these relationships as evidential matter for our audit opinions.

Substantive Analytics – A Video Overview

This video provides an overview of substantive analytical procedures. 

Before we look at what substantive analytics are and how we use them, let’s see how analytical procedures are used in audits.

Analytics in Three Stages

Auditors use analytics in three stages:

  1. Preliminary (risk assessment)
  2. Final (wrap up)
  3. Substantive (response to risk of misstatement)

Preliminary analytics are performed as a risk assessment procedure. We use them to locate potential material misstatements. And if we identify unexpected activity, we plan a response. For example, if we expect payroll to go up 5% but it goes down 8%, then we plan further audit procedures to see why: these can include tests of details, substantive analytics, and test of controls. 

At the completion of the audit, we use final analytics to determine if we have addressed all risks of material misstatement. Here we compare our numbers and ask, “Have we dealt with all risks of material misstatement?” If yes, fine. If not, then we may need to perform additional further audit procedures. 

Less precision is necessary for preliminary and final analytics as compared to substantive analytics. Preliminary analytics locate misstatements and final analytics confirm the results of the audit. But substantive analytics are used to prove material misstatements are not present. 

Substantive Analytics

Substantive analytical procedures can, in certain cases, be more effective and efficient than a test of details. 

For example, if the ratio of salaries to total expenses has been in the 46% to 48% range for the last few years, then you can use this ratio as a substantive analytic to prove the payroll occurrence assertion. If your expectation is that payroll would be in this range and your computation yields 48%, then your substantive analytic provides evidence that salaries occurred. And this is much easier than a test of details such as a test of forty payroll transactions (where you might agree hours paid to time records and payroll rates to authorized amounts). 

Disaggregation of Data

For a small entity with six employees, one payroll substantive analytic might be sufficient, but you may need to disaggregate the payroll information for a larger company with six hundred people. For instance, you might divide departmental salaries by total salaries and compare those ratios to the prior year. Disaggregation adds more precision to the analytic, resulting in better evidential matter. 

Another example of disaggregation is in relation to revenues. If the company has four major sources of revenue, disaggregate the substantive analytical revenue sources. You might use a trend analysis by revenue source for the last three years. Or you might recompute an estimate of one or more revenue sources based of units sold or property rented. 

The type of substantive analytic is dependent on the nature of the transaction or account balance. If a company rents fifty apartments at the same monthly rate, computing an estimate of revenue is easy. But if a company sells fifty different products at different prices, you may need to disaggregate the substantive analytical data. 

Additionally, consider disaggregating substantive analytics by region if the company has different geographic locations. 

Not for Significant Risk Areas (at least not alone)

Are there audit areas where substantive analytical procedures should not be used alone? Yes. When responding to a significant risk. A test of details must be used when a significant risk is present. For example, a bank’s allowance for loan losses. This allowance is a highly complex estimate; therefore, a test of details is required. You could not solely compare the allowance to prior years,  for example, though such a comparison could complement a test of details. In other words, you could perform a test of details and use a substantive analytic. But a substantive analytic alone would not do. 

Now let’s consider how auditors use substantive analytics to respond to the risk of material misstatement.

Responses to Risks of Material Misstatement

Once you identify a risk of material misstatement, you plan further audit procedures including (1) test of details, (2) substantive analytical procedures, and (3) test of controls. Many auditors use a test of details without performing substantive analytics. Why? For many, it’s habit. We’ve always tested bank reconciliations, for example, so we continue to do so. But maybe we’ve never used substantive analytics to prove revenues or expenses. 

A test of details is often used in relation to balance sheet accounts such as cash, receivables, and debt. 

Substantive Analytical Procedures as a Response

Substantive analytics, on the other hand, are sometimes more fitting for income statement accounts such as revenue or expenses. Why? Because income statement accounts tend to be more consistent from year to year. Here are some examples:

  • Depreciation expense
  • Payroll expense
  • Lease revenue
  • Property tax revenue (in a government)

So consider using substantive analytics when the volume of transactions is high and the account balance is predictable over time. Additionally, use substantive analytics in lower risk areas, including some balance sheet accounts such as: 

  • Plant, property, and equipment (if no significant additions or retirements)
  • Debt (if no new debt or early payoffs)
  • Prepaid assets (e.g., prepaid insurance)

Audit standards tell us that substantive analytics are more appropriate when the risk of misstatement is lower. The higher the risk of misstatement, the more you should use a test of details. For instance, it’s better to use tests of details for significant receivable accounts. But substantive analytics may work well for prepaid insurance. 

Additionally, substantive analytics can be combined with a test of details or a test of controls. If, for example, you’re planning a risk response for accounts payable and expenses, you might use a combined approach: a test of details for accounts payable (e.g., search for unrecorded liabilities) and substantive analytics for expense (e.g., departmental expenses divided by total expenses compared to the prior year).

Another common combined approach is a test of details sample along with substantive analytics. If the substantive analytics are effective, you can reduce the sample size, making the overall approach more efficient. 

Substantive Analytical Assurance Level

Certain substantive analytics provide higher levels of assurance. For example, computing expected rental income provides high assurrance. If your client rents fifty identical apartments at $2,000 a month, the computation is easy and the assurance is high. 

How to Increase Assurance When Using Substantive Analytics

Other types of analytics provide lower assurance: topside ratios or period-to-period comparisons at the financial statement level, as examples. You can, however, increase the substantive analytical assurance level by taking actions such as:

  • Using more comparative periods (e.g., years or months)
  • Comparing ratios to independently published industry statistics 
  • Disaggregating the data (e.g., revenues by product line and units sold)
  • Documenting expectations prior to creating the analytics (to remove bias)
  • Documenting client responses regarding differences along with the follow up procedures and results

Comparing balances with a prior period and providing no explanations is not sufficient as a substantive analytic. Also, if the activity is unexpected, solely documenting client responses to questions is not sufficient. For example, these client answers will not do:

  • Client expected revenues to go up
  • Numbers declined because sales activity went down
  • Client said it’s reasonable

Vague responses are not evidential matter and can result in audit failure, or—worse yet—litigation against your firm. 

Substantive analytics can be used in a wide variety of ways. 

substantive analytical procedures

Examples of Substantive Analytics

Here are examples of substantive analytics:

  • Comparison of monthly sales for the current year with that of the preceding year (to test occurrence)
  • Comparison of profit margins for the last few months of the audit period with those subsequent to period-end (to test cutoff)
  • Percent of expenses to sales compared with the prior year (to test occurrence)
  • Current ratio compared to prior year (to test for solvency and going concern)
  • Comparing current year profit margins with prior periods (to test accuracy and occurrence)
  • For pension or postemployment benefit plans: actuarial value of plan assets divided by actuarial accrued liability compared to prior year (to test completeness and accuracy)
  • For debt: total debt divided by total assets compared to prior year (to test the financial strength of the entity and going concern)
  • For inventory: cost of goods sold divided by average inventory compared to prior year (to test existence and occurrence)

Now let’s see how to document your substantive analytics.

Documenting Substantive Analytical Procedures

In performing substantive analytical procedures, document the following:

1. The reliability of the data 

Document why you believe the data is trustworthy. Reasons could include your prior experience with the client’s accounting system and internal controls related to the information you are using. Though a walkthrough sheds light on those controls, a test of controls for effectiveness provides even greater support for the reliability of the data. Testing controls is optional, however. 

2. Assessed risk of material misstatement by assertion 

Document the assertions being addressed and the related risks of material misstatement. 

3. Expectation 

Document a sufficiently precise expected result of the computation or comparison. You can use a range. Document the expectation prior to examining the recorded numbers. Why? To reduce bias. If the current year expectation is different from the prior year, explain why. For example, if payroll has been stable over the last three years but is expected to increase eight percent in the current year, document why. A less precise expectation may be acceptable if a test of details is performed along with the substantive analytic. 

4. Approach 

Document if the substantive analytic is to be used alone or in conjunction with a test of details. 

5. Acceptable difference 

The acceptable difference is the amount that requires no further investigation. So, for example, if the analytic is $30,000 different from the recorded amount and the acceptable difference is $50,000, you are done. No additional work is necessary. Unacceptable differences require further investigation such as inquiries of management and other audit procedures. Consider the performance materiality for the transaction or account balance as you develop the acceptable difference amount. Also, consider the assessed risk of material misstatement. Higher risk requires a lower acceptable difference. 

6. Conclusion 

Document whether the computation or comparison falls within your expectation. Perform and document other procedures performed if the result is not within your acceptable difference. Your conclusion should include a statement regarding whether you believe the account or transaction balance is materially correct. After all, that’s the purpose of the substantive analytic. 

Here are some concluding thoughts about substantive analytics. 

Other Substantive Analytical Considerations

Substantive analytics are not required. So, think of them as an efficient alternative to test of details.

If the company has weak internal controls or a history of significant misstatements, rely more on tests of details. Substantive analytics work better in stable environments. Additionally, if you, as the auditor, expect to make several material audit adjustments, record those prior to creating substantive analytics. This will help reduce the distortion from those misstatements. 

Testing of controls for effectiveness lends strength to substantive analytics. If the controls are effective, you’ll have more confidence in the substantive analytics. For example, if you test the disbursement approval controls and find them to be effective, the expense analytics will be more trustworthy. If you are testing controls for effectiveness, you may want to do so before creating any related substantive analytics. 

You may also want to see AU-C 520, Analytical Procedures in the audit standards. 

1 2 3 38
>