All Posts by Charles Hall

Follow

About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles is the quality control partner for McNair, McLemore, Middlebrooks & Co. where he provides daily audit and accounting assistance to over 65 CPAs. In addition, he consults with other CPA firms, assisting them with auditing and accounting issues.

audit risk assessment
Aug 14

Audit Risk Assessment: The Why and the How

By Charles Hall | Auditing

Today we look at one of most misunderstood parts of auditing: audit risk assessment.

Are auditors leaving money on the table by avoiding risk assessment? Can inadequate risk assessment lead to peer review findings? This article shows you how to make more money and create higher quality audit documentation. Below you’ll see how to use risk assessment procedures to identify risks of material misstatement. You’ll also learn about the risk of material misstatement formula and how you can use it to plan your engagements. 

risk assessment

Audit Risk Assessment as a Friend

Audit risk assessment can be our best friend, particularly if we desire efficiency, effectiveness, and profit—and who doesn’t?

This step, when properly performed, tells us what to do—and what can be omitted. In other words, risk assessment creates efficiency.

So, why do some auditors (intentionally) avoid audit risk assessment? Here are two reasons:

  1. We don’t understand it
  2. We're creatures of habit

Too often auditors continue doing the same as last year (commonly referred to as SALY)--no matter what. It’s more comfortable than using risk assessment.

But what if SALY is faulty or inefficient?  

Maybe it’s better to assess risk annually and to plan our work accordingly (based on current conditions).

Are We Working Backwards?

The old maxim “Plan your work, work your plan” is true in audits. Audits—according to standards—should flow as follows:

  1. Determine the risks of material misstatements (plan our work)
  2. Develop a plan to address those risks (plan our work)
  3. Perform substantive procedures (work our plan) and tests controls for effectiveness (if planned)
  4. Issue an opinion (the result of planning and working)

Auditors sometimes go directly to step 3. and use the prior year audit programs to satisfy step 2. Later, before the opinion is issued, the documentation for step 1. is created “because we have to.”

In other words, we work backwards.

So, is there a better way?

A Better Way to Audit

During the initial planning phase of an audit, an auditor should do the following:

  1. Understand the entity and its environment
  2. Understand entity-level controls
  3. Understand the transaction level controls
  4. Use preliminary analytical procedures to identify risk
  5. Perform fraud risk analysis
  6. Assess risk

While we may not complete these steps in this order, we do need to perform our risk assessment first (1.-4.) and then assess risk.

Okay, so what procedures should we use?

Audit Risk Assessment Procedures

AU-C 315.06 states:

The risk assessment procedures should include the following:

  • Inquiries of management, appropriate individuals within the internal audit function (if such function exists), others within the entity who, in the auditor's professional judgment, may have information that is likely to assist in identifying risks of material misstatement due to fraud or error
  • Analytical procedures
  • Observation and inspection

I like to think of risk assessment procedures as detective tools used to sift through information and identify risk.

Risk assessment

Just as a good detective uses fingerprints, lab results, and photographs to paint a picture, we are doing the same.

First, we need to understand the entity and its environment.

Understand the Entity and Its Environment

The audit standards require that we understand the entity and its environment.

I like to start by asking management this question: "If you had a magic wand that you could wave over the business and fix one problem, what would it be?"

The answer tells me a great deal about the entity's risk.

I want to know what the owners and management think and feel. Every business leader worries about something. And understanding fear illuminates risk.

Think of risks as threats to objectives. Your client's fears tell you what the objectives are--and the threats. 

To understand the entity and its related threats, ask questions such as:

  • How is the industry faring?
  • Are there any new competitive pressures or opportunities?
  • Have key vendor relationships changed?
  • Can the company obtain necessary knowledge or products?
  • Are there pricing pressures?
  • How strong is the company’s cash flow?
  • Has the company met its debt obligations?
  • Is the company increasing in market share?
  • Who are your key personnel and why are they important?
  • What is the company’s strategy?
  • Does the company have any related party transactions?

As with all risks, we respond based on severity. The higher the risk, the greater the response.

Audit standards require that we respond to risks at these levels:

  • Financial statement level
  • Transaction level

Responses to risk at the financial statement level are general, such as appointing more experienced staff for complex engagements.

Responses to risk at the transaction level are more specific such as a search for unrecorded liabilities.

But before we determine responses, we must first understand the entity's controls.

Understand Transaction Level Controls

We must do more than just understand transaction flows (e.g., receipts are deposited in a particular bank account). We need to understand the related controls (e.g., Who enters the receipt in the general ledger? Who reviews receipting activity?). 

So, as we perform walkthroughs or other risk assessment procedures, we gain an understanding of the transaction cycle, but—more importantly—we gain an understanding of controls. Without appropriate controls, the risk of material misstatement increases.

 AU-C 315.14 requires that auditors evaluate the design of their client's controls and to determine whether they have been implemented. However, AICPA Peer Review Program statistics indicate that many auditors do not meet this requirement. In fact, noncompliance in this area is nearly twice as high as any other requirement of AU-C 315 - Understanding the Entity and Its Environment and Assessing the Risk of Material Misstatement.


Some auditors excuse themselves from this audit requirement saying, "the entity has no controls."  


All entities have some level of controls. For example, signatures on checks are restricted to certain person. Additionally, someone usually reviews the financial statements. And we could go on.


The AICPA has developed a practice aid that you'll find handy in identifying internal controls in small entities.

The use of walkthroughs is probably the best way to understand internal controls.

Sample Walkthrough Questions 

As you perform your walkthroughs, ask questions such as:

  • Who signs checks?
  • Who has access to checks (or electronic payment ability)?
  • Who approves payments?
  • Who initiates purchases?
  • Who can open and close bank accounts?
  • Who posts payments?
  • What software is used? Does it provide an adequate audit trail? Is the data protected? Are passwords used?
  • Who receives and opens bank statements? Does anyone have online access? Are cleared checks reviewed for appropriateness?
  • Who reconciles the bank statement? How quickly? Does a second person review the bank reconciliation?
  • Who creates expense reports and who reviews them?
  • Who bills clients? In what form (paper or electronic)?
  • Who opens the mail?
  • Who receipts monies?
  • Are there electronic payments?
  • Who receives cash onsite and where?
  • Who has credit cards? What are the spending limits?
  • Who makes deposits (and how)?
  • Who keys the receipts into the software?
  • What revenue reports are created and reviewed? Who reviews them?
  • Who creates the monthly financial statements? Who receives them?
  • Are there any outside parties that receive financial statements? Who are they?

Understanding the company’s controls illuminates risk. The company’s goal is to create financial statements without material misstatement. And a lack of controls threatens this objective.

So, as we perform walkthroughs, we ask the payables clerk (for example) certain questions. And—as we do—we are also making observations about the segregation of duties. Also, we are inspecting certain documents such as purchase orders.

This combination of inquiries, observations, and inspections allows us to understand where the risk of material misstatement is highest.

In a AICPA study regarding risk assessment deficiencies, 40% of the identified violations related to a failure to gain an understanding of internal controls.

40%
failure to gain understanding of internal controls

Need help with risk assessment walkthroughs?

See my article Audit Walkthroughs: The What, Why, How, and When.

Get my new book:

Audit Risk Assessment Made Easy

Click here to see it on Amazon. 

Another significant risk identification tool is the use of planning analytics.

Preliminary Analytical Procedures

Use planning analytics to shine the light on risks. How? I like to use:

  • Multiple-year comparisons of key numbers (at least three years, if possible)
  • Key ratios

In creating preliminary analytics, use management’s metrics. If certain numbers are important to the company, they should be to us (the auditors) as well—there’s a reason the board or the owners are reviewing particular numbers so closely. (When you read the minutes, ask for a sample monthly financial report; then you’ll know what is most important to management and those charged with governance.)

You may wonder if you can create planning analytics for first-year businesses. Yes, you can. Compare monthly or quarterly numbers. Or you might compute and compare ratios (e.g., gross profit margin) with industry benchmarks. (For more information about, see my preliminary analytics post.)

Sometimes, unexplained variations in the numbers are fraud signals.

Identify Fraud Risks

In every audit, inquire about the existence of theft. In performing walkthroughs, look for control weaknesses that might allow fraud to occur. Ask if any theft has occurred. If yes, how?

Also, we should plan procedures related to:

  • Management override of controls, and
  • The intentional overstatement of revenues

My next post—in The Why and How of Auditing series—addresses fraud, so this is all I will say about theft, for now. Sometimes the greater risk is not fraud but errors.

Same Old Errors

Have you ever noticed that some clients make the same mistakes—every year? (Johnny--the controller--has worked there for the last twenty years, and he makes the same mistakes every year. Sound familiar?) In the risk assessment process, we are looking for the risk of material misstatement whether by intention (fraud) or by error (accident).

One way to identify potential misstatements due to error is to maintain a summary of the larger audit entries you’ve made over the last three years. If your client tends to make the same mistakes, you’ll know where to look.

Now it’s time to pull the above together.

Creating the Risk Picture

Once all of the risk assessment procedures are completed, we synthesize the disparate pieces of information into a composite image. 

Synthesis of risks

What are we bringing together? Here are examples:

  • Control weaknesses
  • Unexpected variances in significant numbers
  • Entity risk characteristics (e.g., level of competition)
  • Large related-party transactions
  • Occurrences of theft

Armed with this risk picture, we can now create our audit strategy and audit plan (also called an audit program). Focus these plans on the higher risk areas.

How can we determine where risk is highest? Use the risk of material misstatement (RMM) formula.

Assess the Risk of Material Misstatement

Understanding the risk of material misstatement formula is key to identifying high-risk areas.

What is the risk of material misstatement formula?

Put simply, it is:

Risk of Material Misstatement = Inherent Risk X Control Risk

Using the RMM formula, we are assessing risk at the assertion level. While audit standards don’t require a separate assessment of inherent risk and control risk, consider doing so anyway. I think it provides a better representation of your risk of material misstatement.

Here's a short video about assessing inherent risk.

And another video regarding control risk assessment.

Once you have completed the risk assessment process, control risk can be assessed at high--simply as an efficiency decision. See my article Assessing Audit Control Risk at High and Saving Time. 

The Input and Output

The inputs in audit planning include all of the above audit risk assessment procedures.

The outputs (sometimes called linkage) of the audit risk assessment process are:

Linking risk assessment to audit planning

We tailor the strategy and plan based on the risks..

In a nutshell, we identify risks and respond to them.

Next in the Audit Series

In my next post, we’ll take a look at Auditing for Fraud: The Why and How.

Audit Risk Assessment Made Easy - My New Book

My new book titled Audit Risk Assessment Made Easy is now available on Amazon. I’ve been working on this for over a year and a half. I think you’ll find it to be a valuable resource in understanding, documenting, planning, and performing risk assessment procedures. 

Audit risk assessment


Expense fraud
Aug 08

Expense Fraud: An Honest Theft

By Charles Hall | Asset Misappropriation

Honest people steal. Nice, innocent looking people take money that’s not theirs. How? One way is expense fraud.

The Honest Person’s Fraud

Expense fraud is one of the most common frauds. While the damage is usually low, this theft is pervasive in most businesses.

Expense fraud

I teach a college Bible study, and in it, I sometimes talk about “acceptable sins,” things like gossip, impatience, anger. My point is they are all issues and not acceptable, but we like to pawn them off as being okay–especially when it’s me that’s angry.

Likewise, expense report fraud is often viewed as acceptable, at least when it’s within bounds. But we all know fraud is fraud. The taking of something that does not belong to us is theft. But, I must say, it is so human to fudge on expense reports. We think things like: If I drove 355 miles, isn’t it okay to round up to 375? After all, I forgot to turn on my distance gauge until I was at least three miles out of town. Such rationalizations are easy to come by.

It always amazes me that executives–making six figures–are willing to jeopardize their positions for a few measly dollars. But C-suite employees commit expense report fraud just like new-hires. You might remember the Health and Human Services Secretary once resigned over questions about travel. While the Secretary was not accused of expense report fraud, it’s an example of how powerful people can abuse the use of travel privileges and, in this case, cost his employer (the federal government) money.

So how do people inflate their expense reports?

  • Inflating mileage
  • Filing the same receipt multiple times
  • Asking for advances and then requesting a second payment after returning from the trip
  • Submitting receipts of a nonemployee (e.g., spouse)
  • Submitting hotel reservation printouts (with projected cost) but not spending the night there

The Control Weakness

Usually, the weakness is that no one is properly reviewing the expense reports. Also, the company may not appropriately communicate the penalties (what happens when fraud is detected) for false reporting.

Correcting the Control Weakness

Create a written expense report policy that all employees sign, acknowledging their agreement to abide by the guidance.

The person reviewing the expense reports should be trained. He needs to know what is acceptable–and what is not. And most importantly, the person reviewing expense reports must be supported by the leadership of the entity–he has to know that the CEO or board chair has his back. (It’s difficult to stand up to high-level employees unless the reviewer knows the leader supports him.)

See a list of my other fraud-related articles.

auditing for fraud
Aug 08

Auditing for Fraud: The Why and How

By Charles Hall | Auditing , Fraud

Auditing for fraud is important, but some auditors ignore this duty. Even so, fraud risk is often present. 

So what is an auditor’s responsibility for detecting fraud? Today, I answer that question in light of generally accepted auditing standards in the United States. We’ll look specifically at AU-C 240, Consideration of Fraud in a Financial Statement Audit.

Here’s an overview of this article:

  • Auditor’s responsibility for detecting fraud
  • Turning a blind eye to fraud
  • Signs of auditor disregard for fraud
  • Incentives for fraud
  • Discovering fraud opportunities
  • Inquiries required by audit standards
  • The accounting story and big bad wolves
  • Documenting control weaknesses
  • Brainstorming and planning your response to fraud risk 

Auditor’s Responsibility for Detecting Fraud – AU-C 240

I still hear auditors say, “We are not responsible for detecting fraud.” But are we not? The detection of material misstatements whether caused by error or fraud is the heart and soul of an audit. So writing off our responsibility for fraud is not an option. We must plan to look for material fraud.

Audits will not, however, detect every material misstatement—even if the audit is properly planned and conducted. Audits are designed to provide reasonable assurance, not perfect assurance. Some material frauds will not be detected. Why? First, an auditor’s time is limited. He can’t audit forever. Second, complex systems make it extremely difficult to discover fraud. Third, the number of potential fraud schemes (there are thousands) makes it challenging to consider all possibilities. And, finally, some frauds are so well hidden that auditors won’t detect them.

Even so, auditors should not turn a blind eye to fraud.

Turning a Blind Eye to Fraud

Why do auditors not detect fraud?

Think of these reasons as an attitude—a poor one—regarding fraud. This disposition manifests itself in the audit file with signs of disregard for fraud.

Signs of Auditor Disregard for Fraud

A disregard for fraud appears in the following ways:

  • Asking just one or two questions about fraud
  • Limiting our inquiries to as few people as possible (maybe even just one)
  • Discounting the potential effects of fraud (after known theft occurs)
  • Not performing walkthroughs
  • We don’t conduct brainstorming sessions and window-dress related documentation
  • Our files reflect no responses to brainstorming and risk assessment procedures
  • Our files contain vague responses to the brainstorming and risk assessment (e.g., “no means for fraud to occur; see standard audit program” or “company employees are ethical; extended procedures are not needed”)
  • The audit program doesn’t change though control weaknesses are noted

In effect, auditors—at least some—dismiss the possibility of fraud, relying on a balance sheet approach.

So how can we understand fraud risks and respond to them? First, let’s look at fraud incentives.

Incentives for Fraud

The reasons for theft vary by each organization, depending on the dynamics of the business and people who work there. Fraudsters can enrich themselves indirectly (by cooking the books) or directly (by stealing).

Fraud comes in two flavors:

  1. Cooking the books (intentionally altering numbers)
  2. Theft

Two forms of fraud: Auditor's Responsibility for Fraud

Cooking the Books

Start your fraud risk assessment process by asking, “Are there any incentives to manipulate the financial statement numbers.” For example, does the company provide bonuses or promote employees based on profit or other metrics? If yes, an employee can indirectly steal by playing with the numbers. Think about it. The chief financial officer can inflate profits with just one journal entry—not hard to do. While false financial statements is a threat, the more common fraud is theft.

Theft

If employees don’t receive compensation for reaching specific financial targets, they may enrich themselves directly through theft. But employees can only steal if the opportunity is present. And where does opportunity come from? Weak internal controls. So, it’s imperative that auditors understand the accounting system and—more importantly—related controls. 

Discovering Fraud Opportunities

My go-to procedure in gaining an understanding of the accounting system and controls is walkthroughs.  Since accounting systems are varied, and there are no “forms” (practice aids) that capture all processes, walkthroughs can be challenging. So, we may have to “roll up our sleeves,” and “get in the trenches.” 

For most small businesses, performing a walkthrough is not that hard. Pick a transaction cycle; start at the beginning and follow the transaction to the end. Ask questions and note who does what. Inspect the related documents. As you do, ask yourself two questions:

  1. What can go wrong?
  2. Will existing control weakness allow material misstatements?

In more complex companies, break the transaction cycle into pieces. You know the old question, “How do you eat an elephant?” And the answer, “One bite at a time.” So, the process for understanding a smaller company works for a larger one. You just break it down and allow more time.

Discovering fraud opportunities requires the use of risk assessment procedures such as observations of controls, inspections of documents and inquiries. Of the three, the more commonly used is inquiries.

Inquiries Required by Audit Standards

Audit Standards (AU-C 240) state that we should inquire of management regarding:

  • Management’s assessment of the risk that the financial statements may be materially misstated due to fraud, including the nature, extent, and frequency of such assessments
  • Management’s process for identifying, responding to, and monitoring the risks of fraud in the entity, including any specific risks of fraud that management has identified or that have been brought to its attention, or classes of transactions, account balances, or disclosures for which a risk of fraud is likely to exist
  • Management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity
  • Management’s communication, if any, to employees regarding its views on business practices and ethical behavior
  • The auditor should make inquiries of management, and others within the entity as appropriate, to determine whether they know of any actual, suspected, or alleged fraud affecting the entity
  • For those entities that have an internal audit function, the auditor should make inquiries of appropriate individuals within the internal audit function to obtain their views about the risks of fraud; determine whether they have knowledge of any actual, suspected, or alleged fraud affecting the entity; whether they have performed any procedures to identify or detect fraud during the year; and whether management has satisfactorily responded to any findings resulting from these procedures

Notice that AU-C 240 requires the auditor to ask management about its procedures for identifying and responding to the risk of fraud. If management has no method of detecting fraud, might this be an indicator of a control weakness? Yes. What are the roles of management and outside auditors regarding fraud?

  • Management develops control systems to lessen the risk of fraud. 
  • Auditors review the accounting system to see if fraud-prevention procedures are designed and operating appropriately.

So, the company creates the accounting system, and the auditor gains an understanding of the same. As auditors gain an understanding of the accounting system and controls, we put together the pieces of a story.

The Accounting Story and Big Bad Wolves

Think of the accounting system as a story. Our job is to understand the narrative of that story. As we describe the accounting system in our work papers, we may find missing pieces. Controls may be inadequate. When they are, we ask more questions to make the story complete.

The purpose of writing the storyline is to identify any “big, bad wolves.”

The Auditor's Responsibility for Fraud - The Big Bad Wolves

The threats in our childhood stories were easy to recognize. The wolves were hard to miss. Not so in walkthroughs. It is only in connecting the dots—the workflow and controls—that the wolves materialize.

So, how long should the story be? That depends on the size of the organization. Scale your documentation. If the transaction cycle is simple, the documentation should be simple. If the cycle is complex, provide more details. By focusing on control weaknesses that allow material misstatements, you’ll avoid distracting details.

But what if control weaknesses are noted?

Documenting Control Weaknesses

I summarize the internal control strengths and weaknesses within the description of the system and controls and highlight the wording “Control weakness.” For example:

Control weakness: The accounts payable clerk (Judy Jones) can add new vendors and can print checks with digital signatures. In effect, she can create a new vendor and have a check sent to that provider without anyone else’s involvement.

Highlighting weaknesses makes them more prominent. Then I can use the identified fraud opportunities to brainstorm about how theft might occur and to develop my responses to the threats.

Brainstorming and Planning Your Responses 

Now, you are ready to brainstorm about how fraud might occur and to plan your audit responses.

The risk assessment procedures provide the fodder for the brainstorming session. 

Armed with knowledge about the company, the industry, fraud incentives, and the control weaknesses, we are ready to be creative. 

In what way are we to be creative? Think like a thief. By thinking like a fraudster, we unearth theft schemes. Why? So we can audit those possibilities. This is the reason for risk assessment procedures in the first place.

We think like a thief. By thinking like a fraudster, we unearth theft schemes.

Click To Tweet

What we discover in risk assessment informs the audit plan. Now we are ready to perform our fraud risk assessment. With the information gained in from the risk assessment procedures, we know where the risks are. If, for example, there is a risk that fictitious vendors are present, we might assess the risk of material misstatement at high for the expense occurrence assertion. (Our risks of material misstatement should be assessed at the assertion level.) Then we plan our response which might be testing new vendors added to determine if they are legitimate. So the fraud risk assessment occurs after we perform our risk assessment procedures. This tells us where the risks of material misstatement are. 

The Auditor’s Responsibility for Detecting Fraud – AU-C 240

In conclusion, I started this post saying I’d answer the question, “What is an auditor’s responsibility for detecting fraud?”

Hopefully, you now better understand fraud procedures. But to understand the purpose of them, look at a standard audit opinion:

The procedures selected depend on the auditor’s judgment, including the assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s preparation and fair presentation of the consolidated financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity’s internal control. Accordingly, we express no such opinion.

The purpose of fraud risk assessments is not to opine on internal control systems or to discover every fraud. It is to assist the auditor in determining where material misstatements—due to fraud—might occur.

Additionally, even well-performed audits will not detect all material fraud. As we saw above, some frauds are extremely difficult to detect. Audits are designed to provide reasonable assurance, not perfect assurance. The standard audit opinion states:

Our responsibility is to express an opinion on these financial statements based on our audits. We conducted our audits in accordance with auditing standards generally accepted in the United States of America. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free from material misstatement.

In summary, the auditor should conduct the audit in a manner to detect material fraud. But it is possible that some material frauds will be missed, even when we perform the audit correctly.

The Why and How of Auditing: A Blog Series About Audit Basics

Check out my series of posts: The Why and How of Auditing?

You’ll see how to audit cash, receivables/revenues, payables/expenses, investments, and other transaction cycles. You’ll also see how to perform risk assessment procedures before you plan your further audit procedures. 

Also, see my book The Why and How of Auditing on Amazon.

Rita Crundwell
Jul 19

Rita Crundwell Story: Why Some Ranches Stink

By Charles Hall | Asset Misappropriation

Is it possible for one person to steal over $53 million from a city with an annual budget of less than $10 million? Yes. The Rita Crundwell story provides a cautionary tale for small businesses, governments, and nonprofits.

The Rita Crundwell Theft

Rita Crundwell, comptroller, and treasurer of Dixon, Illinois stole $53 million over a twenty-year period. The city of 16,000 residents held Crundwell in high esteem. One friend described her as “sweet as pie.” Another said: “You could not find a nicer person.”

So why did she steal? It appears Rita just enjoyed the good life. She used the money to fund one of the top quarter horse ranches in the country, and she did it with style: Some of the funds were used to purchase over $300,000 of jewelry and a $2.1 million motor coach vehicle.

Rita Crundwell
Her annual salary? $80,000.

The city’s annual budget? $6 to $8 million

Were yearly audits performed? Yes.

Were budgets approved? Yes.

But even with budgets and audits, the Dixon, Illinois scandal happened. 

Too Much Trust

So how did this happen? Rita Crundwell won the trust of those around her—especially that of mayor and council. In April 2011, finance commissioner and veteran council member, Roy Bridgeman, praised Crundwell calling her “a big asset to the city as she looks after every tax dollar as if it were her own.” Too much trust in a bookkeeper can lead to huge problems. 

It was a disturbing moment when Dixon Mayor James Burke presented the FBI with evidence of Crundwell’s fraud. Burke later recalled his emotions and words: “I literally became sick to my stomach, and I told him that I hoped my suspicions were all wrong.” Such a response is understandable given that Crundwell had worked for the city for decades. She had fooled everyone.

Secret Bank Account

According to the mayor, the city’s annual audits raised no red flags, and the city’s primary bank never reported anything suspicious. So how did she steal the money? In 1990, Crundwell opened a secret bank account in the name of the city (titled the RSDCA account: the initials stood for reserve sewer development construction account). Crundwell was the only authorized check signer for the account, and the RSDCA bank account was never set up on the city’s general ledger. The City’s records reflected none of the RSDCA deposits or disbursements.

Crundwell would write and sign manual checks from a legitimate city capital project fund checking account, completing the check payee line with “Treasurer.” (Yes, Crundwell had the authority to issue checks with just her signature—even for legitimate city bank accounts.) She would then deposit the check into her secret account. From the bank’s perspective, a transfer had been made from one city bank account to another (from the capital projects fund to the reserve sewer development construction fund).

Accounting Cover-up

While the capital project fund disbursement was recorded on the city’s books, the RSDCA deposit was not. A capital project fund journal entry was made for each check debiting capital outlay expense and crediting cash. But no entry was made to the city’s records for the deposit to the RSDCA account. Once the money was in the RSDCA account, Crundwell wrote checks for personal expenses—and she did so for over twenty years.

To complete her deceit, Crundwell provided auditors with fictitious invoices from the Illinois Department of Transportation; these invoices included the following notation: Please make checks payable to Treasurer, State of Illinois. (So the canceled checks made out to Treasurer agreed with directions on the invoice, but the words “State of Illinois” were conveniently left off the check payee line.) Remember Crundwell was the treasurer of Dixon. 

Those invoices and the related checks were often for round dollar amounts (e.g., $250,000) and most were for more than $100,000. In one year alone, Crundwell embezzled over $5 million.

Vacation Leads to Arrest

So how was she caught? While Rita was on an extended vacation for horse shows, the city hired a replacement for her. For some reason, Crundwell’s substitute requested all bank account statements from the city’s bank. As the bank statements were reviewed, the secret bank account was discovered. And soon after that, the mayor contacted the FBI.

The Control Weakness

Why was Rita Crundwell able to steal $53 million? Wait for it. A lack of segregation of duties.

Rita could:

  • Write checks
  • Approve payments
  • Create and monitor the budget
  • Enter transactions into the accounting system
  • Reconcile the bank statements

The Accounting Fix

Multiple people should perform accounting duties, not just one.

Moreover, accounting employees should annually take a one-week vacation (or longer). And while they are gone, someone else should perform the vacant person’s duties. The vacation itself is not the key to this control. The performance of the absent accountant’s duties is. Why? Doing so allows the replacement person to understand the work of the vacant employee. But, more importantly, the substitute can note any unusual or fraudulent activity.

Here’s another action to take: Periodically contact your organization’s bank and ask for a list of all bank accounts. Then compare the list to the bank accounts in your general ledger. If a bank account is not on the general ledger, see why. And request a copy of the related signature card from the bank.

What Happened to Rita Crundwell?

So, what happened to Rita? She was sentenced to 19.5 years in prison. Here are pictures from the Chicago Tribune that shed light on the fraud.

All the Queens Horses

Kelly Richmond Pope has masterfully captured the Rita Crundwell tale in the movie All the Queen’s Horses, available on Amazon. Think auditing is boring? Then watch the movie. It does a better job of explaining the psychological and financial damage of fraud than any textbook. 

GASB 87 Lease Accounting
Jul 15

GASB 87 Lease Accounting

By Charles Hall | Accounting , Local Governments

Are you looking for GASB 87 lease accounting information? Are you a government that leases assets? Then you're in the right place. Below I provide information about lease terms, discount rates, accounting entries, and disclosure requirements.

GASB 87 Lease Accounting

Removal of Bright-Line Criteria

Historically governments have followed the guidance in FASB 13, Accounting for Leases. Lease classifications (i.e., operating or capital) were based on bright-line criteria such as whether the government leased an asset for more than 75% of its economic life. 

GASB 87, Leases, removes the bright-line criteria and calls for more judgment. (The words reasonably certain appears thirty-nine times in GASB 87.)

The new lease standard provides for various accounting alternatives. Let's see what they are.

Three Potential Accounting Alternatives

Regarding leases, there are now three accounting alternatives:

  1. Short-term leases
  2. Contracts that transfer ownership
  3. Contracts that do not transfer ownership

Before we dive deeper, here are three quick points about these alternatives:

First, know that short-term leases do not create a lease liability.

Second, understand that contracts that transfer ownership are a financed sale.

Third, know that contracts that do not transfer ownership create a lease liability. This third category is a catchall for arrangements that don't qualify for short-term lease treatment and don't transfer ownership.

Now, let's see how GASB defines a lease.

Definition of a Lease

GASB defines a lease this way:

A lease is defined as a contract that conveys control of the right to use another entity’s nonfinancial asset (the underlying asset) as specified in the contract for a period of time in an exchange or exchange-like transaction.

There are five points to this definition:

First, the lease must be a contract. 

Second, the contract must provide control of the right to use.

Third, this control is in relation to a nonfinancial asset.

Fourth, the control of the nonfinancial asset must be for a period of time.

And finally, the lease is an exchange or exchange-like transaction.

I think the terms contract, period of time, and exchange are easily understood. But the terms control and nonfinancial assets might cause some confusion. So let's clarify those.

Control

A government controls an asset if it has the right to the present service capacity and the right to determine the nature and manner of use of the asset.

In other words, the government must have the right to the benefits generated from the asset. A city can drive a leased police car. That is the benefit, the present service capacity.

Additionally, Nature and manner address whether the government controls the use of the asset. A city police officer can, for example, drive a leased police car at 3:00 a.m. And she can drive it as far as she likes. The police department determines the nature and manner of use.

Nonfinancial Asset

And what is a nonfinancial asset? It's generally anything that is not a financial asset (e.g., cash, receivable). Examples of nonfinancial assets include buildings, land, vehicles, and equipment. There are exceptions, however. 

GASB 87 Scope Exclusions

GASB 87 does not apply to:

  • Leases of intangible assets (e.g., rights to explore for oil and gas)
  • Leased biological assets (e.g., timber)
  • Inventory that is leased
  • Service concession arrangements
  • Leases in which the underlying asset is financed with outstanding conduit debt (unless the underlying asset and the conduit debt are reported by the lessor)
  • Supply contracts (e.g., power purchase agreements)

Now let's see how to determine the lease term.

Lease Term

Prior to GASB 87, the minimum lease payments determined the lease term. Not so any more. In some cases, GASB 87 provides for a more subjective determination of a lease's term, one based on what is reasonably certain.

Lease Options

Under GASB 87, lease terms are not just the noncancelable portion of the agreement. Governments add the following to the noncancelable period:

  • Periods covered by a lessee’s option to extend the lease if it is reasonably certain, based on all relevant factors, that the lessee will exercise that option 
  • Periods covered by a lessee’s option to terminate the lease if it is reasonably certain, based on all relevant factors, that the lessee will not exercise that option 
  • Periods covered by a lessor’s option to extend the lease if it is reasonably certain, based on all relevant factors, that the lessor will exercise that option  
  • Periods covered by a lessor’s option to terminate the lease if it is reasonably certain, based on all relevant factors, that the lessor will not exercise that option.
Reasonably Certain Factors

In determining what reasonably certain is, the government considers factors such as the economic impact of not exercising an option or how the government has acted in the past.

Once the lease term decision is made, document your basis for doing so. Why? So there is a record of the decision. (Your auditors may want to see this. Additionally, the record provides valuable information regarding future lease term decisions.)

Fiscal Funding Clauses Affect on Term

Additionally, you may be wondering if fiscal funding clauses affect leases. (Fiscal funding clauses allow a government to cancel a lease if the government does not appropriate funds for the payments.) If a government is reasonably expected to exercise such a provision, then this factor can impact the lease term. Personally, however, I've never seen a government terminate a lease through such a provision. Fiscal funding clauses will usually not affect lease terms.

So, should governments ever reassess the term period?

Reassessment of Term

Government will generally not reassess the lease term decision. 

Nevertheless, reassessment will occur in some cases. Consider this example. The government enters into a fifteen-year lease with a five-year lease extension. The government believes that it will not exercise the five-year extension. But then in year fifteen, it does so. Now the government binds itself for another five years. Therefore, the lease is extended. And the additional five years is added to the lease term. 

Now that you know about lease terms, you may be wondering about short-term leases. How does a government account for those?

Short-Term Leases

Treat leases with a maximum possible term of twelve months or less as short-term leases. And do not capitalize such leases. 

One word of caution: if there are renewal options, include those in making the short-term lease classification decision, regardless of probability. If, for example, the lease is for twelve months with an option to renew for another six months, then the lease is not short-term. Even if the government believes it will not exercise the option.

So, how do you record short-term lease payments? As expenses.

Contract that Transfers Ownership

If an agreement transfers ownership of the asset to the lessee by the end of the contract, then the contract is a financed purchase. For the lessee, the government records the purchased asset (not an intangible) and the related debt (not a lease liability).

So, what about a lease agreement with a bargain purchase option? Should it be treated as financed purchase? The answer is no. The presence of a bargain purchase option in a lease contract is not the same as a provision that transfers ownership of the underlying asset.

Multiple Components of a Lease Contract

If an agreement has lease and non-lease components, split the transaction. 

A government might, for example, lease floors four and five of a ten-story building. In doing so, it is required to pay for common area maintenance. Split this transaction into a lease and a maintenance contract. Record the lease exclusive of the maintenance payments. If, however, it is not practicable to determine the separate price allocation, the government should account for the transaction as a single lease.

If a lease involves multiple underlying assets (say a police car and a water tank), the government should account for each as a separate lease component. 

Lessee Accounting

If the government is leasing an asset, then it will use the following guidance. (An exception exists if the lease is short-term as explained above.)

GASB 87 Lessee accounting

Initial Recognition

At commencement, the government recognizes an (1) intangible right-to-use asset and (2) a lease liability. 

So the government does not recognize the asset itself (e.g., tractor), but the right to use the asset. This is an intangible asset.

Now let's see how to compute the lease asset.

1. Lease Asset 

So. what goes in the lease asset calculation?

The government should include:

  • Initial lease liability (see below)
  • Payments made to lessor at or before commencement less any lease incentives received from the lessor at or before the commencement of the lease term
  • Initial direct costs that are ancillary charges necessary to place the lease asset into service

So what costs are not included in the intangible asset? Governments should exclude any debt issuance costs.

Notice that the lease asset can be greater than the lease liability. The lease asset starts with the lease liability and increases if, for example, the government makes a payment to the lessor prior to commencement of the lease term.

In governmental funds (e.g., general fund), the initial accounting entry is a debit to capital outlay and a credit to other financing sources. In full accrual funds (e.g., enterprise fund), the initial entry is a debit to the intangible lease asset and a credit to the lease liability.

So, how should the lease asset be amortized?

Lease Asset Amortization

Amortize the lease asset in a systematic and rational manner over the shorter of the lease term or the asset's useful life. Usually this will be straight-line amortization.

And what are the journal entries for recording the lease asset?

Lease Asset Accounting

The government records the lease asset and then amortizes it using an entry such as the following (for full-accrual funds; e.g., water and sewer fund):

Account
Amortization Expense
Accumulated Amortization - Right-of-Use Asset
Debit
XX


Credit


XX

GASB 87 says to report the amortization as an outflow of resources (e.g., amortization expense). The amortization expense can, for financial reporting purposes, be combined with the depreciation expense of other capital assets. 

Modified accrual funds (e.g., general fund) will not record an amortization entry. Why? The asset does not appear on the balance sheet.

2. Lease Liability 

How does a government compute the lease liability?

Simply put, the lease liability is the present value of everything you think you're going to pay. Prior to GASB 87, governments used the present value of minimum lease payments. Now governments include payments that are reasonably certain. (See information above regarding what is reasonably certain.)

The computation is made up of the present value of:

  • Fixed payments
  • Variable payments that depend on an index or a rate (e.g., consumer price index) measured using the index or rate as of the commencement of the lease
  • Variable payments that are fixed in substance
  • Amounts that are reasonably certain of being required to be paid by the lessee under residual value guarantees
  • The exercise price of a purchase option if it is reasonably certain that the lessee will exercise that option
  • Payments for penalties for terminating the lease
  • Any lease incentives receivable from the lessor
  • Any other payments that are reasonably certain of being required based on an assessment of all relevant factors
Variable Payments Based on Future Performance

Governments will not include payments based on future performance or usage in the lease liability. Expense such payments in the period incurred. 

For example, if a government leases a vehicle with a provision for 12,000 miles annually but the car is driven 15,000 miles, expense the payment for the additional mileage as incurred.

So, where does the discount rate come from?

Discount Rate

Use the rate charged by the lessor if specified in the agreement. If not specified, use the incremental borrowing rate for the government. This is the estimated rate the government would pay if, during the life of the lease, it borrowed the funds for those lease payments.

Lease Liability Accounting

Once the initial lease is recorded as a liability, the government will begin making periodic payments to the lessor. The effective interest rate method will be used. Record the payments as follows (for full-accrual funds; e.g., water and sewer fund):

Account
Lease liability
Interest Expense

Cash

Debit
XX

XX

Credit


XX

Post the payments to principal and interest expenditures in modified accrual accounting funds (e.g., general fund).

GASB 87 Disclosures

The following disclosures are required for lessees:

  • A general description of its leasing arrangements 
  • The total amount of lease assets, and the related accumulated amortization, disclosed separately from other capital assets
  • The amount of lease assets by major classes of underlying assets, disclosed separately from other capital assets
  • The amount of outflows of resources recognized in the reporting period for variable payments not previously included in the measurement of the lease liability
  • The amount of outflows of resources recognized in the reporting period for other payments (e.g., termination penalties) not previously included in the measurement of the lease liability
  • Principal and interest requirements to maturity, presented separately, for the lease liability for each of the five subsequent fiscal years and in five-year increments thereafter
  • Commitments under leases before the commencement of the lease term
  • The components of any loss associated with an impairment 

Transition

Apply GASB 87 retroactively, if practicable, for all periods presented. Use the facts and circumstances existing at the beginning of the implementation period to record the leases.

The notes to the financial statements should disclose the nature of the restatement and its effect. 

GASB 87 says that the provisions of this statement need not be applied to immaterial items.

GASB 87 Effective Date

The effective date of GASB 87 is for reporting periods beginning after December 15, 2019. On May 8, 2020, the Governmental Accounting Standards Board (GASB) issued Statement No. 95, Postponement of the Effective Dates of Certain Authoritative Guidance. This standard postponed GASB 87 by eighteen months.

So GASB 87 is effective for fiscal year-ends of June 30, 2022 (years starting after June 15, 2021) and calendar year-ends of December 31, 2022 (again, years starting after June 15, 2021). 

1 2 3 4 … 37
>