All Posts by Charles Hall

Follow

About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles is the quality control partner for McNair, McLemore, Middlebrooks & Co. where he provides daily audit and accounting assistance to over 65 CPAs. In addition, he consults with other CPA firms, assisting them with auditing and accounting issues.

Jun 29

How a Tax Commissioner Walks Away with $800,000

By Charles Hall | Asset Misappropriation

The Theft

Some twenty years ago, I was working on an audit of a county tax commissioner’s office. We were noticing differences in the receipts and the cash collections.

Theft of cash

Picture is courtesy of AdobeStock.com

So one day I walk into the Tax Commissioner’s office. As I step in, I see several thousand dollars of cash laying on her desk. So, I remarked to her, “Haven’t made a deposit lately?” She laughed and said, “No, I’ve been too busy lately.”

I thought to myself, “Strange. She knows we’re here for the annual audit, and she has all this undeposited cash in open view. It’s as though she has no fear.”

The next day a gentleman comes into the room where we (the auditors) were working and whispers to me, “The Commissioner has a cocaine habit.” I did not know the fellow, so I wondered if the assertion had any merit. Regardless, this was shaping up to be an interesting audit.

Our audit disclosed unaccounted-for funds of over $300,000 in the year one. Year two, the differences continued and exceeded $500,000. After three years, the unaccounted-for amount was in the $800,000 range.

Why was she not removed? Tax Commissioners are elected in Georgia, so the only person that could remove her was the governor. The local county commissioners could not dismiss her.

Finally, the FBI was brought in. But even they could not prove who was stealing the money. Why? The tax office had two cash drawers and eight clerks. All eight worked out of both drawers. So when cash went missing, you could not pin the differences on any one person.

In addition, the books were a disaster, postings were willy-nilly. There was no rhyme or reason–what I call “designed smoke.”

The tax commissioner eventually went to prison for tax evasion. She made the mistake of depositing some of the stolen cash into her personal bank account, and the Feds were able to prove she had not reported the income.

The Weakness

The primary weakness was the lack of design in the collection process. Two or more people should never work from one cash drawer. Deposits were not timely made (and in many cases, not made at all). And then the books (mainly the tax digest) was not appropriately posted as collections were received.

The Fix

The primary fix was to remove the tax commissioner.

Next, each cash drawer should be assigned to only one person at a time.

Cash receipts should be written and the tax digest should be posted as tax payments are received.

Finally, deposits should be made daily.

How to steal money with altered check payees
May 18

How to Steal Money with Altered Check Payees

By Charles Hall | Asset Misappropriation

Some fraudsters steal money with altered check payees.

As a kid I once threw a match in a half-gallon of gasoline—just to see what would happen. I quickly found out. In a panic, I kicked the gas container—a plastic milk jug—several times, thinking this would somehow kill the fire. But just the opposite happened. And when my father found out, something else was on fire.

Some accounting weaknesses create unintended consequences. Show me an accounting clerk who (1) can sign checks (whether by hand, with a signature stamp, or with a computer-generated signature), (2) posts transactions to the accounting system, and (3) reconciles the bank account, and I will show you another combustible situation. Here’s how one city clerk created her own blaze.

Altered Check Example

Using the city’s signature stamp, the clerk signed handwritten checks made out to herself; however, when the payee name was entered into the general ledger (with a journal entry), another name was used—usually that of a legitimate vendor.

How to steal money with altered check payees

For example, Susie, the clerk, created manual checks made out to herself and signed them with the signature stamp. But the check payee was entered into the accounting system as Macon Hardware (for example). Also, she allocated the disbursements to accounts with sufficient remaining budgetary balances. The subterfuge worked as the expense accounts reflected appropriate vendor activity and expenses stayed within the budgetary appropriations. No red flags.

The accounting clerk, when confronted with evidence of her deception, responded, “I don’t know why I did it, I didn’t need the money.” We do a disservice to accounting employees when we make it so easy to steal. Given human nature, we should do what we can to limit the temptation.

How?

Controls to Lessen Check Fraud

First, if possible, segregate the disbursement duties so that only one person performs each of the following:

• Creating checks
• Signing checks
• Reconciling bank statements
• Entering checks into the general ledger

If you can’t segregate duties, have someone (the Mayor, a non-accounting employee, or an outside CPA) review cleared checks for appropriateness.

Secondly, have a second person approve all journal entries. False journal entries can used to hide theft. With sleight of hand, the city clerk made improper journal entries such as:

                                                Dr.                 Cr.

Supply Expense              $5,234

Cash                                                        $5,234

 

The check was made out to Susie, but the transaction was, in this example, coded as a supply expense paid to Macon Hardware. You can lessen the risk of fraud by preventing improper journal entries.

Thirdly, restrict access to check stock. It’s wise to keep blank check stock locked up until needed.

Finally, limit who can sign checks, and deep-six the signature stamp.

A Fraud Test for Auditors

Here’s a word to external auditors looking for a fraud test idea (or those just looking for check fraud): Consider testing a random sample of cleared checks by agreeing them to related invoices.

Work from the cleared check to the invoice. It is best for the auditor to pull the invoices from the invoice file; if you ask someone in accounting to pull the invoices, that person might create fictitious invoices to support your list (not hard to do these days). If the payee has been altered, you will, in many cases, not find a corresponding invoice. Pay particular attention to checks with company employees on the payee line.

Click here for more white-collar crime examples.

Seven Ways to Feed Evernote
May 02

Seven Ways to Feed Evernote

By Charles Hall | Technology

Do you find yourself overwhelmed with information? Today I show you seven ways to feed Evernote, a cloud-based storage application. You’ll soon be on your way to gaining control over your information overload.

Seven Ways to Feed Evernote

Evernote as a Solution to Information Overload

Maybe you spend several hours researching interest rate swaps and file the information away, but months later–at the very time you need it–the material vanishes. You spend 20 minutes searching through your computer folders, but you can’t find it.  (Where did you put it? You know you filed it away.) The result: You spend three more hours doing the same research–again. What a waste!

Wouldn’t it be nice to have your own personal electronic library? That way, all of your research, sample financial statements, forms, professional articles, expense reports, meeting notes, screenshots, etc. are all in one place–and accessible with search features. Such a place exists. It’s called Evernote. I previously provided an overview of Evernote that you can see here. Once you create your Evernote account, you can do the following.

First Set Up Your Default Evernote Notebook

Before sending information from one of your devices (e.g., smartphone) to Evernote, specify where it should go. My default landing area: To Be Filed notebook. (You will need to create the To Be Filed notebook in your Evernote account.)

Setting Default Folder

Since I send information from a variety of devices, I initially send information to the To Be Filed notebook; later, when I have time, I tag each note (e.g., Fair Value) and then move each to an appropriate notebook (e.g., Accounting).

Tip – If you put an asterisk in front of the folder name (e.g., *To Be Filed), Evernote will present it (the folder) at the top of your folder list. This will make it easier to locate your default folder.

In short, my standard operating procedure: (1) capture on the fly and (2) classify with a block of time (it usually takes me less than five minutes each day to tag and move the new notes).

Seven Ways to Feed Evernote

1. Smart Phones

You can use your smartphone to create and send pictures, text files, and voice messages to Evernote.

To download Evernote for an Android phone, click here.

iPhone users should download the Evernote app.

Here’s a screenshot of my iPhone Evernote app.

iPhone evernote

2. Scanners

I use a Fujitsu scanner (model iX500) to scan documents directly to Evernote. (The iX500 costs about $400 from Amazon.)

scanner

3. Web Clippers

Evernote provides web clippers for browsers including Safari, Explorer, Google Chrome, and Firefox. If you click this web clipper link, Evernote will automatically recognize your browser; then download the clipper software to your browser. While browsing, click the Elephant icon to clip a portion of the web page, the full page, or the full article.

Clippers

4. Hotkeys

Evernote allows you to use hotkeys to capture information from any program (as long as Evernote is running in the background). To activate screen clipping, use the key combination (e.g., for Windows: Win+PrintScreen). See Preferences to change your hotkeys.

So if you are working on an Excel spreadsheet, for example, and would like to capture the information into Evernote, use the hotkey combination and select the portion of the screen you wish to save. The screenshot will go to your default Evernote location.

You can do the same with an email, a Word document, and anything else that appears on your screen.

5. Email Directly to Evernote Account

One of my favorite ways to feed Evernote is to email a document (e.g., Excel, Word, PDF) directly to Evernote; when you set up your Evernote account, you will be provided a private Evernote email address. Set this address up in your email contact list; then you can send any email or document (attached to an email) to your Evernote default notebook.

6. Drag and Drop

With Evernote open, you can create a new note and then drag a document (e.g., Word or Excel file) onto the open note. The material is added to the note. You can add multiple documents to one note.

7. Import Folder

An even easier way to get files into Evernote is to use an “import folder.” After you specify in Evernote where the “import folder” is located on your computer (i.e., a particular Windows folder), you can drop files into the designated folder, and they will automatically feed into your default Evernote notebook. (Note–Import folders are only available in Windows.)

What About You?

How do you feed Evernote? Are there other ways to feed Evernote that I have not mentioned?

Apr 08

How to Document the Use of a Specialist

By Charles Hall | Auditing

As an auditor, you often use the work of specialists such as actuaries, appraisers, and engineers. Such work can seem mystical, like something conjured up from a mathematical soup. And since we don’t always understand their incantations, we wonder, “Can we rely on the information?” Thankfully, the audit standards provide guidance.

Picture is courtesy of DollarPhotoClub.com

Picture is courtesy of DollarPhotoClub.com

A specialist can be hired by your audit firm or by management. If you audit banks, you might hire an appraiser to assist with loan collateral reviews–an example of an auditor’s specialist. If your client uses an actuary, then you will obtain audit evidence from a specialist hired by management. As we begin our look into the use of specialists, let’s define the terms auditor’s specialist and management’s specialist.

Definitions

AU-C 620 provides the following definitions:

Auditor’s specialist. An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the auditor to assist the auditor in obtaining sufficient appropriate audit evidence. An auditor’s specialist may be either an auditor’s internal specialist (who is a partner or staff, including temporary staff, of the auditor’s firm or a network firm) or an auditor’s external specialist.

Management’s specialist. An individual or organization possessing expertise in a field other than accounting or auditing, whose work in that field is used by the entity to assist the entity in preparing the financial statements.

Now let’s take a look at audit considerations for both the auditor’s specialist and management’s specialist.

Use of Auditor’s Specialist

AU-C Section 620–Using the Work of an Auditor’s Specialist provides guidance on the use of an auditor’s specialist.

Is the Specialist Needed?

AU-C 620.07 states, “If expertise in a field other than accounting or auditing is necessary to obtain sufficient appropriate audit evidence, the auditor should determine whether to use the work of an auditor’s specialist.” Before using the services of a specialist, consider the significance of the information for which you might need a specialist. If the (specialist) information has little impact on the financial statements, then the specialist issue will be of less importance.

Specialist Considerations

AU-C 620.09 says, “The auditor should evaluate whether the auditor’s specialist has the necessary competence, capabilities, and objectivity for the auditor’s purposes.” So if you hire an investment pricing specialist, you want to know if she is reputable, what her experience is, whether she can perform the work appropriately, and whether she can be objective.

Auditor's Specialist

Picture is courtesy of Adobe Stock

According to AU-C 620.A16, information regarding the competence, capabilities, and objectivity of an auditor’s specialist may come from the following:

  • Personal experience with previous work of that specialist
  • Discussions with that specialist
  • Discussions with other auditors or others who are familiar with that specialist’s work
  • Knowledge of that specialist’s qualifications, membership in a professional body or industry association,   license to practice, or other forms of external recognition
  • Published papers or books written by that specialist
  • The quality control policies and procedures of the auditor’s firm and such other procedures the auditor considers necessary in the circumstances

If you’ve previously worked with the aforementioned pricing specialist, you have personal experience with her work. This helps. You might call her with regard to current year issues, and since you already know her, you probably already know her qualifications.

Regarding objectivity, the auditor should inquire about any relationships that the specialist may have with the client, and if necessary, obtain a signed representation letter– from the specialist–concerning their objectivity. Continuing with our pricing specialist illustration, you want to ask her if she has any business relationships with the auditee. Are there any family relationships? Is there any reason her objectivity might be lessened?

Engagement Letter with Specialist

Does the audit firm need an engagement letter with its specialist?

Though not required, the auditor can use a written engagement letter to define the work of the specialist. AU-C 620.A45 provides suggestions for the engagement letter as follows:

  • Nature, Scope, and Objectives of the Auditor’s External Specialist’s Work
  • The Respective Roles and Responsibilities of the Auditor and the Auditor’s External Specialist
  • Communications and Reporting
  • Confidentiality

When an engagement letter is not used, document the work of the specialist in a memorandum or other audit work papers such as an audit program.

Adequacy of the Specialist’s Work

Auditors must evaluate the adequacy of the specialist’s work.

AU-C 620.12 says:

The auditor should evaluate the adequacy of the work of the auditor’s specialist for the auditor’s purposes, including:

  1. The relevance and reasonableness of the findings and conclusions of the auditor’s specialist and their consistency with other audit evidence.
  2. If the work of the auditor’s specialist involves the use of significant assumptions and methods,
    • obtaining an understanding of those assumptions and methods and
    • evaluating the relevance and reasonableness of those assumptions and methods in the circumstances, giving consideration to the rationale and support provided by the specialist, and in relation to the auditor’s other findings and conclusions.
  3. If the work of the auditor’s specialist involves the use of source data that is significant to the work of the auditor’s specialist, the relevance, completeness, and accuracy of that source data.

Bottom line: Does the work of the specialist provide sufficient and appropriate audit evidence with regard to the issue at hand (e.g., investment pricing)?

When to Start Thinking About a Specialist

When should an auditor begin to think about the use of a specialist? Before the engagement is accepted. Why? If we accept an audit without the necessary skill sets, we have a problem. As we consider our acceptance of an audit, we should consider if there is a need to hire a specialist–and whether such a specialist is available at a reasonable price.

Reference to a Specialist in an Auditor’s Opinion

AU-C 620.14-15 says the following about references to a specialist’s work in an audit opinion:

The auditor should not refer to the work of an auditor’s specialist in an auditor’s report containing an unmodified opinion.

If the auditor makes reference to the work of an auditor’s external specialist in the auditor’s report because such reference is relevant to an understanding of a modification to the auditor’s opinion, the auditor should indicate in the auditor’s report that such reference does not reduce the auditor’s responsibility for that opinion.

What does this mean? Regardless of the use of a specialist, the opinion is the auditor’s (and not the specialist’s). We may use the specialist’s work as audit evidence, but the audit opinion is ours.

The audit standards do allow auditors to reference the work of a specialist when the opinion is modified, but if you do so, get the specialist’s permission (consider getting written authorization).

Confidentiality Language in the Client Engagement Letter

When an auditor hires an external specialist, should the audit engagement letter change?

Picture is courtesy of AdobeStock

Picture is courtesy of AdobeStock

When an audit firm hires an external specialist, the firm should follow the Code of Conduct section ET 1.700.040, Disclosing Information to a Third-Party Service Provider. How can you comply with this ethical requirement? By including additional language in your engagement letter advising the client that you might provide confidential information to an outside party; in effect, you are gaining consent to share client information. If you are not using an outside specialist, but someone who works for your firm, then no such consent is necessary.

Use of Management’s Specialist

AU-C Section 500–Audit Evidence provides guidance on the use of information from management’s specialist.

Your audit client might use their own specialist such as a pension plan actuary. To rely on the actuary, you need to know if she is competent and objective. You also need to understand–at least in a general sense–what the actuary is doing.

Specialist Considerations

AU-C 500.08 states:

If information to be used as audit evidence has been prepared using the work of management’s specialist, the auditor should, to the extent necessary, taking into account the significance of that specialist’s work for the auditor’s purposes,

  1. evaluate the competence, capabilities, and objectivity of that specialist;
  2. obtain an understanding of the work of that specialist; and
  3. evaluate the appropriateness of that specialist’s work as audit evidence for the relevant assertion.

AU-C 500.A39 provides the following insights into evaluating competence, capabilities, and objectivity:

Information regarding the competence, capabilities, and objectivity of management’s specialist may come from a variety of sources, such as the following:

  • Personal experience with previous work of that specialist
  • Discussions with that specialist
  • Discussions with others who are familiar with that specialist’s work
  • Knowledge of that specialist’s qualifications, membership in a professional body or industry association, license to practice, or other forms of external recognition
  • Published papers or books written by that specialist

Representation Letter

Exhibit B of AU-C 580, Written Representations, provides the following example of language that an auditor might include in the representation letter:

We agree with the findings of specialists in evaluating the [describe assertion] and have adequately considered the qualifications of the specialists in determining the amounts and disclosures used in the financial statements and the underlying accounting records. We did not give or cause any instructions to be given to specialists with respect to the values or amounts derived in an attempt to bias their work, and we are not otherwise aware of any matters that have had an effect on the independence or objectivity of the specialists.

Conclusion

So how do you document your use of a specialist? As you can tell, the audit standards provide a framework, and the documentation will vary depending on the type of specialist used and the importance of the information. At a minimum, consider documenting:

  1. Why you need the specialist (or their work product)
  2. The abilities, reputation, and experience of the specialist
  3. The objectivity of the specialist
  4. The adequacy of the work provided

At the end of the day, auditing is all about obtaining reasonable assurance by obtaining audit evidence. As you consider the use of a specialist, ask yourself how their work impacts your risk assessment, your audit procedures, and finally your opinion.

Feb 24

Group Audit Standards Applicability When One Firm Audits Consolidated Financial Statements?

By Charles Hall | Auditing

Do the group audit standards apply when one firm audits all of the entities comprising a consolidated whole?

Yes.

You say, “confusing.” I say, “I agree.”

The confusion–at least for me–lies in the pre-clarity auditing standard, AU 543, Part of Audit Performed by Other Independent Auditors, which focused on who was performing the audit. The clarity standard, AU-C 600 Special Considerations — Audits of Group Financial Statements, focuses on what is being audited. The word group (as applied to the group audit standards) does not mean more than one auditor.

Regarding applicability (of the group audit standards), we look at the entities and business activities being audited rather than how many audit firms are involved. We used to focus on the interaction with other auditors; now we focus on the risks associated with the group financial statements.

Businessman holding a transparent screen with an inscription a auditing. Business, technology, internet and networking concept.

The picture is courtesy of DollarPhotoClub.com.

Group Audit Standards When There is Only One Audit Firm

The AICPA’s Technical Questions and Answers (8800.24) says the following about the applicability of AU-C Section 600 (Audits of Group Financial Statements) when only one engagement team is involved:

Inquiry—Company X consolidates the operations of Entity A. The same group engagement team that audits Company X also audits Entity A. Because only one engagement team is involved, does AU-C section 600 apply? If so, what does AU-C Section 600 require that is not already covered by other auditing standards?

ReplyAU-C section 600 applies to all audits of group financial statements, which are financial statements that contain more than one component. In the circumstances when the same engagement team audits all components of the group, the considerations addressed in AU-C Section 600 that relate to component auditors are not relevant. However, considerations addressed in AU-C section 600, such as understanding the components; identifying components that are significant due to individual financial significance and the significant risk of material misstatement; determining component materiality; understanding the consolidation process; and addressing the risks, including aggregation risk, of material misstatement in the group financial statements; are relevant in all group audits.

What does this mean?

If your firm audits consolidated financial statements, then the group audit standards apply, and you do need to comply with certain provisions (even though your firm audits all entities included in the consolidation). Consequently, you have some additional documentation requirements. Your audit file should contain the following documentation:

  • Your understanding of the components
  • Your identification of significant components (due to financial significance or risk)
  • Component materiality
  • Your understanding of the consolidation process
  • How you plan to address the identified risk of material misstatement (including aggregation risk)

Group Financial Statements

What are group financial statements? They are statements that include the financial information of more than one component.

Here are examples of components:

  • Subsidiaries
  • Geographical locations
  • Divisions
  • Investments (equity method)
  • Products or services
  • Component units of a state or local government

You can see from these examples of components, the concept of group financial statements is broader than that of consolidated or combined financial statements.

The idea behind the group audit standards is to highlight the risk of material misstatement whether at the group level or a lower level. If for example, a component is not financially significant but it has particularly risky assets (e.g., derivatives), then the group audit standards direct our attention here.

Examples of When Group Audit Standards are Applicable

Here are examples of when the group audit standards are in play:

  • Consolidated subsidiary
  • Combined financial statements due to common control
  • Investment accounted for using the equity method
  • Consolidated affiliate (due to variable-interest considerations)

Notice we made no mention of other auditors in these examples. It is possible that another firm may audit a subsidiary (for example), but this factor is not the determinant of when the group audit standards apply.

>