Danger: Hosting Services Impair Independence

By Charles Hall | Auditing

(It’s August 14, 2018 as I write this. The AICPA has just delayed the effective date of the Hosting Services rule to July 1, 2019. I have not amended the following post for that change.)

As of September 1, 2018, hosting services impair independence, so says the AICPA. And most firms are providing hosting services (though they may not know it). This article explains why your possession of client records, whether electronic or hard-copy, can affect your independence.

Hosting Services Impair Independence

Starting September 1, 2018, your possession of client documents (e.g., tax records) or information (e.g., the housing of QuickBooks files on our server) can, in some instances, create an independence impairment. (If you temporarily possess original documents (e.g., tax records) but return them to the client in a short period, then the possession of the original documents does not impair your independence.)

The AICPA recently adopted a new interpretation, “Hosting Services,” which appears in the Code of Conduct under nonattest services. See 1.295.143 of the Code.

Why would possessing documents or information potentially impair independence? Because you accepted the responsibility for designing, implementing or maintaining internal controls for the records in your possession. And this is considered a management function.

In effect, the AICPA is saying there is an implicit understanding that you (the CPA) will safeguard the client’s records. And to safeguard the information, you agree to create controls to ensure the safety of the information in your possession.

To understand the actions that would impair your independence, see Catherine Allen’s article in the Journal of Accountancy. Specifically, look at her examples of where independence is impaired and where it is not. 

Continue reading

What I Wish I Had Known About Public Accounting

By Charles Hall | Accounting and Auditing

As I enter the latter part of my career, I look back and see several mistakes I made. Here’s what I wish I had known about public accounting–before I started.

I thought I knew a lot when I graduated from college, but my education was just beginning.

Job #1 – The Lesson of Firm Culture

In my first job, I went to work with a “big eight” public accounting firm in Tampa, Florida. As soon as I moved to my new digs on Tampa Bay, they shipped me out to Jackson, Mississippi where I remained for months (seeing my Tampa apartment twice in three months). Most days I did the expert work of pro-forming work papers—the thing they gave to newbies. Boredom defined. So I had this sexy job with a big firm, but I spent most days dawdling with routine duties. I kept thinking, “I went to college for this?” Surely accounting had to be more interesting.

I felt uncomfortable. This international firm was cold (even if this office was in Florida). I had grown up in a small town where you spoke to everyone and respected all. Soon I left Tampa and headed back home to Georgia.

What I learned: Work in a place that allows you to grow and one where you fit in. Firms have cultures. I needed one that aligned with who I was.

Job #2 – The Lesson of a Niche Practice

Back in Georgia, I landed work with a regional firm. I felt more at home. The work was more challenging than my former job, and my knowledge began to expand rapidly. This particular business had a strong niche practice and was very profitable. The firm used a pooled staffing approach, so I worked for one partner one week, another the next week, and another the next. I did not get a chance to start and finish audit engagements. It stressed me that so many different partners wanted me to complete their work. And each partner felt their work was the priority. After three years, I moved on.

What I learned: Firms that focus on niches perform better than those that don’t. As an employee, it’s better to work with one partner. You get to see engagements from start to finish, and the stress decreases since you know what your (one) boss wants. 

Job #3 – The Lesson of Working for One Boss

My new firm was even smaller than the last, having about thirty people. Here I worked for one partner which was nice, and he worked in one industry which was also pleasant. When I interviewed with the firm, I was told that my assigned partner would retire in three or four years, and I would have the opportunity to take his place. Since I was the audit manager, I learned a great deal, but over time it became apparent to me I was doing most of the work and the partner was receiving most of the pay.

The partner was a wonderful guy, but after eight years (not three or four), the partner was still in plain sight (and had not retired). 

So one day I screwed up my courage and asked, “When are you retiring?” The conversation was difficult (an understatement, he yelled at me). He wouldn’t answer my question. It was clear he had no intention of retiring (even though he was 68). I was angry. I had been duped (at least, I felt that way). 

So I left.

What I learned: I like working for one boss. I knew what he wanted, and I delivered it. When someone makes you a partnership offer, get it in writing (clarify the timetable and how the transition will occur). Don’t allow years to go by without communicating.

Job #4 – The Lesson of a Solo Practice

The next step in my journey was to start a new firm. I bought a small company that was only yielding $200 per month (yes, you read that right—$200 a month). My wife was at home with our kids, so we had no other income. 

About this same time, my two-year-old son was diagnosed with cystic fibrosis. I wondered how we would make it. I’ve never been so low in my life. And then three years into the solo practice, I was diagnosed with a brain tumor. (See my article, Audit Lessons from a Brain Tumor.)

We had an excellent opportunity to exercise faith, so we did, praying often. All I can say is God took care of us. At the end of the first year, my income was equal to my prior year of employment. The following five years were successful.

But after six years of being a sole proprietor (and then as a partner), my father’s health began to fail, and I was called to attend to his needs and…yes, you guessed it, another job.

What I learned: Going solo is one of the hardest things you will ever do. I quickly realized how important it is to have other professionals around me so I can bounce things off them and seek their guidance. Being alone is…lonely. (I brought in a partner in my third year. Having her there was wonderful.) 

Without the economies of scale afforded to larger firms, my overhead ate most of my cash flow. I found it hard to get potential audit clients to take me seriously. They saw me as “small” though my skill level was no different than it was in my previous jobs. When it comes to marketing, perception is everything.

On to the next job.

Job #5 – The Lesson of Learning to Speak and Write

I returned to my first Georgia employer (job #2 above) as their quality control director. I was 42 years old and had never been a quality control guy, so this was all new to me. But I enjoyed the challenge. While the firm had a niche practice, it still afforded me the opportunity to see a wide variety of audits, reviews, and compilations. I also began teaching more continuing education classes and loved doing so. When I taught, I felt “in my element.” The firm did (and still does) an excellent job of marketing. 

After six years in this position, my father passed away, and my wife wanted to move back to middle Georgia to be near her mother. So we did.

What I learned: Exposure to a broad range of work expands your professional abilities. It is easier for niche firms to market themselves as go-to experts. A niche practice generates higher profits since a common client base allows a firm to build repeatable processes and train staff. Also, I was beginning to realize the importance of speaking and writing. 

On a personal note, being there with my Dad was awesome. The conversations we had are some of my most treasured memories.

Job #6 – The Lesson of Staying with a Firm

For the last ten years, I’ve worked as the quality control director and now as the quality control partner for our firm, McNair, McLemore, Middlebrooks & Co. We are well diversified, but we have specialized niches within the company, so no one industry defines us. The diversity of work keeps me on my toes. I deal with accounting and auditing issues for banks, telecommunication companies, nonprofits, governments, small businesses and more. I continue to speak at professional conferences and to our staff, and, as you can see, I write. 

The Main Lessons Learned

One thing I have thought about as I look back over my career: I changed jobs too often.

If I had my career to do over again, I would find a good firm, and I would stay.

What I learned: Finding and staying with a good firm will provide you with significant opportunities.

Speak to groups and write professional articles and blog posts. Doing so will allow you to make new friends and great contacts.

Reflections on the Journey

Finally, let me say this: Finding balance and taking care of ourselves physically and spiritually are keys to success. Sitting at a desk for ten to twelve hours a day—without breaks—will only make us less productive and less healthy.

Praying and running (now walking as I’m older) have been my two biggest allies. At 6:00 every morning, I spend about 30 minutes reading my Bible and praying. I also walk five days a week with my wife and every Saturday with my twin brother (he blogs at ProjectRiskCoach.com).  Praying and walking give me energy and stamina. (See my article How to Create Energy that Sustains You.)

By the way, I mentioned my son with cystic fibrosis. He was three years old when diagnosed. Today he is twenty-four and works as a data scientist at the University of Georgia. Most importantly, he is doing well. And I am so thankful. 

What Lessons Have You Learned?

These are some things I have learned. I’d love to hear about your lessons. Please share one or two career experiences in the comment field below.

The Auditor’s Responsibility for Fraud: The Why and How

By Charles Hall | Auditing , Fraud

What is an auditor’s responsibility for fraud in a financial statement audit? Today, I’ll answer that question. Let’s take a look at the following:

• Auditor’s responsibility for fraud
• Turning a blind eye to fraud
• Signs of auditor disregard for fraud
• Incentives for fraud
• Discovering fraud opportunities
• Inquiries required by audit standards
• The accounting story and big bad wolves
• Documenting control weaknesses
• Brainstorming and planning your response to fraud risk 

Auditor’s Responsibility for Fraud

I still hear auditors say, “We are not responsible for fraud.” But are we not? We know that the detection of material misstatements—whether caused by error or fraud—is the heart and soul of an audit. So writing off our responsibility for fraud is not an option. But auditors often turn a blind eye to it.

Turning a Blind Eye to Fraud

Why do auditors not perceive fraud risks? 

Here are a few reasons:

• We don’t understand fraud, so we avoid it
• We don’t know how to look for control weaknesses
• We believe that auditing the balance sheet is enough

Think of these reasons as an attitude—a poor one—regarding fraud. This disposition manifests itself—in the audit file—with signs of disregard for fraud.

Signs of Auditor Disregard for Fraud

A disregard for fraud appears in the following ways:

• Asking just one or two questions about fraud
• Limiting our inquiries to as few people as possible (maybe even just one)
• Discounting the potential effects of fraud (after known theft occurs)
• Not performing walkthroughs
• We don’t conduct brainstorming sessions and window-dress related documentation
• Our files reflect no responses to brainstorming and risk assessment procedures
• Our files contain vague responses to the brainstorming and risk assessment (e.g., “no means for fraud to occur; see standard audit program” or “company employees are ethical; extended procedures are not needed”)
• The audit program doesn’t change though control weaknesses are noted

In effect, auditors—at least some—dismiss the possibility of fraud, relying on a balance sheet approach.

So how can we understand fraud risks and respond to them? First, let’s look at fraud incentives.

Incentives for Fraud

The reasons for theft vary by each organization, depending on the dynamics of the business and people who work there. Fraudsters can enrich themselves indirectly (by cooking the books) or directly (by stealing).

Fraud comes in two flavors:

1. Cooking the books (intentionally altering numbers)
2. Theft

Cooking the Books

Start your fraud risk assessment process by asking, “Are there any incentives to manipulate the financial statement numbers.” For example, does the company provide bonuses or promote employees based on profit or other metrics? If yes, an employee can indirectly steal by playing with the numbers. Think about it. The chief financial officer can inflate profits with just one journal entry—not hard to do. While false financial statements is a threat, the more common fraud is theft.

Theft

If employees don’t receive compensation for reaching specific financial targets, they may enrich themselves directly through theft. But employees can only steal if the opportunity is present. And where does opportunity come from? Weak internal controls. So, it’s imperative that auditors understand the accounting system and—more importantly—related controls. 

Discovering Fraud Opportunities

My go-to procedure in gaining an understanding of the accounting system and controls is walkthroughs.  Since accounting systems are varied, and there are no “forms” (practice aids) that capture all processes, walkthroughs can be challenging. So, we may have to “roll up our sleeves,” and “get in the trenches”—but the level of the challenge depends on the complexity of the business.

For most small businesses, performing a walkthrough is not that hard. Pick a transaction cycle; start at the beginning and follow the transaction to the end. Ask questions and note who does what. Inspect the related documents. As you do, ask yourself two questions:

1. What can go wrong?
2. Will existing control weakness allow material misstatements?

In more complex companies, break the transaction cycle into pieces. You know the old question, “How do you eat an elephant?” And the answer, “One bite at a time.” So, the process for understanding a smaller company works for a larger one. You just have to break it down—and allow more time.

Discovering fraud opportunities requires the use of risk assessment procedures such as observations of controls, inspections of documents and inquiries. Of the three, the more commonly used is inquiries.

Inquiries Required by Audit Standards

Audit Standards (AU-C 240) state that we should inquire of management regarding:

• Management’s assessment of the risk that the financial statements may be materially misstated due to fraud, including the nature, extent, and frequency of such assessments
• Management’s process for identifying, responding to, and monitoring the risks of fraud in the entity, including any specific risks of fraud that management has identified or that have been brought to its attention, or classes of transactions, account balances, or disclosures for which a risk of fraud is likely to exist
• Management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud in the entity
• Management’s communication, if any, to employees regarding its views on business practices and ethical behavior
• The auditor should make inquiries of management, and others within the entity as appropriate, to determine whether they have knowledge of any actual, suspected, or alleged fraud affecting the entity
• For those entities that have an internal audit function, the auditor should make inquiries of appropriate individuals within the internal audit function to obtain their views about the risks of fraud; determine whether they have knowledge of any actual, suspected, or alleged fraud affecting the entity; whether they have performed any procedures to identify or detect fraud during the year; and whether management has satisfactorily responded to any findings resulting from these procedures

Notice that AU-C 240 requires the auditor to ask management about its procedures for identifying and responding to the risk of fraud. If management has no method of detecting fraud, might this be an indicator of a control weakness? Yes. What are the roles of management and auditors regarding fraud?

• Management develops control systems to lessen the risk of fraud. 
• Auditors review the accounting system to see if fraud-prevention procedures are designed and operating appropriately.

So, the company creates the accounting system, and the auditor gains an understanding of the same. As auditors gain an understanding of the accounting system and controls, we are putting together the pieces of a story.

The Accounting Story and Big Bad Wolves

Think of the accounting system as a story. Our job is to understand the narrative of that story. As we (attempt to) describe the accounting system, we may find missing pieces. When we do, we’ll go back and ask more questions to make the story complete.

The purpose of writing the storyline is to identify any “big, bad wolves.”

The threats in our childhood stories were easy to recognize—the wolves were hard to miss. Not so in the walkthroughs. It is only in connecting the dots—the workflow and controls—that the wolves materialize. So, how long is the story? That depends on the size of the organization.

Scale your documentation. If the transaction cycle is simple, the documentation should be simple. If the cycle is complex, provide more details. By focusing on control weaknesses that allow material misstatements, you’ll avoid unneeded—and distracting—details.

Documenting Control Weaknesses

I summarize the internal control strengths and weaknesses within the description of the system and controls and highlight the wording “Control weakness.” For example:

Control weakness: The accounts payable clerk (Judy Jones) can add new vendors and can print checks with digital signatures. If effect, she can create a new vendor and have a check sent to that provider without anyone else’s involvement.

Highlighting weaknesses makes them more prominent. Then I can use the identified fraud opportunities to brainstorm about how theft might occur and to develop my responses to the threats.

Brainstorming and Planning Your Responses 

Now, you are ready to brainstorm about how fraud might occur and to plan your audit responses.

The risk assessment procedures—discussed above and in my prior post—provide the fodder for the brainstorming session. 

Armed with knowledge about the company, the industry, fraud incentives, and the control weaknesses, we are ready to be creative. 

In what way are we to be creative? We think like a thief. By thinking like a fraudster, we unearth ways that stealing might occur. And why? So we can audit those possibilities. And this is the reason for the fraud risk assessment procedures in the first place.

What we discover in the risk assessment stage informs the audit plan—in other words, it has bearing upon the audit programs.

The Auditor’s Responsibility for Fraud

In conclusion, I started this post saying I’d answer the question, “What is an auditor’s responsibility for fraud?” Hopefully, you now have a better understanding of the fraud-related procedures we are to perform. But to understand the purpose of these procedures, look at the language in a standard audit opinion:

The procedures selected depend on the auditor’s judgment, including the assessment of the risks of material misstatement of the consolidated financial statements, whether due to fraud or error. In making those risk assessments, the auditor considers internal control relevant to the entity’s preparation and fair presentation of the consolidated financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity’s internal control. Accordingly, we express no such opinion.

The purpose of fraud risk assessments is not to opine on internal control systems or to discover every fraud. It is to assist the auditor in determining where material misstatements—due to fraud—might occur.

The What and Why of Auditing: A Blog Series About Basics

Have you been following my series of posts: The What and Why of Auditing? If not, you may want to review the prior posts:

• The What and Why of Auditing: A Blog Series about Basics
• The What and Why of Audit Acceptance and Continuance
• The What and Why of Audit Risk Assessment

Also subscribe (below) to my blog to receive future installments in this series (we have several more coming). This series is a great way for seasoned auditors to refresh their overall audit knowledge and for new auditors to gain a better understanding of the audit process. 

Audit Risk Assessment: The Why and the How

By Charles Hall | Auditing

Government Auditing Standards 2018 Revision (Hot Off the Press)

By Charles Hall | Auditing , Local Governments