Internal Auditors’ Assessment of Fraud Implications for External AuditorsWarning Signs: Implications for External Auditors

Internal Auditors’ Assessment of Fraud Implications for External AuditorsWarning Signs: Implications for External Auditors

By Audrey A. Gramling and Patricia M. Myers

In Brief

External Auditors Can Partner with Internal Auditors

Recognizing the mandated role of internal auditors and leveraging the important fraud-related information that resides with the client’s internal audit personnel can improve the effectiveness of the external audit. The extent to which internal auditors are sensitive to warning signs that might indicate the possibility for fraud demonstrates how much internal auditors can help external auditors. Internal auditors that can provide advance notice of fraud risk can be effective partners in the prevention and detection of fraudulent financial reporting. The authors’ research indicates that internal auditors attach the same importance to warning signs as external auditors; however, they also tend to emphasize attitude or rationalization factors and not consider corporate governance characteristics as highly.

The AICPA’s recently issued SAS 99, Consideration of Fraud in a Financial Statement Audit, directs external auditors to ask a company’s internal audit personnel about the risk of fraud and any knowledge of actual or suspected fraud. The impetus for this directive comes from the important role internal auditors play in corporate governance. As recognized by the Treadway Commission Report in 1987, internal auditors are expected to assume an active role in preventing and detecting fraudulent financial reporting.

If internal auditors are adept in recognizing the factors that signal the likelihood of fraud, an active partnership between external and internal auditors could be beneficial for all stakeholders. If internal auditors tend to emphasize or ignore certain factors, CPAs should be aware of such potential biases and take that into consideration when coordinating with the client’s internal auditors.

Fraud Conditions

According to SAS 99, three fundamental conditions are generally present when fraudulent financial reporting occurs: 1) incentive or pressure to perpetrate fraud, 2) an opportunity to carry out the fraud, and 3) attitude or rationalization to justify the fraudulent action. Within each of the three fundamental conditions, there are a number of specific warning signs of fraud, including some factors directed toward corporate governance.

The Enron collapse dramatically demonstrated the importance of corporate governance in ensuring quality financial reporting. The June 6, 2002, Report of the New York Stock Exchange Corporate Accountability and Listing Standards Committee (http://www.nyse.com/pdfs/corp_govreport.pdf) revealed that characteristics of boards of directors and audit committees are useful in discriminating between companies with and without fraudulent financial reporting. Auditors (both external and internal) should recognize that opportunities to fraudulently report financial information are reduced in the presence of high-quality corporate governance mechanisms. Such mechanisms include a board and an audit committee that not only recognizes their responsibility for ensuring quality financial reporting, but also have the characteristics and knowledge to objectively meet their oversight responsibilities.

Fraud Warning Signs

External auditors that work with internal audit personnel can form an effective partnership directed toward detecting and preventing fraudulent financial reporting. CPAs interested in developing this type of partnership must be aware of internal auditors’ perceptions regarding the importance of not only traditional fraud warning signs, but also newly recognized factors related to corporate governance.

One concern is that the broadening of internal audit activities may result in internal auditors shifting from a focus on financial reporting to a focus on operational activities. Such a shift could result in internal auditors not having an awareness of relevant aspects of fraudulent financial reporting, including the growing importance of corporate governance factors. Such a lack of awareness would render internal auditors’ fraud-related insights less useful to the external auditor.

Internal Auditors’ Perceptions

The authors surveyed 124 internal auditors on the importance of fraud warning signs. Each respondent rated the importance of 43 potential warning signs in helping identify possible fraudulent financial reporting. These warning signs included 38 risk factors derived from SAS 82, Consideration of Fraud in a Financial Statement Audit, as well as five additional corporate governance warning signs. Interestingly, SAS 99 includes only one, broad corporate governance warning sign, concerning an ineffective board or audit committee. The other corporate governance factors in the survey are inspired by recommendations made by the Blue Ribbon Committee on Improving the Effectiveness of Corporate Audit Committees.

The Exhibit lists the warning signs and the importance internal auditors attached to them. Each warning sign represents one of the three fundamental conditions that are generally present when fraudulent financial reporting occurs. Of the 43 warning signs, 14 represent incentive or pressure conditions, 16 represent opportunity conditions, and 13 represent attitude or rationalization conditions.

The survey indicates that internal auditors, like forensic experts and external auditors, generally perceive factors related to attitude or rationalization as the most important warning signs of possible fraud. Of the top 15 warning signs, six represent attitude or rationalization conditions, three represent incentive conditions, and six represent opportunity factors. Most striking is that attitude or rationalization conditions captured the top four spots. It is also worth noting that all 43 warning signs were rated as “important” or higher, indicating that internal auditors are aware of the risks for fraudulent financial reporting.

Characteristics of the board and the audit committee fall into the opportunities condition. All of the board or audit committee warning signs ranked in the bottom third in terms of importance. Given the growing evidence about the importance of corporate governance mechanisms in reducing the likelihood of fraudulent financial reporting, this result suggests that the effectiveness of auditors’ fraud risk assessments might be enhanced by more emphasis on these factors. SAS 99 stops short of recommending weights that should be assigned to various risk factors or to the three fundamental fraud conditions. This decision is left to auditors’ judgment—a judgment that may be enhanced by seeking and evaluating insights from the client’s internal audit personnel. External auditors attempting to partner with a client’s internal auditors must be aware that while internal auditors do recognize that board and audit committee characteristics are important, these warning signs are ranked near the bottom of their risk assessment list.

Implications for External Auditors

Internal auditors tend to emphasize attitude or rationalization warning signs. This finding is consistent with research results reported indicating that practitioners and forensic experts weigh management characteristics as significantly more important than industry conditions, operating characteristics, or financial stability. On one hand, CPAs can derive comfort from the similarity between internal and external auditors’ ranking of warning signs, but on the other hand, CPAs should give adequate attention to the other two categories.

Recent egregious instances of fraudulent financial reporting have caused external auditors to become more concerned about their ability to detect fraud during audit engagements. External auditors that leverage their clients’ internal auditors’ knowledge will be more effective in obtaining information needed to make informed fraud risk assessments, and better able to detect fraudulent financial reporting.

By successfully leveraging internal auditors’ insights regarding fraud, external auditors will be able to utilize internal auditors as partners in the prevention and detection of fraudulent financial reporting. Training and education about fraud risk factors are useful for external auditors, but identifying warning signs is only the first step. The more demanding task is effectively and efficiently responding to the identified warning signs of fraud.

Given the recent instances of high-profile fraud cases, it is important that CPAs in public practice take actions to restore public confidence in financial reporting. Assessing the fraud knowledge of their clients’ internal auditors, and working with those internal auditors to effectively detect instances of fraudulent financial reporting, is a first step toward this goal.

Audrey A. Gramling, PhD, is an assistant professor of accounting at Georgia State University.
Patricia M. Myers, PhD, is an associate professor of accounting at Brock University, St. Catharines, Ontario.