A store manager creates a fictitious supplier, approves invoices to it for ₦15 million over two years and pays them into his own account. Nobody notices because the manager also approves the receipt of the goods. The directors are shocked and ask the auditors why they did not find it. The honest answer lies in what an audit promises.
The auditor must plan to find material misstatement, including from fraud, and must be alert to fraud. But the audit is not an investigation, and the duty to prevent and detect fraud rests with management.
This topic covers the definition of fraud, the responsibilities of management and the auditor under International Standard on Auditing (ISA) 240, the two types of fraud, procedures to assess fraud risk, risk factors, the response and reporting. A later group of topics covers forensic investigation in depth.
In 30 seconds
Fraud: an intentional act involving deception to gain an unjust or illegal advantage. Error: an unintentional mistake. Responsibility: management prevents and detects fraud; the auditor obtains reasonable assurance that the statements are free from material misstatement, whether from fraud or error. Two types: fraudulent financial reporting and misappropriation of assets. Risk factors: pressure or incentive, opportunity, attitude or rationalisation.
Response: ISA 330 procedures; report to management; consider a duty to report to authorities.
Key terms in plain English
| Term | What it means |
|---|---|
| Fraud | An intentional act of deception to gain an unjust or illegal advantage |
| Error | An unintentional mistake |
| Management override | Management overruling controls to misstate figures |
| Misappropriation of assets | Stealing or misusing the entity's assets |
| Fraud triangle | Pressure, opportunity and rationalisation |
| Fictitious supplier | A supplier that does not exist, used to divert payments |
Syllabus check
This topic is in syllabus area A, process of audit and assurance (20% of marks). It covers:
- fraud and the auditor's responsibilities (ISA 240)
- the assessment of the risk of material misstatement from fraud
- the forensic accounting link
CAMA 2020 and fraud
The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.
| Section | What it says | Link to this topic |
|---|---|---|
| s. 404(1) | The auditors report on whether the statements give a true and fair view | Material fraud may make the statements untrue or unfair |
| s. 405 | Corporate responsibility for financial reports | Management and the company answer for the reports |
| s. 406 | Improper influence on the conduct of audit | Pressure on the auditor can be a sign of fraud |
The rules in more depth
Fraud and error
Fraud is an intentional act by one or more persons that involves deception to gain an unjust or illegal advantage. Error is a genuine mistake or omission and is not intentional. The distinction is intent. A statutory audit aims to give an opinion on whether the financial statements give a true and fair view.
Its objective is not primarily the prevention or detection of fraud. The auditor is concerned with fraud only so far as it could affect the view shown by the statements, which means the risk of material fraud.
Who is responsible
Management has the main responsibility for setting up systems and controls to prevent or detect fraud and error, and internal audit may monitor them. Management may also ask internal audit to review the entity's exposure to fraud or to do a special investigation into suspected fraud.
Under company law the company is answerable for its financial reports (section 405 of the Companies and Allied Matters Act 2020 (CAMA 2020)). The auditor reports to the members on the statements under section 404(1).
The auditor's responsibilities under ISA 240
The objectives under ISA 240, The Auditor's Responsibilities Relating to Fraud in an Audit of Financial Statements, are the same as for other areas: to identify and assess the risks of material misstatement, and to get sufficient appropriate evidence about them through suitable procedures. The auditor must also respond properly to fraud or suspected fraud found during the audit. Professional scepticism is especially important.
ISA 240 says that unless the auditor has reason to believe otherwise, records and documents may be accepted as genuine, and that if management's answers to enquiries are inconsistent, the auditor must investigate the inconsistencies, as they may point to fraud.
The two types of fraud
| Type | What it includes |
|---|---|
| Fraudulent financial reporting | Forging or altering accounting records or supporting documents; misrepresenting or intentionally leaving out events or transactions; intentionally misapplying accounting principles. It often involves management override of controls. |
| Misappropriation of assets | Embezzling receipts, for example by diverting them to personal accounts; stealing physical assets such as inventory, or intellectual property, for example by selling trade secrets; making the entity pay for goods and services it did not receive, for example through fictitious suppliers; using the entity's assets for personal use |
Procedures to assess fraud risk
ISA 240 requires the auditor to:
- make enquiries of management about its assessment of the risk of material fraud, the process for identifying and responding to fraud risks, specific risks identified or likely, and communications within the entity about fraud, including to employees about management's views on business practices and ethical behaviour;
- enquire of management and others in the entity whether they know of any actual, suspected or alleged frauds and get their views on fraud risk;
- evaluate unusual or unexpected relationships found in analytical procedures that may indicate fraud risk; and
- evaluate information from other risk assessment procedures to see if fraud risk factors are present.
Fraud risk factors
Fraud risk factors are best grouped under three headings, known as the fraud triangle: pressure or incentive, opportunity and attitude or rationalisation.
| Heading | Examples |
|---|---|
| Pressure or incentive | The need to meet third-party expectations, for example to get more finance; management paid profit-related bonuses; profitability under threat from competition or technology; personal financial problems or fear of redundancy among staff |
| Opportunity | An ineffective control environment; an industry or operations with complex transactions or significant estimates; large amounts of cash or highly portable, valuable inventory; poor controls over assets, such as no segregation of duties |
| Attitude or rationalisation | Low staff morale; poor communication or enforcement of ethical standards by management; a dominant individual who ignores the rules |
The response to fraud risk
Having identified risks of material misstatement due to fraud, the auditor must under ISA 330 design and carry out further procedures to deal with them. ISA 240 also expects the auditor to:
- treat the risk of fraud in revenue recognition as a significant risk unless there is a good reason not to;
- treat management override of controls as a risk in every audit, and test journal entries, review accounting estimates for bias and examine significant transactions outside the normal course of business;
- build an element of unpredictability into the procedures, such as unannounced visits or testing items not normally tested; and
- assign more experienced staff and increase supervision where fraud risk is high.
If fraud is found or suspected
If the auditor finds fraud, it must be reported to an appropriate level of management as soon as practicable. If management may be involved, the auditor reports to those charged with governance. The auditor evaluates the effect on the financial statements and on the audit report, and considers whether there is a statutory duty to report to the authorities.
The topic on non-compliance with laws and regulations sets out the framework for deciding whether to disclose outside the entity. Where the fraud makes the statements materially misstated, the opinion is modified.
Worked examples
Example 1: fraud or error? A clerk enters ₦250,000 twice by mistake. Another clerk enters an invoice twice on purpose to pay a friend's company.
- The first is error: no intent.
- The second is fraud: intent and deception.
Example 2: type of fraud. (a) The managing director backdates sales to meet a profit target. (b) A cashier diverts customers' cash into his own account.
- (a) Fraudulent financial reporting: misstating the records, with override of controls.
- (b) Misappropriation of assets: embezzling receipts.
Example 3: risk factors. A company has a profit-linked bonus for directors, a weak control environment, cash takings of ₦20 million a month and staff who are not paid on time.
- Pressure or incentive: the bonus, and staff pay problems.
- Opportunity: weak controls and large cash.
- The auditor assesses a high fraud risk and plans extra work on revenue, cash and journals.
Example 4: inconsistent answers. The finance director says sales rose because of a new product. The sales manager says there was no new product.
- The answers are inconsistent, and ISA 240 requires the auditor to investigate.
- The auditor examines the product list, the orders and the cut-off, and widens the testing if needed.
How to score full marks
- Define fraud and error by intent.
- Say clearly that management is responsible and that the auditor gives reasonable assurance on material misstatement.
- Group risk factors under pressure, opportunity and rationalisation.
- Name the two types of fraud with an example of each.
Common mistakes in the exam
- Saying the auditor is responsible for preventing fraud.
- Saying the audit guarantees that no fraud exists.
- Forgetting management override and revenue recognition.
- Not stating that fraud must be reported to management.
Quick revision
- Fraud is intentional; error is not.
- Management prevents and detects; the auditor assesses and responds.
- Two types: financial reporting and misappropriation.
- Risk factors: incentive, opportunity, rationalisation.
- Report to management and consider the authorities.
Practice questions
Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.
Question 1. Fraud differs from error because fraud is:
- Intentional
- Larger
- Older
- Easier to find
Show the answer
A. It involves intent and deception.
Question 2. The main responsibility for preventing fraud lies with:
- The external auditor
- Management
- The registrar
- The tax authority
Show the answer
B. Management and those charged with governance.
Question 3. ISA 240 deals with:
- The auditor's responsibilities relating to fraud
- Materiality
- Sampling
- Written representations
Show the answer
A. Fraud in an audit of financial statements.
Question 4. Forging accounting records is:
- Fraudulent financial reporting
- Misappropriation of assets
- An error
- A tax matter
Show the answer
A. It misstates the records.
Question 5. Creating a fictitious supplier is:
- Misappropriation of assets
- An error
- A control
- Fraudulent reporting only
Show the answer
A. The entity pays for goods not received.
Question 6. Which is a fraud risk factor of pressure?
- Profit-related bonuses for management
- A strong control environment
- Segregation of duties
- Staff rotation
Show the answer
A. An incentive to misstate.
Question 7. If management's answers to enquiries are inconsistent, the auditor must:
- Ignore them
- Investigate the inconsistencies
- Accept the first answer
- Resign
Show the answer
B. As ISA 240 requires.
Question 8. Management override of controls is especially linked to:
- Fraudulent financial reporting
- Petty cash
- Tax
- Inventory counts
Show the answer
A. It is often used in misreporting.
Question 9. A fraud found by the auditor must be reported:
- To an appropriate level of management as soon as practicable
- Only at the end of the year
- Only to shareholders
- Never
Show the answer
A. And the auditor considers any statutory duty.
Question 10. An audit gives:
- A guarantee that no fraud exists
- Reasonable assurance that statements are free from material misstatement
- No assurance
- Absolute assurance
Show the answer
B. Reasonable assurance only.
Question 11 (10 marks). Distinguish between fraud and error and explain the responsibilities of management and the auditor for fraud. (8 marks)
Question 12 (10 marks). Describe the two types of fraud identified by ISA 240 with two examples of each. (6 marks)
Question 13 (10 marks). Explain fraud risk factors under the headings of pressure, opportunity and rationalisation, and the auditor's response. (6 marks)
Model answers
Show the model answer to Question 11
Fraud: intentional act involving deception for an unjust or illegal advantage; error: unintentional mistake. (2) Management prevents and detects fraud through controls. (2) Auditor: obtains reasonable assurance that the statements are free of material misstatement from fraud or error, assesses fraud risk, maintains scepticism, responds and reports; the audit is not an investigation. (4)
Show the model answer to Question 12
Fraudulent financial reporting: forging or altering records; omitting transactions; misapplying accounting principles; often management override. (3) Misappropriation of assets: embezzling receipts; stealing inventory; fictitious suppliers; personal use of assets. (3)
Show the model answer to Question 13
Pressure: bonuses, expectations, threats to profit; opportunity: weak controls, cash, complex estimates; rationalisation: poor ethical tone. (3) Response: ISA 330 procedures; revenue and override tests; unpredictability; more experienced staff; report to management. (3)
Spotted a mistake? Tell us and we will check it.
