Fraud risk indicators

Fraud is an intentional act involving deception to obtain an unjust or illegal advantage. It's the intention that separates fraud from error. ISA 240 deals with two kinds that cause material misstatement:

• Fraudulent financial reporting — deliberate misstatement of the statements: fictitious revenue, hidden liabilities, biased estimates, manipulated cut-off, misleading disclosures. Usually involves management.
• Misappropriation of assets — theft: pocketing receipts, fictitious suppliers or employees, stolen inventory, personal expenses charged to the company. Usually by employees, often concealed with false records.

The fraud triangle explains when fraud is likely: incentive or pressure (bonus targets, covenants, market expectations, personal debts), opportunity (weak controls, override, complex transactions, related parties) and attitude or rationalisation ("I'll pay it back", "everyone does it", disdain for controls). Auditors look for all three when assessing fraud risk.

Management and those charged with governance are primarily responsible for preventing and detecting fraud. The auditor is responsible for obtaining reasonable assurance that the statements as a whole are free from material misstatement, whether caused by fraud or error. Because fraud is concealed — often by forgery or collusion — the risk of not detecting a material fraud is higher than for error, and higher still when management is involved. That's why ISA 240 insists on professional scepticism throughout, whatever the auditor's past experience of management's honesty.

ISA 240 builds in two standing risks: 1. A presumed risk of fraud in revenue recognition, which the auditor can rebut only with documented reasons. 2. The risk of management override of controls, which is present in every entity and can't be rebutted. Required responses: test the appropriateness of journal entries and other adjustments, review accounting estimates for bias (including looking back at prior estimates), and evaluate the business rationale of significant unusual transactions.

The engagement team also holds a discussion about where the statements are susceptible to fraud, and the auditor makes inquiries of management, internal audit and those charged with governance.