● Human resource policies that minimize the chance of hiring or promoting individuals with low levels of honesty, especially for positions of trust
● Training – both at the time of hire and on an ongoing basis – about the entity's values and its code of conduct
● Confirmation from employees that they understand and have complied with the entity's code of conduct and that they are not aware of any violations of the code
● Appropriate investigation and response to incidents of alleged or suspected fraud
Evaluating Antifraud Programs and Controls
The entity's risk assessment process (as described in the separate chapter on AU-C 315) should include the consideration of fraud risk. With an aim toward reducing fraud opportunities, the entity should take steps to:
● Identify and measure fraud risk.
● Mitigate fraud risk by making changes to the entity's activities and procedures.
● Implement and monitor an appropriate system of internal control.
Develop an Appropriate Oversight Process
The entity's audit committee or board of directors should take an active role in evaluating management's:
● Creation of an appropriate culture
● Identification of fraud risks
● Implementation of antifraud measures
To fulfill its oversight responsibilities, audit committee members should be financially literate, and each committee should have at least one financial expert. Additionally, the committee should consider establishing an open line of communication with members of management one or two levels below senior management to assist in identifying fraud at the highest levels of the organization or investigating any fraudulent activity that might occur.
AU-C Illustrations
Illustration 1. Risk Factors – Fraudulent Financial Reporting
The following are examples of risk factors, reproduced with permission from AU-C Section 240 Appendix A, relating to misstatements arising from fraudulent financial reporting:
Incentives/Pressures
a. Financial stability or profitability is threatened by economic, industry, or entity operating conditions, such as (or indicated by):
● High degree of competition or market saturation, accompanied by declining margins.
● High vulnerability to rapid changes, such as changes in technology, product obsolescence, or interest rates.
● Significant declines in customer demand and increasing business failures in either the industry or overall economy.
● Operating losses making the threat of bankruptcy, foreclosure, or hostile takeover imminent.
● Recurring negative cash flows from operations or an inability to generate cash flows from operations while reporting earnings and earnings growth.
● Rapid growth or unusual profitability, especially compared to that of other companies in the same industry.
● New accounting, statutory, or regulatory requirements.
b. Excessive pressure exists for management to meet the requirements or expectations of third parties due to the following:
● Profitability or trend level expectations of investment analysts, institutional investors, significant creditors, or other external parties (particularly expectations that are unduly aggressive or unrealistic), including expectations created by management in, for example, overly optimistic press releases or annual report messages.
● Need to obtain additional debt or equity financing to stay competitive – including financing of major research and development or capital expenditures.
● Marginal ability to meet exchange listing requirements or debt repayment or other debt covenant requirements.
● Perceived or real adverse effects of reporting poor financial results on significant pending transactions, such as business combinations or contract awards.
● A need to achieve financial targets required in bond covenants.
● Pressure for management to meet the expectations of legislative or oversight bodies or to achieve political outcomes, or both.
c. Information available indicates that management's or the board of directors' personal financial situation is threatened by the entity's financial performance arising from the following:
● Significant financial interests in the entity.
● Significant portions of their compensation (for example, bonuses, stock options, and earn-out arrangements) being contingent upon achieving aggressive targets for stock price, operating results, financial position, or cash flow.10
● Personal guarantees of debts of the entity.
d. There is excessive pressure on management or operating personnel to meet financial targets set up by the board of directors or management, including sales or profitability incentive goals.
Opportunities
a. The nature of the industry or the entity's operations provide opportunities to engage in fraudulent financial reporting that can arise from the following:
● Significant related-party transactions not in the ordinary course of business or with related entities not audited or audited by another firm.
● A strong financial presence or ability to dominate a certain industry sector that allows the entity to dictate terms or conditions to suppliers or customers that may result in inappropriate or non-arm's-length transactions.
● Assets, liabilities, revenues, or expenses based on significant estimates that involve subjective judgments or uncertainties that are difficult to corroborate.
● Significant, unusual, or highly complex transactions, especially those close to period end that pose difficult “substance over form” questions.
● Significant operations located or conducted across international borders in jurisdictions where differing business environments and cultures exist.
● Significant bank accounts or subsidiary or branch operations in tax-haven jurisdictions for which there appears to be no clear business justification.
b. There is ineffective monitoring of management as a result of the following:
● Domination of management by a single person or small group (in a nonowner-managed business) without compensating controls.
● Ineffective board of directors or audit committee oversight over the financial reporting process and internal control.
c. There is a complex or unstable organizational structure, as evidenced by the following:
● Difficulty in determining the organization or individuals that have controlling interest in the entity.
● Overly complex organizational structure involving unusual legal entities or managerial lines of authority.
● High turnover of senior management, counsel, or board members.
d. Internal control components are deficient as a result of the following:
● Inadequate monitoring of controls, including automated controls and controls over interim financial reporting (where external reporting is required).
● High turnover rates or employment of ineffective accounting, internal audit, or information technology staff.
● Ineffective accounting and information systems, including situations involving reportable conditions.
● Weak controls over budget preparation and development and compliance with law or regulation.
Attitudes/Rationalizations
Risk