HOUCK 00.qxd
5/30/03
12:57 PM
Page i
Why and How Audits Must Change
◆
PRACTICAL GUIDANCE TO IMPROVE YOUR AUDITS
Thomas P. Houck, CPA
John Wiley & Sons, Inc.
HOUCK 01.qxd
5/30/03
12:05 PM
Page 2
HOUCK 00.qxd
5/30/03
12:57 PM
Page i
Why and How Audits Must Change
◆
PRACTICAL GUIDANCE TO IMPROVE YOUR AUDITS
Thomas P. Houck, CPA
John Wiley & Sons, Inc.
HOUCK 00.qxd
5/30/03
12:57 PM
Page ii
This book is printed on acid-free paper. ∞ Copyright © 2003 by John Wiley & Sons, Inc. All rights reserved. Published by John Wiley & Sons, Inc., Hoboken, New Jersey Published simultaneously in Canada No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, 978-750-8400, fax 978-750-4470, or on the web at www.copyright.com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, 201-748-6011, fax 201-748-6008, e-mail:
[email protected]. Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Neither the publisher nor author shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services, or technical support, please contact our Customer Care Department within the United States at 800-762-2974, outside the United States at 317-572-3993 or fax 317-572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic books. For more information about Wiley products, visit our web site at www.wiley.com. Library of Congress Cataloging-in-Publication Data: Houck, Thomas P. Why and how audits must change : practical guidance to improve your audits / Thomas P. Houck. p. cm. Includes index. ISBN 0-471-44429-4 (CLOTH) 1. Auditing. 2. Auditing, Analytical review. I. Title. HF5667.H677 2003 657'.45--dc21 2003001703 Printed in the United States of America 10 9 8 7 6 5 4 3 2 1
HOUCK 00.qxd
5/30/03
12:57 PM
Page iii
This book is dedicated to my late father, Paul W. Houck. He devoted countless hours to helping me become a better writer.
HOUCK 00.qxd
5/30/03
12:57 PM
Page iv
◆ About the Author
Thomas P. Houck is the founder and Chairman of AuditWatch, Inc. He is a nationally recognized authority on auditing and has been named to Accounting Today’s List of 100 Most Influential Persons in the profession for the past four years. In 1995, Tom created the Audit Productivity Improvement ProgramSM, a comprehensive training program used by hundreds of top accounting firms to strengthen audit quality and improve efficiency. He also oversaw the development of AuditWatch University SM, a five-level training program for staff auditors. For more information about the author and about AuditWatch, visit www.auditwatch.com.
iv
HOUCK 00.qxd
5/30/03
12:57 PM
Page v
◆ Contents
Preface
vii
1. A WAKE-UP CALL FOR ALL AUDITORS “Please, Don’t Compare Us to Andersen!” Fundamental Change Is Still Needed Purpose of This Book
1 4 7 9
2. RISK-BASED AUDITING: SAVIOR OR VILLAIN? Why Many Firms Resist Risk-Based Auditing Progress Must Be Made
13 16 19
3. THE RISK OF “COOKING THE BOOKS” General Methods of Cooking the Books Why Companies Cook the Books How Auditors Should Assess the Risk that a Client Has Cooked the Books Tailoring Audit Programs
21 24 27
4. OTHER RISKS AND CONSIDERATIONS Ask “Anticipation” Questions Perform Proactive Research about the Client’s Business Perform a Diligent Preliminary Analytical Review Risk Assessments During Fieldwork
53 56 57 62 63
5. THE MANY BENEFITS OF ANALYTICAL PROCEDURES Quality Efficiency Client Service Staff Morale
67 71 74 76 78
6. COMMON PITFALLS OF ANALYTICAL PROCEDURES Uncorroborated Client Explanations
81 84
v
35 47
HOUCK 00.qxd
5/30/03
12:57 PM
Page vi
Contents
Imprecise Explanations Lack of Informed Expectations Setting Scopes for Variance Analyses
89 93 101
7. AN EASY APPROACH TO IMPLEMENTING ANALYTICAL PROCEDURES Step One: Think Analytical First Step Two: Determine the Proper Strength Step Three: Test and Evaluate Results Lousy Internal Controls Closing Thoughts
103 105 119 123 129 132
8. INTERNAL CONTROL: THE MISUNDERSTOOD CHILD Types of Controls Minimum Audit Requirements
135 139 146
9. TO TEST OR NOT TO TEST A Four-Step Approach to Testing Controls Step One: Evaluate Cost-Benefits Step Two: Identify Specific Controls to Test Step Three: Select and Perform Control Tests Step Four: Arrive at Conclusions Conclusion
155 159 159 164 169 173 175
10. TALKIN’ TO THE CLIENT Who Should Ask the Questions? How Reliable Is the Evidence Source? Do You Hear What I Hear?
177 180 181 182
11. DATA EXTRACTION SOFTWARE Purpose of This Chapter Benefits of Data Extraction Software Case Study How to Proceed
187 190 191 196 199
12. ACTION STEPS Thinkers and Robots Three Essential Steps for Transforming Your Firm Closing Thoughts
207 209 211 227
Index
229
vi
HOUCK 00.qxd
5/30/03
12:57 PM
Page vii
◆ Preface
For more than a decade, I have studied how independent auditors fulfill their responsibilities. As the founder of AuditWatch, I’ve had the privilege of serving and observing hundreds of accounting firms throughout the United States and Canada. This includes both big and small firms, and progressive as well as unsophisticated companies. Based on my experience, there’s no doubt as to what must be done to improve the quality of independent audits. Most importantly, all auditors must be highly trained professionals who display sound judgment while accomplishing their objectives. Since every engagement is different, the exact approach will vary from job to job. This is why auditors must be capable of designing and implementing the best approach for any given circumstance. In this book, I identify four crucial areas in which every auditor needs to be proficient: ◆ ◆ ◆ ◆
Risk-based auditing Analytical procedures Internal controls Technology (specifically, data extraction)
An auditor who fails to master these fundamentals is like a golfer who doesn’t properly hold a club, or a trumpet player who can’t read music. These auditors are unlikely to detect material frauds and prevent the issuance of misleading financial statements. vii
HOUCK 00.qxd
5/30/03
12:57 PM
Page viii
Preface
Unfortunately, the truth is that most auditors are not sufficiently skilled in these areas. This is a major reason why so many engagement teams implement the SALY (same-as-last-year) approaches that are prevalent throughout the accounting profession. In addition to higher competency levels, the culture at most accounting firms must change. The best training in the world is of limited value if an organization’s culture fails to support and reinforce the fundamentals of effective auditing. This book delves deeply into all of these topics, providing specific and practical examples that are applicable to all accounting firms. My recommendations are not abstract or theoretical. At AuditWatch, I’ve seen both large and small clients implement these ideas with great success over the past ten years. In 2002, the accounting profession was forever changed after a string of financial scandals made the headlines. Unfortunately, a repeat scenario is possible unless accounting firms make the necessary changes in their cultures and offer better audit training for their professionals. This is, by far, the most pressing issue that accounting firms and regulators must address in any efforts to restore and improve the credibility of independent auditing. I assure you that mastering the concepts in this book is the best way to improve audit quality. In addition, this will produce a positive impact on productivity, client service and the morale of audit professionals. Yes, a win-win outcome is possible for both accounting firms and users of financial statements! NOTICE TO OUR READERS
As we went to press, the Public Company Accounting Oversight Board had just voted to take control of establishing auditing standards for public company audits. At present, it is not known how this decision will alter the audits of public companies or if there will be a cascading effect on the audits of other companies, but it seems likely that there will be an impact on the audits of non-public companies. viii
HOUCK 01.qxd
5/30/03
12:05 PM
Page 1
1 A WAKE-UP CALL FOR ALL AUDITORS
HOUCK 01.qxd
5/30/03
12:05 PM
Page 2
HOUCK 01.qxd
5/30/03
12:05 PM
Page 3
T
he year 2002 was not a good one for the accounting profession. And that’s putting it mildly! The profession’s problems started after high-flying Enron Corporation suddenly declared bankruptcy. As shocked investors and employees reeled over the sudden disappearance of vast sums of money, the finger-pointing started immediately. Much of the blame for and anger over the losses was directed at Arthur Andersen, the company’s independent auditing firm. Not only did the once-venerable accounting firm apparently screw up the Enron audit, it then made matters worse by shredding documents related to the scandalous case. Like it or not, independent auditors became regular features in front-page news stories and banner headlines. The media attention was unprecedented, and criticism of accounting firms rose to near-hysterical levels as new scandals broke and more apparent accounting misdeeds were uncovered in the months following the Enron collapse. “Where were the auditors?” and “What’s wrong with accounting?” became some of the most frequently asked questions of the year. A Fortune magazine article declared: We used to think [accountants] were wise, honest, and probing, necessary to keep gung-ho management straight. Now it’s clear: They’re not.1 3
HOUCK 01.qxd
5/30/03
12:05 PM
Page 4
Why and How Audits Must Change
The Wall Street Journal ran numerous stories depicting auditors in a negative light. One front-page article ran under this pointed headline: How Decade of Greed Undid the Proud Respectability of a Very Old Profession2
Remarkably, within just a few months of Enron’s bankruptcy filing, Andersen was essentially driven out of business, and the reputation and credibility of the entire accounting profession had taken an abrupt nosedive. Auditors were the subject of jokes by late-night comedians and scored lower than lawyers in public opinion polls. Despite these stunning events, a return to normalcy appeared likely in the spring of 2002. That is, until WorldCom announced a massive restatement of earnings after a multibilliondollar accounting fraud was discovered. The accounting profession took it on the chin once again! Whereas Enron “cooked the books” using complicated and tricky techniques, WorldCom’s fraud was amazingly simple. Management simply capitalized expenditures that should have been expensed on the income statement. This simple technique added billions of dollars in profits and dramatically altered the true financial condition of the company. Fortunately for the accounting profession, Arthur Andersen was again the “culprit”— or scapegoat—for having failed to uncover this massive fraud.
“PLEASE, DON’T COMPARE US TO ANDERSEN!” In the aftermath of these high-profile scandals, accounting firms of all sizes rushed to distance themselves from Andersen. The firm that had been highly respected—to the point of nearveneration—just months before was now labeled by its peers as a bunch of “rogue auditors” who had abandoned the values of 4
HOUCK 01.qxd
5/30/03
12:05 PM
Page 5
A Wake-Up Call for All Auditors
the profession. But guess what? Regulators, politicians, and investors didn’t buy the claim that Andersen was an isolated exception. By the summer of 2002, the capital markets had seemingly lost all faith in the credibility of corporate financial statements. Even though Andersen was no longer a force in the auditing world, stock prices continued to decline. As a result, concerned regulators and politicians expressed their strong determination to restore confidence in financial reporting in the United States. For example, the Securities and Exchange Commission (SEC) became very aggressive in identifying and prosecuting wrongdoers. Suits were brought and fines levied against both allegedly miscreant companies and their accounting firms. In addition, this federal agency required that senior management at public companies personally certify the numbers on their companies’ financial filings. In short, the government and business communities no longer trusted auditors to catch material errors. In essence, many people believed that the audit opinion had become worthless. Most of the criticisms of the accounting profession centered on an issue raised by Arthur Levitt, former chairman of the SEC. In the late 1990s, Levitt sparked a major controversy at the SEC by attempting to ban accounting firms from providing consulting services to audit clients. Though this practice had become widespread throughout the profession, Levitt believed it constituted a conflict of interest that tainted the judgment of auditors. At a cursory level, his reasoning made sense. If a company paid an accounting firm boatloads of money for consulting services, the auditors might be inclined to look the other way if the company used creative, dubious, or overly aggressive accounting treatments—particularly if the auditors’ co-employees on the consulting side had suggested the tactics in the first place. 5
HOUCK 01.qxd
5/30/03
12:05 PM
Page 6
Why and How Audits Must Change
Nevertheless, Levitt failed to present tangible evidence to support his contentions. In fact, numerous research studies have concluded that there is no basis to such claims.3 Furthermore, many smart people reasonably believed that audit quality might suffer if such a ban were implemented. So, for a variety of reasons, and after a heated and contentious debate, Levitt found himself unable to implement the proposed ban. Fast-forward to 2002: When the public learned that Enron had paid tens of millions of dollars in consulting fees to Andersen, this old issue resurfaced quickly. This time, however, there was to be no debate. Virtually everyone agreed that what was now presumed to be a conflict of interest was a huge problem. In essence, people apparently believed that auditors were willing to sell their (professional) souls to make a few (consulting) bucks. As one investment manager put it, “All accountants are sheep”; the implication was that auditors would never dare stand up to their clients when disagreements arose, for fear of losing their lucrative consulting engagements. Of course, this characterization was unfair and untrue. But politicians needed to rant and rave about something—and pin blame on something—and “consulting services” were an easy target. The politicans accomplished this with assistance from the media, which showed little interest in fair and objective reporting. Unfortunately, yet more bad news arrived on the doorstep of the accounting profession in the spring of 2002. A survey by NFO WorldGroup revealed that clients perceived their auditors to be “incompetent.”4 Wow! What’s worse than being called sheep? That’s right, being called incompetent sheep! Not only were auditors accused of lacking integrity, but now their basic competence was being called into question. It seemed that the state of affairs couldn’t get much worse. Not surprisingly, this environment acted as an engraved invitation for Congress to leap into action. In response to the 6
HOUCK 01.qxd
5/30/03
12:05 PM
Page 7
A Wake-Up Call for All Auditors
growing list of financial scandals, the nation’s elected representatives in Washington, D.C., enacted sweeping legislation to “fix” many of the accounting profession’s problems. The result was the Sarbanes-Oxley Act of 2002, signed into law by President George W. Bush. Among other things, this legislation created a new federal agency (the Public Company Accounting Oversight Board) to regulate audits of public companies. And, yes, accounting firms were finally banned from providing a variety of consulting services to audit clients.
FUNDAMENTAL CHANGE IS STILL NEEDED The Sarbanes-Oxley legislation (and the resulting fallout) created numerous issues for many firms. For example, would the state CPA societies impose similar restrictions on consulting services at nonpublic companies? At the time this book went to press, many of these matters remained unresolved. In addition, the Auditing Standards Board proposed and issued new professional standards to help audit firms improve both their methods and their track records for addressing risk and detecting fraud. Nonetheless, after a tumultuous year in 2002, the dust has largely settled. For the most part, practitioners are returning to business as usual. Another storm has been weathered. But firms that adopt this attitude are making a major mistake! The events of 2002 should serve as a wake-up call for any accounting firm that conducts independent audits. Folks, it’s crucial to look in the mirror and objectively evaluate the state of your audit practice. For starters, the rapid demise of Andersen should scare the you-know-what out of any firm that opines on financial statements. This is serious stuff: The public trust is involved! In7
HOUCK 01.qxd
5/30/03
12:05 PM
Page 8
Why and How Audits Must Change
vestors, lenders, managers, and others rely on the statements that auditors certify. If an accounting firm blows it, the consequences can be catastrophic. “But we don’t audit public companies,” you might respond. That doesn’t matter. Whenever financial statements are issued, an accounting firm assumes risk. That’s why you get paid! Of course, most firms have always been concerned about quality, and have taken steps to address this issue. In reality, though, these actions fall short. Accounting firms must raise their standards and learn to conduct better-quality audits. In short: Fundamental changes must occur in the vast majority of auditing firms.
What kind of changes? Changes in how audits are conducted. Changes in how engagements are planned. Changes in how evidence is obtained and analyzed. Changes in how professionals are trained. You see, an overriding problem continues to exist in the accounting profession. The audit approaches used by the vast majority of firms are inadequate and out-of-date. They rely too heavily on detailed procedures (e.g., confirming, vouching, recalculating) that have been used for decades, and many times have evolved into unthinking, mechanical routines. Not only are these approaches inefficient and costly, they are woefully inadequate for detecting material fraud. Mulford and Comiskey’s book, The Financial Numbers Game: Detecting Creative Accounting Practices, describes the many methods companies use, not only to cook the books, but also to fool the auditors. These authors note, for example: Cover-up activities might take the form of backdating invoices, changing shipping dates, or creating totally false records. The actions taken often are limited only by the imagination of those concocting the scheme.5 8
HOUCK 01.qxd
5/30/03
12:05 PM
Page 9
A Wake-Up Call for All Auditors
In other words, even a normally competent practitioner can vouch or confirm every transaction for the entire year and still fail to detect material fraud. It’s simply too easy for management to hoodwink auditors with phony documents, fake signatures, bogus explanations, and so forth. Auditors have to remember, though, that when a fraud is ultimately uncovered, the public doesn’t care about (or lend any credence to) flimsy defenses like “management didn’t tell us they were cooking the books” or “we’re not trained to catch fraud.” This serious problem can be corrected only by fundamental changes in the way auditing engagements are conducted. Auditors must adopt approaches and use procedures that offer better odds of detecting material fraud. Fortunately, the necessary audit approaches and procedures are not a mystery. Our profession doesn’t have to undertake a massive research project to figure out how to improve financial audits. In fact, smart auditors have already been implementing these approaches for years. Generally accepted auditing standards (GAAS) already encourage application of the approaches and techniques that must become widespread in our profession. In other words, accounting firms don’t have any excuses for further delayit’s time to modernize your audit approaches right away!
PURPOSE OF THIS BOOK This book addresses several major areas that accounting firms must address to improve independent audits. Specifically, it covers the following topics: ◆ Risk-based auditing ◆ Analytical procedures ◆ Internal controls 9
HOUCK 01.qxd
5/30/03
12:05 PM
Page 10
Why and How Audits Must Change
◆ Data extraction software ◆ Cultural change If auditors better understand and properly implement these concepts, quality will improve dramatically. Does this mean that accounting scandals will never happen again? Of course not. But independent auditors will have much greater success in preventing material frauds from occurring, and will be able to uncover attempted fraud much earlier. “But,” you might respond, “my firm already addresses most of the items on this list. This isn’t anything new.” This may be true. But the problem is that most firms fail to go far enough in implementing these concepts. For instance, every accounting firm performs analytical procedures, but those procedures are not as strong or extensive as they should be. As a result, auditors rely too heavily on detailed procedures to gain comfort about the fairness of the financial statements. Unfortunately, accountants are not quick to acknowledge or accept the need for change. Although these more effective audit approaches have been available for years, most firms have continued to use inferior alternatives, for a variety of reasons that include: ◆ ◆ ◆ ◆ ◆
Complacency Familiarity Fear of change Unwillingness to invest in training Skewed or poorly set priorities
However, these folks can no longer afford to keep their heads in the sand. The scandals of 2002 have changed our profession forever. Auditors simply cannot continue to perform audits using methods and procedures that have only a miniscule chance of detecting material fraud.
10
HOUCK 01.qxd
5/30/03
12:05 PM
Page 11
A Wake-Up Call for All Auditors
As Samuel A. DiPiazza, Jr., and Robert G. Eccles state in their book Building Public Trust: This much is abundantly clear: independent auditing firms must address the questions raised about the quality and relevance of their work. They must do this quickly because the public trust is fragileeasy to lose and hard to regain.6
In short, it’s clear that every accounting firm should seriously evaluate its audit approach and make real improvements. Don’t settle for incremental changes when more dramatic actions are needed. In other words, don’t stick on a bandage when surgery is necessary! When you begin examining your firm, realize that evaluating an audit approach involves far more than assessing the provider of audit programs. In fact, your current forms and checklists are probably fine. Most manuals allow tremendous flexibility in designing and implementing audit approaches. The real key to success is to create a culture that encourages intelligent application of the approaches described in this book. This includes establishing and maintaining an environment in which well-trained professionals continuously strive to find more effective ways to fulfill their responsibilities. This, unfortunately, will come into direct conflict with the rote, “sameas-last-year” mentality that exists at so many accounting firms. Chapter 12 addresses this topic at greater length. While reading this book, you’ll encounter many examples of how to perform better audits. Many are simple, whereas others are more advanced. Rest assured that each one is applicable in virtually every accounting firm practicing today. Along those same lines, be very careful when you run across a seemingly simple example. It’s tempting to think, “I know that already.” But that isn’t the point, is it? The issue is whether you
11
HOUCK 01.qxd
5/30/03
12:05 PM
Page 12
Why and How Audits Must Change
(and everyone else in your firm) implement this idea and knowledge consistently in the real world. Well, it’s time to get started. So I must offer you a warning. Have you seen the hit movie The Santa Clause? In this movie, when Scott Calvin (played by Tim Allen) picks up Santa’s calling card off the ground near his house, he is obligated to become the next Santa, whether he wants to or not. It’s the same deal with this book. Now that you’ve picked up this book, you have an obligation to challenge the practices at your own firm. You don’t have a choice! Fortunately, like Scott Calvin, you can become a hero by helping your firm take the necessary steps to change. Have fun reading!
NOTES 1. 2. 3.
4.
5.
6.
Stanley Bing, “Lessons from the Abyss,” Fortune, February 18, 2002, p. 49. Ianthe Jeanne Dugan, “Did You Hear the One about the Accountant?” Wall Street Journal, March 14, 2002, p. A1. Mark L. Defond (University of Southern California–Leventhal School of Accounting), Kannan Raghunandan (Texas A&M International University-College of Business), and K.R. Subramanyam (University of Southern California), “Do Non-audit Service Fees Impair Auditor Independence? Evidence from Going-Concern Audit Opinions,” January 2002: http://papers.ssrn.com/so13/papers.cfm? abstract_id=297747. NFO WorldGroup, “Accounting Faces Crisis of Competence, Not Integrity; ‘Andersenitis’ Isn’t What Ails the Industry,” April 2002: www.newstream.com/us/story_pub.shtml?story_id=5607&user_ip=65.114. 26.62. Charles W. Mulford and Eugene E. Comiskey, The Financial Numbers Game: Detecting Creative Accounting Practices (Hoboken, NJ: John Wiley & Sons, 2002), p. 163. Samuel A. DiPiazza, Jr., and Robert G. Eccles, Building Public Trust (Hoboken, NJ: John Wiley & Sons, 2002), p. 154.
12
HOUCK 02.qxd
5/30/03
12:06 PM
Page 13
2 RISK-BASED AUDITING: SAVIOR OR VILLAIN?
HOUCK 02.qxd
5/30/03
12:06 PM
Page 14
HOUCK 02.qxd
5/30/03
12:06 PM
Page 15
D
uring the past decade, the popularity of “risk-based auditing” grew significantly as accounting firms across the continent embraced it. This has been a positive, but puzzling, trend. After all, all audits were always supposed to be risk-based: Our standard-setters realized long ago that it’s not cost-effective to examine everything that transpires in a company. Even if an eager auditor wants to scrutinize every recorded transaction and turn over every stone, the resulting audit still can’t guarantee that the financial statements are fairly stated. Why? Because clients can easily forge supporting documentation, omit transactions from the accounting records, and provide misleading or untrue information to the auditors. In short, there is no such thing as a foolproof or perfect audit. No matter how much evidence is obtained, more tests can always be performed to make the audit stronger. Of course, at some point the cost of gathering additional evidence exceeds the benefits (that is, the principle of diminishing returns kicks in). Therefore, auditors need guidelines to decide when enough is enough. This is why our profession developed the concept of reasonable assurance. This principle basically requires that auditors perform enough work to obtain reasonable assurance that the financial statements are free of material misstatements. Critics sometimes argue that “reasonable” (as opposed to 15
HOUCK 02.qxd
5/30/03
12:06 PM
Page 16
Why and How Audits Must Change
“absolute”) assurance is merely an attempt to reduce legal liability, but such charges are neither thoughtful nor fair. Reasonable assurance is a commonsense, cost-effective concept that enhances the integrity of financial reporting.
WHY MANY FIRMS RESIST RISK-BASED AUDITING We know that auditors can’t possibly look at everything (and even if they could, it still wouldn’t guarantee anything, as previously noted). Thus, practitioners must pick and choose where to spend their time. They must figure out how to generate the most “bang for the buck” from their audit efforts. Naturally, it’s logical to focus on areas that contain the most risk—and that’s exactly the intent of a risk-based audit. Here’s a simple definition of “risk-based audit”: An audit where the engagement team focuses its efforts on areas of higher risk.
Sounds like a no-brainer, right? After all, what’s the alternative to a risk-based approach: an audit that doesn’t focus on the biggest risks? That wouldn’t make any sense. Even so, most accounting firms have resisted the key components of risk-based auditing. Why? For starters, a surprising number of practitioners believe that risk-based auditing is sinister. These folks think that “risk-based auditing” is simply a code phrase for doing less work. This is ridiculous to anyone who understands risk-based auditing. Nevertheless, it’s difficult to get the naysayers to change their minds, especially if they have encountered even one example of a risk-based audit that wasn’t properly implemented (i.e., not enough work was done). Unfortunately, in recent years, some engagement teams at 16
HOUCK 02.qxd
5/30/03
12:06 PM
Page 17
Risk-Based Auditing: Savior or Villain?
certain firms have gone too far in eliminating procedures under the guise of doing risk-based audits. But let’s be fair: If auditors fail to devote adequate attention to important matters, they are not conducting a risk-based audit, no matter what they call it! Even so, critics will use these examples to support their contentions that risk-based audits are poor practice at best and fundamentally evil at worst. Perhaps more common are practitioners who have purchased “risk-based” methodologies, but essentially ignore (or don’t understand) the concepts of risk-based auditing. This happens for three primary reasons.
Standardization First, the accounting profession has a long history of attempting to standardize engagements and eliminate thinking from the audit process. This is why so many audits are performed in a rote, SALY (same as last year) manner. This behavior flies in the face of risk-based auditing. Why is standardization so tantalizing? It presumably provides management with a sense of control. In other words, if engagement teams always perform the same procedures, management knows exactly what will be done on all audits. Although standardization may be convenient for senior audit personnel (especially those who aren’t interested in properly planning and supervising their engagements), it typically hurts audit quality and efficiency. It’s not hard to understand why. If different audits are approached in an identical (i.e., standardized) manner, the engagement team is likely to overaudit, underaudit, or both. For example, the team might end up performing procedures that aren’t necessary. Perhaps the risks being addressed are low at a particular client, and therefore, the procedures are overkill. This constitutes overauditing. 17
HOUCK 02.qxd
5/30/03
12:06 PM
Page 18
Why and How Audits Must Change
Alternatively, the team may not complete enough work in an area that warrants additional attention. In other words, the auditors follow the preset, “canned” program, even though the situation at hand clearly indicates that additional efforts would be prudent. This is an example of underauditing that puts the accounting firm at risk. Supporters of standardization claim that auditors always have the option of deviating from the canned approach, particularly if more work is required. In reality, though, this does not happen nearly enough, because standardized approaches encourage audit professionals to turn off their brains. There is simply less incentive to think critically and to understand the audit objectives when one is routinely following a canned program.
Underplanning Second, the accounting profession has a long history of shortchanging the planning process. Many auditors think that they’re too busy or too important to mess around with planning. A common mentality is “just follow the programs” or “do it like last year.” In other words, why in the world would a partner devote a lot of time to this mindless task? After all, an audit is a commodity. A partner has deadlines to meet, clients to serve, proposals to finish, and so on. If partners have the time to sit around in planning meetings, they must not be very important (or maybe they are neglecting more lucrative business opportunities). This lack of appreciation for audit planning is also contrary to risk-based auditing. To implement the concepts in this book, professionals must spend more time planning their engagements. Audits are not commodities!
18
HOUCK 02.qxd
5/30/03
12:06 PM
Page 19
Risk-Based Auditing: Savior or Villain?
Undertraining Third, few auditors are sufficiently trained to conduct riskbased engagements. Not only must they understand the many aspects of risk-based auditing (as described in Chapters 3 and 4 herein), but they must also be able to effectively apply the other concepts described throughout this book. At present, most independent auditors are ill prepared for this task. As a result, accounting firms must take professional development related to auditing more seriously than in the past (see more on this topic in Chapter 12).
PROGRESS MUST BE MADE Despite many accounting firms’ resistance to risk-based auditing, they have not completely rejected its principles. Virtually every firm utilizes the concept of materiality, an integral component of a risk-based audit. The theory is that larger dollar balances are riskier than smaller ones; therefore, it makes sense to focus on the higher-dollar items. Additionally, in recent years, many firms have acquired or created audit programs to help them better focus on risks. This has generated improvements at some firms, mainly by helping auditors to spend less time in immaterial or non-risky areas. Despite this progress, our profession has a long way to go until it can celebrate the full and proper implementation of risk-based auditing. Fortunately, the Auditing Standards Board understands and promotes the importance of risk-based auditing. Statement on Auditing Standards (SAS) No. 99, Consideration of Fraud in a Financial Statement Audit (issued in 2002), requires auditors to better assess and address the risk of fraudulent financial reporting. In addition, just before this book went to press, the Auditing
19
HOUCK 02.qxd
5/30/03
12:06 PM
Page 20
Why and How Audits Must Change
Standards Board issued an Exposure Draft addressing other aspects of risk-based auditing. In that draft, the Board again stressed the critical importance of conducting risk-based audits. Accounting firms should resist the temptation to comply mechanistically with these new standards by using a checklist approach, while continuing to perform audits essentially as they did in the past. More importantly, true compliance and implementation of risk-based auditing involves adopting a mindset that influences all aspects of the audit. As many people know, risk-based auditing begins in planning, with a careful identification and assessment of various risks. The next step is appropriate tailoring of audit programs to address these risks. Contrary to popular misconceptions, though, risk-based auditing doesn’t end with planning. Smart auditors constantly refer to their risk assessments throughout the engagement, using this information for guidance and direction as a host of other decisions are made. It should be increasingly clear that risk-based auditing is not sinister. Nor is it optional. Accounting firms must understand and implement these concepts if they are to comply with professional standards and raise quality levels. The next two chapters address numerous risks that auditors must understand. That won’t be the last time you hear about risk in this book, though. An engagement team’s risk assessments are needed to implement many of the concepts described later in this book.
20
HOUCK 03.qxd
5/30/03
12:06 PM
Page 21
3 THE RISK OF “COOKING THE BOOKS”
HOUCK 03.qxd
5/30/03
12:06 PM
Page 22
HOUCK 03.qxd
5/30/03
12:06 PM
Page 23
D
uring an audit, it’s critical to properly assess the risk of fraudulent financial reporting. This is the risk that a company has intentionally altered its financial results, often referred to as “cooking the books.” Statement on Auditing Standards No. 82, Consideration of Fraud in a Financial Statement Audit, required auditors to assess this risk on every engagement. Nevertheless, despite the critical importance of this step, most firms addressed this risk by answering “yes” or “no” to questions on checklists, often with little thought or investigation. As a result, the Auditing Standards Board concluded that stronger language was necessary to force auditors to comply with this important requirement. Statement on Auditing Standards No. 99 now requires that auditors discuss this risk during planning. The discussion should include brainstorming about the different ways in which management might commit fraud. Smart auditors have always performed this step, and it is now mandated by professional standards. To successfully comply with this requirement, auditors need to be knowledgeable about various aspects of fraudulent financial reporting. This chapter addresses three important subjects: 1. General methods of cooking the books. 2. Why companies cook the books. 23
HOUCK 03.qxd
5/30/03
12:06 PM
Page 24
Why and How Audits Must Change
3. How auditors should assess the risk that a client has cooked the books.
GENERAL METHODS OF COOKING THE BOOKS This section gives an overview of the ways in which management generally goes about cooking the books. Specific techniques (recipes, if you will) are illustrated in later sections of this chapter. Although some of the following information is basic, it’s imperative that all auditors understand these concepts.
Manipulating the Bottom Line When a company wants to inflate its bottom line (e.g., net income), it can accomplish that objective by any of the following techniques: ◆ ◆ ◆ ◆
Overstating assets Understating liabilities Overstating revenues Understating expenses
For example, WorldCom boosted profits by capitalizing operating costs (i.e., understating expenses). In contrast, Enron understated liabilities by failing to include debt on its balance sheet. Despite these recent and notorious examples, most frauds involve improper revenue recognition (overstatement of assets and revenues). This is why Statement on Auditing Standards (SAS) No. 99 requires auditors to specifically address this risk on all engagements. Even though most high-profile accounting frauds are committed to boost the bottom line, some companies choose to re24
HOUCK 03.qxd
5/30/03
12:06 PM
Page 25
The Risk of “Cooking the Books”
port results that look worse than reality. The methods employed to achieve this goal are the exact opposites of those used to overstate the bottom line. They include: ◆ ◆ ◆ ◆
Understating assets Overstating liabilities Understating revenues Overstating expenses
For example, Microsoft Corporation agreed to a settlement with the Securities and Exchange Commission in 2002 after allegedly understating earnings by material amounts. Specifically, the company established “reserve accounts” to reduce its net income.
Misclassifying Transactions A company can also distort its financial results without altering the bottom line. This typically involves overstating or understating different accounts by identical amounts, while the bottom line remains unchanged. Do you remember the dot-com mania of the late 1990s? During this strange era, the investment community was apparently sold on the notion that profits were unimportant. It seemed like the most important objective for an Internet company was to secure market share, regardless of the cost! Accordingly, the equities market rewarded companies that posted large revenue gains and spent tons of money on marketing, because this supposedly indicated that the company was serious about gaining market share. In response, many Internet companies engaged in unique ways of cooking their books, many of which did not alter their bottom lines. Here’s an example. A Web retailer might sell a $50 product for $45 because the customer was given a $5 discount coupon. 25
HOUCK 03.qxd
5/30/03
12:06 PM
Page 26
Why and How Audits Must Change
A reasonable person might believe that the sales price is thus $45, right? But that’s not how this retail company recorded the transaction. It was posted as a $50 sale, along with a $5 marketing charge. Although the bottom line is unchanged, this accounting treatment distorts the financial results by overstating both sales and marketing expenses. Of course, investors were greatly pleased. A similar example involved Amazon.com and eToys.1 Unlike many other companies, these retailers recorded fulfillment costs (e.g., packaging, shipping) as marketing expenses. Normally, these expenditures are posted to cost of goods sold. “What’s the big deal? After all, the bottom line is right,” somebody might respond. Well, as previously mentioned, investors rewarded companies that spent megabucks on marketing to grab market share. In addition, they loved dot-coms that showed continuous improvement in their profit margins. This presumably indicated that the company was on the road to future profitability. In this instance, again, two birds were killed with one stone. Of course, the dot-coms weren’t the only companies in history to misclassify expenses to improve their financial statements. Other examples include: ◆ Public companies that exclude certain expenses from ordinary income (to improve operating results) ◆ Not-for-profit organizations that misclassify general and administrative expenses (to make it appear that more money is spent on programs)
Altering Footnotes Companies can mislead financial statement readers by tampering with footnote disclosures. Management might omit impor26
HOUCK 03.qxd
5/30/03
12:06 PM
Page 27
The Risk of “Cooking the Books”
tant disclosures or alter figures contained in the notes, viewing this as an easy (though somewhat more subtle) way to deceive readers of the financial statements. It’s also less likely that they’ll be caught, because many auditors subject footnote balances to less scrutiny than the numbers on the balance sheet and income statement. To get a feel for this variety of fraud, imagine that a bank holding company has an unusually high level of commercial real estate loans in its portfolio. If the local real estate market begins to decline, management may not want investors to be aware of the bank’s true exposure. Therefore, management might reclassify loan balances in the footnotes. For example, the following entry could be posted: DR
Consumer Loans CR Commercial Real Estate Loans
Another common distortion involves related-party disclosures. If a company boosts sales by pushing products to related parties, it might not want to reveal the full extent of these activities. Therefore, management may be motivated to understate the volume of related-party sales in the footnotes. In summary, it’s important to realize that there are a variety of ways to distort financial results. In the next section, we address the most common reasons why management engages in such activities. On every audit, auditors should evaluate these motivations while assessing the risk of fraudulent financial reporting.
WHY COMPANIES COOK THE BOOKS Contrary to popular opinion, companies of all shapes and sizes—from large public entities to small private companies— care deeply about their financial results. It’s a myth that only 27
HOUCK 03.qxd
5/30/03
12:06 PM
Page 28
Why and How Audits Must Change
large, public companies engage in fraudulent financial reporting; this simply isn’t true. Even so, not all companies cook their books. There are countless organizations in which management truly wants the numbers to be “right.” In addition, client personnel are not always sophisticated enough to cook the books. Nevertheless, a large percentage of organizations are willing to take steps to influence their financial results. In most cases, these companies operate in the gray areas of accounting, indulging in practices that may be dubious but not outright illegal or improper. Some, however, are willing to take more extreme steps to accomplish their goals. Auditors need to be alert to both groups. In either case, management’s actions are motivated by the desire or need to produce certain financial results. This section presents many of the major reasons why companies want to alter their results.
Influence Stock Price The most notorious accounting frauds in history were committed to maintain or increase stock prices. This includes the recent Enron and WorldCom scandals, as well as classic examples such as Crazy Eddie and ZZZZ Best. In these cases, management deliberately and blatantly deceived financial statement users by reporting numbers that were dramatically different from reality. More common than such brazen fraud, however, is cooking or fudging the numbers and books to meet (“hit”) analysts’ expectations. As The Wall Street Journal reported: Many companies, at one time or another, massage their numbers using creative accounting techniques, and more probably do it now than ever.2 28
HOUCK 03.qxd
5/30/03
12:06 PM
Page 29
The Risk of “Cooking the Books”
This practice, often called earnings management, became commonplace in the 1990s and was rarely challenged until the scandalous frauds of 2002 became public. In these situations, management misdeeds are less blatant than in the previous examples. Nevertheless, games are played to produce the desired results. This includes both overstating and understating profits, depending on how well the company performs in the reporting period. Although earnings management tactics are often used to influence stock prices, auditors should realize that a private company might cook the books in expectation of going public in the future. In many such cases, management is eager to show an impressive growth trend, to increase the value of the company. Like public companies, they may need to smooth earnings up or down depending on the company’s actual performance.
Earn Incentives Performance-based incentives can motivate employees at both large and small companies to distort financial results. A common example is senior managers who earn a profit-sharing bonus based on net income. The bonus may be a percentage of profits, or a fixed amount earned if certain thresholds are exceeded. Suppose the president of a medium-sized manufacturer is entitled to a $50,000 cash bonus if net income exceeds $2 million. If the company closes its books and reports preliminary profits of $1,974,382, wouldn’t management be tempted to post journal entries to boost profits to $2 million? You bet! This is a great time to reduce accruals or reserves that are suddenly considered to be overly conservative. Or perhaps management will identify amounts that were originally expensed, but that could be moved into prepaid expenses or other assets. 29
HOUCK 03.qxd
5/30/03
12:06 PM
Page 30
Why and How Audits Must Change
Most executives aren’t stupid, though. They will be sure to make the “new” net income an odd number like $2,010,349, so as to be less conspicuous.
Save for a Rainy Day When a company does better than expected in a year, it may be tempted to “save for a rainy day.” In other words, once management is certain it will exceed its goals (e.g., budgetary, analysts’ expectations), it may attempt to make the current period’s results look less favorable, and stash the overage where it can be allocated to a leaner year in the future.
Example: A manufacturer in Pennsylvania is a wholly owned subsidiary of a large European corporation. Every year, the parent company sets hard-toreach budgets (euphemistically called “stretch goals”) for its numerous subsidiaries. In the current year, the Pennsylvanian company is performing superbly and will easily surpass its budgeted goals. Though accurate reporting of these splendid results appeals strongly to the managers’ egos, they may know the economic forecast for the upcoming year is weak. Therefore, these executives believe that it is more practical to “save” some profits in case they’re needed to shore up results in the following year. This can be accomplished in a variety of ways, including deferring legitimate revenue and writing down assets. Another common approach is to build large cushions into various liability accounts; this is sometimes referred to as establishing “cookie-jar reserves.” When management needs to show profits
30
HOUCK 03.qxd
5/30/03
12:06 PM
Page 31
The Risk of “Cooking the Books”
in the future, it can simply dip into the jar and reduce the overly conservative liability balances.
Make the Budget The operating budget is an important management tool that drives behavior at both large and small companies. Many organizations put strong pressure on subsidiaries, departments, or divisions to make the budget (i.e., meet the budgeted goals). When employees are struggling to meet the budget, management may be tempted to inflate the financial results. Conversely, when the company (or division, department, etc.) has exceeded its budgeted goals, it may decide to save for a rainy day.
Pile on Bad News (Take a Big Bath) In a bad year, it’s no surprise that management may be tempted to report inflated results to make the financial statements appear more favorable. In some instances, however, a company’s results are so bad that management is motivated to make the results look even worse. The rationale goes something like this: This year is already a disaster, and everybody knows it. It really doesn’t matter if we lose $700,000 or $900,000either way, it’s terrible. So let’s make the loss as big as we can. This will help us do better next year.
I refer to this as piling on bad news. It’s also commonly known as taking a big bath. At two different times during the past decade or so, this phenomenon occurred throughout the United States:
31
HOUCK 03.qxd
5/30/03
12:06 PM
Page 32
Why and How Audits Must Change
1. In the early 1990s, many commercial banks were clobbered by a soft economy and declining real estate market. Banking regulators were aggressive in demanding that reserves be established for bad or questionable loans. As a result, the entire industry incurred significant losses. In this environment, some banks took advantage of the situation and took bigger hits than necessary. They also wrote down other assets and established ultraconservative accruals (i.e., cookie-jar reserves). These steps were not taken to produce accurate financial statements, but rather to make it easier to post stellar earnings in future years (when investors would be less forgiving). 2. More recently, a similar trend occurred in 2001. A U.S. News & World Report headline announced, “Some Companies May Now Want Earnings to Look as Bad as Possible.”3 Why? Earnings across the country were below par in the first half of the year. Due to the weak economy, financial results weren’t nearly as good as originally hoped for. Therefore, companies took advantage of this dire situation by making their numbers look even worse. As explained in the article, “The rationale . . . is simply that the worse things look now, the better they’ll look later. . . . Ratcheting down inventory value on the books could boost profit margins later.”4
Reduce Income Taxes The desire to lower income taxes may cause management to distort its financial results. A common scenario involves privately held companies that pay taxes on an accrual basis. Because theirs is a private company, the owners don’t have to worry about impressing analysts or large groups of share32
HOUCK 03.qxd
5/30/03
12:06 PM
Page 33
The Risk of “Cooking the Books”
holders. Therefore, they may lack incentives to overstate financial results. However, they may be passionate about reducing income tax liabilities. Consequently, the company may be ultraconservative in applying accounting treatments, or take other steps such as tampering with cutoff dates, to make earnings look worse than reality. A less common example involves not-for-profit organizations that earn unrelated business income. Because these revenues are subject to federal income taxes, they should be separately tracked. However, management may be tempted to post these revenues in general ledger accounts established for taxexempt revenues. Make the Predecessor Look Bad When a member of senior management (such as the chief executive officer or president) is replaced in the middle of a year, the new management team may be tempted to distort the financial results for that year. For example, it’s common for a new regime to aggressively write off questionable assets or establish extremely conservative accruals and reserves. Why? Because this isn’t the new team’s “year” yet, and the bad news can be blamed on the old management team. This practice accomplishes two goals. First, it helps to ensure that there are no ugly surprises (e.g., write-offs) in future years when the new executive is solely responsible for the results. Second, it makes the old regime look worse, thereby making it easy for the new management team to shine. Influence Financing or Funding Sources A company might cook its books to influence banks or other funding sources. For example, say management wants to obtain 33
HOUCK 03.qxd
5/30/03
12:06 PM
Page 34
Why and How Audits Must Change
a million-dollar line of credit to support additional growth. A lender is likely to expect (and even require) certain levels of profitability before it will extend the credit. In addition, a company might need to ensure compliance with debt covenants.
Example: A company is required to maintain $1 million in shareholders’ equity to comply with the debt agreement on its primary line of credit. However, when the fiscal year ends, the preliminary balance sheet shows equity of only $965,000. Because of this shortfall, the company will default on its credit line. Faced with this situation, management convinces itself that it’s acting in the best interest of the company by committing accounting fraud. After all, management reasons, there will be a potentially devastating impact on investors or employees if the company defaults on the debt agreement. Thus, it’s acceptable and maybe even noble to “tweak” the numbers a little, to buy some time to turn things around. Interestingly, management often cooks the books with the honest intention of reversing or undoing the fraudulent entries in a subsequent period. This makes the fraud easier to justify, since the crooks plan to fix things and make everything right in the future. It’s sort of like taking money from your college roommate’s desk. If you can replace the cash before your roommate discovers it’s missing, everything is cool. It’s more like a temporary loan; it’s not really stealing. Of course, when a shady tactic proves successful, management might be encouraged to take similar action in the future (just like the college student), since nobody knew the difference. Unfortunately, things don’t always work as planned. Perhaps 34
HOUCK 03.qxd
5/30/03
12:06 PM
Page 35
The Risk of “Cooking the Books”
the company didn’t receive the big order it believed was imminent. Maybe an unexpected production snafu in the next reporting period killed profits. Whatever the reason, management might not be able to reverse the fraudulent entries without making the situation worse. In fact, more book-cooking may become necessary to hide the company’s deteriorating performance. Once this vicious cycle starts, it can be very difficult to prevent the “snowball” effect, when things just spin out of control.
HOW AUDITORS SHOULD ASSESS THE RISK THAT A CLIENT HAS COOKED THE BOOKS Auditors must carefully assess management’s ability and motivation to alter financial results. This section provides practical guidance to help auditors arrive at a reasonable, proper risk assessment. Specifically, your engagement team needs to answer the following questions: ◆ What are your client’s motivations? ◆ Where is the book-cooking most likely to occur?
What Are Your Client’s Motivations? In the last section, we identified numerous motivations for tampering with financial results. Of course, the presence of one or more of these conditions doesn’t mean that management is cooking the books. Executives with high integrity will never intentionally distort the numbers, regardless of these pressures. Nevertheless, auditors must always maintain professional skepticism and carefully consider these factors. When evaluating a client’s motivations, an auditor must be alert for clues both before and during the engagement. It 35
HOUCK 03.qxd
5/30/03
12:06 PM
Page 36
Why and How Audits Must Change
would be convenient if the client told the auditor, “Yes, we’re proud to admit that we cooked the books this year,” but this conversation will never happen! The following are effective ways to uncover the motivations of management.
Client Conversations
Valuable clues are often revealed in conversations with client personnel. This information can be obtained in formal discussions (e.g., interviewing the client) or informal conversations (e.g., talking over lunch). At some companies, client personnel are open and honest about the pressure to produce certain results. For example, the controller may complain that this year’s budget is very aggressive, and describe how extremely important it is for the company to achieve its goals. Another great clue may appear if the audit team identifies a potential adjustment. Suppose the audit partner informs the client that a $75,000 liability for warranty reserves is necessary. If the client reacts adversely to the proposed adjustment, the auditor needs to determine the reason for this response. On the one hand, it may be that the client simply disagrees and truly doesn’t believe that such a reserve is necessary. On the other hand, the client may oppose the entry because it changes the bottom line. If the client immediately begins to search for additional adjustments to offset the accrual, this is a pretty good sign that the company wants to generate predetermined results. Incidentally, this example reveals a great reason to identify issues and adjustments well before the fiscal year-end. For example, if the $75,000 adjustment is proposed in October (to a client with a December 31 year-end), the engagement team will gain valuable information about the client’s motivations before performing its year-end fieldwork. 36
HOUCK 03.qxd
5/30/03
12:06 PM
Page 37
The Risk of “Cooking the Books”
However, if the adjustment is proposed shortly before the final deadline in March, the engagement team might complete the bulk of its testing without knowing this important information. The team might not be alterted to the client’s motivations and the possibility for book-cooking. Consequently, the audit might be conducted differently than it should have been.
Cooked Transactions
Cooked transactions occur when management enters into transactions (or fails to do so) with a primary intent of influencing financial results. In contrast to cooking the books, “cooking transactions” does not violate generally accepted accounting principles (GAAP). In other words, the transaction is accounted for properly and the books are fairly stated.Nevertheless, this behavior should be of great interest to auditors, because it provides wonderful clues about the motivation of management. Here are several examples: ◆ A technology company slashes previously budgeted research and development expenditures in the fourth quarter to meet its profitability goals for the year. ◆ A public company offers extremely aggressive concessions on several large contracts to ensure that the sales are consummated before year-end. ◆ A retailer pushes a major direct mail campaign from December to the first week in January. ◆ A wholesaler announces early that there will be a large price increase on January 1, to spark sales in the fourth quarter. ◆ A not-for-profit organization hires a consulting firm late in the year to evaluate its fundraising efforts, with the stipulation that the project be completed before yearend. 37
HOUCK 03.qxd
5/30/03
12:06 PM
Page 38
Why and How Audits Must Change
◆ A professional services firm freezes spending on continuing professional education (CPE) for the final three months of its fiscal year. In each example, management made a business decision with the primary purpose of influencing financial results. The General Electric Corporation has been famous (or notorious, depending on your viewpoint) for its ability to generate consistent earnings. Although the company has not yet been accused of cooking its books, it appears that General Electric routinely cooked transactions to achieve its financial goals. Jack Welch, the legendary former chairman of General Electric, wrote about this practice in his autobiography: Every now and then we’d get a critic, challenging how we achieved “our consistent earnings growth.” One reporter even suggested that if we took a charge to close a business in one quarter and took a gain to sell another business in the following quarter, our earnings would not have been consistent. Duh!!!5
Someone might wonder, “Why should auditors care about cooked transactions? Everything is accounted for in accordance with GAAP, right?” First, this behavior may be harmful to the company, as should be evident from the preceding examples. When management makes poor business decisions in an effort to manage the bottom line, the engagement team may want to inform the company’s board of directors of this activity. At larger companies, senior management may not even be aware that such efforts are being used to produce the desired results. Second, as previously mentioned, cooked transactions provide the audit team with great clues about management’s motivations. The presence of cooked transactions doesn’t necessarily mean that management is cooking the books, but this 38
HOUCK 03.qxd
5/30/03
12:06 PM
Page 39
The Risk of “Cooking the Books”
discovery should help the team to properly assess the risk of fraudulent financial reporting before it tailors the audit programs.
Client Correspondence or Documentation
More clues about client motivations can be found in client correspondence and documentation. For example, the minutes from a meeting of the board of directors may include approval of a profit-sharing package for senior management. In another instance, an internal memo from a vice president might reiterate, in no uncertain terms, the importance of meeting budgets.
Other Considerations
Here are some additional considerations to keep in mind when you are assessing the risk of fraudulent financial reporting: ◆ Management may be faced with conflicting goals and therefore conflicting motivations. For example, suppose a privately held company is insistent about reducing federal income taxes. At the same time, though, senior management receives a large bonus based on net income. Do you think management will be more likely to overstate or understate the bottom line? Unfortunately, no magical, one-size-fits-all template or solution exists for situations like this. The engagement team must use its judgment when evaluating clues at a particular client. Whatever is ultimately decided, it’s important that the engagement team clearly document its assessment (along with the rationale) in the workpapers. ◆ Engagement teams should be careful to avoid making assumptions about management’s motivations, especially 39
HOUCK 03.qxd
5/30/03
12:06 PM
Page 40
Why and How Audits Must Change
with repeat clients. This practice is tempting when planning is rushed or not taken seriously. It’s important to realize that the risk of fraudulent financial reporting can change from year to year. For example, a company might exceed expectations in 2002, thus prompting management to save for a rainy day. But then, in 2003, it may become difficult for the company to reach its new goals, and thus management feels compelled to inflate the financial results. ◆ Finally, financial statements are usually altered because management wants the users to see certain results. Therefore, when evaluating a client’s motivations, consider the users of the financial statements. Identifying these persons (and thinking about what management wants them to see) can help in accurately assessing this risk.
Example: You are auditing a trucking company that is privately owned by Samson Rice, a wealthy individual. The company has always performed extremely well, and your engagement team is not aware of any reasons why management would distort the results. However, suppose your tax partner knows that Mr. Rice is experiencing severe cash-flow problems due to poorly performing investments in his portfolio. The flagging investments include an industrial equipment company (not audited by your firm) for which Mr. Rice has personally guaranteed the debt. It’s likely that the equipment company’s lenders will scrutinize Mr. Rice’s other holdings, including the trucking company. Therefore, although your financial statements are not intended for these individuals, Mr. Rice may be motivated to make his trucking company’s results look better than reality. 40
HOUCK 03.qxd
5/30/03
12:06 PM
Page 41
The Risk of “Cooking the Books”
The only possible conclusion is that auditors should always be alert for information (of any type) that may provide clues about management’s motivations. This evidence can come from many different sources. Therefore, every professional on the engagement team should be knowledgeable about this topic and be alert for any information that can be used to make a more accurate risk assessment. Even when an auditor concludes that management lacks a reason to cook the books (i.e., the risk of fraudulent financial reporting is low), it’s important to maintain professional skepticism throughout the audit. After all, it’s possible to incorrectly assess the risk of fraudulent financial reporting. Where Is the Book-Cooking Most Likely to Occur? When an auditor concludes that management may be inclined to alter financial results, the obvious questions become: ◆ Where is the client likely to do it? ◆ Which accounts are likely to be tampered with? At the beginning of this chapter, we discussed general methods of cooking the books. Unfortunately, there are an endless number of specific ways to alter financial results. In fact, so many exist that it’s impossible for an auditor to address every scenario. Therefore, it’s critical for the engagement team to focus its efforts in the areas of greatest risk. Let’s begin by lumping the many techniques into two broad categories: “Blatant and Brazen” and “Pushing the Envelope.” “Blatant and Brazen”Techniques
Blatant and brazen frauds are just what the description indicates. In such a case, management is willing to do whatever it 41
HOUCK 03.qxd
5/30/03
12:06 PM
Page 42
Why and How Audits Must Change
takes to produce the desired results. The techniques used to alter the financial statements are not a matter of judgment, nor do they fall into any gray area. Blatant and brazen activities are clear-cut, undeniable financial fraud.
Example: In 2002, the Securities and Exchange Commission brought charges against HPL Technologies in which it accused the company of fabricating more than 80 percent of its revenues.6 To accomplish this fraud, HPL Technologies’ chief executive officer was alleged to have done the following: • • • •
Forged purchase orders from customers. Generated phony shipping documents. Doctored bank statements. Created fictitious confirmation letters.
Many high-profile historical frauds were also blatant and brazen. For example, Crazy Eddie fraudulently increased inventory balances by millions of dollars.7 When the auditors arrived for the physical inventory observation, they committed the cardinal sin of allowing client personnel to perform some of the test counts (because the boxes were stacked so high in the warehouse). The employees simply yelled down the wrong numbers, and presto, fake profits were created! Although these outrageous types of fraud do not occur frequently, auditors must always be alert. It’s common for practitioners to let their guards down, especially when dealing with likeable clients. In reality, a hospitable and friendly client might be playing the auditor like a Stradivarius violin. Barry Minkow, mastermind of the infamous ZZZZ Best fraud, bragged about how he manipulated the auditors by making them feel important and liked:
42
HOUCK 03.qxd
5/30/03
12:06 PM
Page 43
The Risk of “Cooking the Books”
Minkow instinctively recognized that accountants had tired of their image as the shlubs of the financial world. . . . While a traditional client might send its CPAs a thank-you note, Minkow presented his accountants with an “Oscar,” and they adored him for it.8
Do you suspect that Enron Corporation, another high-flying fraud finagler, engaged in similar tactics? It’s a safe bet. When blatant and brazen accounting frauds occur, the problems tend to center around recognition of revenue. Typical practices include: ◆ ◆ ◆ ◆ ◆
Engaging in “bill and hold” practices Recording sales to fictitious customers Shipping products that were never ordered Sending shipments to storage or consignment Recording sales with side agreements that create contingencies
A particularly outrageous example involved the Sonali Corporation.9 This company, which sold gold jewelry, reported annual sales of $70 million in the late 1990s. In actuality, sales never exceeded $2 million! After the fraud was unraveled, the owner was both vocal and quite forthcoming about how easy it had been to fool the independent auditors. Among other things, he created fictitious customers with post office boxes throughout the United States. Knowing the auditors would confirm the accounts receivable balances, he instructed that all mail be forwarded to his residence in California. Then he personally signed all of the confirmation requests, indicating that the balances were correct. Mulford and Comiskey’s book, The Financial Numbers Game, provides a host of other examples of how companies such as
43
HOUCK 03.qxd
5/30/03
12:06 PM
Page 44
Why and How Audits Must Change
Sunbeam, Bausch & Lomb, and Leslie Fay used aggressive or fraudulent accounting techniques to inflate sales and profits.10 It’s critical for auditors to understand these techniques and design audit approaches that adequately address these risks. Because problems with revenue recognition are so pervasive, SAS No. 99 requires auditors to specifically address this risk on all engagements. The AICPA has published a lot of excellent guidance on this topic, including a publication entitled Audit Issues in Revenue Recognition. However, an auditor must also be alert for other blatant and brazen attempts to cook the books. These can occur just about anywhere in the financial statements (more examples are provided later in this chapter). Unfortunately, these frauds can be extremely difficult to detect, especially if the perpetrator is clever. This is why it’s critical for accounting firms to replace historical audit approaches with the methods and techniques described in this book. Some of the best detection methods include properly identifying and assessing risk, conducting strong analytical procedures, thoroughly understanding internal controls, and harnessing the power of technology.
“Pushing the Envelope”Techniques
Management doesn’t have to design elaborate schemes or concoct fictitious transactions to distort a company’s financial results. Because GAAP contains a plethora of subjective or “gray” areas, management has plenty of other opportunities to produce the financial results that it desires. Accounts involving estimates are prime targets for management game-playing. Examples include estimates for bad debts, obsolete inventory, product returns, restructuring costs, net realizable value, and others. Earlier in the chapter, we discussed the use of cookie-jar reserves. You might have wondered, “Why do auditors allow 44
HOUCK 03.qxd
5/30/03
12:06 PM
Page 45
The Risk of “Cooking the Books”
clients to use this technique?” The answer is that it’s hard to refute a client’s position when the balance involves estimates. In other words, nobody can claim with certainty that a precise number is the correct balance for, let’s say, the reserve for bad debts. Unless the balance is way out of line (i.e., clearly unreasonable), it’s difficult to force unwilling clients to post adjustments in these areas. Hence, there’s an opportunity for management to play games with the figures. Let’s face it, folks. Because of the subjective and approximate nature of the figures involved, it’s much easier and safer for management to sway financial results in these areas, as opposed to engaging in blatant and brazen techniques.
Example: A company holds a sizable amount of inventory that hasn’t been sold in more than two years. After analyzing the composition of these items, the audit team proposes a $120,000 adjustment to write off all of the items. Management argues, however, that this inventory can still be sold, although it knows full well that this claim is far-fetched. To support this view, the company dreams up several plausible, seemingly sensible reasons why the inventory should not be written off. In the spirit of compromise (after all, the audit team cannot definitively prove its point), a compromise is reached and a $60,000 adjustment is made. What just happened? Well, in essence, the client cooked the books to the tune of $60,000. While doing so, management took very little risk because of the nature of this account (the possibility of sale is, after all, a subjective judgment). In other words, this accounting fraud was safer and easier than forging documents, doctoring bank statements, and establishing bogus post office boxes. Unless 45
HOUCK 03.qxd
5/30/03
12:06 PM
Page 46
Why and How Audits Must Change
the auditor discovers a smoking gun that clearly proves management is lying, it’s very difficult to prove that fraud was committed. Remember, accounting frauds are often committed by certified public accountants. As a group, CPAs are an ethical bunch of people. If given the choice, they would prefer not to blatantly and brazenly cook the books, especially when easier and less obvious techniques are available. As a result, there is a large percentage of executives who are willing to (1) push the envelope in subjective accounts such as reserves; and (2) engage in aggressive accounting treatment when GAAP allows flexibility. These same individuals would never engage in the blatant examples of financial fraud described earlier. They are not desperate or crass. In view of these facts, the engagement team should consider this reality during planning and identify areas of potential concern with that particular client. During the team’s conversations, it should not be unusual to hear comments such as the following: ◆ “If Johnny [the owner] needs to show higher profits, I’m confident he would bring down the allowance for bad debts. He would never intentionally overstate inventory or receivables.” ◆ “My biggest concern is the percentage-of-completion accounting. It would be very easy to alter some of those estimates. I think it’s difficult to mess with anything else on their financials, so let’s hit those estimates really hard.” Let’s summarize. An auditor must assess management’s motivations and ability to engage in fraudulent financial reporting. After considering these factors, the engagement team should identify the audit areas that pose the greater risk. Only then is it time to tailor the audit approach.
46
HOUCK 03.qxd
5/30/03
12:06 PM
Page 47
The Risk of “Cooking the Books”
TAILORING AUDIT PROGRAMS Most firms use standardized audit programs. Therefore, “tailoring” usually consists of emphasizing or deemphasizing various steps. It may also include adding or deleting procedures from the program. Before determining the procedures for any audit area, however, it’s important to be aware of the primary directional risk assessment. In other words, what are management’s financial reporting motivations, if any? At the same time, the auditor should consider the severity of risk. In other words, how likely is it that management will alter results to achieve its goals? In some cases, an auditor will conclude that the risk is a possibility, but not likely. In other instances, the auditor may perceive that management is under enormous pressure to produce certain results. Without any consideration of management’s motivations, most audit programs are geared toward preventing: ◆ Overstatement of assets and revenues ◆ Understatement of liabilities and expenses For example, most audit programs include procedures to confirm the existence of cash and receivables. Normally, though, you don’t encounter steps requiring the auditor to search for unrecorded cash or missing receivables. This philosophy makes sense if we remember that an auditor’s worst fear is to opine on the financial statements of a company that is a complete sham. After all, if the company goes belly up, the audit firm is in big trouble, right? Nevertheless, the preset (canned) audit program should be used as a starting point when developing the audit approach for a particular client. For example, suppose an auditor believes that management is aggressively trying to boost a company’s
47
HOUCK 03.qxd
5/30/03
12:06 PM
Page 48
Why and How Audits Must Change
bottom line. The audit approach should be even more targeted toward detecting overstatement of assets and revenues (or understatement of liabilities and expenses). Conversely, suppose an auditor believes that management is saving for a rainy day by understating profits. Does it really make sense to conduct an extensive search for unrecorded liabilities? This test is primarily designed to address the completeness assertion, by ensuring that accounts payable are not understated. But is this a big concern if management is attempting to understate profits? Not unless the auditor is worried about unintentional mistakes resulting from weak controls. Using the same logic, an auditor may not be very concerned about overstated assets or revenues at this particular client. Accordingly, he may feel justified in tailoring the audit programs to perform fewer or weaker procedures to address these issues. In contrast, if an auditor is concerned about understatement of profits, does this mean that she should aggressively search for understatement of assets and revenues (or overstatement of liabilities and expenses)? For instance, should the auditor perform a search for unrecorded accounts receivable, or conduct heavy testing on the balances that comprise accrued liabilities? In most cases, such extensive testing is not necessary, because litigation is less likely to occur when a company acts “conservatively” by understating profits or equity. This is why most practitioners are more lenient (i.e., willing to pass on adjusting entries) when misstatements make the financial statements look worse than they should. Even so, auditors should be concerned when management understates its results. First, even if the financial statements are conservative, they may be materially misstated. This can result in problems for the accounting firm depending on how the financial statements are used (e.g., the sale price of a company is based on a multiple of GAAP earnings). Second, the accounting firm may be creating problems for future years. Suppose an auditor allows a company to establish 48
HOUCK 03.qxd
5/30/03
12:06 PM
Page 49
The Risk of “Cooking the Books”
ultraconservative accruals for various liabilities. Now, fast-forward two years. The client loses its biggest customer and is losing large sums of money. In response, management decides to reduce the excessive liabilities recorded in earlier years (“We now believe these liabilities are overaccrued,” the client says). This, in turn, allows the company to post a profit on the financial statements—and the result, quite simply, is misleading financial statements. All right, let’s summarize. Because the ultimate risk is issuing an unqualified opinion on grossly overstated financial statements, auditors will always perform procedures to address that risk. This is true even when the auditor believes that the client lacks any reason to cook the books. Thus, this is sometimes referred to as the default risk. However, if the auditor is gravely concerned about a client inflating its results, procedures should be expanded in areas of greater risk. Conversely, if the auditor believes that management is likely to understate its results, procedures can be scaled back while also being cognizant of management’s motivations. One final point: When auditors believe that a client is aggressively trying to inflate results (i.e., the primary directional risk is overstatement of assets and revenues), they may be tempted to ignore the secondary risk (i.e., that assets and revenues are understated). Auditors need not go overboard in addressing this risk, particularly when it is considered to be very low, but it should never be completely ignored.
Example: An auditor performs cutoff tests on sales. The standard audit program calls for examining five transactions before and after year-end. If the auditor is most concerned about overstated revenues, shouldn’t this procedure be modified to address the bigger risk: sales recorded before year-end? After all, these transactions are riskier because they may actually belong in the subsequent year. 49
HOUCK 03.qxd
5/30/03
12:06 PM
Page 50
Why and How Audits Must Change
In this scenario, depending on controls and materiality, the engagement team may expand its cutoff testing on sales recorded before year-end. Perhaps the auditors will select 10 transactions or even use computer-assisted audit techniques (see chapter 11) to satisfy themselves as to the cutoff. At the same time, though, the auditor still needs to address the risk that sales are understated (even though this is the secondary risk). Perhaps the auditor will test-check just a few transactions that occurred after year-end. Or perhaps analytical procedures can provide evidence to address both overstatement and understatement concerns. In short, an auditor can’t just declare, “I’m not worried about understatement of sales. Therefore, I don’t need to do any work.” If you encounter anybody with this attitude, it would be wise to make that person re-read the language in an unqualified opinion! An Example: Fixed Assets Dill, Pickles & Mayonnaise LLP is conducting the annual audit of a capital-intensive company. Because it is very material to the financial statements, fixed assets is identified as a critical audit area. The engagement team believes that management is under heavy pressure to produce favorable results in the current year. As a result, the primary directional risk in the audit of net fixed assets is overstatement. In other words, if management wants to boost the bottom line, it will overstate this balance. During planning, the engagement team discusses the risks in this audit area, including how management could intentionally alter the financial results. The auditors identify numerous techniques that the company could use to inflate its bottom line. These include:
50
HOUCK 03.qxd
5/30/03
12:06 PM
Page 51
The Risk of “Cooking the Books”
◆ Capitalizing items that should be expensed (a trick most famously used by WorldCom) ◆ Failing to depreciate new equipment or facilities that were placed in service ◆ Changing the residual values of equipment (and taking the difference into income) ◆ Extending useful lives to lower depreciation expense ◆ Selling fixed assets and recording the proceeds as “other income” (while not removing the assets from the books) After developing this list, the engagement team must determine how concerned it is about these particular risks. For a variety of reasons, including the effectiveness of internal controls and materiality, the auditors may care more about some items than others. After discussing these issues, the team should select audit procedures to adequately address these concerns. For example, suppose the auditors suspect that the client aggressively capitalizes inappropriate expenses such as repairs and maintenance. Perhaps management tried this same trick in the prior year, or maybe an internal auditor mentioned that this was happening. If the engagement team merely examines large fixed asset additions (a common approach used by accounting firms), it is likely to miss a material misstatement. To avoid this error, the engagement team might perform a variety of additional tests to address this particular risk. For example, the auditors might utilize data extraction software to search for cash disbursements that contain descriptions containing the words “repair” or “maintenance” or “paint.” (For more information on data extraction, see Chapter 11.) Additionally, inquiries might be made to plant workers to uncover such activities. In conclusion, engagement teams need to carefully assess their appproaches and techniques to ensure that they address the most pressing risks.
51
HOUCK 03.qxd
5/30/03
12:06 PM
Page 52
Why and How Audits Must Change
NOTES 1. Jeremy Kahn, “Presto Chango! Sales Are Huge!,” Fortune, March 20, 2000, p. 96. 2. Ken Brown, “Tweaking Results Is Hardly a Sometime Thing,” Wall Street Journal, February 6, 2002, p. C1. 3. Anne Kates Smith, “Uncooking the Books.” U.S. News & World Report, May 14, 2001, p. 33. 4. Id. 5. Jack Welch, Jack Straight from the Gut (New York: Warner Books, 2002), 113. 6. Rosemary Schlank, “SEC Sues CEO for Falsifying 80% of Company’s Revenues.” AccountingWeb, September 12, 2002: www.AccountingWeb. com/cgi-bin/item.cgi?id=90356, 7. Glenn Cheney, “How Crazy Was Crazy Eddie?” Accounting Today, October 26, 1998, p. 61. 8. Mark Stevens, The Big Six (New York: Simon & Schuster, 1991), p. 31. 9. Jeff D. Opdyke, “Aspiring Midas Enmeshes Auditors in Gold Chain,” Wall Street Journal, March 1, 2002, sect. C. 10. Charles W. Mulford and Eugene E. Comiskey, The Financial Numbers Game: Detecting Creative Accounting Practices (Hoboken, NJ: John Wiley & Sons, 2002).
52
HOUCK 04.qxd
5/30/03
12:07 PM
Page 53
4 OTHER RISKS AND CONSIDERATIONS
HOUCK 04.qxd
5/30/03
12:07 PM
Page 54
HOUCK 04.qxd
5/30/03
12:07 PM
Page 55
I
n the last chapter, we discussed the risk of fraudulent financial reporting, also known as “cooking the books.” However, financial statements can be materially misstated even when fraud is not being perpetrated. Specifically, financial statements might be misleading because: ◆ Internal controls are weak. For example, some transactions are never posted to the general ledger, or they are posted inaccurately. ◆ The client is unfamiliar with the proper accounting treatment. For example, the controller fails to realize that an accrual is necessary for unused vacation. ◆ Differences in opinion exist as to the proper accounting treatment. For example, the chief financial officer (CFO) doesn’t believe that a certain Financial Accounting Standards Board (FASB) pronouncement is applicable, but the accounting firm thinks otherwise. ◆ Honest differences in opinion exist as to subjective matters. For example, the client believes that a reserve is adequate, but the auditor thinks that it is understated. At many companies, auditors may conclude that these risks are greater than the possibility of fraudulent financial report55
HOUCK 04.qxd
5/30/03
12:07 PM
Page 56
Why and How Audits Must Change
ing. This is especially true with unsophisticated clients who struggle to maintain accurate accounting records. The accounting staff may not have the ability (or desire) to cook the books. Nevertheless, the risk of material error is very much present, because of weak controls. During planning, the audit team should identify and discuss any such matters that could lead to material misstatements in the financial statements. In many cases, the audit team will already be aware of these issues before the engagement begins. However, smart auditors should also conduct the following procedures in the planning stage of every engagement: ◆ Ask “anticipation” questions. ◆ Conduct proactive research about the client’s business. ◆ Perform a diligent preliminary analytical review.
ASK “ANTICIPATION” QUESTIONS Great auditors excel at identifying potential issues and adjustments early in the audit process. This requires a proactive approach in order to identify issues or problems and then take action to avoid frantic, inefficient, and possibly inaccurate activity at the eleventh hour. Not only does this ensure that risks are identified and addressed in a timely manner, but it also greatly improves client service. How many clients want to learn about an audit adjustment shortly before a deadline arrives? Not many. To succeed in this process, auditors should ask “anticipation” questions to key client personnel before the audit begins. These are questions such as the following: ◆ What kind of year is your company having? How do the results compare to budget?
56
HOUCK 04.qxd
5/30/03
12:07 PM
Page 57
Other Risks and Considerations
◆ What are some highlights (operating or otherwise) of the past year? ◆ Are any economic or industry trends affecting your business? ◆ Have you initiated significant changes in your operations during the past year? ◆ Have you embarked on any new strategic initiatives? ◆ Have there been any changes in key personnel? ◆ Are you aware of any issues that we should know about (accounting or otherwise)? ◆ Have you entered into any nonroutine transactions? ◆ Have there been any changes in the chart of accounts? ◆ Have all issues, problems, or management letter comments from the prior audit been resolved? These simple inquiries, along with the appropriate follow-up questions, should help the engagement team identify events or issues that will or might affect the audit approach.
PERFORM PROACTIVE RESEARCH ABOUT THE CLIENT’S BUSINESS Effective auditing entails far more than analyzing and verifying numbers on a general ledger. It also requires understanding the client’s business, including the environment in which it operates. This knowledge is essential for ensuring that the numbers make business sense and for identifying issues or risks that could affect the financial statements. Unfortunately, most auditors gain only a cursory understanding of their client’s business. Although more experienced personnel on the engagement team may possess more knowledge, this information is rarely communicated to the professionals who perform the bulk of the audit procedures.
57
HOUCK 04.qxd
5/30/03
12:07 PM
Page 58
Why and How Audits Must Change
At a minimum, pertinent information must be transmitted to increase each team member’s knowledge of the client’s business. This is essential for the quality of the audit, and it also gives a considerable boost to staff morale. In addition, the engagement team should consider including steps in the audit program to learn more about the client’s business. Such tasks might include conducting research on the client’s industry or interviewing persons outside of the accounting department (on topics other than accounting and auditing). In recent years, an increasing number of progressive firms have decided that this type of research is cost-beneficial. The goals of gaining a more thorough understanding of a client’s business are to raise audit quality and identify opportunities to add value. Compare this philosophy to the approach used by most accounting firms. Under professional standards, an engagement team is required to gain an understanding of the client’s business. However, the documentation of this information usually consists of only a few sentences. For example: “ASHH is a 501(c) organization dedicated to helping homeowners.” or “Hofam Corporation distributes electrical parts to retailers in the Northeast.”
These are pretty insightful, aren’t they? Imagine how helpful they would be to a new member of the audit team who is just being introduced to this client. If audit quality is to improve, engagement team members need to learn more about a client’s business and operating environment. Suppose you were auditing a manufacturer of office 58
HOUCK 04.qxd
5/30/03
12:07 PM
Page 59
Other Risks and Considerations
furniture as of December 31, 2001. Before beginning this audit, wouldn’t it be valuable to know if the industry was experiencing rough times? Here is an excerpt from The Wall Street Journal in November 2002: Hit by cutbacks in corporate spending even before Sept. 11 and the dot-com implosion, industry shipments are expected to drop 16% this year.1
The article proceeds to describe how manufacturers across the United States are facing layoffs and lower profits. Armed with this knowledge, a smart engagement team should have approached this engagement differently than in the past (when times were better). But what if you failed to read The Wall Street Journal on that particular day? What if your engagement team isn’t aware of the industry problems (or fails to adequately discuss the many implications thereof during planning)? Pretty obviously, this could result in a substandard audit. “Come on,” you might respond. “Of course we would know about the industry problems. We’re not stupid. Our client would tell us about the problems. Plus, their results aren’t going to look as good as in the past.” This may be true, but do you really want to rely on a client for this information? Sure, management may admit it’s having a rough year . . . but what if it’s worse than they claim? For example, suppose the client’s sales are 5 percent lower than the previous year. How do you know this is reasonable? Perhaps external industry information suggests that sales should have dropped even lower. Do you really want to rely solely on the client’s word for such an important issue? And what about those aging receivables to two large customers? Should reserves be established, even though the client is adamant that collection is imminent? 59
HOUCK 04.qxd
5/30/03
12:07 PM
Page 60
Why and How Audits Must Change
Folks, it’s awfully dangerous to answer these questions using insular information. By this, I mean relying primarily on the client for critical information about what’s happening in the world. Unfortunately, this occurs far too often on audits, especially audits of businesses in less common industries. This discussion of insular information reminds me of an annual audit conducted in the early 1990s.
Example: A commercial bank in the southeast had a large concentration of commercial real estate loans and enjoyed much success in the booming 1980s. However, the market had pretty much tanked since then. Anybody who read the newspaper was aware of the deterioration, but the engagement team decided to conduct more research to obtain a deeper understanding of the local real estate market. The auditors learned about how different local submarkets were performing, the names of builders that were in deep trouble, the types of properties that were struggling the most, and so forth. After analyzing the loan portfolio, the auditors decided that a significant amount of additional loan loss reserves was necessary. Unfortunately, the senior loan officer strongly disagreed. He stated that everything was fine. When confronted with research showing that additional reserves were necessary, he would not budge. He noted that “lesser” banks might be experiencing problems, but not his bank. He concluded the meeting by declaring, “We’ve never lost one dollar on a real estate loan, and we never will!” Well, it’s a good thing this audit team didn’t rely on the client to learn about the state of the industry! In this case, the senior
60
HOUCK 04.qxd
5/30/03
12:07 PM
Page 61
Other Risks and Considerations
loan officer was in total denial regarding the severity of the bank’s situation. (By the way, this particular bank eventually wrote off millions of dollars in real estate loans.) Although such an extreme reaction from a client is uncommon, it’s typical for clients to view their businesses through rosecolored glasses. Let’s examine a different example.
Example: Jimmy Turner, the “in-charge” auditor for a software developer, is waiting in the lobby to meet with the client’s controller. To pass the time, he idly peruses an industry trade publication that’s lying on the coffee table. He is struck—and dismayed—by one particular article, which reports that a major competitor has just released a superior product that might destroy his client’s sales. Does this information have audit implications? Absolutely! Is Jimmy lucky this magazine was sitting on the lobby table? You bet! Let’s consider one more example.
Example: Denise Buckholtzer has worked on the audit of a technology company for seven years. By reading her client’s newsletter, she discovers that the company is betting heavily on a new product to catapult sales. At year-end, the company has stocked up on inventory and is preparing for a major advertising and marketing campaign. Does this have audit implications? Yes, yes, yes! All of these situations should be of concern to auditors. Let’s be frank, though: It’s likely that these issues will never arise if an audit team is focused on sending confirmations, vouching transactions, examining reconciliations, and so on.
61
HOUCK 04.qxd
5/30/03
12:07 PM
Page 62
Why and How Audits Must Change
It should be fairly obvious, my friends, that a thorough understanding of the client’s business leads to higher-quality audits. There’s no question about it. Not only are issues and risks more likely to be properly identified, but the audit team will also have more informed expectations when conducting analytical procedures (as described in Chapter 6). This knowledge also better equips an auditor to add value. This results in more insightful business advice and better management letter comments. It can also lead to the acquisition of additional billable projects.
PERFORM A DILIGENT PRELIMINARY ANALYTICAL REVIEW Professional standards require auditors to perform a “preliminary” analytical review during the planning stage of an engagement. Unfortunately, this valuable procedure is not taken seriously by most audit teams. The problem seems to be that most auditors are confused about the primary purpose of this procedure. As a result, they often document noninsightful explanations for variances exceeding a predetermined scope (e.g., greater than $100,000 and 10 percent). Have you ever seen an explanation like, “Cash has decreased in the current year because accounts payable is lower?” What a joke! The real purpose of a preliminary analytical review is: To identify issues or matters that may cause the engagement team to alter its audit approach.
With this goal in mind, an auditor should search for: ◆ Accounts that look unreasonable or unusual, based on the auditor’s informed expectations. (The key word here 62
HOUCK 04.qxd
5/30/03
12:07 PM
Page 63
Other Risks and Considerations
is informed; see Chapter 6 for more information on this topic.) ◆ The addition of new general ledger accounts that require new or different audit approaches. ◆ Accounts that have increased or declined significantly since the prior year. (SALY may not be appropriate!) In conclusion, when an engagement team understands the client’s business, takes proactive steps to identify issues, and performs a diligent preliminary analytical review, it has a much greater chance of identifying and addressing important risks in a timely manner. Not only does this improve audit quality, but it also enhances client service and reduces stress for members of the engagement team.
RISK ASSESSMENTS DURING FIELDWORK As mentioned in Chapter 2, risk-based auditing is a mindset that influences all aspects of an engagement. Effective auditors refer to their risk assessments throughout the entire engagement, using this information to guide and direct them when making a variety of decisions.This includes decisions such as: ◆ Determining the proper amounts for scopes. ◆ Writing review notes (have you ever received nitpicky review notes in utterly unimportant areas?!). ◆ Deciding whether to rely on internal auditors. ◆ Determining the strength of analytical procedures. Many other audit decisions should also be influenced by the risk assessments. Here are two additional examples that illustrate how directional risk assessments affect decisions made in the field. 63
HOUCK 04.qxd
5/30/03
12:07 PM
Page 64
Why and How Audits Must Change
Example 1Reconciling Items: A client provides the auditor with the schedule shown in the following exhibit. This report reconciles the inventory subsidiary ledger to the general ledger. The client posted two adjustments (JE09 and JE10) to arrive at the final balance. Reconciliation of Inventory Subsidiary Ledger to the General Ledger Inventory Report 229
$4,392,998.85
JE09
33,000.00
JE10
(45,000.00)
Amount per General Ledger
$4,380,998.85
Let’s assume the auditor has already gained sufficient evidence to support the subsidiary ledger balance. The only remaining step is to address the reconciling items. Before doing this, the auditor should consider materiality and directional risk (i.e., fraudulent financial reporting risk). If the auditor believes that management is inclined to make the bottom line appear as good as possible, the $33,000 adjustment is riskier than the $45,000 entry, right? Even though JE09 is a smaller balance, it increases accounts receivable. Therefore, if this entry is not proper, assets and profits are overstated. Conversely, the $45,000 entry is larger but reduces accounts receivable. Because the auditor is highly concerned about overstating the bottom line, this entry is of less concern and may not warrant any attention (depending on overall materiality and internal controls). 64
HOUCK 04.qxd
5/30/03
12:07 PM
Page 65
Other Risks and Considerations
Example 2Analytical Procedures: Roberta Bush is auditing tuition revenues at a private school. The following exhibit shows a simple predictive test that assesses the reasonableness of tuition revenue.
Simple Predictive Test to Assess the Reasonableness of Tuition Revenue Number of students
800
Times: Average tuition Predicted revenues
× $5,000 4,000,000
Difference
(97,000)
Amount per books
$3,903,000
Not surprisingly, the predicted revenue doesn’t match the amount in the general ledger. This is expected because predictive tests include estimates that often are not completely accurate or precise. In this example, “number of students” and “average tuition” are estimates. As can be seen, the difference between predicted and actual revenues is $97,000. In this situation, Roberta must decide if she can live with the difference. If she considers the amount to be immaterial, Roberta will most likely decide not to conduct further work. If the difference is too large, though, Roberta will need to refine the test by making it more precise. Theoretically, this will reduce the difference to an acceptable level (assuming that the general ledger is accurate). Before making this decision, however, Roberta should consider directional risk. Assume that the engagement team has already concluded that manage65
HOUCK 04.qxd
5/30/03
12:07 PM
Page 66
Why and How Audits Must Change
ment lacks any reasons to cook the books. Thus, the default directional risk is overstatement of assets and revenues (and understatement of liabilities and expenses). As described in Chapter 3, this is the default risk because an auditor’s worst fear is issuing an unqualified opinion on a sham company. Given the simple predictive test shown on the previous page, Roberta might conclude that further testing is unnecessary, as her prediction is greater than the actual balance (depending on overall materiality and the state of internal controls). In contrast, suppose that her prediction was $97,000 less than the amount on the books. This would be of greater concern, because the general ledger could be overstated. Follow-up should be more strongly considered to resolve this difference. Of course, this difference would be of even greater concern if the engagement team had assessed the risk of fraudulent financial reporting as high. Chapters 3 and 4 addressed various aspects of risk-based auditing. When these concepts are not applied (or are applied improperly), audit quality may suffer dramatically. Consequently, proper application of these concepts is essential to conducting a high-quality audit.
NOTE 1.
Chad Terhume and Kelly Greene, “Office-Furniture Shipments Expected to Fall 16% in 2001,” Wall Street Journal, November 2, 2001, p. B2.
66
HOUCK 05.qxd
5/30/03
12:07 PM
Page 67
5 THE MANY BENEFITS OF ANALYTICAL PROCEDURES
HOUCK 05.qxd
5/30/03
12:07 PM
Page 68
HOUCK 05.qxd
5/30/03
12:07 PM
Page 69
I
f the audit profession is serious about improving quality, it must perform more and better analytical procedures. One of the biggest disappointments in public accounting is how auditors fail to utilize these incredibly potent tools. Let’s begin with the basics. Statement on Auditing Standards No. 56, Analytical Procedures (SAS No. 56), defines analytical procedures as “evaluations of financial information made by a study of plausible relationships among both financial and nonfinancial data.” Sounds clinical, huh? I prefer to describe the audit technique as “figuring out if a balance makes sense.” Common analytical procedures include trend, ratio, and predictive (sometimes called reasonableness) tests. SAS No. 56 explains that analytical procedures can be used at the following times: ◆ To assist in planning the nature, timing, and extent of auditing procedures. (This is commonly referred to as the preliminary analytical review or planning analytical review.) ◆ To obtain evidential matter supporting account balances. (In these uses, an analytical procedure becomes a substantive procedure.)
69
HOUCK 05.qxd
5/30/03
12:07 PM
Page 70
Why and How Audits Must Change
◆ To perform an overall review of the financial statements before issuance. Generally accepted auditing standards mandate that auditors use analytical procedures during the planning and review stages of every audit. However, the use of analytical procedures for substantive tests is optional. According to SAS No. 56: The auditor’s reliance on substantive tests to achieve an audit objective related to a particular assertion may be derived from tests of details, from analytical procedures, or from a combination of both. The decision about which . . . procedures to use to achieve a particular objective is based on the auditor’s judgment on the expected effectiveness and efficiency of the available procedures.
In practice, most auditors regularly choose detailed tests (e.g., vouching, confirmations, recalculations) over analytical procedures. Why? The detailed tests usually require less judgment and are more easily delegated to lower-level staff. In addition, many practitioners feel more confident when examining a tangible document, such as an invoice, rather than relying on analytical skills to draw conclusions about the fairness of account balances. My friends, this is a major mistake! There are numerous compelling reasons to incorporate more analytical procedures into an audit approach. As discussed in the rest of this chapter, using these procedures results in improvements in: ◆ ◆ ◆ ◆
Quality Efficiency Client service Staff morale
70
HOUCK 05.qxd
5/30/03
12:07 PM
Page 71
The Many Benefits of Analytical Procedures
QUALITY When done properly, analytical procedures are among the most valuable audit procedures. In The Financial Numbers Game: Detecting Creative Accounting Practices, Professor Charles W. Mulford revealed the results of a comprehensive study undertaken to identify the best audit techniques to detect fraudulent financial reporting. Here’s what he found: Scanning numbers, conditions and relationships across a series of periods is one of the most important tools of financial analysis. It has a long tradition of use, usually under the title of analytical review, by auditors. Some might have expected more specialized or esoteric methods. However, the value of this fundamental analytical technique is very clear.1
In other words, analytical procedures are very powerful procedures. Although many practitioners believe that detailed testwork is supreme, these procedures actually contain serious shortcomings. The following example illustrates the dangers of ignoring analytical procedures and relying on detailed tests.
Example: Jill Jesse is auditing the monthly roll-forward of accounts receivable. Jill confirmed a sample of receivables at an interim date (November 30) and now needs to gain comfort about the activity in the roll-forward period. The accounting department provided Jill with the following data: Balance @ November 30 Revenues for December Cash receipts for December
$1,232,548 567,234 (278,110)
Balance @ December 31
$1,521,672
71
HOUCK 05.qxd
5/30/03
12:07 PM
Page 72
Why and How Audits Must Change
After examining invoices and shipping documents for a sample of sales transactions in December, Jill concludes that the roll-forward is accurate. Imagine her surprise upon discovering that the client cooked the books in December! The controller simply posted entries for bogus sales, as follows: DR
Trade accounts receivable CR Sales
Let’s eavesdrop on the conversation that took place between Jill and the engagement partner after the accounting fraud was detected by internal auditors: Jill:
I don’t understand. We hit that area hard. We vouched a sample of transactions, and everything was in order. Partner: I guess it’s just the nature of sampling. There’s no guarantee that you’ll get lucky and select the bogus sales. Jill: But you know what really bothers me? I may have picked some of these sales. That dirty rotten controller created a bunch of fake documentation. Partner: Hmmm. Well, I’m not sure what to do. Just check the sample size computations to make sure they were computed properly. I’ll go ahead and contact our attorneys. Gee whiz. Do you feel sorry for these auditors? I don’t! This is a classic case of getting lost in the details. Jill and the partner completely missed the big picture by relying so heavily on detailed tests. They never realized that December’s results didn’t make sense. Using basic analytical procedures, Jill should have discovered that December’s sales and profit margins were significantly
72
HOUCK 05.qxd
5/30/03
12:07 PM
Page 73
The Many Benefits of Analytical Procedures
higher than in previous months, including the prior December. If she had understood the client’s business, she would have known that there was no plausible explanation for this sudden improvement. In short, analytical procedures enable auditors to determine if a balance looks reasonableand isn’t this what auditors are ultimately concerned about? An analytical procedure helps the engagement team to answer questions like: ◆ Is the balance consistent with previous periods and other accounts on the financial statements? ◆ Does the balance make sense compared to those of similar companies? ◆ Does the balance appear reasonable based on events happening inside and outside of the company? Detailed tests, in contrast, don’t help auditors answer any of these important questions. Just think about it. By examining an invoice or other supporting documentation, an auditor gains evidence only about that particular transaction. Of course, auditors pick a sample to reach a conclusion about the entire population, but in many cases, the selection methods don’t provide much evidence about the entire balance. Examples include the frequently used scope test (i.e., all items greater than a certain amount), as well as haphazard and random selections. Even when more reliable (e.g., statistical) sampling methodologies are used, the possibility always exists that bogus transactions will not be selected. Plus, as mentioned earlier in Chapter 1, it’s easy for clients to supply doctored documentation when auditors do happen to select fraudulent items. Please don’t misunderstand, folks. I’m not suggesting that detailed procedures should be banned forever. There is cer-
73
HOUCK 05.qxd
5/30/03
12:07 PM
Page 74
Why and How Audits Must Change
tainly a time and a place for transactional or detailed testing. Situations that call for detailed procedures include: ◆ Cases in which it’s difficult to design effective analytical procedures. Cash can be a good example, because the balances often fluctuate widely on a daily basis. ◆ Instances when an auditor executes strong analytical procedures, but still feels that more evidence is necessary, considering materiality and risk. Detailed procedures can be useful to supplement the analytical techniques. ◆ Times when unintentional outright errors are present. Detailed testing can be effective in detecting misstatements when financial fraud does not exist; that is, when honest mistakes have been made. ◆ Instances in which an alert auditor might uncover a fraud by noticing inconsistencies or problems with forged documentation. In the famous ZZZZ Best fraud, the bogus supporting documentation contained numerous flaws and inconsistencies. As a result, even an auditor using detailed tests could have concluded that something was amiss. Despite these important uses of detailed tests, it’s clear that analytical procedures often provide more compelling evidence than detailed tests. This is why auditors must utilize more and strong analytical procedures to help ensure high-quality audits.
EFFICIENCY Analytical approaches are often less time-consuming than detailed tests. It’s the best of both worlds. An engagement team can improve quality and efficiency at the same time! This fact was acknowledged years ago in generally accepted auditing standards. SAS No. 56 notes: “Analytical procedures 74
HOUCK 05.qxd
5/30/03
12:07 PM
Page 75
The Many Benefits of Analytical Procedures
can be more effective or efficient than tests of details for achieving particular substantive testing objectives.”
Example: Henry “The Voucher” Williamson wanted to ensure that profit margins were recorded accurately at a wholesale distributor. To test “cost of goods sold,” he examined supporting documentation for a large sample of inventory purchases. Unfortunately, Henry encountered difficulties while performing these procedures. The supporting documentation did not appear to jibe with the information recorded in the accounting system. After much anguish and deliberation, Henry projected an error and informed the client’s controller that an adjustment was necessary. The controller immediately rebuked Henry. “Your proposed adjustment can’t possibly be correct. If our margins were as out-of-line as you suggest, everybody in the company would already be aware of it. Don’t you know that senior management reviews margins and profitability with a fine-tooth comb? You better check your work, son.” Henry was perturbed. He had already exceeded his budget, and now his overruns would be even worse because the client refused to accept reality. Since he had no choice, Henry conducted further research to bolster his case. Upon doing so, however, he discovered that he had not properly understood some key matters. The controller was right after all! What’s the moral of this story? The controller, who understood the business, needed roughly three seconds to realize that Henry’s proposed adjustment was wrong. Conversely, if the financials had indeed been wrong, the controller probably would have suspected a problem just as quickly. 75
HOUCK 05.qxd
5/30/03
12:07 PM
Page 76
Why and How Audits Must Change
Meanwhile, Henry blew his budget, embarrassed himself (and the accounting firm), and ultimately was forced to eat crow. Why? He ignored analytical procedures!
CLIENT SERVICE In many cases, effective analytical procedures require an auditor to possess a good understanding of the client’s operations (or a particular aspect of the business). Consequently, an auditor is more likely to add value and help the client improve its business.
Example: Aaron Brooks is the auditor of the National Association of Whatevers (NAWE). This organization has thousands of members throughout the world whose philosophy on life is, that’s right, “Whatever.” The client loves Aaron because of his laid-back style. While auditing deferred revenue related to membership dues, Aaron decides to use an analytical approach. Although the balance of this liability account is roughly the same as in the prior year, he resists the temptation to quickly write “appears reasonable” in the workpapers. Why did Aaron hesitate? He noticed that advertising and marketing expenses had increased dramatically. After inquiring of management, he learns about a major campaign to increase NAWE’s membership. Why then, Aaron wondered, hasn’t deferred revenue also increased as new members joined the organization? Of course, it’s possible that a mistake (intentional or unintentional) occurred in the preparation of the financial statements. Aaron thinks this is unlikely, 76
HOUCK 05.qxd
5/30/03
12:07 PM
Page 77
The Many Benefits of Analytical Procedures
though, for several reasons. First, he believes that the risk of fraudulent financial reporting is very low. In fact, every time he has proposed an adjusting entry in the past, the executive director has responded, “Whatever. That’s fine.” Second, the internal controls surrounding this account are very strong. The controller, Jeff Blake, used to work at Aaron’s accounting firm before AB (as Aaron’s colleagues call him) took over this client. Because of Blake’s conscientious efforts, there has never been an error in the deferred revenue accounts. For these reasons, Aaron decides to ask the client more questions. He wonders if perhaps: • The campaign was a disappointment and failed to attract new members. • The campaign was successful in bringing in new members, but an equal number of old members left because dues were too high. • The campaign was successful, but dues notices were mailed late (as compared to the prior year); therefore, more cash receipts arrived after yearend, thus reducing the deferred revenue balance. • Management doesn’t truly know if the campaign was successful because results weren’t adequately tracked. After talking to various members of management, Aaron discovers that NAWE’s executives believe the campaign was worthwhile; even so, they had hoped for better results. Simultaneously, the association lost a number of members during the year for unknown reasons. Here Aaron smells an opportunity to excel as a business advisor. After performing some research, he discovers that the campaign’s success rate was below 77
HOUCK 05.qxd
5/30/03
12:07 PM
Page 78
Why and How Audits Must Change
industry norms. He then convinces NAWE to engage his firm to conduct a special project to evaluate this campaign. Because NAWE is already planning another major campaign in the upcoming year, the opportunity to obtain objective feedback is well received by management. Additionally, Aaron is surprised that NAWE doesn’t know why it lost a large number of members. In the management letter, he recommends that these customers be contacted (by a phone or mail survey) to learn the reasons for their departures. When the engagement is completed, NAWE’s executive director informs the partner that this was the best audit he’d ever experienced. Not only were the financial statements delivered in a timely manner, but Aaron’s advice and counsel on business issues were invaluable. Of course, this happened because Aaron Brooks utilized analytical procedures! In an environment where many people believe audits are commodities, analytical approaches can help auditors to distinguish themselves.
STAFF MORALE As is evident from the examples in this chapter, analytical procedures require that auditors use their brains. Consequently, gathering this type of evidence is far more interesting than sending confirmations, recalculating numbers, or examining invoices. In short, professionals who use analytical procedures quickly discover that auditing can be interesting and creative. Be honest, now, folks: how many auditors really love to vouch? Consider the preceding example involving NAWE. Al78
HOUCK 05.qxd
5/30/03
12:07 PM
Page 79
The Many Benefits of Analytical Procedures
though a lot of auditors might apply some weak analytical procedures to the deferred revenue balance, they would most likely obtain the subsidiary ledger and pick transactions to test. That’s boring! To add insult to injury, this procedure isn’t even particularly effectivethe balance may be materially misstated despite these time-consuming efforts. When students are recruited into our profession, they are typically promised an exciting and diverse career. The AICPA has spent millions of dollars to convince undergraduates that accounting is cool. After these newly minted accounting types accept their first jobs, though, reality sets in. Footing, vouching, photocopying, scanning, sending confirmations, and an endless array of other mind-numbing tasks usually fill their long days. Don’t misunderstand: there are pleasant experiences, too. Examples include meeting new people, attending board meetings, learning about new industries, and many others. Nevertheless, how many current or former auditors truly believe that the mechanics of performing an audit are exhilarating? Over the years, I’ve surveyed thousands of auditors at speeches and seminars about this topic. When I ask whether they believe auditing can be creative and interesting, the response is consistent: a collective laugh rocks the room. Folks, this is a shame and unnecessary. As an astute practitioner once said, “Show me a person who says auditing is boring, and I’ll show you a person who doesn’t know how to audit.” Well said! The approaches in this book enable auditors to use their brains and learn a ton about business. This allows them to become better business advisors (rather than just talking about it), developing clients who respect and value their advice. Do you want to improve staff morale? Handing out mugs with the firm’s logo is nice, but think about addressing the heart of job satisfactionwhether employees enjoy their daily assignments. 79
HOUCK 05.qxd
5/30/03
12:07 PM
Page 80
Why and How Audits Must Change
You can take a major step forward by performing more and better analytical procedures!
NOTES 1.
Charles W. Mulford and Eugene E. Comiskey, The Financial Numbers Game: Detecting Creative Accounting Practices (Hoboken, NJ: John Wiley & Sons, 2002), p. 148.
80
HOUCK 06.qxd
5/30/03
12:08 PM
Page 81
6 COMMON PITFALLS OF ANALYTICAL PROCEDURES
HOUCK 06.qxd
5/30/03
12:08 PM
Page 82
HOUCK 06.qxd
5/30/03
12:08 PM
Page 83
M
any auditors are hesitant about relying heavily on analytical techniques unless the account balance is not material. This is because most auditors are accustomed to flimsy analytical procedures that provide little or no evidence. Over the years, I’ve had the privilege of reviewing workpapers at hundreds of accounting firms. Here is a sampling of some of the less than stellar analytical explanations I’ve encountered: Sales increased because the client sold more goods. Per Robert, Controller, the increase in profit margin appears reasonable. Per Joan, Assistant Controller, gross margins improved because the client negotiated better deals from their suppliers. Sales increased 30 percent due to expansion into the Northeast. Advertising expense is reasonable since it’s comparable to the prior year. No wonder accounting firms perform a ton of detailed procedures. These explanations are almost worthless. Sadly, the explanations for most analytical procedures aren’t much different at the vast majority of accounting firms. 83
HOUCK 06.qxd
5/30/03
12:08 PM
Page 84
Why and How Audits Must Change
It’s just a fact that many accounting firms do a poor job in designing and executing strong analytical procedures. Consequently, they are forced to rely heavily on detailed testing to support account balances. But is this the proper response? No, it’s not. As discussed in Chapter 5, the benefits of performing analytical procedures can be tremendous. Therefore, it makes more sense to strengthen these procedures so they can be more heavily relied upon. Thereafter, a reduction in detailed testing is justifiable. This section covers the three most common problems with analytical procedures in the real world. These include: ◆ Uncorroborated client explanations ◆ Imprecise explanations ◆ Lack of informed expectations
UNCORROBORATED CLIENT EXPLANATIONS When performing analytical procedures, an auditor often obtains explanations and commentary from the primary contact person at the client. This is usually the main accounting person (e.g., controller, director of finance, head bookkeeper). Consequently, explanations in the workpapers are notorious for beginning with the phrase, “Per Susan, the controller, . . .” Alternatively, some auditors don’t even bother to document the source of the information. They simply write something like “Sales are higher due to the introduction of new products” rather than “Per Susan, sales are higher due to the introduction of new products.” Either way, the information source is the same: the primary contact person for the audit (or a close associate). It’s not difficult to imagine the potential problems with this audit technique. If Susan doesn’t know what she is talking
84
HOUCK 06.qxd
5/30/03
12:08 PM
Page 85
Common Pitfalls of Analytical Procedures
about, the auditor might obtain faulty evidence and fail to detect material errors in the financial statements. This is certainly possible, as many client staff members don’t have full knowledge of everything happening in the business. Worse yet, what if Susan is cooking the books? The “per Susan” approach of auditing is unlikely to impress jurors in a court of law. Indeed, this is a fantastic way to get your firm in a heap of trouble.
Finding Reliable Sources of Information To perform better analytical procedures, auditors should identify the best person at the client to interview. In many cases, this person does not work in the accounting department. Suppose the auditor has a question concerning sales volumes or profit margins. Such questions should be directed to the plant manager or another informed person outside of the accounting department. Two things are important here: 1. These persons are probably much more knowledgeable about the subject matter. 2. They are outside the accounting department. All other things being equal, nonaccounting client staff represent a better source of evidence, because they’re not directly involved in the preparation of the financial statements. Despite the benefits of stepping outside of the accounting department, many auditors prefer to deal only with accounting personnel. They know these people the best and feel more comfortable dealing with them. After all, birds of a feather flock together. Sure, it can be intimidating to interview the foreman on the loading dock or the vice president of sales, but these inquiries
85
HOUCK 06.qxd
5/30/03
12:08 PM
Page 86
Why and How Audits Must Change
can provide invaluable evidence to bolster analytical explanations. Auditors must break out of their comfort zones and force themselves to do this more often. When considering the best source for analytical explanations, auditors should always remember costs and benefits. This includes considering materiality and risk. Perhaps the vice president of research and development (R&D) is the absolute best person to ask about a particular variance—but if the fluctuation isn’t large, it may not be cost-beneficial to schedule a special meeting with this individual. In this instance, the controller’s explanation may be sufficient, assuming that she has knowledge of the subject. In contrast, if you had already planned to interview the R&D vice president for other reasons; then by all means ask your question about the variance as well. Once the auditor obtains an explanation from any client, she must decide if corroboration is necessary or cost-effective. Ultimately, this is a judgment call influenced by materiality and risk, as well as the reasonableness or plausibility of the client’s explanation. If additional evidence is deemed necessary, an auditor can verify or corroborate the explanation by inquiring of other client personnel or examining supporting documentation. Consider this sample explanation for a variance.
Example: Per discussion with Darlene, controller, accounts receivable increased 20 percent over the prior year because the largest customer, Bob’s Discount Club, is paying significantly slower than in past years. I verified this by talking with William Henderson, VP-Sales, who independently (without prompting) told me that Bob’s Discount Club is paying all of its vendors more slowly. He showed me a memo that Bob’s Discount Club sent to all suppliers, announcing 86
HOUCK 06.qxd
5/30/03
12:08 PM
Page 87
Common Pitfalls of Analytical Procedures
it would pay vendors in 90 days versus 60 as in the past. I asked Kristen Horn, a partner in our firm, about this policy, since she serves several clients who supply Bob’s Discount Club. She confirmed that her clients are experiencing the same trend. This is also consistent with the accounts receivable aging report, which shows a significant increase in days outstanding. For all of the above reasons, the increase in accounts receivable appears reasonable. Wow! This explanation sure beats “Per Darlene, receivables increased because Bob’s Discount Club is paying slower.” But how many times do you see insightful and thoughtful explanations like this in your workpapers? Be honest! In this example, the auditor corroborated the controller’s explanation by speaking with several other knowledgeable persons, including the vice president of sales and a partner in the accounting firm. Also, the auditor examined documentation (a memo from Bob’s Discount Club, and the accounts receivable aging) to further corroborate the explanation. Is this a flawless analytical procedure? Nope. The analysis is not precise enough to provide satisfactory evidence. But let’s just cover one topic at a time, okay? We’ll address other common problems with analytical procedures later in this chapter.
Dealing with Conflicting Evidence During an engagement, an auditor often encounters information that supports or contradicts various analytical explanations. In many cases, this evidence is included in the workpapers; nevertheless, the auditors don’t seem to notice it. In other words, the supporting or contradictory evidence is ignored. 87
HOUCK 06.qxd
5/30/03
12:08 PM
Page 88
Why and How Audits Must Change
Example: The controller informs the auditor that payroll expense increased 5 percent because of a 10 percent across-the-board raise given in the middle of the year. If the controller is knowledgeable and trustworthy, as described in Chapter 10 (and if internal controls are strong), the auditor may conclude that corroboration is not necessary. However, when reviewing the minutes of the board of directors, the auditor notices that all pay raises are approved by the board of directors. This is great, because the auditor can now corroborate the controller’s explanation and spend hardly any time doing so. How? The auditor simply cross-references the board information with the analytical explanation. Although this makes perfect sense, most auditors ignore such opportunities to bolster their explanations. Why? Perhaps a different staff person read the minutes. Or maybe the same staffer performed both tasks, but did so on different days and failed to make the necessary mental connection. Here’s a related example:
Example: The auditor overhears the main receptionist talking about raises on the telephone. She exclaims, “We’ve been working really hard this year, so it was nice that everyone received 10 percent raises. I can sure use the money this holiday season!” Again, why not document this nugget of evidence? It requires almost no extra time, and, most importantly, the analytical explanation is no longer merely “Per the controller . . . .” Of course, an auditor might encounter evidence that contradicts an analytical explanation, as follows.
88
HOUCK 06.qxd
5/30/03
12:08 PM
Page 89
Common Pitfalls of Analytical Procedures
Example: An auditor hears a group of workers in the cafeteria complaining about raises. Being a good auditor, she slowly tilts her head in the direction of their table with hopes of hearing more comments. When a middle-aged man complains that a cost-ofliving increase is a “slap in the face,” the auditor knows that more “digging” is necessary before she can accept the controller’s explanation about the 10 percent, across-the-board raise. Auditors should always be alert for other evidence that supports or contradicts their anaytical explanations, and then document or resolve the matter accordingly.
IMPRECISE EXPLANATIONS In the last section, we used an example where accounts receivable increased 20 percent because the client’s biggest customer (Bob’s Discount Club) decided to pay its vendors more slowly than in the past. Rather than relying solely on the controller’s word about this important matter, the diligent auditor successfully corroborated the comments in a variety of ways. Even so, I suggested that the auditor’s analysis was insufficient. Although the auditor obtained seemingly solid evidence indicating that receivables should have increased, was 20 percent the right amount? Perhaps receivables should have increased only 10 percent. Maybe they should have shot up 30 percent. Unfortunately, the auditor failed to determine whether the amount of the increase was reasonable. In other words, the auditor’s analysis was imprecise. As a result, the financial statements might still be materially misstated despite the auditor’s impressive efforts to corroborate the controller’s explanation.
89
HOUCK 06.qxd
5/30/03
12:08 PM
Page 90
Why and How Audits Must Change
Imprecise analytical procedures are a common problem. Here are more examples of workpaper explanations, along with my own questions and comments for the auditors (in italics): ◆ Interest expense increased 9 percent compared to the prior year because the company borrowed more frequently on its line of credit. Did average borrowings on the line of credit also increase by 9 percent, while interest rates remained flat? ◆ Sales increased from $3 to 4 million (33%), mainly due to the successful introduction of a new board game. Am I to assume that sales of this new product went from zero to roughly $1 million? ◆ Sales increased 33 percent due to the successful introduction of a new board game. Per discussion with Mac McKnight, Assistant Sales Manager, the company originally hoped that its new game, Tantrum, would generate $500,000 in sales during its first year. But after receiving favorable publicity on a national television show, sales reached slightly over $1 million. Sales for other products were flat this year due to the sluggish economy. (I also saw in the company newsletter where the staff had a party when the game hit $1 million in sales, shortly before year-end.) Now we’re talking! ◆ Accrued sales commissions are up 19 percent due to an increase in sales. Oops, we regressed! ◆ Accrued sales commissions are $129,000, up 19 percent due to an increase in sales. Commissions are paid to salespeople on a monthly basis. Thus, accrued commissions should relate to December sales. This December’s sales were 18 percent higher than in the previous year. In addition, sales commissions range from 4–6 percent, ac-
90
HOUCK 06.qxd
5/30/03
12:08 PM
Page 91
Common Pitfalls of Analytical Procedures
cording to Jimmy Jones, sales rep for the East Coast. December sales were $2.5 million: 129/2500 = 5.2%. This is within the range and appears reasonable. Ahh, that’s better! This isn’t rocket science. There is nothing earth-shattering or complex about the preceding analyses. Nevertheless, it is difficult to find explanations as solid as these in the files at most accounting firms. In addition to writing more precise explanations, auditors can strengthen analytical procedures by beginning with more precise analyses. Statement on Auditing Standards No. 99 calls this “disaggregating” the data. Although this sounds like something that might happen when you catch the stomach flu, it’s actually a simple concept to understand. When comparing current and prior year balances, which analytical tests are likely to be stronger? ◆ Gross margins for the entire company or gross margins by division? ◆ Revenues for the entire year or revenues by month? ◆ Accrued interest receivable on all investments or accrued interest receivable for each major category of investments?
91
HOUCK 06.qxd
5/30/03
12:08 PM
Page 92
Why and How Audits Must Change
In each case, the second answer is likely to lead to a stronger analytical procedure. By breaking the balances into smaller components, the auditor’s explanations should become more meaningful and precise. Suppose the following balances exist: Example 12-31-01
12-31-02
Accrued interest receivable— employee loans
25,550
36,372
Accrued interest receivable— corporate bonds
79,109
87,987
Accrued interest receivable— certificates of deposit
70,222
46,987
174,881
171,346
Total
A common analytical procedure is to calculate the average interest rate earned, and compare this result to the prior year. Assuming total investments of $3,179,654 and $3,232,943 for 2001 and 2002, respectively, the average interest rates are as follows: 12-31-01 5.5%
12-31-02 5.3%
Most auditors would quickly conclude that the current balance is reasonable, because the average interest rate is comparable to the prior year. Perhaps the auditor even expected a decline in average rate, as interest rates were dropping in the overall economy. By “disaggregating” the data to create a more precise analysis, though, the auditor might arrive at a different conclusion. Specifically, rather than computing an average interest rate for the entire investment port-
92
HOUCK 06.qxd
5/30/03
12:08 PM
Page 93
Common Pitfalls of Analytical Procedures
folio, an auditor would compute the percentage for each investment category. This new analysis reveals information that was not available in the original example: 12-31-01 12-31-02 Accrued interest receivable— employee loans
8.3%
8.1%
Accrued interest receivable— corporate bonds
5.6
5.8
Accrued interest receivable— certificates of deposit
4.8
4.5
With this new information, the auditor may realize that it’s strange to learn the average rate on corporate bonds increased during the period. Upon further investigation, the auditor discovers that the accounting department incorrectly applied an interest payment to “interest income” rather than “accrued interest receivable.” After fixing this entry, the average rate drops to 5.2 percent. In this example, notice that the auditor discovered the misstatement because the actual disaggregated results were not in line with expectations. So, guess what we’re going to address next? That’s right, expectations!
LACK OF INFORMED EXPECTATIONS Over the years, many auditors have fallen into the trap of believing that a balance or ratio is reasonable because it is comparable to the prior year. This view has become prevalent, aided by trial balance software packages that quickly identify variances exceeding a certain threshold (e.g., 10 percent and $100,000).
93
HOUCK 06.qxd
5/30/03
12:08 PM
Page 94
Why and How Audits Must Change
As a result, it’s common for auditors to identify and explain fluctuations that meet the stated scope, while concluding that the remaining variances appear reasonable because they are comparable to the prior year. This isn’t effective auditing. Why? Perhaps the balance that failed to fluctuate should have changed! For example, suppose an auditor concludes that advertising expense is reasonable because it increased only 2 percent from the prior year. But how can someone claim that a 2 percent increase is reasonable unless he or she is familiar with the company’s marketing plans? What if the client switched from direct mail techniques to a major television campaign? What if the client scaled back radio advertising and focused on public relations and community involvement? Is a 2 percent increase reasonable in either case? Probably not. SAS No. 56 states that the evaluation of results from analytical procedures generally requires “knowledge of the client and industry.” Put another way, an auditor must have an informed expectation about what the balance should be. Yes, it’s possible and often reasonable for auditors to expect balances to be comparable to those from the prior year. In many cases, though, this is simply a default stance, because the auditors aren’t adequately informed about what is happening in the client’s business. Therefore, they have no choice but to assume that balances should be comparable to the prior year’s, unless evidence to the contrary smacks them in the face. In addition to forming a knowledgeable expectation, auditors must document their expectations in the workpapers. As on so many other occasions, the Auditing Standards Board apparently felt it needed to reemphasize this fact, because the vast majority of practitioners have apparently ignored previous standards.1
94
HOUCK 06.qxd
5/30/03
12:08 PM
Page 95
Common Pitfalls of Analytical Procedures
How to Develop Informed Expectations How does an auditor develop informed expectations? A common way is to understand the interrelationships of accounts (e.g., when payroll increases, payroll taxes and employee benefits usually increase). In addition, the auditor needs to be knowledgeable about the client and its industry. More specifically, an auditor should identify the major factors that impact an account balance. Here are some examples:
Example: Payroll expense increased 2 percent from the prior year. Before concluding that the increase is reasonable, an auditor should consider the major factors affecting payroll expense. In many cases, this is (1) the number of employees and (2) the amount of raises. Suppose the company slashed its workforce by 10 percent and froze salaries for the lucky employees who remained. Does a 2 percent increase in payroll expense appear reasonable? Of course not! The auditor should expect a reduction in payroll expense. By how much? That depends on the timing of the layoffs, which personnel were terminated (highly compensated employees or minimum-wage operators?), amounts of severance paid, and the like. By considering these factors, the auditor can make a fairly precise computation of what payroll should be. If the auditor expects payroll to be 5 percent lower after considering these factors (and the general ledger shows an increase of 2 percent), she should conduct a further investigation to account for the discrepancy. Of course, the auditor should always consider directional risk concerns (as described in Chapter 3) when following up on such differences.
95
HOUCK 06.qxd
5/30/03
12:08 PM
Page 96
Why and How Audits Must Change
Now let’s consider a more comprehensive example.
Example: You are conducting the 2002 audit of a professional football team, the Atlanta Falcons. Gross ticket sales are roughly the same as in the prior year. Before concluding that this balance is reasonable, though, the auditor should review the major factors that affect this account. Let’s assume these factors consist primarily of (1) tickets sold and (2) ticket prices. Here’s a little bit of background. The ownership of the Falcons changed just before the 2002 season. Arthur Blank, co-founder of The Home Depot, purchased the team and immediately made several big changes. In an unprecedented move, he slashed ticket prices for games in the Georgia Dome. Mr. Blank wanted to ensure that every game was sold out, to give his team a real home-field advantage. In previous years, tens of thousands of seats had sat empty, and Mr. Blank knew this would not help Atlanta win football games. Also, when so many seats are unsold, NFL games are blacked out on television and local residents can’t watch the Falcons on Sunday afternoons. Of course, when the local community can’t watch the games, it’s harder to create excitement about the franchise. Enough background; now back to the annual audit. To determine whether ticket revenues are reasonable, you need to find out how many tickets were sold, including prices. Because of Blank’s actions, a comparison to the prior year would be a big mistake, right? A smart auditor would gather the pertinent information needed to form an expectation. By the way, would you expect merchandise sales to be comparable to the prior year? No way! For starters, 96
HOUCK 06.qxd
5/30/03
12:08 PM
Page 97
Common Pitfalls of Analytical Procedures
all of the new fans attending games would undoubtedly cause sales of shirts, hats, pennants, and other merchandise to soar. Plus, because games are no longer blacked out on television, more people will have become familiar with the team and will have been more likely to purchase merchandise (from online or retail outlets). There’s also the little matter of a player named Michael Vick. This superstar joined the team for the 2001 season and undoubtedly caused a spike in sales of number “7” jerseys. But in 2002, Vick became the starting quarterback and was quickly dubbed the “most exciting player in football” by virtually everybody on the planet. (On a personal note, it is painful for me to include this example. As a hard-core fan of the New Orleans Saints, a divisional foe of the Falcons, I am deeply disturbed by Michael Vick’s abilities!) For all of these reasons, do you think merchandise sales skyrocketed in 2002? You betcha! Now let’s switch gears and look at one more simple example.
Example: Accrued real estate tax is the same as last year. Before concluding that the balance is reasonable, the auditor should consider the major factors affecting this liability. Normally, this includes (1) the value of any properties owned and (2) local tax rates. If the company acquired a new facility during the year, the auditor should expect to find an increase in the accrual, right? Right. Let’s summarize the lessons of these examples. To form reliable expectations, auditors must do three important things: 97
HOUCK 06.qxd
5/30/03
12:08 PM
Page 98
Why and How Audits Must Change
1. Consider the major factors that affect the account balance (e.g., payroll is impacted by number of employees and raises). 2. Understand the interrelationships of accounts (e.g., when payroll increases, payroll taxes and employee benefits should increase). 3. Understand what is happening in the client’s business (or the environment in which it operates). In general, most accounting firms earn passing, but not stellar, grades on the first two items. It’s the third point that many firms fail to adequately consider or document. So, let’s discuss this topic in more detail. Unfortunately, most auditors don’t know much about their clients’ businesses. If they are to improve audit quality, they must remove the myopic blinders that cause them to focus so heavily on verifying specific numbers. It’s important to maintain a broader perspective. An auditor must understand what is happening in the client’s business and its environment. Not only does this reduce audit risk, by offering a better chance to identify important issues, but it also allows the engagement team to implement a more extensive analytical approach. Why? The team will possess more informed expectations that lead to stronger analytical procedures. How should an engagement team learn about the client’s business? Numerous ways exist, including the following: ◆ The engagement partner should share pertinent knowledge with other team members. A partner often possesses valuable information, but doesn’t share this knowledge with the other staff members. This is a mistake and can harm audit quality. “Time constraints” is the most common excuse for this information hoarding, but it’s rarely an acceptable reason. For starters, information about the client’s business 98
HOUCK 06.qxd
5/30/03
12:08 PM
Page 99
Common Pitfalls of Analytical Procedures
or industry can be shared during planning meetings. As discussed in Chapter 2, these meetings are essential to audit quality. If the partner truly lacks the time to communicate such information in a formal setting, she can document pertinent thoughts in a memo, share information with the “in-charge” auditor while commuting in the car (by talking on a cellular phone), or take one or more team members to lunch before the engagement begins. ◆ Another great way to learn about the client’s business is to ask client personnel a lot of questions—but please, don’t talk about accounting! Forget about reconciling items and PBC lists. Instead, learn about the client’s goals and challenges. Find out what the company is trying to accomplish strategically. Ask about the competition. Most importantly, listen, listen, listen. Don’t be afraid to invite the client to lunch, rather than always eating with your fellow audit team members (or eating at your desk). Not only can informal lunches enhance client relations, you may discover new ways to assist your clients and serve as a better business advisor. This is well worth the price of a meal! When not interacting directly with clients, be alert for other ways to learn about the company’s business. Read the company’s newsletter, visit its website, read marketing materials, and so on. All of this information can be useful. ◆ Finally, effective auditors should be aware of what’s happening in the world. I’m not referring to knowing whether the Lakers won the basketball game last night, or whether Jennifer Lopez crossed the line with her latest dress. Auditors need to be familiar with what is happening in the business world as well as their clients’ industries. Begin by reading a major business publication on a 99
HOUCK 06.qxd
5/30/03
12:08 PM
Page 100
Why and How Audits Must Change
daily basis. I’ve always believed that The Wall Street Journal is essential reading for any businessperson. Also, it’s a nobrainer to read the business section of your local paper. In addition, I recommend reading at least one business magazine. My favorite has always been Fortune, but there are many other popular and valuable periodicals along the same lines, such as Business Week, Inc., Fast Company, and others. Auditors should also have a decent understanding of the client’s industry and operating environment (as opposed to general business knowledge). If the widget industry is experiencing severe overcapacity, smart professionals want to consider this when planning an audit of a widget maker (or any other company affected by this trend, such as customers or suppliers of widget companies). To obtain up-to-date industry knowledge, the engagement team should consider performing proactive research before the engagement begins, as described in Chapter 4. A variety of websites and industry publications, in addition to discussions with knowledgeable persons in the accounting firm, can assist the engagement team in developing informed expectations. Here are a few general websites with extensive information on a variety of industries: ◆ www.1stresearch.com ◆ www.asaenet.org ◆ www.bizminer.com Documenting Expectations When an auditor develops an informed expectation, it’s important to include the proper documentation in the workpapers. 100
HOUCK 06.qxd
5/30/03
12:08 PM
Page 101
Common Pitfalls of Analytical Procedures
Statement on Auditing Standards No. 96, Audit Documentation, states: When an analytical procedure is used as the principal substantive test of a significant financial statement assertion, the auditor should document . . . the expectation, where that expectation is not otherwise readily determinable from the documentation of the work performed, and factors considered in its development.
Smart auditors take this one step further. They document their expectations, along with pertinent factors considered during development of those expectations, in any instance when analytical procedures are a significant part of the audit approach. For example, if an auditor performs analytical procedures to lower the sample size for confirmations, he should thoroughly document this analysis (including expectations), even though confirmations are considered to be the principal substantive test.
SETTING SCOPES FOR VARIANCE ANALYSES At the beginning of this chapter, I described the problem with selecting variances to explain based on predetermined scopes (e.g., items greater than 10 percent and $100,000). What’s a better alternative? In most instances, I prefer a scope like this: Items were judgmentally selected based on (1) materiality of the account balance, (2) variance from the prior year, (3) relationship to other accounts, and (4) considering our knowledge of the client’s operations, industry, and economy.
This may sound vague, but it’s appropriate. Once the client’s 101
HOUCK 06.qxd
5/30/03
12:08 PM
Page 102
Why and How Audits Must Change
general ledger is available, the engagement team should exercise its good professional judgment to decide which numbers are worthy of explanation. Ultimately, the engagement partner needs to ensure that all necessary balances are investigated. When making selections, the engagement team should keep in mind directional risk. For example, suppose you strongly believe that your client wants to artificially inflate its bottom line. When reviewing fluctuations from the previous year, you notice that “prepaid expenses” decreased $40,000 from the prior year (when you expected the balance to be roughly the same). Because you are most concerned about overstatement of prepaid expenses, the $40,000 drop may not be worrisome even though you expected a constant balance. Of course, if the client posted a $40,000 increase in prepaid expenses, this might be a red flag warranting further investigation.
NOTE 1. See SAS No. 96.
102
HOUCK 07.qxd
5/30/03
12:08 PM
Page 103
7 AN EASY APPROACH TO IMPLEMENTING ANALYTICAL PROCEDURES
HOUCK 07.qxd
5/30/03
12:08 PM
Page 104
HOUCK 07.qxd
5/30/03
12:08 PM
Page 105
O
nce an auditor becomes skilled in performing more effective analytical procedures (as discussed in Chapter 6), it’s time to use these skills whenever possible. After all, these procedures improve quality, efficiency, staff morale, and client service. This chapter explains a process that I call “The Analytical Three-Step.” Don’t worry, it doesn’t matter if you can’t dance! This is simply an easy approach to help auditors incorporate more analytical procedures into their audit approaches.
STEP ONE: THINK ANALYTICAL FIRST The first step in this process is extremely simple: Always look for opportunities to perform analytical procedures.
No matter what account or balance you’re examining, always consider if analytical procedures can provide evidence. Always! Always! Always! At AuditWatch, we created a motto to help our clients remember this. It’s called “think analytical first.” Put another way, always ask yourself this question: How can I prove that this balance makes sense using analytical procedures? 105
HOUCK 07.qxd
5/30/03
12:08 PM
Page 106
Why and How Audits Must Change
Smart auditors ask this question before considering vouching, confirmations, or any other detailed procedures. If the balance can be wholly or partially addressed by analytical techniques, you should strongly consider using any or all of those techniques. “Think analytical first” is easy to understand, but most auditors struggle to apply the concept in the real world. Why? They mistakenly assume that many accounts and balances can’t be addressed analytically. As a result, they rely heavily on detailed procedures to gain evidence. As discussed in Chapter 1, this approach can be dangerous. Detailed procedures may be easier to perform, but they are not foolproof. In fact, overreliance on such procedures clearly can lead to faulty audits. Think about this question: Would you rather know: (a) That the financial statement balances make sense and appear reasonable, even if little or no tests of details are performed? or (b) That a slew of detailed tests were conducted but you aren’t really sure if the financial statement balances are reasonable?
If I am the person signing the audit opinion, I’ll choose the first answer! Unfortunately, many audit approaches today appear to be based on the second choice. The engagement team relies heavily on detailed tests and often doesn’t know whether the numbers truly make sense. Let me reiterate (from Chapter 5) that I don’t hate detailed procedures. I’m not suggesting that we lock them in the dun-
106
HOUCK 07.qxd
5/30/03
12:08 PM
Page 107
An Easy Approach to Implementing Analytical Procedures
geon and throw away the key. Detailed procedures play a valuable role in all engagements. Nevertheless, the accounting profession’s overreliance on these procedures has spawned poor quality and greatly hampered efficiency. A better mix is necessary! The challenge lies in the fact that detailed testing is so ingrained in our profession that it requires a true paradigm shift to break this addictive habit. I fondly hope that the “think analytical first” motto will be helpful in your efforts to become a more effective auditor.
Types of Analytical Procedures When auditors “think analytical first,” they must identify different types of analytical procedures that might be appropriate in the circumstances. A variety of alternatives exist, including comparing the balance to: ◆ Prior period balance. This includes comparing the balance to the previous year’s number (in some cases, a multiyear analysis is useful). An auditor may also compare monthly or quarterly balances. ◆ Other general ledger accounts. Certain accounts typically move in tandem with others. A simple example is sales commissions moving in proportion to sales. ◆ Budgets. If the client has an effective budgeting process, a comparison to budgeted numbers may be valuable. ◆ Nonfinancial data. General ledger balances are often linked to nonfinancial or operational data. For example, tuition is related to the number of students; sales are often related to production. ◆ Benchmarking data. In many cases of financial fraud, the financial statements appeared out of whack when com-
107
HOUCK 07.qxd
5/30/03
12:08 PM
Page 108
Why and How Audits Must Change
pared to industry norms. When done properly, benchmarking is a valuable procedure that helps to detect material misstatements. ◆ Predictive test. This kind of testing occurs when an auditor independently predicts a balance by identifying the major factors influencing the account. Once the auditor makes a prediction, that forecast is compared to the actual balance on the client’s books. These are sometimes called reasonableness tests.
Examples The “think analytical first” strategy is applicable any time a practitioner encounters a balance during an audit. Here are several examples.
Inventory
At December 31, the following balances exist at a “made-toorder” manufacturer of industrial equipment: 2000 Raw materials Work-in-process Finished goods
398,155 1,010,452 242,565
2001 399,402 1,235,854 210,001
2002 398,105 1,410,559 575,843
In addressing such balances, accounting firms usually perform a variety of detailed procedures. This includes the physical observation of inventory and a substantial amount of price testing. Consequently, most engagement teams make a substantial investment to ensure that these balances are fairly stated. Interestingly, few auditors perform extensive analytical procedures to determine if the inventory balances make sense. This 108
HOUCK 07.qxd
5/30/03
12:08 PM
Page 109
An Easy Approach to Implementing Analytical Procedures
is a pity, because engagement teams can thereby improve quality, as well as justifiably reduce the performance of time-consuming detailed procedures. In this example, it’s evident that “raw materials” remains relatively constant over the three years, despite fluctuations in the other accounts. Is this a coincidence? Perhaps the company follows strict policies on when to replenish inventory. Perhaps items are automatically ordered electronically when quantities hit certain levels. Perhaps there are other factors that cause this balance to remain stable. But which explanation is it? It’s often difficult for an auditor to know if a number makes sense without obtaining a better understanding of the client’s business. Therefore, the auditor needs to interview knowledgeable client personnel (somebody like the plant manager or vice president of purchasing) to learn more about the client’s operations. After obtaining this information, the auditor is better equipped to determine if the raw-material balance appears reasonable. In some cases, auditors may gain enough comfort to feel that it’s appropriate to significantly reduce detailed procedures. In other cases, the auditor will gain only a limited amount of assurance concerning the balance. At that point, a large dose of detailed tests is still needed before the auditor can reach any supportable conclusions. This same concept can be applied to work-in-process (WIP) and finished goods. In other words, an auditor should try to determine if these numbers make sense (i.e., appear reasonable) before diving into detailed procedures. In doing so, the auditor may attempt to answer questions such as the following: ◆ Does $1,410,559 of WIP make sense for a shop that employs 20 full-time laborers? 109
HOUCK 07.qxd
5/30/03
12:08 PM
Page 110
Why and How Audits Must Change
◆ Does the WIP balance make sense considering the nature of the products being manufactured? ◆ Why is WIP the only inventory balance that consistently rises each year? ◆ Does the balance of finished goods make sense for this type of “made-to-order” shop? ◆ Why is the balance of finished goods so much higher than in previous years? ◆ If finished goods are comprised of four large pieces of equipment for a certain customer, why is this so? Why wasn’t the equipment delivered to the customer before year-end? Of course, these are just sample questions. The engagement team’s exact questions should be based on a variety of factors, including the nature of the client’s operations, evaluation of internal controls, materiality of the balances, directional risk assessments, and more. Incidentally, an astute plant manager or factory foreman can often look at these balances (or the composition of the balances) and instinctively know whether the numbers make sense. The plant manager might say, “Yep, on New Year’s Eve, we had four big projects in process. Each one was almost fully completed because the customers wanted the machines by early January. But we were waiting on a key part from our supplier.” Or he might state, “You’re saying we have $1.4 million in WIP? That doesn’t sound right to me. I’ll check my records, but I’m sure we shipped one of those four big orders before year-end.” In short, an auditor can consider designing a variety of analytical tests and gather evidence from several different sources to gain comfort (or pinpoint a discomfort) regarding the account balances. If the auditor feels comfortable that the evidence validates the recorded balances, this knowledge can be used to justify a reduction in detailed procedures.
110
HOUCK 07.qxd
5/30/03
12:08 PM
Page 111
An Easy Approach to Implementing Analytical Procedures
For example, suppose the audit team uses nonstatistical sampling to determine the selections for price testing. In most methodologies, sample sizes can be reduced by performing “other substantive procedures” such as analytical procedures. Depending on the extent and strength of the analytical explanations, the auditor may be able to justify a “low” or “moderate” risk assessment. Just as importantly, the audit team gains a much better understanding about the composition of inventory, rather than simply looking at supporting documentation for a bunch of transactions.
Fixed Assets
Most engagement teams don’t spend a lot of time verifying fixed assets. It’s common practice to assume that the beginning balance is accurate (if the company’s books were audited in the prior year) and to examine supporting documentation for large additions and deletions. Unfortunately, this “roll-forward” activity is rarely tested using analytical techniques. But doesn’t it make sense to determine whether the activity is reasonable before you dive into detailed tests? For example, does it make sense for a small radio station to show that it acquired $200,000 of fixed assets in a given year? If so, the auditor should explain the rationale and corroborate client explanations, as appropriate. Depending on the comfort level obtained, the auditor may be able to justify a reduction in detailed procedures (e.g., by raising the scope when vouching fixed asset additions). Conversely, suppose the auditor determines that $200,000 in additions is extremely high for a small station. She reached this conclusion after reviewing the activity in prior years, and by talking to an experienced manager at a different station (an ac-
111
HOUCK 07.qxd
5/30/03
12:08 PM
Page 112
Why and How Audits Must Change
quaintance of the engagement manager). If $200,000 seems unreasonably high (as it does in this case), the client may be cooking the books by capitalizing items that should be expensed (as WorldCom did). Of course, there may be a legitimate reason for the unusually high level of activity. Perhaps the station finally purchased a bunch of ultrasophisticated, high-tech equipment after years of postponing such investments. Whatever the reason, an auditor should validate the explanation and ensure that it makes sense. In addition to using analytical techniques on the roll-forward, it’s important to ensure that the gross fixed asset balance appears reasonable, if possible. In many industries, the auditor can benchmark to accomplish this task (more on this later in this section). Finally, fixed assets should make sense in relation to other accounts. In The Financial Numbers Game, the authors describe an accounting fraud at Flight Transportation Inc., an air charter carrier: The company recorded flights that were not made and overstated tourist charter revenue by 62%.... As was later learned, Flight Transportation reported that it had flown 109 flights during the fourth quarter, a next-to-impossible feat given the size of the company’s fleet.1
In other words, the company didn’t possess the physical capacity to produce the recorded revenue numbers. Thus, an overstatement in revenues could have been detected by considering the amount of fixed assets.
Income Statement
During a typical financial audit, accounting firms usually concentrate on verifying balance sheet numbers, while subjecting 112
HOUCK 07.qxd
5/30/03
12:08 PM
Page 113
An Easy Approach to Implementing Analytical Procedures
the income statement to relatively weak analytical procedures. Unfortunately, it’s rather difficult to learn about the client’s business using this approach. In fact, it’s possible to conduct an entire audit while knowing hardly anything at all about the client’s business! Think about it. Any rookie auditor can confirm cash and receivables, examine invoices for inventory purchases, conduct a search for unrecorded liabilities, complete a few questionnaires, and so on. All these procedures can be performed without knowing fact one about the client’s business. Why, then, do auditors use this approach? The reason is simple: It’s easier to delegate these assignments to inexperienced staff! In recent years, an increasing number of auditors have challenged this conventional wisdom and practice by beefing up procedures performed on the income statement. Specifically, they bulk up their analytical procedures by obtaining more insightful explanations, corroborating client explanations, and designing more precise tests. Here’s an example. On a typical audit, the explanation for a client’s profit margin goes something like this: “Per Raymond, Assistant Controller, margins increased because the company was able to raise prices on customers this past year.”
Pretty lame, huh? But now imagine an engagement team that gains a deeper understanding of the company’s profitability. Among other steps, the auditors conduct research on pricing in the current environment. This allows them to intelligently assess whether the company could realistically have raised prices in such a slow economy. To accomplish this research task, the auditors interview senior management (including the vice president of sales), read in113
HOUCK 07.qxd
5/30/03
12:08 PM
Page 114
Why and How Audits Must Change
dustry publications, and even interview a stock analyst. Armed with this knowledge, the auditors summarize their research in a memo for the workpapers. Now, here are two questions for you: 1. Do you think this audit team understands the client’s business better than a typical engagement team would? 2. Do you think this research provides the auditors with more comfort that the financial statements are fairly stated? I hope your answer to both questions is, “Absolutely!” Now let’s assume that the auditors spent six hours working on this issue. Despite the benefits of this approach, isn’t it true that the team will experience lower realization (i.e., profitability) on this engagement? Not necessarily. You see, once the auditors are more confident that margins (as well as the other components of the income statement) are fairly stated, this provides assurance about large balance sheet accounts, such as inventory and receivables. This is basic accounting, folks. If a client cooks the books to inflate profits, it creates an extra “credit” on the income statement, right? Therefore, there must be an extra “debit” on the balance sheet. Two-sided entries are a beautiful thing! In other words, a client can’t overstate income without affecting the balance sheet. Extending this logic, we see that if an auditor better understands how the client earns money (including its profit margins, expense structure, customer base, and so forth), and thereby gains additional comfort about balances on the income statement, the auditor can then justify a reduction in traditional procedures on balance sheet accounts, especially those closely linked to profitability (e.g., receivables, payables, inventory). Furthermore, if an auditor also performs more and better analytical procedures on the balance sheet, a fundamental shift in the historical audit model has started to materialize. And we 114
HOUCK 07.qxd
5/30/03
12:08 PM
Page 115
An Easy Approach to Implementing Analytical Procedures
haven’t even discussed internal controls and computer-assisted audit techniques yet. How exciting!
Reconciling Items
In the preceding examples, we addressed analytical procedures on the balance sheet and income statement. It should be obvious, if you’re “thinking analytical first,” that these techniques can also be used on other parts of the financial statements, such as footnote disclosures or the statement of cash flows. But these aren’t the only places where analytical techniques can be applied. Remember, “think analytical first” applies any time an auditor encounters a balance.
Example: A client posts a $78,000 “post-closing entry” to increase accounts receivable. This adjustment is made each year to account for legitimate receivables that were not entered into the subsidiary ledger. Presumably, the computer system rejects these transactions due to incomplete or inaccurate information. In most cases, the information is corrected and resubmitted within one or two days. Assuming that this balance is somewhat material, most auditors will perform one of two procedures. First, they might document the client’s explanation about this entry (e.g., “per Bob, Controller, this adjustment is needed because . . .”). Second, they might examine documentation that supports the entry. In many cases, this consists of a journal entry sheet with a bunch of computer reports stapled to the back. Once an auditor sees the $78,000 figure (on the computer reports, or perhaps adding machine tape), he decides it’s time to move on to the next assignment. A smart auditor treats this adjustment differently. First, as 115
HOUCK 07.qxd
5/30/03
12:08 PM
Page 116
Why and How Audits Must Change
always, she considers directional risk in determining how much effort to expend on this adjustment. If strong concerns exist about overstatement of net income, this adjustment is immediately recognized as an opportunity for the client to boost its bottom line. In any scenario, however, the auditor should “think analytical first” when deciding how to test the balance. A simple procedure is to compare the adjustment to the prior year. If last year’s adjustment was only $6,452, the auditor probably has some more work to do! Also, the auditor should ask, “Does this balance make sense?” Let’s say the average sale at this company is $500. Does it make sense that 156 transactions (78,000/500) were rejected by the computer system on the final days of the year? When investigating this matter, a good starting point might be to talk with data entry personnel (rather than the controller).
Benchmarking
The final example in this section relates to benchmarking, a process that involves comparing a client’s results to industry or peer averages. Benchmarking can help auditors to assess the reasonableness of financial results, and also shows where they might be able to generate opportunities to add value.
Example: An auditor determines that sales per square foot at a retail client are significantly higher than industry averages. This should be thoroughly investigated to ensure that recorded sales are legitimate. At the same time, SG&A (selling, general, and administrative) expenses are also higher than industry averages. Perhaps this is the reason why sales are so high? 116
HOUCK 07.qxd
5/30/03
12:08 PM
Page 117
An Easy Approach to Implementing Analytical Procedures
Alternatively, this latter observation may provide an opportunity to add value by sharing this information with management (if it doesn’t know it already), or by helping the company to better control SG&A expenses in the future. A lot of accounting firms already “benchmark” the balance sheet and income statement, as well as key operating and financial ratios. This is quite common in specialized industries, such as health care or financial institutions. However, this analysis is often completed near the end of the audit. When this is the case, the primary purpose of the endeavor is to provide valuable information to management and directors. If, however, this analysis is performed earlier in the audit, it can also potentially be used to alter the audit approach, in two ways: 1. Benchmarking can be performed in conjunction with the preliminary analytical review (see Chapter 4). The goal here is to determine whether the benchmarking results should spur a change in the nature, timing, or extent of audit procedures. 2. Benchmarking data can be incorporated into substantive procedures. In other words, when auditing a particular account, it is useful for an auditor to know if the balance is out of line with those of comparable companies. This is different from benchmarking for planning purposes (where the goal is to determine if the audit approach should be altered), although some auditors perform this step at the same time. To illustrate this point, let’s revisit some of our previous examples. Suppose that the small radio station being audited owns about twice as much property, plant, and equipment than any of its peers. Shouldn’t a smart auditor want to be aware of this fact? 117
HOUCK 07.qxd
5/30/03
12:08 PM
Page 118
Why and How Audits Must Change
This situation might result from the company capitalizing items that should be expensed. Or there may be a plausible explanation—but the auditor should carefully investigate the discrepancy, particularly if strong concerns exist about overstating profits. Do you remember our earlier discussion about performing stronger analytical procedures on the income statement? One way to bolster these tests is to incorporate benchmarking into the analysis.
Example: A client earns 30 percent operating margins while the rest of the industry struggles to achieve 20 percent. If management suggests that its spectacular performance results from heavy investments in technology, the auditor should corroborate this claim. What if the executives suggest that their margins are higher because the company charges more for its services? The auditor should then find out why customers are willing to pay this hefty premium. In both cases, management’s explanations should also influence the auditor’s expectations about other accounts. For example, heavy investments in technology should be reflected in property, plant, and equipment (PPE) accounts. Perhaps the company is able to charge premium prices because it employs a more experienced, higher-paid workforce. When benchmarking, misstatements are harder to detect when the client’s numbers appear to be in line with those of its peers.
Example: A company is inefficient, with actual operating margins of 15 percent. On the financial state118
HOUCK 07.qxd
5/30/03
12:08 PM
Page 119
An Easy Approach to Implementing Analytical Procedures
ments, though, management reports 19 percent margins, right in line with industry norms. Unless the auditor knows that the company’s margins should be lower than those of its peers, he might incorrectly conclude that the margins are reasonable. How can you detect such situations? First, the auditor might uncover the problem by performing strong tests on the balance sheet. Remember, the balance sheet must be wrong if the income statement is falsified. Second, by truly understanding the client’s business, the auditor may suspect that 19 percent margins are too high. In short, auditors should always be alert for opportunities to compare results to other companies. This can be formal (e.g., an official survey) or informal (e.g., a partner’s knowledge of what’s normal). Either way, benchmarking can bolster analytical procedures and lead to higher-quality audits.
STEP TWO: DETERMINE THE PROPER STRENGTH Once potential analytical procedures are identified, the engagement team must determine how much effort to expend. Analytical procedures can be weak or strongit’s up to the auditor! When making these judgmental decisions, an auditor should consider materiality and risk, as well as the cost-effectiveness of obtaining evidence by using other techniques. Exhibit 7.1 provides an example of how this works.
Example: An engagement team considers overstatement of revenues and assets (understatement of liabilities and expenses) to be the primary directional risk. For deferred revenue—membership, the auditor conducts a quick reasonableness test and considers 119
427,741
450,485
(22,744.00)
30,094.00 (52,838.00)
–5.05%
11.93% –26.65%
% Variance
120
Source: The Efficient Auditor Newsletter, AuditWatch Inc., 2000.
This account reflects amounts paid in advance for the Electric Football Certification Exam that is held in September of each year. We expected an increase in deferred revenue (due to overall membership growth); however, Jeff Collins (Controller) told us that the exam’s marketing materials were delayed due to printing problems. As a result, the monies were collected later than normal, thus creating less deferred revenue at year-end. I verified this by speaking with Exam Coordinator, Carlos Williams, who confirmed that the materials were mailed late and showed me a report detailing the registrations, including the timing of cash receipts. I also spoke to Curt Wornock in the mailroom, who said his crew had to work overtime to complete this mailing since it was going out late. These stories are consistent, and my review of documentation supports the reasonableness of this balance.
b
Number of members is currently at 5,579 individuals (per board report) who pay annual dues of $100 (per website) prior to the start of the calendar year. As a result, 6 months of the dues should be deferred at June 30. (5,579 × $100) × 6/12 = $278,950. Difference is immaterial. As an additional test, we noted that membership was 5,025 (per p/y workpapers), meaning that member growth in the current year was 11%. Increase in deferred revenue was 11.93%. Again, balance appears reasonable.
a
Notes:
282,343 145,398b
252,249 198,236
$ Variance
12:08 PM
Def. Revenue—Membership Def. Revenue—Certification
a
2021 2025
6/30/00
6/30/99
Description
5/30/03
National Association of Electric Football Coaches Lead Sheet: Deferred Revenue, June 30, 2000
Exhibit 7.1 Determine the Strength
HOUCK 07.qxd Page 120
HOUCK 07.qxd
5/30/03
12:08 PM
Page 121
An Easy Approach to Implementing Analytical Procedures
membership growth since the prior year. This was easy to perform and didn’t involve asking the accounting department any questions. That’s good because it gives the client more time to prepare other prepared by client (PBC) schedules. Notice instead how the auditor spends a lot more effort on the second account, even though the balance is smaller. For starters, the account balance does not match the auditor’s initial expectation of a higher deferred balance. Furthermore, all other things being equal, a reduction in a liability account is riskier than a comparable increase (because the primary risk with this client is understatement of liabilities). The certification balance decreased by approximately $52,000, so the auditor wants to ensure that the client is not inflating the bottom line by recording June cash receipts as revenue (rather than deferred revenue). This is why the auditor corroborates the controller’s explanation to produce a stronger analysis. In general, it’s wise to design stronger analytical tests for material or risky accounts. Conversely, weaker procedures may be appropriate when account balances are less risky or immaterial. Of course, an auditor’s goal is always to find the most efficient way to obtain sufficient evidence. In some situations, it may actually be faster and more effective to examine supporting documentation than to design an analytical approach. For example, suppose the company owns several large certificates of deposit. It’s probably most efficient and effective to perform detailed tests on these balances. In other situations, the auditor may choose to use both analytical and detailed procedures to gain comfort. In fact, for large balances, it can be difficult to gain satisfaction by using only analytical procedures, even if they are strong. 121
HOUCK 07.qxd
5/30/03
12:08 PM
Page 122
Why and How Audits Must Change
Before continuing, I’d like to make one other point. It’s possible that several weaker analytical procedures, when considered together, can provide solid evidence. Here’s an example.
Example: Robert Barone, a former policeman, just started his new career in auditing. While testing payroll at a large company, he asks the controller to explain the variance in total payroll from the prior year. Although he’s pretty comfortable with the controller’s explanation, Robert believes that more work is necessary, because payroll is the company’s largest expense. Therefore, he designs a few more analytical tests, including: • Average payroll per employee (three-year analysis) • Average payroll per employee (comparison to industry averages) • Actual payroll versus amount per budget Assuming that these tests provide satisfactory results, Robert can be much more satisfied with the payroll test results. Although none of these tests may be particularly strong, together they all paint the same picture. As Robert explained later to his inquisitive mother, Marie, it’s kind of like obtaining circumstantial evidence in a murder trial. A prosecutor loves to find the murder weapon, but even without it, the prosecution can still win the case if enough circumstantial evidence is gathered. Of course, if Robert had not been satisfied by these tests, he could have performed other detailed tests or strengthened the analytical procedures, using the methods described in Chapter 6. As should be evident from the discussion throughout this 122
HOUCK 07.qxd
5/30/03
12:08 PM
Page 123
An Easy Approach to Implementing Analytical Procedures
section, there is no clear-cut, mechanistic formula for determining the strength of analytical procedures; it just doesn’t exist. As with other topics in this book, judgment and brainwork are required. This is actually great news, because creating and evaluating insightful analytical procedures is one of the most rewarding aspects of auditing. Without analytical procedures, auditing might be boring!
STEP THREE: TEST AND EVALUATE RESULTS When you evaluate the results of analytical tests, your conclusions and analyses should be logical and defensible. One of the most common mistakes is for auditors to rely on faulty assumptions when reaching their conclusions.
Example: Charles Deardorf, staff auditor, designed the following simple test for interest expense: Average Debt × Average Interest Rate = Predicted Interest Expense To compute the average balances, Charles obtained the following data: Outstanding debt at December 31, 2001 Outstanding debt at December 31, 2002 Interest rate at December 31, 2001 Interest rate at December 31, 2002
$970,000 $950,000 9% 7%
Charles then determined that interest expense should be: (970,000 + 950,000)/2 × (.09 + .07)/2 = $76,800 Before bashing Charles, it’s fair to acknowledge that this is a common audit approach. But what if the 123
HOUCK 07.qxd
5/30/03
12:08 PM
Page 124
Why and How Audits Must Change
company’s business is seasonal and the credit line is used more heavily at various times throughout the year? Specifically, here are the month-end balances for the outstanding debt: January
$ 970,000
February
$1,040,000
March
$1,415,000
April
$1,785,000
May
$2,001,000
June
$2,355,000
July
$2,310,000
August
$2,375,000
September
$2,018,000
October
$1,645,000
November
$1,210,000
December
$ 950,000
Using this more precise data, the average balance is computed as $1,673,000. Assuming an 8 percent interest rate (which could also have fluctuated during the year), the interest expense prediction now becomes $133,840, nearly double the amount that Charles estimated. In this case, Charles made a poor assumption when estimating average balances. Specifically, he concluded that year-end balances were representative of the entire year. We can hope that a supervisor would have challenged the assumption when reviewing his work. Better yet, the auditors should have discussed this test in planning and determined the appropriate degree of precision at that time.
124
HOUCK 07.qxd
5/30/03
12:08 PM
Page 125
An Easy Approach to Implementing Analytical Procedures
Here’s another example:
Example: Prepaid insurance at June 30 is comparable to the prior year’s balance. Many auditors would conclude that this amount is reasonable . . . but isn’t this conclusion a bit premature? What if annual premiums are due on July 1 and the client fails to prepay this year’s invoice (unlike in past years)? If so, the prepaid balance should be zero. If the client wanted to cook the books and overstate profits, this might be an easy way to accomplish the task. The following journal entry could be posted at year-end: DR
Prepaid Insurance CR Cost of Sales
In this case, an auditor should consider when annual premiums are due. With a payment due on July 1, an analytical approach might not make sense, because the exact timing of the payment can affect the account balance. Of course, if the annual premium is due on March 31, an analytical approach makes more sense. After all, it’s more likely in this situation that the balance will be comparable to the prior year’s (assuming no major changes in coverage, rates, etc.).
Evaluating Results An auditor must ultimately decide if analytical tests provide sufficient evidence. If not, the auditor may need to strengthen the analytical procedures or perform additional detailed procedures.
125
HOUCK 07.qxd
5/30/03
12:08 PM
Page 126
Why and How Audits Must Change
Example: As shown in Exhibit 7.2, an auditor performs a simple analytical test to assess the reasonableness of revenues at an international consulting firm. The difference between the auditor’s prediction and the actual balance is $210,000.
Exhibit 7.2 Analytical Test to Assess the Reasonableness of Revenues at an International Consulting Firm Stardox & Associates, Inc. Consulting Revenues December 31, 2000 Number of consultants Hours per year ×
50 (per year end payroll register) 1,920 (2,080 less 4 weeks of personal days) 96,000 95 (per discussions with CFO)
Rate per hour
×
Revenue estimate Difference
9,120,000 (210,000)
Revenue per G/L
$8,910,000
Assume that materiality is $250,000 and that the engagement team is concerned about understatement of revenues. In the past, several senior partners intentionally lowered revenues by failing to report the time they spent on certain projects. For a variety of reasons identified during planning, the engagement team suspects that company management may try these tricks again in the current audit. Based on this risk assessment, it would be foolish for an auditor to accept the discrepancy shown in Exhibit 7.2, wouldn’t it? This predictive test suggests that a potential problem does indeed exist, because it indicates that revenues should be higher (and this as126
HOUCK 07.qxd
5/30/03
12:08 PM
Page 127
An Easy Approach to Implementing Analytical Procedures
sumes 100 percent chargeable hours by the consultants!). Although the discrepancy is less than the materiality threshold, a prudent auditor would normally follow up on this matter. Even so, many auditors are tempted to write “appears reasonable” in such an instance, especially if strong budget pressures exist. Don’t make this mistake! Auditors should always ensure that their explanations can withstand scrutiny from supervisors—or other, even less sympathetic scrutinizers!
Don’t Forget about Related Accounts It’s great when a client provides a reasonable explanation for a variance; but it’s important to consider the explanation in relation to other general ledger accounts as well. Inexperienced auditors frequently fail to consider this point. Suppose the client informs the auditor that “payroll increased because 50 new employees were hired this year.” Based on this initial comment, the auditor might build a strong analytical procedure by corroborating this explanation and achieving the right degree of precision. However, the auditor must also consider other accounts that are affected by this explanation. For example, payroll tax expense, health insurance, and other benefits are likely to increase. But that’s not all. Where are these employees working? Did they receive new offices or cubicles? Were they provided with computers or other equipment? If 50 employees is a significant number, the impact on these various accounts could be material. In short, it’s important to think about all of the potentially material ramifications of the explanation. Let’s look at a more involved example: 127
HOUCK 07.qxd
5/30/03
12:08 PM
Page 128
Why and How Audits Must Change
Example: An audit “senior” is testing revenues at an Internet service provider (ISP). She learns that revenues increased 20 percent due to a surge in membership after a successful nationwide direct mail campaign involving free signup-software disks. To determine if online service revenues are reasonable, the auditor must consider a variety of factors, including the timing of the giveaways, the conversion rate (i.e., how many recipients become paying customers), and other factors. Let’s assume that the auditor executes a series of strong analytical procedures and is satisfied with the resulting evidence. This is wonderful, but this event (i.e., a nationwide distribution of free disks) should affect numerous other accounts as well. For example: • Other revenue accounts may rise. For instance, with more members, it’s reasonable to assume that the ISP can command higher advertising rates. • Various expense accounts (e.g., postage, packaging) related to distribution of the disks should increase. • Personnel expenses may rise, as online or telephone support capabilities are boosted in response to higher demand. • Numerous balance sheet accounts (including cash, deferred revenue, and fixed assets, among others) may be affected. The auditor should ensure that these balances appear reasonable in light of this information. In short, it’s important to remember the impact on other accounts when documenting analytical explanations. In practice, partners or managers on engagements often realize this and ensure that appropriate items are addressed. 128
HOUCK 07.qxd
5/30/03
12:08 PM
Page 129
An Easy Approach to Implementing Analytical Procedures
Nonetheless, good auditors don’t wait to receive review notes before doing a good job. By considering such matters before review notes are written, these accountants both prove that they are on the ball while improving the efficiency of the engagement.
LOUSY INTERNAL CONTROLS Throughout this chapter, we’ve addressed the need to incorporate more analytical procedures into the audit process. “That’s great,” you might respond. “But analytical procedures aren’t useful on clients with lousy controls.” This view is commonly held, but it’s not necessarily true. In fact, analytical procedures are often invaluable on clients that are messed up. If auditors can determine the major factors that affect particular accounts, they can accurately predict the balances at year-end, regardless of the competence of the client’s accounting staff.
Example: William Bones is auditing deferred subscription revenue at a small publisher. It produces a newsletter for accounting and auditing professionals, called Unqualified Opinion$. Unfortunately, the accounting records are in disarray, and the deferred revenue account has not been touched since the controller quit in late August. With only two days remaining before a deadline, William’s request for a supporting schedule has been ignored. What should William do? Most auditors choose to pressure the client, threatening to delay issuance of the report until the schedule is prepared and audited. However, William is a “think analytical first” auditor and realizes that it’s possible to address this account without a detailed schedule. 129
HOUCK 07.qxd
5/30/03
12:08 PM
Page 130
Why and How Audits Must Change
William asks Carson Kush (head of circulation) to provide the December report produced for the board of directors. The document contains the following information: One-year subscribers
24,489
Two-year subscribers
1,482
Annual subscription rate Two-year subscription rate
$99 $189
William knows these subscription prices are accurate because they are included in each issue of the newsletter, as well as the client’s website. In addition, Carson is highly confident that the circulation numbers are accurate. They were obtained from a reliable software package used by many publishers. Further, Carson shows William documentation from the printing company revealing that 27,500 copies of the December issue were produced. He explained they always order 5 percent more than the actual circulation so as to have an adequate supply of spare copies. Carson also tells William that the customer base is very stable, with most subscribers renewing each year. He believes that roughly one-half of the subscribers renew late in the year (November or December), before their busy season arrives. The other renewals are spread evenly throughout the year. William verifies this information by talking to the president (who independently agrees with Carson’s assessment) and by examining monthly bank statements. Even though the bank statements were not reconciled, the part-time bookkeeper maintained them in a neat file. By scanning these documents, William is quickly able to confirm that roughly 50 percent of the 130
HOUCK 07.qxd
5/30/03
12:08 PM
Page 131
An Easy Approach to Implementing Analytical Procedures
company’s cash receipts arrived in the last two months of the year. William now has adequate information to make a reliable prediction for the deferred subscription revenue account. He starts by making a quick computation: 26,000 subscribers (rounded) × $99 per year $2,574,000 in subscription revenue William is excited to see that last year’s subscription revenue is $2,559,230pretty close to his prediction. Note that he doesn’t bother to factor in two-year rates, because it’s unlikely to materially change his estimate. Now it’s time to estimate deferred revenue. If onehalf of the cash receipts arrived in November and December, then approximately 11/12 of these receipts should be deferred at year-end (one month of revenue should be recognized). For the remaining cash receipts, William assumes that they arrive evenly throughout the other 10 months. Therefore, on average, the cash arrives 5 months into the year. This means that 7 months of revenue should be recognized, and 5/12 of the total receipts should be deferred. ($2,574,000 × .50) × 11/12 = $1,179,750 ($2,574,000 × .50) × 7/12 = $750,750 $1,179,750 + $750,750 = $1,930,500 The amount deferred on the books was far less than this amount, but this is exactly what William expected. After all, once the controller quit, all cash receipts were posted directly into revenue (i.e., nothing was deferred). 131
HOUCK 07.qxd
5/30/03
12:08 PM
Page 132
Why and How Audits Must Change
After checking his calculations and logic, William shares his findings with his supervisors and the client. If everyone agrees, the financial statements are adjusted to more accurately reflect the deferred revenue balance. This example is provided to debunk the incorrect notion that analytical procedures aren’t useful when controls are weak. In this case, William’s estimate is materially correct because he thoughtfully considered the major factors that affected the account balance. Could William have spent countless hours reconstructing the subsidiary ledger (or ask the client to do this) to arrive at the exact balance? Sure, but this would have been a costly way to arrive at essentially the same answer. The difference would not have been material. In a perfect world, every client would maintain fantastic, completely accurate records and support each balance on the financial statements. But as we all know, a perfect world is just a fantasy. That’s why it’s imperative, whenever possible, for the auditor to use analytical procedures to determine the reasonableness of certain numbers, even when internal controls are weak.
CLOSING THOUGHTS The past three chapters have given numerous examples of how more analytical procedures can and should be incorporated into the audit approach. I did not cover more sophisticated techniques, such as regression analysis, because auditors must learn to walk before they can run. To be blunt, our profession has a long way to go before it should start considering more advanced approaches. Furthermore, many sophisticated techniques are not cost-beneficial on the vast majority of audits.
132
HOUCK 07.qxd
5/30/03
12:08 PM
Page 133
An Easy Approach to Implementing Analytical Procedures
In summary, the proper use of analytical procedures improves audit quality and efficiency, while enhancing client service and boosting staff morale. These are procedures that every firm should love!
NOTE 1.
Charles W. Mulford and Eugene E. Comiskey, The Financial Numbers Game: Detecting Creative Accounting Practices (Hoboken, NJ: John Wiley & Sons, 2002), p. 191.
133
HOUCK 07.qxd
5/30/03
12:08 PM
Page 134
HOUCK 08.qxd
5/30/03
12:08 PM
Page 135
8 INTERNAL CONTROL: THE MISUNDERSTOOD CHILD
HOUCK 08.qxd
5/30/03
12:08 PM
Page 136
HOUCK 08.qxd
5/30/03
12:08 PM
Page 137
A
solid understanding of internal control is needed to conduct an effective and efficient audit. Unfortunately, most auditors struggle to understand and fail to implement fundamental concepts concerning this important topic. In defense of the accounting profession, there’s a pretty good reason why this is so. Internal control is a hard topic to master because it’s difficult to learn and teach. Plus, it isn’t the most exciting topic in the world, to say the least! Seriously, have you read any literature that is supposed to help auditors understand this subject? It’s about as much fun as getting a tooth pulled, or watching paint dry, or . . . well, you get the point. Nonetheless, it’s crucial that auditors understand a client’s internal controls. When effective controls are in place and functioning properly, an accounting firm assumes virtually no risk. Why? Because these controls ensure that the financial statements are reliable and accurate, whether or not an audit is performed. One could argue that substantive tests are unnecessary because the auditors would already know that the numbers are correct. Of course, professional standards don’t allow auditors to forego all substantive procedures, even if the client’s internal controls are spectacular. Clearly, though, smart engagement teams should look for allowable ways to reduce substantive tests when strong controls are present. 137
HOUCK 08.qxd
5/30/03
12:08 PM
Page 138
Why and How Audits Must Change
Now let’s consider a less rosy scenario. What if weaknesses exist in a client’s internal control system? What if material mistakes can find their way into the financial statements? One hopes that the engagement team would design an effective approach to catch misstatements. After all, the independent auditors are essentially the last line of defense for investors, creditors, and other users of the financial statements. If the auditors fail to catch the problems, inaccurate financial statements will be issued. Let’s back up for a moment. Basically, the engagement team has two potential strategies for finding misstatements: 1. The auditors can essentially ignore internal controls (except to comply with the minimum requirements of generally accepted auditing standards), and conduct a purely substantive audit. 2. The auditors can invest some time to better their understanding of the client’s controls. After gaining more knowledge about the nature of possible weaknesses, and developing a better sense of where those control weaknesses exist, the auditors can then focus substantive tests on areas of higher risk, rather than casting a wide net over the entire financial statements. This approach normally involves testing and relying on internal controls. The second approach allows an auditor to (1) spend less time in areas where controls are strong; and (2) devote more time to areas that warrant more attention. It is essentially just another form of risk-based auditing. In addition, this approach often opens up some client service opportunities. If nothing else, the auditors can offer advice to management about how to strengthen controls. For all these reasons, it often makes sense to gain a deeper
138
HOUCK 08.qxd
5/30/03
12:08 PM
Page 139
Internal Control: The Misunderstood Child
understanding of a client’s internal controls. Once again, this can improve quality, efficiency, and client service. Before continuing, it is true that I clearly implied that internal control isn’t the most exciting topic in the world. It’s generally perceived as boring and confusing. Even so, I have accepted the Herculean task of making this topic interesting and understandable. And guess what? I feel up to the task—so let’s get started! TYPES OF CONTROLS Statement on Auditing Standards No. 78, Consideration of the Internal Control Structure in a Financial Statement Audit, says that internal control is a process “designed to provide reasonable assurance regarding the achievement of objectives in the following categories: (a) reliability of financial reporting, (b) effectiveness and efficiency of operations, and (c) compliance with applicable laws and regulations.” Fortunately, auditors need not worry about all of a client’s controls, just the ones related to financial reporting. For example, a company may have policies and procedures to ensure compliance with the Americans with Disabilities Act (category “c”). Additionally, controls may exist to ensure that customer complaints are satisfactorily resolved in a timely manner (category “b”). In either case, it’s unlikely that an auditor would have to understand these controls to plan and perform an effective financial audit. The auditor should, however, be very interested in a control ensuring that all sales are captured in the general ledger (category “a”). Why? This control has a direct impact on the financial statements being audited. Of course, most companies have numerous controls to help ensure the reliability and accuracy of the financial statements. The following example illustrates this point.
139
HOUCK 08.qxd
5/30/03
12:08 PM
Page 140
Why and How Audits Must Change
Example: At the First National Bank of Stuckeyville, a customer named Mr. Stevens is granted a $500,000 term loan to make improvements to his bowling alley. The interest rate is 7 percent. Before any loan of more than $250,000 is granted, it must be approved by the bank’s loan committee. These executives review the paperwork prepared by the loan officer before making a final decision. The paperwork contains information on the creditworthiness of the borrower, as well as the proposed terms of the loan (e.g., total amount, interest rate, maturity date, repayment terms). Once approval is granted by the loan committee, the paperwork is forwarded to the loan processing department and entered into the computer system. In the case of Mr. Stevens, the loan officer accidentally types in “700 percent” for the interest rate, rather than the correct figure of 7 percent. This mistake, if undetected, will cause the bank’s financial statements to be misstated. Specifically, the bank would record 100 times too much interest, thereby overstating accrued interest receivable and interest income. Fortunately, the bank has a variety of internal controls to prevent these types of mistakes from occurring. For starters, during its review of the paperwork, the loan committee may notice the error and correct the documents. This control would prevent the mistake from ever affecting the financial statements. But suppose the loan committee fails to catch the error? Perhaps the executives don’t carefully review the terms of the loans, or maybe they consumed too many adult beverages at the holiday party on the previous night. For whatever reason, they miss the mistake. Will the financial statements end up being misstated? It’s unlikely. 140
HOUCK 08.qxd
5/30/03
12:08 PM
Page 141
Internal Control: The Misunderstood Child
After the loan committee approves the loan, the paperwork is forwarded to the loan processing department, where a loan clerk inputs the data into the computer system. At this point, the clerk should notice the highly unusual interest rate and report this finding to a supervisor. This control would prevent the financial statements from being inaccurate. For the sake of the example, though, let’s assume that the loan clerk isn’t paying close attention and fails to notice the error when inputting the data into the system. What happens next? The transaction is rejected by the bank’s computer system. A 700 percent interest rate is considered to be invalid. That’s great—that’s just what’s supposed to happen. But what if the bank uses software that doesn’t reject unreasonable interest rates? Would the financial statements then end up being misstated? It’s still unlikely. The following morning, the bank’s loan officers and senior management are provided with reports detailing new loan activity. When a senior vice president comes across the Stevens loan, she should notice the usurious interest rate and take action to correct the mistake. Down the hallway, the original loan officer also notices the error. For the sake of discussion, let’s imagine that all of the previously identified controls broke down at the same time. Somehow, this mistake elusively slipped through the cracks. Would the financial statements end up being misstated? It’s still unlikely! 141
HOUCK 08.qxd
5/30/03
12:08 PM
Page 142
Why and How Audits Must Change
When Mr. Stevens receives the loan documents (to sign them), he should notice the incorrect interest rate. Even if he fails to catch the error, Mr. Stevens will soon become delinquent on his loan, despite making the agreed-upon payments. Once he receives the first delinquency notice from the bank, he will immediately contact the loan officer to explain that all required payments were made. After investigating the matter, the bank will figure out what really happened. Of course, if this mistake is material or somehow occurs with numerous customers’ loans (e.g., a quirk exists in the computer system), a good accounting department should also catch the problem. When preparing the monthly reporting package, the controller notices that the yield on commercial loans increased from 7.2 to 7.8 percent in the past month (with no change in the prime rate). This red flag would be investigated to determine the source of the problem. Well, the First National Bank of Stuckeyville may have even more internal controls, but I’m sure you get the point. As a transaction goes from inception to its ultimate destination in the financial statements, it’s not unusual for companies to have a variety of controls to detect misstatements.
The Internal Control StreamTM At AuditWatch, we developed a concept called The Internal Control StreamTM to help auditors better understand and “get 142
HOUCK 08.qxd
5/30/03
12:08 PM
Page 143
Internal Control: The Misunderstood Child
their arms around” the many controls that can exist in a company. The “stream” represents the path that a transaction follows as it moves from inception to its ultimate resting place in the financial statements. As shown in Exhibit 8.1, controls can be located at four different spots along the stream.
Upstream Controls
Upstream controls help to ensure that transactions are properly entered into the computer system. For example, an accounting clerk verifies that every purchase order is properly approved and coded before he or she enters the transaction into the system. Over the years, auditors have typically focused their attention on these types of controls when learning about a client’s system.
Information Technology Controls
Information technology controls are automated controls that help to prevent misstatements. For example, a payroll software application might reject unreasonable data such as an hourly wage of more than, let’s say, $20 per hour. Despite the increasing prevalence of information technology in the business world, many auditors don’t understand these controls; therefore, they shy away from them.
Downstream Controls
Downstream controls come into play after information is processed in a computer system. The control kicks in when client personnel review reports (i.e., the output) generated by the system. 143
HOUCK 08.qxd
5/30/03
12:08 PM
Page 144
Exhibit 8.1 The Internal Control System™
Upstream
Information Technology
Downstream Monitoring (Over-the-Stream)
General Ledger Pond
Copyright © 2000 by AuditWatch, Inc. Reprinted with permission.
144
HOUCK 08.qxd
5/30/03
12:08 PM
Page 145
Internal Control: The Misunderstood Child
For example, suppose a manager at a consulting firm inadvertently charges time to the wrong contract. It’s likely that the partner on the engagement will discover this misposting and take action to fix the mistake. As another example, suppose the assistant controller diligently verifies the completeness and accuracy of accounts payable while preparing PBC schedules for the annual audit. This verification includes checking subsequent disbursements to ensure that all necessary liabilities have been accrued. This is another type of downstream control. These controls can be very effective, which is why an increasing number of auditors are investing the time to better understand how they function.
Monitoring Controls
Once a transaction finds its final resting place in the general ledger, financial reports are prepared for management. In addition to basic financial statements, these reports may include actual-to-budget comparisons, profitability by division, and others. At most companies, this information is produced on a monthly basis. These reports present another opportunity for the company to detect misstatements. When preparing or reviewing these reports, management may conclude that certain numbers just don’t look right. For instance, suppose a privately held company posts record sales in the month of December. However, the owner is suspicious because he knows that December was not an outstanding month. He asks for further investigation and soon finds that a mistake occurred in the preparation of the financial statements. I often refer to such controls as “over the pond” (to maintain the stream metaphor), but they are generally referred to as 145
HOUCK 08.qxd
5/30/03
12:08 PM
Page 146
Why and How Audits Must Change
monitoring controls in professional literature. The distinguishing aspect of monitoring controls (as opposed to others) is that they are pervasive. In other words, such controls aren’t related to a particular account or assertion. Rather, they are applied to the overall financial reports. As a result, strong monitoring controls may allow an auditor to reduce control risk for a variety of accounts or assertions.
MINIMUM AUDIT REQUIREMENTS During an audit, the engagement team may test and rely on internal controls to reduce substantive procedures. Although relying on controls is usually optional, auditors are always required to gain a sufficient understanding of controls to properly plan the audit. The second standard of fieldwork (as revised under a new Exposure Draft issued by the Auditing Standards Board), states: A sufficient understanding of the entity and its environment, including its internal control, is to be obtained to assess the risk of material misstatement of the financial statements whether due to error or fraud, and to design the nature, timing, and extent of further audit procedures.1
Unfortunately, most accounting firms fail to comply with the spirit of this requirement. They achieve merely technical compliance by checking boxes on questionnaires, performing walkthroughs of typical transactions, and the like. Despite this accumulation of documentation, most auditors gain only a cursory or superficial knowledge of controls using these approaches. Consequently, there is little or no impact on the rest of the audit. It’s crucial to remember that the ultimate purpose of this work is to “determine the nature, timing, and extent of tests to 146
HOUCK 08.qxd
5/30/03
12:08 PM
Page 147
Internal Control: The Misunderstood Child
be performed.” Therefore, to truly fulfill the ASB requirements, an auditor should sincerely try to identify where controls are strong or weak, rather than simply gathering documentation for the workpapers. If controls are strong, an auditor can then evaluate the costbenefits of testing controls and reducing substantive procedures. However, if controls are weak, an auditor may need to tailor audit programs to compensate for these risks. The next several sections discuss the pitfalls of the most commonly used approaches in more detail.
Internal Control Questionnaires Most accounting firms use standardized questionnaires to document their understanding of internal controls. Nothing is inherently wrong with these tools; in fact, they can provide great value by ensuring that important matters are considered. The problem lies in how the questionnaires are used in the real world. In many instances, questions are answered “yes” or “no” without critical thought. This is partially because inexperienced auditors are assigned the task of completing these lengthy documents. They lack the knowledge to properly evaluate client responses or ask insightful follow-up questions. (In reality, they don’t even know what some of the questions mean!) Obviously, this problem can be rectified by assigning more experienced staff to these tasks. Imagine the difference if partners (as opposed to junior-level staff) interviewed clients and completed the questionnaires! Of course, using this logic, partners should perform virtually every procedure on an audit. Besides the fact that it’s never going to happen, this would be very expensive and impractical. Fortunately, it’s not necessary in most cases. As discussed in Chapter 12, firms simply need to do better at ensuring that all 147
HOUCK 08.qxd
5/30/03
12:08 PM
Page 148
Why and How Audits Must Change
audit personnel are well trained and equipped to perform their assigned tasks. That said, when the client is a higher-risk entity (e.g., a large public company with complex information technology controls), it may be appropriate for more experienced auditors to conduct the internal control work. Another option is to make personnel assignments to the various areas based on risk. For example, a talented auditor with 18 months’ experience may be qualified to understand the controls surrounding cash disbursements. However, perhaps a senior manager should address the revenue cycle, particularly if complex recognition problems exist. These recommendations are basically just common sense, but many firms still don’t take this process seriously. Questionnaires are frequently handled by an individual with inadequate training, thereby turning the exercise into a mechanical, rote, and relatively useless process.
Documentation of Significant Cycles In addition to completing standard questionnaires, many firms document controls related to major accounts or cycles (sometimes called processing streams). These often include revenue/ cash receipts, accounts payable/cash disbursements, and payroll. In specialized industries, others are also typically included. Years ago, many firms used flowcharts to document these processes. Unfortunately, auditors often wasted time figuring out whether to draw a rectangle or an oval on the flowchart, rather than spending time gaining an understanding of the client’s business. Today, the walkthrough seems to be the most popular technique for documenting knowledge of processing streams. In a walkthrough, an auditor selects a transaction and follows it from initiation to its destination in the accounting records
148
HOUCK 08.qxd
5/30/03
12:08 PM
Page 149
Internal Control: The Misunderstood Child
(from cradle to grave). This enables the auditor to learn the client’s process for posting transactions. Sadly, walkthroughs have also turned into mindless procedures performed mechanically by the least experienced staff on the team. In many cases, the auditor simply repeats the process documented in the prior year’s workpapers. This repetition is especially easy when copies of client documentation (e.g., reports, reconciliations) are retained in the prior year’s workpapers. Inexperienced auditors typically set out to gather the same documents without truly understanding the process of which those documents are a record. The auditor might simply ask the client, “Do you still generate Report 4934? Can I get a copy?” Even when walkthroughs are performed by more experienced auditors, it’s debatable whether this technique produces a satisfactory understanding of controls. Many smart people believe that a walkthrough is unlikely to identify anything except the most obvious control weaknesses. Sure, it’s nice to understand how a typical, everyday transaction is processed; but is this enough? Wouldn’t it be better to uncover weaknesses in the system, as opposed to tracing routine transactions through the entire process? Yes! In addition to following a typical transaction from cradle to grave, auditors should be asking more questions like the following: I understand that the CFO approves all disbursements, but what happens when she goes on vacation? What happens if an invoice number isn’t included on this form? Why are so many adjustments made at the end of the month? It seems like a division head could easily play games with these estimates. How do you make sure this doesn’t happen?
149
HOUCK 08.qxd
5/30/03
12:08 PM
Page 150
Why and How Audits Must Change
What happens when a cash receipt comes in, but you don’t know where to apply it? Seriously, does the vice president really have time to review these reports? It seems like it would be very time-consuming. In other words, gaining a proper understanding of controls requires experience, inquisitiveness, and common sense. Don’t allow this to become a rote, same-as-last year process! I’m not suggesting that every engagement team conduct an extensive penetration-type audit to find holes or weaknesses in the systems. Nevertheless, most auditors can do a much better job in understanding the controls relevant to the audit. In recent years, progressive firms have made great strides in this area. Typically, the best documentation is contained in memos that provide a wealth of information about a client’s controls. The knowledge is derived from client interviews that focus not only on how typical transactions are processed, but also—and more importantly—on whether the system is effective in preventing material misstatements. When writing these memos, the auditor should make the documentation easy to review. I once reviewed a four-page, single-spaced memo; it contained fantastic information on the client’s controls, but my most lasting memory is the migraine I got from reading the document! Especially when a lot of text is presented, it’s important to break the memo into different parts, each with its own heading. This helps the writer and reviewer by ensuring that important information is not omitted or overlooked. Naturally, it’s essential to update the memo properly each year. Avoid the temptation to simply ask the client if anything has changed. Instead, consider providing a copy of the old memo and asking the client to update the information. Then verify key information verbally, as appropriate. Alternatively, if the circumstances warrant, consider discussing the entire memo with the client. 150
HOUCK 08.qxd
5/30/03
12:08 PM
Page 151
Internal Control: The Misunderstood Child
Information Technology Controls To gain the required understanding of internal controls, auditors must be increasingly familiar with information technology (IT) controls. As previously mentioned, though, most auditors lack adequate knowledge of these matters. The Auditing Standards Board recognized this problem and provided additional guidance on IT controls in SAS No. 78. Unfortunately, this pronouncement had little impact on how accounting firms conduct their engagements. Therefore, the Auditing Standards Board again addressed IT controls in Statement on Auditing Standards No. 94, The Effect of Information Technology on the Auditor’s Consideration of Internal Control in a Financial Statement Audit. In a nutshell, this standard basically said, “Come on, auditors, you can’t ignore technology any longer!” SAS No. 94 also emphasized that auditors might have no choice but to test IT controls in certain situations. In other words, assessing control risk “at the maximum” may not be efficient or effective in highly automated environments. If there were an easy solution to the IT dilemma, most accounting firms would have jumped on it by now. After all, most firms are conscientious and want to do the right thing. The problem is that technology has become so complex and pervasive that specialists are often needed to understand these issues. Particularly on higher-risk or complex client audits, firms must consider using technology specialists as part of the audit team. The Panel on Audit Effectiveness echoed this view after conducting a comprehensive evaluation of audits performed in the United States: Information technology specialists should be more effectively and consistently integrated into the audit process. ... Firms without such specialized capabilities should develop appropriate cooperative arrangements to assure informa151
HOUCK 08.qxd
5/30/03
12:08 PM
Page 152
Why and How Audits Must Change
tion technology risks and controls are fully addressed in the audit.2
Certainly, this expertise will lead to better-quality audits. In addition, engagement teams are likely to provide better service to clients by identifying IT weaknesses and opportunities. Larger accounting firms are likely to possess the necessary IT expertise in-house. Smaller firms, however, may need to acquire assistance from a qualified third party. One alternative is for a group of local or regional firms (or an association of firms) to band together and share the cost of hiring this expertise. Using technology specialists on financial audits makes sense in many instances—but this doesn’t mean that core engagement team members should be ignorant about technology. My friends, technology is not going to disappear. In fact, it will only become more prevalent in clients’ control systems. Therefore, practitioners need to raise their awareness and competence levels. The Panel on Audit Effectiveness agrees, noting that: Firms should develop specific training materials and programs to make auditors more knowledgeable about information technology.3
No, independent auditors need not specialize or become expert in every aspect of technology (this is impossible). They should, however, become more comfortable with and conversant in technology matters. As mentioned, accounting firms should provide more training to audit professionals on relevant IT topics. Several organizations offer a variety of in-house and public seminars, including:
152
HOUCK 08.qxd
5/30/03
12:08 PM
Page 153
Internal Control: The Misunderstood Child
◆ The Institute of Internal Auditors (www.theiia.org) ◆ MISTI Institute (www.misti.com) ◆ CanAudit (www.canaudit.com) Another way to raise competency and awareness levels is for an accounting firm to encourage (or mandate) that its auditors obtain the CISA (Certified Information Systems Auditor) designation. Like the CPA examination, professionals seeking this certification must successfully pass a test that demonstrates skill levels. At present, gaining an adequate understanding of IT controls is a very important issue for larger accounting firms. Smaller firms tend not to be as concerned because their clients’ systems are often not as complex. Remember, though, all clients are becoming more technologically sophisticated as each year passes. Don’t wait until it’s too late to address this issue!
NOTES 1.
2. 3.
Auditing Standards Board, Proposed Statement on Auditing Standards, Amendment to Statement on Auditing Standards No. 95; in Generally Accepted Accounting Standards (New York: AICPA, 2002), p. 2. Panel on Audit Effectiveness, Report and Recommendations (Stamford, CT, 2002), p. 28. Ibid, p. 28.
153
HOUCK 08.qxd
5/30/03
12:08 PM
Page 154
HOUCK 09.qxd
5/30/03
12:09 PM
Page 155
9 TO TEST OR NOT TO TEST
HOUCK 09.qxd
5/30/03
12:09 PM
Page 156
HOUCK 09.qxd
5/30/03
12:09 PM
Page 157
A
s discussed in Chapter 8, auditors are required to gain a sufficient understanding of the client’s internal controls to plan the engagement. They are usually not required to test and rely on controls. The most notable exceptions are (1) when testing is required for regulatory reasons; and (2) when it’s impractical to conduct a purely substantive audit, because of a highly automated environment. As recently as a decade ago, many firms conducted extensive control tests on virtually all audits, notwithstanding the lack of mandate to do so. This control testing usually involved selecting samples of transactions in major processing streams (e.g., cash receipts, cash disbursements, payroll) and testing a variety of controls for each cycle. The samples were often quite large, anywhere from 25 to 60 items, and the tests results were documented on a multicolumn, manual spreadsheet. Sample items were listed down the lefthand side and controls were identified in columns across the top. The auditor’s hope was to fill the page with a lot of red checkmarks indicating that controls were functioning properly. Despite performing these time-consuming tests, audit teams rarely took credit for their work. In other words, they chose not to reduce substantive procedures. “So why did they test controls?” a logical person might wonder. 157
HOUCK 09.qxd
5/30/03
12:09 PM
Page 158
Why and How Audits Must Change
Well, they sometimes found “exceptions” that led to management letter comments. (It’s questionable whether most clients cared about the often nitpicky exceptions, but that’s a different issue.) Ironically, auditors often tried valiantly to avoid finding exceptions. Why? In some cases, firm policy required engagement teams to expand their samples if exceptions were discovered. This, of course, meant more work for the auditors. So, whenever possible, some auditors labeled an instance of noncompliance as an “isolated exception.” In other words, the finding was not really a problem, they argued, because it wasn’t representative of the population. Although isolated exceptions could legitimately occur, both the concept and the avoidance tactic were often abused. Another trick to produce clean results was to pick a different sample item if the auditor didn’t like the first selection. This was most likely to happen when the original selection required a special explanation or if the documentation was not straightforward (as opposed to the auditor ignoring a known problem). In these cases, some auditors concluded it was simply easier to pick new sample items. Though these actions may initially seem alarming, audit quality was rarely affected by this behavior. Why? Unfortunately, it’s because many of the control tests were virtually worthless and didn’t prove much to begin with. By the mid-1990s, most accounting firms had realized the folly of these approaches and had discontinued these practices. Instead, they adopted 100 percent, substantive audit approaches on most engagements. For most firms, this phenomenon persists even today. Therefore, even when a client possesses strong controls, many auditors essentially ignore them and assess control risk at the maximum. Unfortunately, this is a missed opportunity to improve efficiency and better understand the client’s control systems.
158
HOUCK 09.qxd
5/30/03
12:09 PM
Page 159
To Test or Not to Test
I’m not encouraging auditors to return to the failed control tests of the past. The key is instead to design efficient and effective tests that actually accomplish the auditor’s goals. Fortunately, as described in Chapter 8, most organizations maintain a variety of controls to prevent material misstatements. Therefore, control reliance is cost-beneficial on a large number of engagements. Now, some of you are thinking: “Yeah, right. You don’t know my clients. The accounting personnel are clueless.” This may be true. But even in these cases, some accounts may be accounted for properly. In fact, if the audit team doesn’t propose an adjusting entry in a particular area, this probably means that decent controls are in place. After all, the general ledger balance is correct. Unless a magical accounting fairy corrected the ending balance in the middle of the night, the client was probably doing something right!
A FOUR-STEP APPROACH TO TESTING CONTROLS A smart auditor is always alert for opportunities to test controls. When client controls are believed to be effective and audit adjustments aren’t anticipated, an auditor should follow the stepby-step process described in this section. Conversely, if the auditor believes that the client’s controls are ineffective, a “reportable condition” or “material weakness” should be communicated to the appropriate persons in the client company.
STEP ONE: EVALUATE COST BENEFITS When an auditor believes that the client’s controls are effective, the first step is to evaluate the potential benefits of obtaining reliance. An auditor should estimate how much time would be re-
159
HOUCK 09.qxd
5/30/03
12:09 PM
Page 160
Why and How Audits Must Change
quired to lower the control risk, and compare it to the expected savings from a reduction in substantive procedures.
Example: An auditor spends 8 hours testing controls in the revenue cycle. This is a wise decision if the auditor can reduce substantive procedures by eight or more hours (e.g., by reducing the sample size for confirmations). If the auditor can’t justify reducing substantive procedures by at least 8 hours, the decision to test controls is not cost-beneficial. The basic rule of thumb is simple: If you can save time by testing controls, do it! The only exception (besides the mandatory examples listed earlier) is if the engagement team believes that it would be beneficial to test controls for other reasons, even if this adds time to the budget. The most common instance is when the audit team is searching for management letter comments. When determining if controls should be tested, it’s smart to identify audit areas where a lot of effort is expended. For example, the internal controls over prepaid expenses might be superb, but if the account is not material, control testing will not be cost-beneficial, because the balance can be addressed substantively with minimal effort. Nevertheless, don’t automatically rule out smaller budget areas. Perhaps an auditor plans to spend only three hours on fixed assets. If this can be reduced to one hour by performing a 30-minute control test, doing so is cost-beneficial. Of course, the biggest opportunities usually arise when a heavy dose of detailed procedures is required (absent control testing). Even after incorporating more analytical procedures into the audit process (see Chapter 7), the size and nature of some accounts normally require the performance of detailed tests.
160
HOUCK 09.qxd
5/30/03
12:09 PM
Page 161
To Test or Not to Test
Think about some of the larger accounts on the balance sheet. It’s doubtful that an audit team will be comfortable with an all-analytical approach, so detailed procedures will be necessary as well. If controls are effectively functioning, it may make sense to test them in these situations. Let’s switch gears and look at specific examples of how substantive procedures can be altered when controls are successfully relied upon.
Reduce Sample Sizes Both statistical and nonstatistical sampling methodologies allow auditors to reduce sample sizes when controls are relied upon. Typically, a lower control risk allows the auditor to utilize a lower sampling factor (which, in turn, reduces the sample size).
Example: An auditor wants to achieve low control risk and reduce a sample by 22 items. If the sample items are easy to select and test, the auditor believes he will save 6 hours when conducting price tests. Therefore, if controls can be tested in 6 or fewer hours, it probably makes sense to proceed. However, suppose the client is unorganized, and vouching always takes longer than it should. Specifically, the accounting personnel struggle to find supporting documentation, and the inventory pricing is complex. In this case, perhaps the smaller sample size will save the auditor 12 hours when performing price tests. As a result, if the auditor can effectively test controls in 12 or fewer hours, it probably makes sense to proceed.
161
HOUCK 09.qxd
5/30/03
12:09 PM
Page 162
Why and How Audits Must Change
Increase Scopes For many account balances, an auditor examines transactions that exceed a predetermined scope. These scopes are influenced by overall materiality and are often determined during planning. For example, a standard scope might be all “individually significant items” (as computed on a planning form). Regardless of how a scope is selected, the amount can justifiably be increased when reliance is placed on internal controls. The logic is simple. If an auditor determines that controls are functioning effectively, it isn’t be necessary to perform as much substantive testing on the applicable balances. A simple example illustrates this point:
Example: Assume that there will be no control testing. The engagement team believes that it should examine all subsequent cash disbursements of more than $20,000. However, if the auditors reduce control risk to “moderate,” it may be justifiable to raise the scope to $40,000. Further, if control risk can be reduced to “low,” perhaps a $60,000 scope is appropriate. Did you notice the words “it may be” and “perhaps”? This isn’t an attempt to be ambiguous, just a recognition that there is no neat, nifty formula to determine scope increases (when controls are successfully tested). This is a judgment call to be made by the audit team. This really isn’t any different from the sampling example. After all, the engagement team must use its judgment in weighing the factors to determine how much work is necessary to justify a smaller sample size. Continuing with the preceding example, let’s suppose the auditor concludes that “moderate” control risk is justified. The team agrees that a $40,000 scope is appropriate and defendable. 162
HOUCK 09.qxd
5/30/03
12:09 PM
Page 163
To Test or Not to Test
But what if this particular client doesn’t have any cash disbursements of more than $40,000? At the same time, it makes a ton of disbursements ranging from $20,000 to $40,000. In this instance, the team might not feel comfortable with an approach under which no items would be selected, especially when control risk is only assessed at “moderate.” Perhaps the team should change the scope to $30,000 if it wants to examine some disbursements. Alternatively, the scope could remain at $40,000, but the engagement team might judgmentally select a few smaller items to gain added comfort. Perhaps the auditors will decide to carefully scan the disbursements register in search of unusual items. What’s the point of these varying examples? It’s not to suggest that audit scopes should always be lowered when they fail to generate sample items. This is, in fact, a mistake commonly made by inefficient auditors. They examine immaterial balances because they want to look at something. In most cases, this is classic overauditing. Control testing is different. An auditor’s decision to reduce substantive procedures is very subjective. Based on the results of the control tests, does a $40,000 scope make sense? $80,000? $25,000? It’s clearly a judgment call. Most importantly, the engagement team should feel confident that they can defend the decision, if ever it is questioned. As always, risk assessments should be done. For example, in higher-risk situations, the team may want to be more conservative, to ensure that its decisions are beyond reproach.
Accept Weaker Evidence In the previous examples, we demonstrated how auditors can reduce sample sizes and increase scopes by relying on controls. What happens if the engagement team uses an analytical approach to test a balance? 163
HOUCK 09.qxd
5/30/03
12:09 PM
Page 164
Why and How Audits Must Change
Reliance on controls generally enables an auditor to be satisfied with less powerful analytical procedures. For example, the auditor may feel comfortable relying on the controller’s explanation, rather than corroborating the explanation with additional evidence. Again, there are no magic formulas to instruct the auditor about the strength of the analytical procedures. The engagement team must make intelligent judgment calls based on the combined strength of the control tests, analytical procedures, and any detailed tests. Don’t forget to consider the overall risk of the engagement, too!
STEP TWO: IDENTIFY SPECIFIC CONTROLS TO TEST Once an auditor makes a preliminary judgement that it’s costbeneficial to rely on controls, the auditor must identify specific controls for testing. Ideally, the client will have key controls that significantly reduce the chance of a material misstatement. All controls are not created equal. Some are more important in the fight against material misstatements. The auditor should concentrate on identifying these controls and determining how much reliance can be placed on them.
Example: A company has installed a variety of upstream and information technology (IT) controls to ensure that receivables are properly recorded in the subsidiary ledger. However, an overriding or key control occurs when the company’s “hands-on” owner performs a detailed review of the receivables listing to see if everything is in order. If the owner really knows the business, this might be the best control of the bunch! Here’s another example. 164
HOUCK 09.qxd
5/30/03
12:09 PM
Page 165
To Test or Not to Test
Example: A company maintains a variety of controls to ensure that capital expenditures are properly recorded. A key control is the fact that the controller (who is experienced and highly qualified) diligently scrutinizes the list of capital additions each month to ensure that they are properly classified. She does this because, during last year’s annual audit, some transactions were found to have been misclassified, and the preliminary financial statements (which had already been provided to the board of directors) had to be significantly adjusted. This was a major embarrassment, and the controller vowed to make sure it would never happen again! In both examples, there are a variety of effective controls. But if certain controls are extremely effective, it might not be cost-effective to test the others.
How to Identify Specific Controls When searching for specific controls to test, auditors should consider the information they gathered when gaining the required understanding of controls. Completed memos, flowcharts, and questionnaires may identify numerous controls worthy of testing. Another excellent alternative is simply to ask the client’s head accounting person the following question: “How do you know this balance is correct?” If the individual is conscientious and competent, she’ll respond with an intelligent description of relevant internal controls. The auditor can then determine if any should be tested. In contrast, suppose that the client responds, “Oh, the computer takes care of that. I just assume the numbers are right.” Uh-oh! Actually, this doesn’t necessarily mean that the bal165
HOUCK 09.qxd
5/30/03
12:09 PM
Page 166
Why and How Audits Must Change
ance is wrong, nor that controls don’t exist; there may be controls that the accountant doesn’t know about. Nevertheless, an auditor may decide to forgo control tests at this point. (I sure hope that most of your clients belong in the first group!) For large, risky, or complex areas, I’m a fan of a tool developed by AuditWatch, called ControlProbeTM. This spreadsheet makes it easier for auditors to identify controls that prevent material misstatements. Exhibit 9.1 shows a partially completed ControlProbeTM for accounts receivable. The major categories of controls (as described in the Internal Control StreamTM) are listed in columns across the top of the page. Key assertions are listed down the lefthand side. Here’s a brief definition of each assertion: ◆ Existence. All transactions or items recorded on the books are legitimate; that is, they actually exist or occurred. ◆ Accuracy. Transactions are recorded at the proper amount. ◆ Completeness. All assets, liabilities, and equity interests are included on the books; that is, none are omitted. ◆ Valuation. Transactions or balances are valued at the proper amount. Using ControlProbeTM, the engagement team must answer an important question for each assertion: “What kinds of events or occurrences can cause problems with the listed assertion?” In Exhibit 9.1, an auditor has answered these questions for a particular client. Specifically, the auditor has identified a variety of events or circumstances that could create problems with the assertions. For example, two potential problems are identified for the “accuracy” assertion. If a customer is billed an incorrect amount for a legitimate purchase, receivables could be overstated or understated. 166
167
• •
•
• • •
• •
Fictitious customer Product was never shipped Product was shipped but was then returned (never ordered) Cutoff problems Customer billed improperly Cash receipts not applied properly Shipped but not billed Cutoff problems Cash receipts applied improperly Improper writeoffs Financial difficulties for customer Customer disputes
Copyright © 2002 by AuditWatch, Inc.
Valuation
Completeness • • • •
Accuracy
Existence
Over-the-stream
Upstream
Computer
Downstream
What controls are in place to prevent the problems?
12:09 PM
What kinds of events can cause problems with the listed assertion?
A/R
Audit Area
5/30/03
AuditWatch’s ControlProbeTM
Exhibit 9.1 A Partially Completed ControlProbe™ for Accounts Receivable
HOUCK 09.qxd Page 167
HOUCK 09.qxd
5/30/03
12:09 PM
Page 168
Why and How Audits Must Change
Another problem occurs if cash receipts are not posted properly. If the payment is applied to a different customer’s account, total receivables will still be correct. But what if the payment is posted as “other income,” or is recorded in a miscellaneous liability account (because the client didn’t know where to post the entry)? In these instances, the financial statements are misstated. Normally, the first situation (where the receipt is posted as “other income”) is a larger worry, because profits are overstated. However, the auditor might also be concerned about a material balance sheet reclassification (which could occur in the latter example). Take a look at the remaining list of potential problems documented by the engagement team in Exhibit 9.1. Realize that this list can vary from client to client depending on numerous factors, including the auditor’s objective in completing the worksheet. After creating the list of concerns or potential problems, the next step is to identify the client’s controls that prevent these potential occurrences from actually happening. This information is normally obtained or identified by interviewing client personnel or reading the client’s policies and procedures. If a key control is discovered, the team might want to highlight it. When they finish completing ControlProbeTM, the auditors should possess an excellent summary of pertinent controls at the client. In addition to identifying potential controls to test, the engagement team may discover areas where the company needs to strengthen its processes. To gain maximum advantage from ControlProbeTM, key engagement team members should work together to complete this spreadsheet. This includes engaging in face-to-face discussions to identify potential problems, as well as the controls to prevent these possibilities. At a bare minimum, this is usually a thoughtprovoking exercise that is especially valuable in helping less experienced auditors to better understand internal controls. 168
HOUCK 09.qxd
5/30/03
12:09 PM
Page 169
To Test or Not to Test
STEP THREE: SELECT AND PERFORM CONTROL TESTS Once the best controls to test have been identified, an auditor should choose the most effective and efficient way to obtain reliance. There are four primary ways to test controls: 1. Inspection. This involves vouching or examining records or documents. For example, an auditor checks for the appropriate signatures on purchase orders, indicating that transactions were properly approved. 2. Reperformance. This involves reperforming a control to ensure that proper conclusions were reached. For example, an auditor reperforms a reconciliation to verify that it was completed properly. 3. Inquiry. This involves interviewing client personnel to gain evidence that a control is effective. For example, an auditor asks the controller to describe the process of reviewing capital expenditures at the end of each month. 4. Observation. This involves physically watching the control in process. For example, suppose the client’s management team meets monthly to review the accuracy of the financial statements. An auditor can attend one or more of these meetings to observe how the process works. Years ago, firms relied heavily on inspection and reperformance to test controls. In recent years, however, a growing number of auditors have successfully focused on using inquiry and observation procedures. These latter techniques are more effective in many instances. In addition, they enable an auditor to test a broader variety of controls. Consider the management team’s monthly meeting described in the list above. How can an auditor reperform this control? Unless the auditors meet in a conference room and pretend they are management reviewing the financial statements, this is a difficult control to replicate! (If you attempt this 169
HOUCK 09.qxd
5/30/03
12:09 PM
Page 170
Why and How Audits Must Change
approach, ask the clients if you can borrow their clothes to make the session more realistic . . . okay, maybe not.) In the old days, this “over-the-pond” or monitoring control would rarely be tested. It simply didn’t lend itself to sampling. Today, though, smart auditors routinely use inquiry or observation tests to gain evidence that these types of controls are effective and functioning properly. Specifically, the auditor might design any of the following tests: ◆ Ask the controller to describe what happens in these meetings. Ask questions such as “Are mistakes ever found?” and “Do the participants take it seriously?” and “What kinds of mistakes would they fail to discover in this review?” ◆ Corroborate the preceding inquires by interviewing another member of the management team who attends these meetings. ◆ Attend a monthly meeting to gain firsthand knowledge of what transpires. In short, inquiry and observation procedures open up a host of new ways to test controls. Although professional standards prohibit gaining reliance solely by performing inquiries, these techniques can provide valuable evidence. An auditor can be creative in designing strong tests, rather than simply picking a bunch of sample items to keep a junior auditor occupied. Of course, the most effective approaches may include a combination of techniques. The auditor might make inquiries, but then observe controls in action or examine certain documents to corroborate the client’s explanations. Exhibit 9.2 shows a sample memo prepared by an auditor. In this example, the auditor focused on a key control—the detailed review of the subsidiary ledger by the owner. If this control is working as described, it provides solid evidence regarding the existence and accuracy assertions. 170
HOUCK 09.qxd
5/30/03
12:09 PM
Page 171
To Test or Not to Test
Exhibit 9.2 Sample Memo Prepared by an Auditor The Piano Store Internal Control Narrative 12/31/00
jelo 3/01
Background The Piano Store is a privately held small business with one store on 52nd Street in Allentown, Pennsylvania. It sells acoustic and digital pianos to individual and corporate customers. The company is very profitable with no debt. The Piano Store extends credit to many of its customers. The owner, Mr. William Joel, is a big shot in the local community. His wife is also well-known for having managed a popular Italian restaurant for the longest time. At the store, Mr. Joel is no stranger to his customers, making a point of knowing them personally. He is highly respected for his honesty and candor. He is also a “hands-on” business owner, personally staying involved in all major aspects of the company. He is a hard worker, believing that there is no such thing as easy money. Receivables: A Key Control Every week, Mr. Joel performs a detailed review of the receivables subsidiary ledger. If he has any questions, he asks the bookkeeper, Christie Lee, to find the answers. When he’s under a lot of pressure, he has been known to leave Christie voice-mail messages in the middle of the night. Unfortunately, he does not formally document this review. Our Control Tests We believe that the above control, if functioning properly, enables us to assess control risk at “moderate” for the existence and accuracy of receivables. It provides a reasonable likelihood that any problems with the completeness or accuracy assertions would be identified and corrected. (continued)
171
HOUCK 09.qxd
5/30/03
12:09 PM
Page 172
Why and How Audits Must Change
Exhibit 9.2 (Continued) To test the control, we performed the following procedures: • Although Mr. Joel does not formally document his review, he showed us exactly how he conducts this review (for the last month of the year). Specifically, he closely examines the report and compares it to a big chart on the wall where all new sales are posted. Since he knows most of the customers and also monitors inventory levels, it’s unlikely that he would miss a mistake on the report. • Despite Mr. Joel’s reputation for integrity, we decided to corroborate this review by interviewing the head bookkeeper, Christie Lee. She confirmed that he often asks her questions about the report if something doesn’t look right. When we asked if Mr. Joel takes his review seriously, she said “Oh my, yes!” We conclude that the above control is effective and functioning properly. As a result, we assess control risk at “moderate” for the existence and accuracy of accounts receivable. As a result, we can use a lower risk factor when computing our sample size for receivables. Source: The Efficient Auditor Newsletter, AuditWatch, Inc., 2001.
To gain reliance, the auditor used inquiry and observation to ensure that the control is functioning properly. In this case, inspection and reperformance weren’t even viable options. Did you notice the auditor’s professional skepticism? Even though the owner is believed to have high integrity, the auditor thought it prudent to corroborate his story with another individual at the company. Finally, the auditor was successful in reducing control risk to “moderate” in an efficient manner. Because of the thoughtfulness and diligence he put into conducting these procedures, he should have no problem in defending the risk assessment. Ultimately, the benefits included a reduction in confirma-
172
HOUCK 09.qxd
5/30/03
12:09 PM
Page 173
To Test or Not to Test
tions sent to customers. In addition, the auditor also gained a better understanding of the client’s business and had the opportunity to further develop a relationship with the owner. This was a win–win result!
STEP FOUR: ARRIVE AT CONCLUSIONS After completing the control tests, an auditor must draw conclusions as to how much reliance, if any, can be placed on controls. If the tests have been designed and carried out properly, the test results should support the preliminary assessment of control risk.
Example: An engagement team intends to rely on controls over the physical observation of inventory at a client with five manufacturing facilities throughout the United States and Canada. By designing a variety of tests to justify the assignment of a “low” control risk, the auditors plan to visit fewer warehouses and perform fewer test counts. What happens, though, if the tests fail to go as expected? In other words, what do the auditors do if they find that the controls are not as effective as originally believed? Unfortunately, the audit approach for the physical observation may have to be altered, perhaps at the eleventh hour. Because the need for plan revision can present serious problems, it’s important that engagement teams always develop contingency plans to be implemented if the auditors find that controls really can’t be relied upon. Even with a backup plan, the pressure to produce expected results may be significant, especially when judgment is involved. Auditors must always be on guard, to avoid allowing their biases
173
HOUCK 09.qxd
5/30/03
12:09 PM
Page 174
Why and How Audits Must Change
(intentional or unintentional) to affect the conclusions reached from control tests. Otherwise, they may reduce substantive tests without the proper justification.
Example: An auditor confirms receivables at September 30, an interim date. When computing the sample size, the auditor assumes that control risk will be “low,” as in the prior year. This dictates a sample size of 57 items (versus 73 if control risk had been “moderate”). The auditor then selects the sample and asks the client to prepare confirmation letters. When testing controls a few weeks later (after the confirmations are mailed), the auditor discovers that a key control in place last year is no longer functioning effectively. Specifically, in the past, the controller thoroughly reviewed the composition of all receivable accounts before preparing the financial statements. This year, however, the controller admits that he was unable to perform the analysis, because of other priorities and deadlines. Instead, he merely scanned the accounts quickly. The engagement team originally identified the controller’s detailed analysis as a key control, so now it is probably prudent to assess control risk as “moderate,” in light of the new information. Unfortunately, this means that 16 more confirmations are needed. Therefore, the auditor has several choices: ◆ Inform an angry client that more confirmations must be prepared. ◆ Don’t say anything to the client; simply perform alternative procedures on these 16 items and blow the budget. ◆ Continue to assess control risk as “low,” but conveniently fail to document that the client admitted that the review was not as thorough as in the past. 174
HOUCK 09.qxd
5/30/03
12:09 PM
Page 175
To Test or Not to Test
In the real world, some auditors may be tempted to overlook the controller’s comment about his less detailed review. (After all, it wasn’t like he completely ignored the accounts.) Nonetheless, this decision is wrong. An auditor must never sacrifice integrity or ethics! Of course, this type of dilemma is not new. Even in an allsubstantive approach, an auditor faces the temptation to select items that won’t cause problems or generate review notes, especially when a deadline is quickly approaching. Fortunately, the vast majority of auditors are unwilling to sacrifice their principles.
CONCLUSION In summary, control testing makes sense for many reasons. Not only can it improve an engagement’s profitability, but it can also improve quality, as auditors come to better understand the client’s controls and spend more time in higher-risk areas. Furthermore, client service is enhanced, because auditors can offer clients insightful and pertinent comments on controls. Does this approach require the use of judgment? Thank goodness, yes. When judgment is removed from auditing, it becomes very boring, and the “best and brightest” make a quick dash for the exit sign of our great profession!
175
HOUCK 09.qxd
5/30/03
12:09 PM
Page 176
HOUCK 10.qxd
5/30/03
12:09 PM
Page 177
10 TALKIN’ TO THE CLIENT
HOUCK 10.qxd
5/30/03
12:09 PM
Page 178
HOUCK 10.qxd
5/30/03
12:09 PM
Page 179
H
ave you noticed any common ingredients in the approaches described so far in this book? For starters, all the approaches require the use of judgment. This means that an auditor must be experienced, or well trained, or both. Second, an auditor must be able to gather reliable, verbal evidence from clients. In other words, an auditor must be able to conduct effective interviews and inquiries. Unfortunately, verbal evidence is misunderstood by a lot of practitioners. Old-timers are often reluctant to rely on “conversational auditing,” as they sometimes call it, preferring to obtain tangible evidence that can be held between their fingertips. Conversely, some auditors rely too heavily on verbal evidence. They fail to display the appropriate degree of skepticism when conducting client inquiries. Rumor has it that a large accounting firm (which shall remain nameless here) fell prey to this trap before its demise in 2002. Because the audit technique of verbal interviewing is so important and so often misunderstood, this chapter provides guidance on performing fundamentally sound inquiries. Although much of this information is basically just common sense, it’s relevant because so many firms seem to need a refresher on this subject.
179
HOUCK 10.qxd
5/30/03
12:09 PM
Page 180
Why and How Audits Must Change
WHO SHOULD ASK THE QUESTIONS? At many accounting firms, low-level auditors are assigned the task of completing questionnaires, obtaining explanations for variances, and updating internal control documentation. Instructions given to these staff members are often succinct: Here, update this section. Just find out if anything changed. Ask the client to explain these fluctuations. This philosophy must be reconsidered. The engagement team needs to think more seriously about the selection of the individual who will interview a client. Though it’s tempting to delegate these assignments to lower-level staff, this practice isn’t always wise. Let’s assume that questionnaires are used to gather information about a client’s internal controls. It’s imperative that the auditor have the experience and knowledge needed to evaluate client responses and ask appropriate follow-up questions (and to know when follow-up is necessary). This includes questions such as: ◆ ◆ ◆ ◆
“What exactly do you mean by that?” “If that’s true, then why does . . . ?” “Can you give me an example?” “It doesn’t seem like that control is very strong. What would happen if . . . ?” ◆ “I don’t understand. Are you saying that . . . ?” Meaningful back-and-forth dialogue is essential, whether it takes place while the auditor is gathering information about controls, obtaining explanations for analytical procedures, or completing a risk questionnaire. Unfortunately, conversations are rare when an auditor lacks experience or self-confidence. 180
HOUCK 10.qxd
5/30/03
12:09 PM
Page 181
Talkin’ to the Client
“But,” a practitioner might respond, “everything in the workpapers is reviewed by a more experienced auditor.” That’s great, but review notes only address certain issues. A supervisor can’t write review notes on matters that she doesn’t know about; for example, she will never know if the staff failed to document an important comment by the client. Therefore, it just makes sense to select the right person to make the original inquiries. Not only does this improve quality and efficiency, but it also enhances client service. Particularly with larger accounting firms, a common client frustration is dealing with inexperienced staffers who don’t understand what they’re doing.
HOW RELIABLE IS THE EVIDENCE SOURCE? You’ve probably heard the old saying “consider the source.” This clearly applies when making inquiries to client personnel. Not all client representations are created equal. Some clients are candid; others are not. Some clients are well informed and knowledgeable; others may wing it or unknowingly provide false or inaccurate information. Obviously, more reliance can be placed on evidence gathered from clients who are (1) trustworthy, and (2) informed about the subject. Let’s discuss these two factors in more detail, beginning with trustworthiness. Why would a client mislead or lie to the independent auditors? Obviously, if a fraud is being committed, the client contact has a strong motivation to lie or choose words very carefully. This isn’t the only reason why a client might avoid being totally forthright, however. Sometimes clients alter the truth to make themselves look better or to reduce the possibility that they will have to provide more assistance for the auditors. Suppose an auditor asks the client, “Do you perform a detailed review of inventory to identify obsolete items?” 181
HOUCK 10.qxd
5/30/03
12:09 PM
Page 182
Why and How Audits Must Change
How many clients will answer “no”? Not too many, because a “no” answer may lead to an adjusting entry or a management letter comment. Further, the auditor may request that the client perform an additional analysis so that the auditor can get comfortable with the reserves. In addition to a lack of candor, some clients provide evidence without being fully informed about the subject matter. Perhaps they don’t want to look uninformed, so they wing it. In other instances, the person being interviewed simply isn’t privy to all the facts. Lower-level personnel, for example, are not always aware of what’s happening elsewhere in the company. A clerk might not know that a supervisor spot-checks his work on a regular basis to ensure that it has been completed properly. Thus, when the clerk informs the auditor that “nobody checks my work,” the clerk is being honest, but the statement is nevertheless untrue. Here a mistake can have the same effect as a lie. In short, when auditors conduct inquiries, they must carefully assess the reliability of their sources. Information from a client employee who is both trustworthy and knowledgeable constitutes the best kind of verbal evidence. Even so, this doesn’t mean that the auditor can abandon all other procedures or blindly accept the evidence. In all cases, the auditor should maintain the appropriate level of professional skepticism. If the client fails to meet both of these criteria, an auditor must be very careful when evaluating verbal evidence. It may be acceptable, but the auditor will usually have to corroborate important comments, especially in riskier areas.
DO YOU HEAR WHAT I HEAR? To conduct effective inquiries, an auditor must possess strong listening skills. Like many other human beings, though, many practitioners struggle with developing basic listening abilities, 182
HOUCK 10.qxd
5/30/03
12:09 PM
Page 183
Talkin’ to the Client
let alone mastering this skill. Here are a few simple pointers to keep in mind: ◆ When interviewing a client, be careful about focusing too much on what you’ll say next (that is, after the client is through talking). This is a common way to miss important information. A simple way to combat this problem is to be well prepared for the discussion. This includes making a list of questions or discussion topics in advance. Having a list of prepared questions allows the auditor to better focus on a client’s responses during the interview, rather than worrying about what to say or ask next. ◆ Attempt to strike the right balance when taking notes. Some auditors don’t write many notes, and consequently fail to remember important information. This is like the waiter at a restaurant who prides himself on his memory and refuses to write down your order; at least half the time, he brings the wrong food or forgets part of the order. Conversely, other auditors write too many notes, frantically scribbling down virtually every word the client says. This makes it difficult to concentrate on the client’s message and, again, important information may be missed. Once again, there is no magical answer to this dilemma. These facts are just more support for the notion that more experienced, better-trained auditors should conduct inquiries. They will have a better feeling for what is and what is not important during client interviews. ◆ Good listeners are wordsmiths. They carefully consider the exact words used by clients, realizing that different words have unique meanings. 183
HOUCK 10.qxd
5/30/03
12:09 PM
Page 184
Why and How Audits Must Change
Most clients who are committing fraud prefer not to lie, unless they don’t have a choice. Instead, they use vague or ambiguous language, or explain matters in ways that are technically true, but misleading. Here’s an example. Example: Auditor: “Do you think this receivable is collectible?” Client: “We’ve never had a problem with this customer, and they’ve assured us that we will get paid. I can assure you that management is ‘all over’ this one.” Auditor: “But what do you think?” Client: “Well, you never know for sure, of course. But look, I just got an email from the client yesterday assuring us that the payment will be coming shortly. I’ve even instructed my assistant to let me know when the check arrives. We’re hoping it will come sometime this week.” Notice how the client never actually answers the auditor’s questions. Without ever lying, he skillfully ducks the issue. One can only hope that the auditor realizes what the client is doing! Related to this point, it’s critical that auditors phrase their questions properly. Consider the following example from The Wall Street Journal: One senior Wall Street official recalls recently asking Enron officials whether the company had retained bankruptcy counsel. He was told no. He later found out that while Enron hadn’t formally retained such representation, it had met with bankruptcy lawyers.1
In short, some clients (even those with nothing to hide) only provide the exact information that is requested. If the auditor 184
HOUCK 10.qxd
5/30/03
12:09 PM
Page 185
Talkin’ to the Client
doesn’t phrase the request properly, it’s possible that the engagement team will fail to obtain important evidence. Do you remember the example, from earlier in this chapter, where the auditor asked the client whether a detailed review of obsolete inventory had been completed? I suggested that a client normally answers “yes.” Why? Because detailed is a vague word, meaning different things to different people. This gives the client the opportunity to say “yes” (and remain somewhat truthful) as long as some type of review is actually performed. If you want to ask this question, go right ahead. Just be sure that you then follow up with a response like, “Oh, good. Please show me exactly what you do each month.” Accounting firms must become better at executing riskbased audits, understanding internal controls, and performing analytical procedures. To be successful in using these approaches, auditors need to excel at conducting client interviews.
NOTE 1.
John R. Emshwiller and Rebecca Smith, “Corporate Veil: Behind Enron’s Fall, a Culture of Operating Outside the Public’s View,” Wall Street Journal, December 5, 2001, p. A1.
185
HOUCK 10.qxd
5/30/03
12:09 PM
Page 186
HOUCK 11.qxd
6/5/03
10:52 AM
Page 187
11 DATA EXTRACTION SOFTWARE
HOUCK 11.qxd
6/5/03
10:52 AM
Page 188
HOUCK 11.qxd
6/5/03
10:52 AM
Page 189
T
echnology is truly changing the world. Particularly in the past decade, companies everywhere have used technology to revolutionize the manner in which they conduct business. Unfortunately, auditors are lagging behind. “But every auditor in our firm has a laptop,” someone might argue. “Plus we just started the process of going paperless. You can’t imagine how much money our firm spends on technology!” This is probably true. Accounting firms have made significant investments in technology in the past decade. On a typical engagement, auditors routinely use trial balance, spreadsheet, and word-processing applications. They also remotely access networks or intranets and do other cool and useful things. More recently, a lot of firms are making the transition from hard-copy workpaper binders to electronic (paperless) files. This is a major development that has a huge effect on how workpapers are prepared and reviewed. Nevertheless, although many firms have spent megabucks on these kinds of technology initiatives, they rarely use technology to fundamentally alter how audit evidence is obtained and evaluated. In the preceding examples, the technology used generally creates efficiencies but doesn’t significantly increase the chances of detecting material misstatements in financial statements. Therefore, while clients become increasingly sophisti189
HOUCK 11.qxd
6/5/03
10:52 AM
Page 190
Why and How Audits Must Change
cated with respect to technology, auditors continue to perform their duties in ways better suited to the 20th century. Just as civilized governments must keep pace with the increasingly sophisticated tactics used by terrorist organizations, auditors must improve their technological capabilities to catch financial villains. Otherwise, it becomes increasingly difficult to discover material misstatements. In short, auditors must harness the power of technology to perform better audits.
PURPOSE OF THIS CHAPTER You’re probably expecting to read about a plethora of futuristic and expensive technology initiatives that promise to revolutionize auditing. Well, it might be fun to predict the future, but I’m more interested in improving audits today—right now! For example, continuous auditing is an interesting concept that has received a fair amount of attention in recent years. The basic idea is that auditors can opine on financial results or other metrics (ones deemed useful to investors or lenders) on a realtime basis. This is very exciting, particularly to the many folks who believe that the current financial reporting system—that is, historical, GAAP-based financial statements—has lost its relevance. Undoubtedly, such auditing efforts will become more widespread in the future. But the big question remains: What should auditors be doing today? Not in the future, but right now. Suppose an engagement team is meeting next Wednesday to plan an upcoming audit. Is there readily available technology that can help the team conduct a more effective, efficient, value-added audit? The answer is a resounding “Yes!” The technology that immediately comes to mind is data ex-
190
HOUCK 11.qxd
6/5/03
10:52 AM
Page 191
Data Extraction Software
traction software (sometimes referred to as data analysis software). These powerful applications enable an auditor to obtain data from a client’s computer system and load it into a personal computer, where it can be analyzed and manipulated in an endless number of ways, limited only by the auditor’s imagination. This type of software has been available for many years, but only a small number of auditors come close to using its full potential. For starters, many firms don’t utilize data extraction software or understand its benefits. Even those who use the software often limit its use to carrying out basic tasks (sometimes called “plucking the low-hanging fruit”). Examples include footing files, sorting data, and selecting samples. This is in sharp contrast to more insightful and innovative tests that are uniquely customized for specific clients. Just as with analytical procedures, auditing firms must raise the bar to increase the odds of detecting material misstatements.
BENEFITS OF DATA EXTRACTION SOFTWARE This section describes some of the major benefits of using data extraction software. These include: ◆ ◆ ◆ ◆
Enhancing audit quality. Improving audit efficiency. Enhancing client service. Generating additional revenues.
Enhance Audit Quality Data extraction software can improve audit quality in many ways, which are described in the following sections.
191
HOUCK 11.qxd
6/5/03
10:52 AM
Page 192
Why and How Audits Must Change
Perform New and Stronger Tests
When auditors obtain client data in electronic formats, they are able to conduct more effective audit tests, many of which were previously impractical in a manual world. Examples include: ◆ Computing gross margin by product, region, or customer (to increase the precision of analytical procedures). ◆ Calculating daily sales and margins during an interim period and comparing this information to the previous year or months. ◆ Testing the effectiveness of computer controls. ◆ Ensuring that payables are recorded for inventory purchases. ◆ Identifying unusual fluctuations in the unit cost of all inventory items (current year versus prior year). ◆ Listing unusual transactions (e.g., that exceed a certain scope).
Replace Sampling with 100 Percent Testing
Most practitioners rely heavily on scope tests and samples. Without data extraction software, an auditor might: ◆ Recalculate a sample of accrued interest balances, inventory price extensions, royalties, and the like. ◆ Select a sample of subsequent sales to ensure that inventory items are properly valued. Data extraction software enables an auditor to test 100 percent of a population in dramatically less time than it takes to perform these manually performed, detailed procedures. Onehundred-percent testing also eliminates error from poor sampling techniques. 192
HOUCK 11.qxd
6/5/03
10:52 AM
Page 193
Data Extraction Software
Reduce Reliance on Printed Reports Provided by Clients
Auditors often rely on client-generated reports when performing their procedures. Data extraction software, however, allows auditors to create their own reports from raw data, rather than being forced to accept the reports handed to them by clients. For example, rather than asking the client to provide a report that identifies obsolete inventory, an auditor can create any report she desires by accessing the computer system’s raw data. “But,” an auditor might respond, “the client can produce any report we want. Why should we mess around with data extraction software?” First, not every client has the ability to provide custom-tailored reports. Even if a particular client does have these capabilities, this approach doesn’t allow an auditor to play with or massage the data in various ways. Sometimes you need to see and manipulate the data before you know exactly what you want. Of course, reducing reliance on client-provided reports also lowers the risk that management will provide incorrect information or omit data (intentionally or unintentionally). Data extraction software thus vastly improves the likelihood that data integrity will be maintained.
Improve Audit Efficiency Data extraction technology enables practitioners to automate many of the rote, mundane procedures that are often performed by auditors.
Minimize Labor-Intensive Tasks
Data extraction software can process large amounts of information very quickly. It’s certainly faster than any human being! 193
HOUCK 11.qxd
6/5/03
10:52 AM
Page 194
Why and How Audits Must Change
Good uses of these capabilities include verifying the mathematical accuracy of schedules, identifying transactions for scope testing (e.g., listing all items over a set dollar amount), and matching cash receipts against individual receivable balances. These are only a few notables among a host of other labor-intensive procedures that the software can handle with ease.
Spend Less Time in Selecting Samples
Data extraction software allows auditors to use statistical sampling techniques that produce more reliable results in less time (for both substantive and compliance tests). In addition, the sample items can be downloaded into a spreadsheet, eliminating the need to rekey data. Also, when confirmations must be prepared, the sample items can quickly be downloaded into a word-processing document for quick production of letters and mailing labels.
Enhance Client Service Data extraction software helps auditors to differentiate themselves by adding value for audit clients. Good technological ability also builds the reputation of the auditor and the accounting firm.
Add Value for Clients
With the ability to perform new types of analytical procedures and other powerful analyses, auditors can improve their understanding of a client’s business, and thus will be better equipped to add value. The possibilities range all the way from simple to complex. For example, a simple test is to search for duplicate 194
HOUCK 11.qxd
6/5/03
10:52 AM
Page 195
Data Extraction Software
payments in the cash disbursements records. On the other end of the difficulty spectrum, an auditor might design custom reports that extract valuable information for management. As Michael Dell, the world-famous founder of Dell Computer, once stated: The more data we extract about the different businesses within our company, the better we are able to see the strengths and the opportunities for improvement. To say that we have become a data-driven company is almost an understatement.1
Enhance Reputation
When auditors use technology in innovative ways, the reputation and image of the accounting firm are enhanced in the eyes of current and prospective clients. Imagine that you are the chief executive officer of a public company. You think that your financial filings submitted to the Securities and Exchange Commission are accurate, but you rely on other personnel to ensure that the information is properly prepared. You also realize that an effective independent audit helps to ensure fair presentation of the financial statements. Therefore, when evaluating accounting firms, do you choose a firm that uses technology such as data extraction software to perform a host of powerful and insightful tests, or one that relies on a manual approach? That’s a tough question, huh? Not!
Generate Additional Revenues Smart accounting firms have used extraction software to generate new sources of revenues and even to create new, marketable 195
HOUCK 11.qxd
6/5/03
10:52 AM
Page 196
Why and How Audits Must Change
consulting services. Typical revenue-generating opportunities include: ◆ Fraud audits. ◆ Accounts payable audits (e.g., searching for duplicate payments; stratifying check amounts to determine if a credit-card system could reduce the costs of processing small transactions). ◆ Operational audits (e.g., summarizing vendor activity at different locations to detect opportunities for increased purchasing power). ◆ Cash management audits (e.g., computing purchase discounts not taken to determine financial impact; calculating interest lost for time lags between shipments and billing). ◆ Royalty or commission audits. ◆ Insurance claim audits. ◆ Litigation support. Despite the Sarbanes-Oxley legislation, there are still many opportunities to provide these types of service to both audit and nonaudit clients.
CASE STUDY Elves Inc. manufactures and distributes a variety of Christmasrelated products, including artificial trees, wreaths, plastic outdoor figurines, and custom-made stockings. The company operates four sales offices, located in the Northeast, South, Midwest, and West Coast. The accounting department produces a profit-and-loss statement for the entire company, but is able to track sales by region. Recent reports showed a steady improvement in sales but a slowly declining profit margin. 196
HOUCK 11.qxd
6/5/03
10:52 AM
Page 197
Data Extraction Software
Sammy Madlock, manager on the audit team, decided to use data extraction software to perform more precise analytical procedures. After obtaining the client’s data, he produced a report that showed sales and profit margins for each region of the company. This analysis showed that profit margins were terrible in the South. When management was presented with this information, the executives said they expect the southern division to have a more difficult time selling products, because of the climate. Even so, they were surprised at the wide discrepancy between that division and the rest of the company. Could the audit team perform additional analyses, they wondered? Of course! After brainstorming with management, Sammy produced a report showing gross margins by type of product. This is when Sammy discovered some extremely interesting information. The southern division’s margins on trees and wreaths were comparable with margins in the other parts of the country, while custom-made stocking margins were even better. At the same time, the plastic outdoor figures were performing miserably. The sales team was able to keep sales volumes at respectable levels, but only by slashing prices on these products. Apparently, these outdoor decorations were not a big hit in many parts of the South. From this analysis, management discovered that prices had been slashed so far that the company wasn’t making any money. On the basis of this information, Elves Inc. decided to offer new varieties of custom-made stockings and discontinue the sale of plastic figurines in the South. In addition, the southern sales team shared best practices on selling the stockings with the other regional groups, in hopes of spiking sales in other parts of the country. Sammy was extremely pleased with the outcome of this analysis. In addition to enhancing client service, he felt that he had gained a much better understanding of the company’s sales. 197
HOUCK 11.qxd
6/5/03
10:52 AM
Page 198
Why and How Audits Must Change
Nevertheless, Sammy wasn’t finished yet. He also performed a variety of tests related to accounts receivable. For starters, he used the software’s statistical sampling capabilities to select invoices for confirmations. He won major brownie points by telling the controller that he could easily produce the confirmation letters. Because he had already obtained the accounts receivable subledger, it was also very easy to: ◆ Foot the entire file (a 350-page printed report). ◆ Check for duplicate invoices. ◆ Search for related-party transactions. Next, he produced a report showing current versus prior-year balances for each customer. This enabled Sammy to identify individual customers whose receivable balances were increasing significantly. Finally, after preparing a similar report detailing sales volumes by customer, he merged his two reports. With the merged report, Sammy could tell if a customer’s receivable balance was increasing faster than sales volume. Much of the information appeared normal, but he did notice the following data on a medium-size customer, Hometown Christmas Stores: 2001 sales $735,862 2002 sales $713,239 Accounts receivable at December 31, 2001 Accounts receivable at December 31, 2002
$334,298 $470,201
Despite a reduction in sales, the receivables balance had increased nearly 41 percent since the prior year. This seemed unusual, so Sammy conducted some quick research on the Internet and discovered that Hometown Christmas Stores was a struggling retailer. It appeared that the company was too small to compete with large discounters and too big to match the service levels offered by niche operators. 198
HOUCK 11.qxd
6/5/03
10:52 AM
Page 199
Data Extraction Software
Before Sammy met with the controller to discuss this situation, he used data extraction software for one more analysis. He figured out that although Hometown Christmas Stores had paid its bills in an average of 39 days in 2001, the payment lag had increased to 59 days in 2002. At first, the controller argued that this receivable didn’t need a reserve because it wasn’t 90 days past due. When Sammy presented his research, though, even the controller agreed that perhaps a problem was brewing. Ultimately, management met with executives at Hometown Christmas Stores and learned that the company was indeed experiencing cash-flow problems. The company was aggressively cutting costs to try to restore profitability. Because Elves Inc. was the first supplier to spot these problems, it was able to restructure the terms of its credit arrangement with Hometown and increase the likelihood that full payment would ultimately be made. At the same time, the executives at Elves Inc. agreed to increase the allowance for bad debts due to the uncertainty about this receivable. By using data extraction software, Sammy Madlock improved audit quality and efficiency on the audit of Elves Inc. In addition, he earned the respect of senior management and received tremendous job satisfaction from being a good independent auditor. Of course, none of this would have happened if Sammy had stuck with implementation of the audit approaches used by most accounting firms. In short, Sammy recognized that technology is a powerful weapon, especially when combined with creativity and ingenuity.
HOW TO PROCEED If your firm already has data extraction software, it’s important to evaluate the ways in which it is used and determine if your personnel are taking full advantage of its capabilities. If auditors 199
HOUCK 11.qxd
6/5/03
10:52 AM
Page 200
Why and How Audits Must Change
are simply automating tasks that were previously performed manually (e.g., selecting a sample), it’s likely that significant improvements are possible. If, however, your auditors are fundamentally changing their approaches by performing unique and insightful tests, this is an excellent sign. If you find yourself saying, “Wow, that’s really cool” when you hear about a new approach, chances are that the team is headed in the right direction. Of course, many firms don’t currently have access to such software. They may be thinking, “Data extraction software sounds really exciting. I can already think of a few clients for whom it could be tremendously valuable. But I don’t know what to do next!” In the remainder of this section, we discuss your two major options for bringing data extraction software into your firm: 1. Purchase the software. 2. Outsource data extraction processing.
Purchase the Software The two most popular data extraction brands for auditors are ACL and IDEA. Both of these are extremely powerful and can import data from any type of computer system. Just as important, they are designed specifically for auditors. Although other packages, such as Excel, perform some of the same functions, they are not nearly as powerful. Conversely, more powerful technologies do exist, but those programs are not necessarily geared to auditors and may be more difficult to learn. For these reasons, ACL and IDEA are the two heavyweights in the world of auditing. More information about these products can be found on the respective company websites:
200
HOUCK 11.qxd
6/5/03
10:52 AM
Page 201
Data Extraction Software
ACL, Ltd.
www.acl.com
Audimation Services (the U.S. distributor of IDEA)
www.audimation.com
Training
A few years ago, most firms that acquired this technology assumed that all of their professionals needed training to use the software. In many cases, however, training turned out to be wasteful, because most of the professionals failed to use the software enough to become (or stay) proficient. Why? The most difficult aspect of using this software is successfully obtaining data files from clients. The secret to success is extensive training and a lot of real-world experience. Therefore, when professionals use the software only a few times each year, they are likely to struggle and incur significant inefficiencies. In the late 1990s, an increasing number of firms decided that it made more sense to train only certain individuals. These “champions” would handle all data extraction requests for the firm. As a result, they would use the software much more frequently, would retain their skills therewith, and thus would have a much better chance of succeeding on the projects, particularly as they built experience. This approach usually pleases two groups of persons. First, technology-savvy professionals who enjoy these assignments are excited about the opportunity to spend more time working with the software. Even more elated are the auditors who don’t have an interest in comma-delimited files or related topics! Not surprisingly, this group includes many partners. Even so, this latter group shouldn’t be let off the hook completely. It’s critical that they understand the power of the soft-
201
HOUCK 11.qxd
6/5/03
10:52 AM
Page 202
Why and How Audits Must Change
ware and how it can be used on their engagements. They don’t need to know which keys to hit on a computer, but they need to be able to identify opportunities to conduct more effective, efficient, and value-added engagements. Regardless of your approach, professionals who are to use the software must obtain sufficient training to become effective and efficient. Self-study courses or tutorials are available, but it’s often wise for new users to attend introductory training classes that last at least two to three days. Training that is any shorter in duration will probably cause the new users to struggle—and produce inefficiency and frustration—when they begin performing real projects in the real world.
Outsource Data Extraction Processing In some instances, accounting firms are reluctant to purchase data extraction software because they are: ◆ Not sure whether the software is applicable to their practices. ◆ Afraid of investing in training and then losing personnel to turnover. ◆ Concerned that the staff may be overwhelmed by the combination of this and other learning initiatives (e.g., a paperless audit application). For these reasons, numerous firms have turned to outsourcing to meet their data extraction needs. Rather than using firm personnel to obtain and process data from clients, the firm uses trained specialists from an outside organization. Such arrangements are normally handled like other subcontractor agreements.
202
HOUCK 11.qxd
6/5/03
10:52 AM
Page 203
Data Extraction Software
Benefits of Outsourcing
Although most firms are knowledgeable about the benefits of maintaining internal expertise, they are less familiar with the merits of outsourcing. When dealing with a reputable provider of outsourcing services, firms should expect to achieve the following benefits: ◆ Save money. It’s often less expensive to use outsourcing specialists than to dedicate internal resources to a data extraction project. This is primarily because the outside specialists are better trained in and much more proficient with the software. As a result, they obtain and process data much more quickly than auditors who use the software only sporadically. For example, suppose a professional in your firm needs 10 hours to obtain and process various data files. An experienced specialist may be able to complete the task in significantly less time; let’s say 3 hours. Suppose the billing rate for both professionals is $150 per hour. The accounting firm can actually save $1,050 by using the outside specialist. This is calculated by comparing the contractor fees (3 hours × 150 = $450) with the revenue that the employee can generate otherwise (10 hours × 150 = $1,500). In other words, rather than spending 10 hours on a data extraction project, the employee can spend 10 productive hours on a billable engagement and generate $1,500 in revenues for the firm. Of course, this cost-benefit analysis doesn’t even consider a host of other cost savings. For example, the accounting firm does not have to purchase the software, train its professionals, and so on.
203
HOUCK 11.qxd
6/5/03
10:52 AM
Page 204
Why and How Audits Must Change
◆ Get results more quickly. A reputable outsourcer should normally offer more timely service than internal providers. For example, if your firm uses “champions” to process data (as described earlier in this chapter), the engagement team must request assistance and hope that the turnaround time is acceptable. Unless your firm devotes personnel to data extraction projects on a full-time basis, there are likely to be times when the engagement team’s activity and progress are held up while they wait for data extraction reports from the champions who are up to their eyeballs in other projects. A benefit of dealing with an external provider is that data extraction processing is its primary business. Therefore, one of a vendor’s primary goals is to provide a quick turnaround time on client requests. Of course, if an engagement team has the wherewithal to handle a request itself (i.e., somebody on the team is proficient in the software), the turnaround time may be faster. Even so, it’s still likely to take this person longer than a specialist to complete the task—in addition, other audit procedures are left unperformed while the team member focuses on data extraction. When deadlines are tight, this can be a cause for concern. ◆ Get better results. Finally, the engagement team can benefit from obtaining new ideas from an outsourcer that serves a lot of different accounting firms. The outsourcer should be familiar with many best practices and can probably provide the engagement team with a fresh viewpoint and different ideas. It is particularly helpful if the outsourcer is an experienced, external auditor who understands the types of reports relevant to financial statement audits. Otherwise, the team might waste time and money producing reports that are not applicable to 204
HOUCK 11.qxd
6/5/03
10:52 AM
Page 205
Data Extraction Software
the main task at hand. Of course, if these reports are processed for other reasons (e.g., to add value), this can be acceptable.
Vendors
At present, several organizations provide outsourcing services, including both ACL (www.acl.com) and IDEA (www.audimation. com). A major independent provider of data extraction services is AuditWatch. This company created a service known as the Data Extraction Power PlaySM (www.powerplaynow.com), which is now utilized by progressive firms throughout the United States. Tip: Before engaging any vendor of data extraction services, it’s important to ensure that the organization is reputable and reliable. Always ask for a client listing and consider checking references.
NOTE 1.
Michael Dell, Direct from Dell (New York: HarperBusiness, 1999), p. 68.
205
HOUCK 11.qxd
6/5/03
10:52 AM
Page 206
HOUCK 12.qxd
5/30/03
12:10 PM
Page 207
12 ACTION STEPS
HOUCK 12.qxd
5/30/03
12:10 PM
Page 208
HOUCK 12.qxd
5/30/03
12:10 PM
Page 209
T
his book contains many examples that illustrate how to perform better audits. Some are simple; others are more advanced. Regardless of the complexity, though, most accounting firms must improve by implementing these concepts on a consistent basis. Fortunately, professional standards strongly encourage the utilization of these approaches. Accounting firms have no excuse for delay or procrastination! The choice to be made is clear: Embrace change and improve the independent audit, or continue to implement the inferior approaches of the past.
THINKERS AND ROBOTS Even firms that are serious about improvement will not achieve success merely by ordering new audit programs or memorizing examples from this book. The key to successful implementation of these concepts is simple: Engagement teams must be comprised of well-trained, thinking auditors.
“Thinkers” understand that generally accepted auditing standards call for tremendous flexibility and judgment in the 209
HOUCK 12.qxd
5/30/03
12:10 PM
Page 210
Why and How Audits Must Change
design and execution of audit approaches. They recognize that auditing is a creative process and that there are dozens of ways to skin a cat. As a result, Thinkers are rarely tied to prior years’ workpapers. In fact, they relish the opportunity to discover new approaches that are both more effective and more efficient. Thinkers are also well trained in the subjects described in this book. In fact, it’s impossible to properly implement these techniques without proper training. Now compare the preceding profile of a Thinker to that of a “Robotic” auditor. Robots tend to blindly follow standard audit programs, checklists, or the prior year’s workpapers. Their rationale (it can’t really be called thinking) generally runs along the lines of “if the procedure was done last year, it must be okay.” Deviations are typically made only in the most obvious situations, such as when an audit step clearly doesn’t apply to the client. Not surprisingly, Robots are not highly familiar with auditing standards, and often lack a solid understanding of audit theory. Consequently, they rarely display ingenuity when designing audit approaches. Furthermore, Robots are often poorly trained in the audit techniques described in this book. They fail to execute strong analytical procedures or control tests. They ignore or struggle to grasp the various aspects of risk-based auditing. If they use data extraction software at all, the applications are usually basic and unimaginative. Please don’t misunderstand, folks. Robotic auditors are not morons. They are often intelligent, conscientious individuals who care about quality and client service. The more experienced Robots are competent in accounting and reporting issues, and may be very knowledgeable about industry or other topics. Clients and colleagues may love and respect these people. In fact, many very impressive professionals are Robots! However, when it comes to implementing auditing techniques, these individuals accept mediocrity. They are content to 210
HOUCK 12.qxd
5/30/03
12:10 PM
Page 211
Action Steps
follow standardized or prior-year audit approaches. It’s almost as if they believe that it’s required to perform audits in such mundane, mechanical ways. The unfortunate fact is that most of the audit profession is comprised of Robots. Thinkers are in short supply. But don’t despair yet. There’s good news. Robots are capable of changing their stripes. Remember, these are impressive professionals in other aspects of their careers. Just as importantly, Robots are often eager to change when given the chance. Nevertheless, it’s tough for Robots to become Thinkers if their colleagues aren’t also on board and committed to changing their approaches too. In other words, this transformation is made much easier when an entire firm decides to make the switch. Therefore, in the next section, we discuss the three major steps that accounting firms must take if they want their professionals to make this exciting transformation.
THREE ESSENTIAL STEPS FOR TRANSFORMING YOUR FIRM To become a top-notch auditing firm, your organization must take the following three steps: ◆ Make a commitment to audit excellence. ◆ Create the right culture. ◆ Provide great training for your people—your “most important assets.”
Make a Commitment to Audit Excellence Virtually every firm maintains quality control procedures and spends money on training. In many cases, though, these efforts are inadequate for producing excellence. 211
HOUCK 12.qxd
5/30/03
12:10 PM
Page 212
Why and How Audits Must Change
“But Tom,” a nonaccountant might ask, “Why would the accounting profession shortchange a core service like auditing?” The answer is easy. For many years, it’s been widely assumed that audits are commodities. As a result, leaders in our profession have failed to demonstrate adequate interest in this important service. Consequently: ◆ Managing partners and leaders at many firms focus their energies on issues that seem more important, such as mergers and acquisitions, strategic alliances, and client service. Put another way, how many managing partners are passionate about auditing? That’s right, hardly any. Auditing is viewed as a nonglamorous, mature business that doesn’t provide growth opportunities for the future. ◆ Engagement teams fail to invest adequate time in planning audits. They reason: “Why bother? Do it like last year. Follow the standard program. It’s a commodity!” ◆ Audit professionals fail to obtain sufficient training. Too many firms continue to view continuing professional education (CPE) as a mandated cost, and focus on controlling training expenses rather than maximizing cost-benefits. For this reason, a stunning number of auditors have failed to master the basics of effective auditing. ◆ Historical, boring audit approaches are still paramount at most firms, thus driving top-notch talent out of and away from our profession. For these reasons, the sense of pride—the sense of being guardians of a public trust—has evaporated from our profession. Auditing has declined in effectiveness and stature. This career choice isn’t hip or cool anymore. It’s simply a steppingstone to bigger and better things (e.g., a high-paying job in private industry). Solely because of self-inflicted wounds, auditing has indeed become a commodity. 212
HOUCK 12.qxd
5/30/03
12:10 PM
Page 213
Action Steps
Until 2002, few practitioners were bothered by this sad state of affairs. But then, they were jolted with bone-chilling reminders about what can happen when auditors fail to perform their duties properly. Today, accounting firms must make a renewed commitment to audit excellence. Every single firm that opines on financial statement owes this to investors, creditors, clients, staff, and its own partners. Lip service isn’t enough. This commitment means taking auditing more seriously than in the past and acknowledging that your firm can improve, no matter how good your professionals think they are now. Smart executives in every industry know the value of adopting a continuous improvement mindset (where the motto is “We can always do better”), but it’s amazing how many audit partners believe they are the pinnacle of the profession. A common attitude is “I know how to conduct audits, I’ve been doing them for 20 years!” Well, do you have 20 years’ experience, or one year’s experience 20 times? Ironically, most of these practitioners have no basis for their self-inflated views, except that they have successfully passed peer reviews. As the Shania Twain song goes, “That don’t impress me much!” Don’t allow your firm to stick its head in the sand and trumpet its own greatness. Unless your firm is thriving in executing the approaches in this book, it’s time to take auditing more seriously. Even if your firm is doing well in executing these approaches, there are many other ways (not covered in this book) to improve audit engagements. Areas such as client management, sampling, wrap-up, and others provide great opportunities to make audits more effective and efficient. Continuous improvement applies to every accounting firm in the world. There are no exceptions. I have personally worked with hundreds of top accounting firms and have never encoun213
HOUCK 12.qxd
5/30/03
12:10 PM
Page 214
Why and How Audits Must Change
tered one that couldn’t improve significantly. Interestingly, the firms that are most critical of themselves are usually the best performers. It’s the mediocre and lesser-caliber firms that tend to think they know it all. So make the commitment to upgrade and improve. Get serious about enacting real change and improvement, and resist incremental steps that keep your firm hovering near the status quo. To succeed, you’ll need to reevaluate your culture and professional development philosophies, as discussed in the next two sections. Finally, firms must believe and acknowledge that audits don’t have to be commodities. Effective auditing requires knowledge of many topics (e.g., accounting, auditing, a client’s business and industry), both creative and logical thinking and cognitive skills, excellent communication ability, and more. To suggest that an audit is a commodity, merely because certain words are required on the opinion page, is absurd. For obvious reasons, the importance of strong leadership can’t be overemphasized. This must be provided by the managing partner, the director of accounting & audit (A&A), and other top persons in the firm. This even includes supervisors and managers who may notice that the firm is slipping back into the old bad habits. Can these individuals set the ship straight? Probably not, but they can hit the alarm system to wake up the sleeping captain!
Create the Right Culture Culture is the way that a company does business. It determines what is acceptable behavior within the organization, and what will not be tolerated. For an auditing firm that is implementing the concepts in this book, culture is incredibly important. To be successful:
214
HOUCK 12.qxd
5/30/03
12:10 PM
Page 215
Action Steps
An accounting firm must create a culture that encourages and requires professionals always to search for better ways to perform their engagements.
In this atmosphere, auditors are always seeking continuous improvement, challenging the status quo, and attempting to raise the bar. Phrases like “This is how we’ve always done it” are met with scornful faces. “SALY” is frowned upon. Fresh ideas and creativity are not just encouraged, but mandated. Put another way, accounting firms with the proper culture develop Thinkers, not Robots. “Uh-oh,” you might respond. “Our culture isn’t anything like that. Our people like to follow prior years’ workpapers. I never hear new ideas from the people who work for me. If we terminate the Robots, we won’t have many people left!” Remember that Robots can become Thinkers. If this is to happen, though, cultural change must almost always occur. Although they frequently do not realize it, this is one of the most important responsibilities of the leaders in an accounting firm. If a culture isn’t similar to the one just described, management is doing a poor job in running the audit practice. Unfortunately, changing a firm’s culture isn’t always easy, and the change never happens instantaneously. It’s naive to think that management can, for example, issue an edict to change the culture instantly. Check out the following memo: Example
To: All audit personnel From: Herbert Jenkins, Director of A&A Subject: Audit Approach It has come to my attention that our engagement teams rely heavily on prior-year workpapers when planning our audits. Effective immediately, all per-
215
HOUCK 12.qxd
5/30/03
12:10 PM
Page 216
Why and How Audits Must Change
sonnel are instructed to become creative and design more effective and efficient audit approaches. If you have any questions, please contact me directly. Thank you. Yes, this memo is humorous, but it’s not vastly different from the tactics used by many firms. Management seems to think that major change will occur if the firm purchases new forms or issues new policies. It’s also common for a firm’s leaders to believe that periodic forms of cheerleading are sufficient. For example, they instruct the auditors in a staff meeting to “improve efficiency” or “find better and faster ways to get the work done.” Guess what? Nothing much changes. These are just more variations on Herbert Jenkins’s memo. Cultural change is a broad topic, but significant progress can be achieved by following these three steps: 1. Ensure accountability. 2. Set goals and measure results. 3. Generate awareness.
Ensure Accountability
If a firm is to produce meaningful change, people must be held accountable. Otherwise, employees tend to keep functioning in the status quo. Accountability results from: ◆ Rewarding persons who change. ◆ Imposing repercussions on those who resist. ◆ A combination of both.
216
HOUCK 12.qxd
5/30/03
12:10 PM
Page 217
Action Steps
Consider this example.
Example: A firm sincerely wants (and intends) to incorporate more and better analytical procedures into its audits. Nevertheless, while auditing a health care clinic in Rhode Island, the in-charge auditor, Robbie Hanson, ignores analytical procedures and conducts a myriad of detailed tests (confirmations, vouching, recalculations, and more), just like last year. Worse yet, the engagement team held a planning meeting before fieldwork began and discussed the specific analytical procedures that were appropriate. But by the time Robbie began fieldwork, he had forgotten most of the ideas and couldn’t decipher his rather lackadaisical, handwritten notes. Should there be repercussions for Robbie Hanson? If the firm does nothing (as many firms would), it’s doubtful that the culture will ever change. Robbie must be held accountable for his failures. Should his pay be reduced? Not necessarily. But perhaps he should lose the opportunity to earn an incentive bonus. He should also be given strongly worded comments in the review notes of the applicable areas. Just as importantly, Robbie’s formal performance evaluation should address this situation. This latter point deserves more attention. Unfortunately, most accounting firms fail to provide timely and meaningful performance evaluations for staff personnel. This type of feedback is essential for cultural change! If formal evaluations are ignored, or if the evaluations that are done fail to reflect the values of the firm, cultural change will be difficult or impossible to achieve.
217
HOUCK 12.qxd
5/30/03
12:10 PM
Page 218
Why and How Audits Must Change
Of course, the most important persons to hold accountable are partners. Their support is crucial for success. Fortunately, partners have much to gain if audits can be conducted more effectively and efficiently. Nevertheless, many of these individuals (passively or actively, intentionally or unintentionally) act as obstacles to change. In some cases, their resistance stems from a fear of change; in other instances, it’s due to flat-out stubbornness. More common are the individuals who support the change intellectually, but don’t walk the walk. The most common excuse is that they’re too busy. That’s right, too busy to plan their engagements, too busy to review workpapers in a timely manner, too busy to teach their staff, and too busy to take auditing seriously. (And these people are partners?!) Whatever the excuse, these individuals must be held accountable when they don’t support and actively further the audit department’s goals. Again, strong leadership is crucial.
Set Goals and Measure Results
If a firm is serious about holding its professionals accountable, it needs to establish expectations and goals. It also needs to measure results. A reasonable person might expect accountants to be excessively zealous about measuring results. Surprisingly, though, most CPAs show little interest in measuring their own performance. It’s amazing that so few firms adequately measure performance in their audit practices. In many cases, management receives only general information from a time-and-billing system. Such data is virtually useless in driving change and improving results. In his book, Reengineering Management, James Champy states:
218
HOUCK 12.qxd
5/30/03
12:10 PM
Page 219
Action Steps
Measurement and reward processes must reinforce the culture you want to create.1
If an accounting firm fails to set and track specific goals for its audit practice, it will find cultural change difficult to achieve. Here’s a simple example.
Example: An accounting firm concludes that data extraction software is very applicable to its audit engagements. Further, the partners believe this is a great tool for adding value to clients and obtaining consulting engagements. Therefore, the firm decides to bite the expense bullet and provide training for all audit personnel. However, unless this training is reinforced with goals, measurement, and accountability, the results are likely to be incremental. In fact, the results are predictable. The firm’s professionals who love technology are likely to find a few ways to use the new data extraction software on their engagements. Most of the others will be too busy to bother, or will offer a variety of excuses for their inaction (“It’s easier to do things the old way” or “We can’t obtain data from my clients”). One year later, the firm may have enjoyed a few success stories, but the software certainly will not have been used nearly enough to maximize the benefits (and possibly even justify the time and expense of obtaining it). Of course, the firm’s leaders (if they’re even interested) will talk about “getting off to a good start” and “taking the initial steps,” but let’s face it: The firm did a rotten job in implementing change. The firm should have established exciting, yet realistic, goals. Then it should have measured progress toward these goals and ensured accountability. For example, perhaps each manager should be required to
219
HOUCK 12.qxd
5/30/03
12:10 PM
Page 220
Why and How Audits Must Change
use the software on three engagements, unless an exemption is obtained from a senior partner in the firm (who promises to be very skeptical of such requests, as they are sure to come). Alternatively, the firm can create a contest to recognize the persons who use the software the most (or develop the most exciting applications). Prizes can even be awarded. The exact approach depends on the firm’s management philosophies, personality, culture, and so forth. In any firm, though, these types of actions are necessary to push through the needed change.
Generate Awareness
When creating a certain type of culture, employees must be frequently reminded about the firm’s goals. If a firm wants its professionals to act like Thinkers who proactively implement the concepts in this book, it must reinforce this message over and over. This way, employees will be less likely to forget the message and return to the status quo. Just as importantly, the firm’s personnel will know that management is serious about enacting change. In other words, it’s not a “program of the month.” Jack Welch, the legendary chairman of General Electric, wrote: I was an outrageous champion of everything we didfrom our early need to face reality and change the culture to our major initiatives that reshaped the company. Whenever I had an idea or message I wanted to drive into the organization, I could never say it enough. I repeated it over and over and over, at every meeting and review, for years, until I could almost gag on the words.2
220
HOUCK 12.qxd
5/30/03
12:10 PM
Page 221
Action Steps
Of course, as time passes, the message must be communicated in fresh ways to prevent staleness. As Welch further stated: Looking at my handwritten notes for my . . . speeches over 21 years only reminded me of how many times I said the same things from different angles and with different emphasis.3
The firm’s leaders aren’t the only ones who should be communicating the message. Key personnel in the trenches (e.g., partners, managers) must also reinforce the desired behavior whenever there’s an opportunity to do so. Clear goals, good and appropriate measurement systems, and accountability are very important in capturing people’s attention, but the firm should also look for other ways to generate awareness and enthusiasm. Here are a few samples: ◆ Include reminders, tips, or success stories in the firm’s newsletter (or send them via email). ◆ Share best practices or discuss implementation issues at every staff meeting. ◆ Distribute written materials on relevant topics. ◆ Distribute pens with reminders or hang posters that promote Thinking. Of course, this is not a comprehensive list. A firm must do whatever it takes to keep its values and goals on the radar screens of all its professionals. I’d like to add one final note on cultural change. You’ve probably heard the saying “Success is not a destination, it’s a journey.” Well, I’ve worked with many firms that achieved great success in changing their cultures for short time periods (one to two years). Eventually, though, management moves on to the next hot topic (e.g., leadership, sales) and old habits return.
221
HOUCK 12.qxd
5/30/03
12:10 PM
Page 222
Why and How Audits Must Change
Thinkers gradually revert to their old Robotic ways. Turnover brings in new professionals who don’t display the desired behaviorsthey are not properly indoctrinated and they are not held accountable. Partners get busy with new accounts and no longer spend time reinforcing the values of the department. My friends, high-quality auditing is not a fad for us to focus on today and ignore next year. It’s not a Program of the Month, nor is it another item to cross off a “to-do” list and then forget about. Top-notch audit practices must always be passionate about raising the bar and achieving ongoing excellence. This feeling should last forever, and it should change the fundamental character of the firm. Everything in the organization should reinforce this behavior!
Provide Great Training for Your People—Your Most Important Assets In recent years, some accounting firms have strayed away from spending CPE dollars on audit training. In its place, they have targeted other skills and programs, such as developing leadership ability, improving sales ability, learning how to become a better business advisor, and so forth. Apparently, these firms still view auditing as a commodity, and fail to realize that practitioners need to continuously reinforce and upgrade their auditing capabilities. At the same time, an even larger number of firms continue to view CPE as an expense to be controlled, rather than an opportunity to invest in the development of professional staff. Even though they claim that professionals are the firm’s “most important assets,” they often look for inexpensive ways to provide the required hours of CPE. This includes minimizing both the cost and time spent out of the office. Because of these realities, a staggering number of auditors 222
HOUCK 12.qxd
5/30/03
12:10 PM
Page 223
Action Steps
struggle just to implement the fundamentals of effective auditing. The audit profession as a whole does a very poor job of the basics, often referred to as “blocking and tackling.” To successfully implement the principles in this book, accounting firms must take audit training more seriously. In fact, if these approaches are adopted without sufficient training for the professionals who are trying to implement them, the effort might backfire.
Example: A firm encourages its staff to question the work done in the past. A particular engagement team heeds the call and enthusiastically challenges procedures that have been conducted for umpteen years. In doing so, the engagement team decides to implement a new audit approach for cash. This balance is material, but the team can’t remember ever receiving a cash confirmation that revealed an error (for any client). Therefore, cash confirmations are scrapped. The team also thinks it’s a waste of time to examine bank reconciliations, because they’ve always been prepared properly in the past. Instead, the team selects an analytical procedure (current year versus prior year for the total cash balance) and simply asks the controller if reconciliations were completed. To document this inquiry, a junior auditor writes a short memo (about a paragraph, actually) memorializing the nonexistence of errors in past years and describing the controller’s assurance to the team that reconciliations were completed at year-end. Wow! This team quickly made the transition from Robots to Thinkers, didn’t they? Plus, they performed analytical procedures, relied on controls, and implemented more of a riskbased audit. 223
HOUCK 12.qxd
5/30/03
12:10 PM
Page 224
Why and How Audits Must Change
Nevertheless, without knowing any other facts, it appears that this audit approach may be too aggressive, if not downright reckless. It’s great to use the approaches described in this book, but they must be implemented properly to be effective. In short, it comes down to training. Auditors are no different from other professionals who need extensive training before they’re ready for prime time. A top concert band would never perform on stage without undertaking weeks or months of rehearsal and private practice beforehand. A Major League baseball player would never step into the batter’s box during a game without spending countless hours in the batting cage during practice. Yet, for some reason, accounting firms believe they are different. Guess what? Accounting firms are not different! In fact, one could argue that the independent auditor’s responsibilities (e.g., safeguarding the public trust) are a lot more important than entertaining an audience or thrilling sports fans. Accounting firms must invest more resources to ensure that its professionals are sufficiently trained in the fundamentals of auditing. In most cases, this training must be high-quality, live, and interactive. Sure, there are many subjects that are appropriate for selfstudy, CD-ROM, or online education. But teaching auditors fundamental ways to upgrade their audit approaches is nowhere on this list. A Robot can’t become a Thinker by staring at a computer screen. Live training enables students to express their feelings and concerns. It allows instructors to challenge students and make sure that light bulbs are coming on in their heads. It allows back-and-forth dialogue, brainstorming, and more. In short, it provides the necessary ingredients for Robots to become Thinkers. Be careful about sending only select auditors to public training sessions. Even if a training program is outstanding, the auditors often return to their respective firms only to encounter 224
HOUCK 12.qxd
5/30/03
12:10 PM
Page 225
Action Steps
resistance because their colleagues are not on the same page. Even though the firm has just paid for this great education, the firm’s culture may not support the new ways of thinking that the students bring back. This is why it’s most beneficial for all of a firm’s personnel to receive this kind of training at the same time.
Internal versus Outside Training
When evaluating training options, a firm must decide if it will provide training by using internal resources or by engaging outsider vendors. In public accounting, it’s common for an accounting firm to handle its own training needs. Interestingly, this is often done to save money, even though the internal approach often turns out to be more expensive than hiring an outside vendor. Most firms fail to adequately consider the time needed to develop, prepare, deliver, and follow up on training sessions. Even when this time is considered, it is often severely underestimated. If these professionals were working on billable projects instead of training classes, the firm could earn a lot more money (even after paying an outside vendor). Of course, if the firm can’t utilize the professionals for billable work, then the costbenefit analysis may be different. Accounting firms also conduct internal training for two other major reasons: 1. The content is almost guaranteed to be relevant for the attendees when a member of the firm is leading the class. With an in-house trainer, the firm doesn’t have to worry about an outside vendor presenting material that conflicts with firm policy or doesn’t apply to the firm’s business. 2. Internal sessions allow certain professionals to develop 225
HOUCK 12.qxd
5/30/03
12:10 PM
Page 226
Why and How Audits Must Change
and practice their teaching skills. Although this approach can be expensive (as described earlier), it is a morale booster for employees who love to teach. These can be good reasons for using internal resources. Nevertheless, many firms hire outside consultants to assist them in upgrading audit approaches and providing this crucial training. If a service provider is reputable and qualified, your firm should receive numerous benefits, including: ◆ Best practices. Your provider should provide similar services for a wide range of accounting firms and be able to share best practices from across the profession. This includes specific examples of how different firms are testing particular areas. ◆ Objective feedback. An outsider is more able to give honest, objective feedback on the strengths and weaknesses of your audit practice. ◆ Delivery techniques. Your provider should deliver outstanding training that not only teaches personnel how to appropriately implement essential techniques, but also gets them excited about learning and implementing the concepts. It’s not enough for an instructor to be knowledgeable about technical topics. The content must be delivered in an engaging and persuasive manner to maximize the participants’ learning experience. This is, in fact, one of the biggest problems with internal training. It is often developed and led by persons who don’t specialize in these matters. Consequently, the participants never become “pumped” and fail to receive maximum benefits from the learning opportunity. ◆ Implementation assistance. Your training provider should have extensive experience in helping accounting firms to implement these techniques. Training alone is not 226
HOUCK 12.qxd
5/30/03
12:10 PM
Page 227
Action Steps
enough for implementation of these changes. As described earlier in this chapter, a shift in culture is essential. When you select the right service provider to assist in your efforts, your firm should recoup its investment many times over.
CLOSING THOUGHTS As the smoke clears from a most difficult period in the history of the accounting profession, firms must resist the temptation to return to business as usual. It’s time to modernize and upgrade audit approaches, change cultures, and provide professional staff with the training they need to become proficient. Auditing is not a commoditynot even close!and it’s time for practitioners to recognize that fact and begin to act accordingly. The good news is that the required medicine is not painful to swallow. In fact, it tastes pretty darn sweet. If your firm modernizes its approaches and changes its culture, the benefits will be tremendous. So, yes, 2002 was a tough year. But if recent events serve as a wake-up call that jolts auditors out of complacency and mediocrity, it will be the best thing that ever happened to our profession.
NOTES 1. 2. 3.
James Champy, Reengineering Management (New York: HarperBusiness, 1995), 144. Jack Welch, Jack: Straight from the Gut (New York: Warner Books, 2001), 393. Ibid.
227
HOUCK 12.qxd
5/30/03
12:10 PM
Page 228
HOUCK index.qxd
5/30/03
12:10 PM
Page 229
◆ Index
Accounts payable, 48, 145, 162–163, 192, 196 Accounts receivable, 43, 48, 184, 198–199 analytical techniques, 86–87, 89, 115–116 internal control considerations, 166–168, 170–173, 174–175 rollforward, 71–73 Accruals, 33, 48–49, 90–91, 97 ACL, 200–201, 205 AICPA. See American Institute of Certified Public Accountants Allen, Tim, 12 Amazon.com, 26 American Institute of Certified Public Accountants, 44, 79 Americans with Disabilities Act, 139 Analytical procedures: benefits: client service, 76–78 efficiency, 74–76 quality, 71–74 staff morale, 78–80 conflicting evidence, 87–89
documenting explanations, 100–101 evaluating results, 125–127 imprecise explanations, 89–93 lack of informed expectations, 93–100 predictive test, 65–66, 108, 129–132 preliminary analytical review, 62–63, 69, 117 related accounts, 127–129 risk assessments, 65 scopes, 101–102 strength, 119–123 test design, 123–125 “think analytical first”, 105–119 uncorroborated explanations, 84–87 weak controls, 129–132 Anticipation questions, 56–57 Arthur Andersen, 3–7 Asaenet.org, 100 ASB. See Auditing Standards Board Asset write-downs, 30, 33 Atlanta Falcons, 96–97 Audimation Services. See IDEA Auditing Standards Board, 7, 19–20, 94, 146–147, 151
229
HOUCK index.qxd
5/30/03
12:10 PM
Page 230
Index
Culture, 11, 214–222 defined, 214–215 Cut-off, 33, 49–50
AuditWatch, Inc., 105, 142, 166, 205 Bausch & Lomb, 44 Benchmarking, 107, 116–119 defined, 116 Big bath (reserves). See Pile on bad news Bizminer.com, 100 Blank, Arthur, 96 Blatant and brazen techniques, 41–44 Bush, George W., 7 Business Week, 100 CanAudit, 153 Cash, 74, 223–224 Certified Information Systems Auditor, 153 Client research, 57–62 ControlProbe. See Internal controls Cooked transactions, 37–39 Cookie-jar reserves, 32, 44–45 defined, 30 Cooking the books: assessment of risk, 35–46 defined, 23 general methods, 24–27 manipulating the bottom line, 24–25 misclassifying transactions, 25–26 altering footnotes, 26–27 tailoring audit programs, 47–51 why companies cook the books, 27–35 Continuous auditing, 190 Cost of goods sold, 75–76 CPE. See Training Crazy Eddie, 28, 42 Critical audit area, 50
Data extraction software: applications, 51, 196–199 benefits, 191–196 defined, 190–191 outsourcing, 202–205 training, 201–202 Default risk, defined, 49 Deferred revenue, 30, 76–79, 119–121, 129–132 Dell, Michael, 195 Detailed procedures, 70, 83–84 Benefits and shortcomings, 8–9, 73–74, 106–107 Directional risk. See Cooking the books Earnings management, defined, 29 Enron Corporation, 3–4, 6, 24, 28, 43, 184 Excel, 200 Expectations. See Analytical procedures eToys, 26 FASB, see Financial Accounting Standards Board Fast Company, 100 Financial Accounting Standards Board, 55 1stresearch.com, 100 Fixed assets. See Property, plant and equipment Flight Transportation, 112 Footnote disclosures, 26–27 Fraud audits, 196 Fraudulent financial reporting. See Cooking the books
230
HOUCK index.qxd
5/30/03
12:10 PM
Page 231
Index
Internal control questionnaires, 147–148 Information technology controls, 143, 151–153, 192 Inquiries: listening skills, 182–185 reliability of evidence, 181–182 risk of cooking the books, 36–37 who should ask questions, 180–181 Institute of Internal Auditors, 153 Interest, 90–93, 123–124, 192 Inventory, 32, 42, 44–45, 64, 108–111, 161, 173, 181–182, 192 Isolated exception, 158
GAAP. See Generally accepted accounting principles GAAS. See Generally accepted auditing standards, and Statement on Auditing Standards General Electric Corporation, 38 Generally accepted accounting principles, 37–38, 44, 46, 48, 190 Generally accepted auditing standards, 9, 58, See also Statement on Auditing Standards Home Depot, 96 HPL Technologies, 42 IDEA, 200–201, 205 Inc., 100 Income statement, 112–114, 116–117 Income tax considerations, 32–33, 39 Internal Controls: benefits of understanding, 137–138 ControlProbe, 166–168 minimum audit requirements, 146–150 testing controls: conclusions, 173–175 evaluating cost-benefits, 159–164 identifying controls to test, 164–168 impact on substantive procedures, 161–164 types of control tests, 169–173 types of controls, 139–146 Internal Control Stream, 142–146, 166
Leslie Fay, 44 Levitt, Arthur, 5–6 Loans, 32, 60–61 Lopez, Jennifer, 99 Los Angeles Lakers, 99 Margins. See Profit margins Memos, 150 Microsoft Corporation, 25 Minkow, Barry, 42–43 MISTI Institute, 153 NFO WorldGroup, 6 Panel on Audit Effectiveness, 151–152 Payroll, 88–89, 95, 122, 127 PCAOB, see Public Company Accounting Oversight Board Pile on bad news, 31 Powerplaynow.com, 205 Prepaid expenses, 102, 125 Professional skepticism, 41
231
HOUCK index.qxd
5/30/03
12:10 PM
Page 232
Index
Profit Margins, 85, 91, 118–119, 192, 196–197 Property, plant and equipment, 50–51, 111–112, 117–118 Public Company Accounting Oversight Board, 7 Pushing the envelope, 44–46 Reasonable assurance, 15–16 Reasonableness test, See Analytical procedures Reconciling items, 64, 115–116 Related party disclosures, 27 Research. See Client research Reserves, 25, 29, 30–31, 32, 33, 36, 44–46, 59, 184, 199 Revenue recognition, 24, 43–44 Revenues. See Sales Risk-based auditing: analytical procedures, 126–127 introduction, 15–20 defined, 16 during fieldwork, 63–66 risk of cooking the books. See Cooking the books Robots, 209–211, 215, 223 Sales, 24, 49–50, 116, 139, 145, 192 analytical techniques, 59, 65, 71–73, 85, 90–91, 126–127, 128 case study, 96–97 SAS. See Statement on Auditing Standards
Santa Clause, 12 Sarbanes-Oxley Act of 2002, 7, 196 SEC. See Securities and Exchange Commission Securities and Exchange Commission, 5, 25, 42, 195 Sonali Corporation, 43 Standardization, 17–18, 47 Statement on Auditing Standards (SAS): SAS 56, 62, 69–70, 74–75, 94 SAS 78, 139, 151 SAS 82, 23 SAS 94, 151 SAS 96, 101 SAS 99, 19, 23–24, 44, 91 Stock price, 28–29 Sunbeam, 44 Thinkers, 209–211, 215, 223 Training, 212, 222–227 data extraction, 201–202 risk-based auditing, 19 Twain, Shania, 213 United States Congress, 6–7 Verbal evidence. See Inquiries Vick, Michael, 97 Wall Street Journal, 59, 100 Welch, Jack, 38, 220–221 WorldCom, 4, 24, 28, 51, 112 ZZZZ Best, 28, 42, 74
232
