Humbling Moments
“It took some time before the public learned that to appreciate an Impressionist painting one has to step back a few yards and enjoy the miracle of seeing these puzzling patches suddenly fall into place and come to life before our eyes.”
Ernst Gombrich, art historian
Auditing is both an art and a science. And, like an impressionist painting, each imperfection diminishes the quality of the final work. Where imperfections are significant or abundant, the final work does not faithfully depict the scene.
Because a single error can result in an audit failure, the old adage that a chain is only as strong as its weakest link is sometimes an apt auditing analogy.
Generally, a single audit defect results in an audit failure only if the audit is tested at a critical weak link. Unfortunately for Andy Accountant, his firm's audits of Any Not-For-Profit, Inc. (NFP) are more aptly characterized by the chain analogy.
Andy's firm audited NFP for many years. In September 2004, NFP's bookkeeper, Kathy Convicted (KC), retired after 14 years of service. When the subsequent bookkeeper had difficulty reconciling various accounts, NFP asked Andy to investigate. Andy's investigation eventually revealed that KC had embezzled approximately $900,000 over an eight-year period by employing a forged check scheme that took advantage of NFP's glaring internal control failures.
Although NFP's controller told Andy that she received and reviewed NFP's bank statements each month, she actually turned the statements over to KC unopened. She further represented that the signature stamp was kept in a locked drawer. In truth, the only time it was actually locked away was when Andy conducted field work for the annual audit.
While the embezzlement was hidden in a sophisticated way, the basic mechanics were simple and exploited the two vulnerabilities that NFP's controller told Andy did not exist.
To accomplish the embezzlement, KC used NFP's accounting software to print a check made payable to herself. She then voided the check on the computer system and removed her name from the payee field.
Because the system did not keep hard-coded detail records, the fact that she was the original payee was not discoverable. After printing the check, KC simply signed it with the signature stamp and deposited it into her personal account. Because KC received NFP's bank statements unopened, she was able to remove and destroy the fraudulent checks each month without detection.
To conceal the missing cash, KC would input an accounts payable invoice that reduced cash. She then input a long list of changes to numerous expense accounts with NFP listed as the vendor so the amount of the forged check was split into small amounts and appeared as nominal expense allocations for support services.
Although KC was convicted and consented to a civil judgment in the amount of the embezzlement, the funds had been taken to cover gambling losses, and the judgment was of little value. Facing a large loss, NFP filed suit against Andy's firm.
Initial expert review suggested that Andy's audit was not deficient. Detailed examination, however, revealed that checks used in the embezzlement had been included in the audit sample group in four of the eight years of the embezzlement, including two checks in the second year of the embezzlement.
This problem was compounded by the fact that the defense expert considered the number of checks selected for testing to be at the low end of an acceptable range. Although the expert opined that the size of the sample group was minimally sufficient, he had to admit that the smaller sample size increased the importance of thoroughly testing each check in the sample.
Investigation of the testing procedures revealed that the junior staff member who performed the testing had accepted KP's explanation for the missing checks and marked the step as completed without commenting on the missing checks.
In deposition, the staff member said he had accepted KP's explanations for missing checks without comment or follow-up because she had worked for NFP for so long, seemed committed to its mission and “just didn't seem like the type of person who would be dishonest.” Because the procedure was marked as completed, Andy's review of the workpapers did not disclose the problem.
While auditing involves many subjective judgments, like art, some audits are better than others. Although the rest of the audit was sound, it failed because it was tested at a critical weak link.
Because Andy had relied on NFP's misrepresentations regarding internal controls in conducting the audit, and NFP had 12 opportunities each year to detect it by simply following the internal controls it represented existed, the case was eventually settled for a fraction of the total loss.
Because the weak link in the audit occurred at a critical point, however, the audit failed, and Andy was forced to accept some responsibility for allowing the embezzlement to continue.
Do you want to read more articles like this? We have an archive of Brainstorming, Humbling Moments and other articles that might interest you.