Full Text:
Assessing an organization's conditions, corporate structure,and the choices it makes can help reveal the motivations, opportunities, andrationalizations behind the commission of financial statement fraud.
FRAUDULENT FINANCIAL REPORTING IN THE UNITED States has costinvestors more than $100 billion over the past two years. In its "2002Report to the Nation on Occupational Fraud and Abuse," the Associationof Certified Fraud Examiners estimates that about 6 percent of revenues, or$600 billion, will be lost this year as a result of occupational fraud andabuse (see related story, "The High Cost of Occupational Fraud,"page 13). This report also indicates that financial statement fraud is themost costly type of occupational fraud, with median losses of $4.25 millionper scheme. The other two types of occupational frauds are assetmisappropriations and corruption schemes.
Fraudulent financial reporting occurs for many reasons, which canbe grouped into three broad categories -- conditions, corporate structure,and choice, or the "3Cs." Internal auditors can use the 3Cs modelto predict and uncover financial statement fraud, consistent with IIAAttribute Standard 1210.A2, which dearly states that "The internalauditor should have sufficient knowledge to identify the indicators of fraud...." IIA Practice Advisory 1210.A2-I: Identification of Fraud, andPractice Advisory 1210.A2-2: Responsibilities for Fraud Detection, furtherdetail the auditor's role in fraud investigations and suggest thatauditors should 1) identify symptoms -- conditions -- that indicate a fraudmay have been perpetrated; 2) search for opportunities -- corporate structure-- that may allow fraud to occur; and 3) evaluate the need for furtherinvestigation, notify the appropriate individuals within the company aboutthe possibility of financial statement fraud, and take the actions necessaryto reduce or minimize its likelihood of occurrence -- choice.
DEFINING THE 3CS
The 3Cs model helps explain motivations, opportunities, andrationalizations for the commission of financial reporting fraud.
CONDITIONS The motivations and pressure to engage in financialstatement fraud are the conditions. Pressures on corporations to meetanalysts' earnings forecasts play an important role in the commission ofthis type of fraud. In recent corporate cases, executives deliberatelycommitted illegal actions to mislead users of financial statements --investors and creditors -- about their poor or less-than-favorable financialperformance.
CORPORATE STRUCTURE An organization's corporate structure cancreate an environment that increases the likelihood that fraudulent financialreporting will occur. Given that management usually is the perpetrator ofthis type of fraud, it is not surprising that most incidences occur in anenvironment characterized by irresponsible and ineffective corporategovernance.
Attributes of the corporate governance structure most likely to beassociated with financial statement fraud are aggressiveness, arrogance,cohesiveness, loyalty, blind trust, control ineffectiveness, andgamesmanship. Aggressiveness and arrogance can play a part in theorganization's attitude and motivations toward being a leader in thefield or exceeding analysts' earnings expectations. Cohesiveness,gamesmanship, and loyalty attributes increase the likelihood of cooking thebooks and subsequent cover-up attempts and decrease the probability ofwhistle-blowing. Blind trust and ineffective controls can cause monitoringmechanisms -- such as audit functions and the internal control structure --to be less effective in preventing and detecting fraud.
CHOICE Management must choose between using ethical businessstrategies to achieve continuous improvements in both quality and quantity ofearnings and engaging in illegitimate earnings management schemes to showearnings stability or growth. Management may choose to engage in financialstatement fraud when: 1) its personal wealth is closely associated with thecompany's performance through profit sharing, stock-based compensationplans, and other bonuses; 2) management is willing to take personal risk --such as risking indictment or civil or criminal penalties -- for corporatebenefit; 3) opportunities for the commission of financial statement fraud arepresent; 4) there is a substantial internal and external pressure to eithercreate or maximize shareholder value; and ~) the probability of the fraudbeing detected is perceived to be very low.
The presence of any one of the 3Cs can signal the possibility offraud, whereas the combination of two or more factors at any one timeincreases the likelihood that fraud has occurred.
RELATING THE 3CS TO ENRON AND WORLDCOM
A fraud scheme focused on the 3Cs fits the Enron crisis well. Theconditions were right.
* Top executives were financially motivated to engage in financialstatement fraud by using sophisticated financing vehicles known as specialpurpose entities (SPEs) and derivative instruments to intentionally overstateearnings and understate liabilities.
* There was tremendous pressure on Enron's management to meetearnings expectations, to be among the top to biggest Fortune 500 companies,and to make Wall Street happy.
* A culture of arrogance and greed was evident among Enron'stop executives, its board of directors, and key employees. Their annual bonusand compensation plans were geared toward enriching themselves rather thancreating shareholder value.
* Andersen auditors were under pressure to retain Enron andgenerate substantial fees for nonaudit services at the expense ofcompromising their objectivity, integrity, reputation, and professionalresponsibilities.
The Enron crisis underscores the importance of vigilant, effectivecorporate governance. Good corporate governance provides a structure throughwhich the organization's objectives are determined; related strategicplans, policies, and procedures are established to ensure objectives areachieved; and activities, affairs, and performance are assessed andmonitored. At Enron, the corporate structure was weak.
* Lack of vigilant oversight functions by the corporation'sboard of directors and audit committee created an environment that providedthe opportunities for the alleged commission of financial statement fraud.
* Internal audits were conducted by the external auditor, possiblycreating conflicts of interest that ultimately impaired the externalauditor's objectivity and integrity.
* An ineffective board of directors created opportunities forEnron and its management to engage in high-risk accounting, approve excessiveexecutive compensation, participate in related-party transactions, andextensively use undisclosed derivatives and other off-balance-sheet financialinstruments.
As for choices, Enron's board of directors has beencriticized for its lack of oversight responsibility in allowing the use ofprivate partnerships--SPEs--to overstate earnings and understate liabilities.Enron's board approved creation of many of these partnerships, despiteserious issues concerning potential conflicts of interest and possibleviolations of the corporate code of conduct. Audit committee members did notinform shareholders of Enron's partnership deals and off-balancederivative transactions. The audit committee relied heavily on the judgmentsof external auditors in determining the legitimacy and economic substance ofthe related-party transactions. Other poor choices included:
* Enron's independent auditor failed to report materialmisstatements of financial statements.
* Management chose to place its own interests and those of SPEsahead of Enron's interests and those of its shareholders.
* The board of directors failed to safeguard Enron shareholders,employees, and other business associates by choosing to ignore managementmisconduct.
And then there's WorldCom. The company's executives,including the chief financial officer (CFO) and controller, overstatedearnings by over $7 billion between 1999 and 2001 by fraudulentlycapitalizing line costs that should have been treated as regular operatingexpenses and by recording the reversal of reserves for bad debts intooperating income.
WorldCom's management was under pressure to continue showingprofit during a time when the quality of earnings was deteriorating(conditions). Irresponsible corporate governance and unethical behavior bythe top management team created an opportunity and environment thatencouraged commitment of financial statement fraud with the intent to deceiveinvestors, creditors, employees, and business associates (corporatestructure). Thus, the organization's management decided to cook thebooks as a way of reporting continuous earnings growth (choice). The board ofdirectors, including the audit committee, failed to exercise its diligenceoversight function and the external auditor failed to uncover fraudulentmisstatements. The company filed for the biggest bankruptcy in U.S. corporatehistory on July 21, 2002.
FIGHTING THE 3CS
Internal auditors can help management establish and monitorcontinuous mechanisms that identify, prevent, and eliminate the 3Cs offinancial statement fraud. However, because 100 percent prevention is notpossible, internal auditors should be on the lookout for identifying signs offraud, or red flags.
Because financial statement fraud is typically perpetrated bymanagement--or at least with the knowledge and participation of topexecutives--internal auditors should pay close attention to identifying"business red flags," or those conditions and circ*mstances thatarise from the perceived need to overcome financial difficulties, such as theinability to meet analysts' forecasts, increased competition, and cashflow shortages. Once financial statement fraud occurs, corrective actionsinclude eliminating the fraud and its adverse impact on the quality,Integrity, and reliability of financial statements and preventing furtheroccurrences by focusing on the 3Cs and eliminating related motives andopportunities to engage in fraud. For example, internal auditors should:
* Help their organizations implement effective corporategovernance principles, such as those endorsed by The IIA.
* Participate in a consolidated financial statement audit functionthat consists of the audit committee, external auditors, and the topmanagement team and that periodically assesses the quality, reliability, andintegrity of the financial reporting process.
* Collaborate with the external auditors in an integrated auditplanning process consisting of the exchange of audit plans, programs,findings, and reports.
* Report audit findings related to financial statementpreparation--especially when there are symptoms of financial statementfraud--to the audit committee or to the board of directors.
* Report failures of the audit committee to act on financialstatement fraud findings to applicable regulatory agencies or even toshareholders.
* Enhance their corporate governance status through a higher levelreporting relationship, more access to the audit committee, and a careerdevelopment plan for obtaining the necessary experience, training, andknowledge.
* Assess the adequacy and effectiveness of the organization'sinternal control structure, particularly the internal controls over thefinancial reporting process.
* Evaluate the quality of the financial reporting process,including the review of both annual and quarterly financial statements filedwith the U.S. Securities and Exchange Commission and other regulatoryagencies.
* Participate with the audit committee and external auditors inreviewing management's discretionary decisions, judgment, and selectionof accounting principles and practices as related to the preparation offinancial statements.
* Assess the risk and control environment pertaining to thefinancial reporting process by ensuring that financial reporting risks areidentified and related controls are adequate and effective.
* Review the risks, policies, procedures, and controls pertainingto the quality, integrity, and reliability of financial reporting, includingrelated-party transactions, partnerships, mergers and acquisitions,information systems risks, and offbalance sheet financial instruments.
* Monitor management's compliance with the company'scode of corporate conduct and ensure that ethical policies and otherprocedures promoting ethical behavior are being followed. Management'stone in encouraging ethical behavior can be the most effective factor incontributing to the integrity and quality of the financial reporting process.
* Assess the organization's susceptibility to fraud,including occupational and financial statement fraud; review managerialprograms and controls to address such risks; and ensure that the establishedprograms and controls are effective in mitigating or eliminating theidentified fraud risks.
Additionally, the chief audit executive should hold regularmeetings with the audit committee regarding the financial reporting process.
Internal auditors are viewed as a first line of defense againstfraud because of their knowledge and understanding of internal controlstructure, the business environment, and corporate governance. Internalauditors can use the 3Cs framework to identify conditions, includinghigh-risk accounting, inappropriate conflict of interest transactions,excessive executive compensation, and extensive use of undisclosedoff-balance sheet financial instruments and derivatives.
Auditors also should evaluate their organization's corporatestructure to identify opportunities for the commission of fraud, such asirresponsible governance; lack of a vigilant and effective board ofdirectors, or audit committee; and an ineffective internal control structure.Finally, internal auditors should assess choices made by management andreport possible occurrences of such fraud to the audit committee.
Internal auditors' involvement in the routine activities oftheir organization and internal control structure place them in the bestposition to develop and use the 3Cs model to identify, assess, and report redflags that may signal the occurrence of financial statement fraud. This wasillustrated when an internal auditor discovered financial reportingmalfeasance at WorldCom.
RESTORING PUBLIC CONFIDENCE
Recent initiatives, including the passage of the Sarbanes-OxleyAct of 2002 and the New York Stock Exchange's board recommendations,which require chief executive officer and CFO certification of financialstatements and require exchange companies to have an internal audit function,underscore the relevance of internal auditing and the important roles thatinternal auditors can play in corporate governance and the financialreporting process. The opportunity to engage in fraudulent financialreporting increases as the organization's control structure weakens, itscorporate governance becomes ineffective, and its audit efficacydeteriorates. Internal auditors who actively participate in corporategovernance and stand as front-line combatants in the struggle againstcorporate abuse and financial statement fraud can help to restore thepublic's confidence in corporate entities.
ZABIHOLLAH REZAEE, CIA, CPA, CMA, CGFM, CFE, is the Thompson-HillChair of Excellence and Professor of Accountancy for the Fogelman College ofBusiness and Economics at the University of Memphis in Tennessee.
To comment on this article, e-mail the author at zrezaee@theiia.org.
