Fraud Auditing Using CAATT

A Manual for Auditors and Forensic Accountants to Detect Organizational Fraud

Shaun Aghili

• Publisher: Auerbach Publications
• Year: 2019
• ISBN:
  9780429628023
• Edition: 1
• Topic: Betriebswirtschaft
• Subtopic: Verwaltung

This book discusses various common occupational and organizational fraud schemes, based on the Association of Certified Fraud Examiners (ACFE) fraud tree and assist fraud examiners and auditors in correctly choosing the appropriate audit tests to uncover such various fraud schemes. The book also includes information about audit test red flags to watch out for, a list of recommended controls to help prevent future fraud related incidents, as well as step-by-step demonstrations of a number of common audit tests using IDEA® as a CAATT tool.

1

A PEDAGOGICAL APPROACH TO USING THIS MANUAL

The book that you are about to read is one of the many outputs of our collaborative research team in the Master of Information Systems Assurance Program (MISAM) at the Concordia University of Edmonton (CUE) in Alberta, Canada.

CUE’s MISAM program got its start in September of 2013, thanks to the vision and hard work of Professor Ron Ruhl to whom this manual is dedicated. Ruhl was also the creator of our Master of Information Systems Security Program (MISSM) a few years earlier. I should also mention that MISSM was the first graduate-level information security program in Canada. Since then, the number of cybersecurity programs in both Canada and the United States has exploded, but as of this writing, MISAM is and remains the first and only graduate-level information systems assurance program in Canada.

Ruhl – who stepped down from the MISSM/MISAM chair position after 10 years of outstanding service in 2016 – was one of the best bosses I have ever had. He gave me full reign to take the MISAM conceptual plan (degree proposal) and design the MISAM curriculum based on my training and professional/academic teaching experience as a finance and accounting educator, a Certified Internal Auditor (CIA), a Certified Information Systems Auditor (CISA), and a Certified Fraud Examiner (CFE).

My objective in developing various course syllabi for the MISAM track was simple enough: to create MISAM graduates with a set of professional skills that would enable them to secure employment in a variety of enterprises. My vision was to provide our MISAM students with the Information Systems Audit and Control Association’s (ISACA) recommended skill sets to perform typical information systems audit functions. I also wanted our students to develop additional skill sets so as to enable our graduates to also be able to serve as a Computer-Assisted Audit Tools and Techniques (CAATT) team contributor in various accounting or internal audit team audit projects. This meant that in addition to using ISACA’s CISA certification task statements as a baseline I wanted our graduates to also develop additional competencies in financial accounting and fraud examination.

As such, we set up to incorporate CAATT training in various MISAM offerings, such as our Fraud Examination and Audit Theory and Application courses, so as to enable our students to build a solid CAATT foundational base. Currently, in MISAM, we use two CAATT vendor solutions: ActiveData and Interactive Data Extraction and Analysis (IDEA). As some of you may know, ActiveData is an Excel-driven CAATT software that may be a more suitable alternative for smaller audit shops due to its lower cost, whereas IDEA is essentially a more powerful (and expensive) CAATT alternative, better suited for organizations with more elaborate audit needs and deeper pockets. There are also other fine CAATT software solutions on the market such as Audit Command Language (ACL), which has managed to secure a CAATT market share lead, as well as Arbutus Analyzer. By using IDEA to demonstrate some audit tests in this manual, we are neither endorsing nor making a claim that IDEA is superior to any other CAATT solution. Promoting products or software is not what we are after in Academia. We have used IDEA for demonstration purposes for the simple reason that it is MISAM’s chosen CAATT software for the purposes of training our assurance students.

Students have at times asked me why we use IDEA instead of ACL for training purposes. I answer this question using my word processing software experience as an analogy. I recall buying my very first personal computer circa 1990. It was an older model that I had purchased from a good friend that had WordPerfect already installed on it. For the next several years, like a lot of new personal computer users, I taught myself how to use WordPerfect for all my word processing needs. However, after a few years, it became apparent that Microsoft Word was fast becoming the most common word processing software in enterprises of all sizes. By 1995, just about every company that I was working with (or working for) had MS Word installed on their computer; it was time to say goodbye to WordPerfect and start working with MS Word! Surprisingly, I had a very easy time switching to Word, because of my knowledge of WordPerfect. As a user, I did not find a significant difference between the two programs, although I am sure that both CorelDRAW and Microsoft could point out to a number of reasons why their word processing product is superior to the competition. The point that I am making is this: If you learn to work with just about any CAATT software solutions, switching to another CAATT software will most likely be a manageable change for most users. What makes a typical CAATT audit test reliable is not the software brand in most cases but the quality of the data used and the skill set of the auditor or fraud examiner to not only correctly apply the audit test but also be able to correctly interpret the ensuing audit results. In other words, an auditor needs to have the skill set necessary to pick up on the red flags revealed as the result of a test, and furthermore be able to recommend appropriate controls to help mitigate or prevent the occurrence of various fraud schemes.

Over the years, as we continued to use and further refine our pedagogical approach to CAATT technology, I noticed that our MISAM students could really use a supplementary CAATT-centric textbook, especially since many of the current CAATT-related book titles were quickly becoming old. As such, I decided to create a “research” project with the objective of creating a compendium of CAATT-centric audit tests aimed at training both students and audit professionals. Since an important MISAM graduation requirement is the completion of a research-based final paper, I created a five-part project aimed at using the Association of Certified Fraud Examiners’ (ACFE) Fraud Tree as the base model, and then, with the help of my students, mapped as many CAATT-compatible audit tests to each of its 55 fraud tree schemes as we could find (Figure 1.1).

The intended audience for this manual is relatively large. It can be used as not only a training and reference tool for audit and fraud examination professionals but also a useful primary or supplementary textbook for graduate and undergraduate accounting and audit courses at various universities. In short, all students and professionals looking to become more proficient at CAATT testing are likely to benefit from this publication.

There are eight chapters in this compendium: Chapter 1 (the preface section that you are currently reading) provides the reader with some background information and the pedagogical approach used to develop this manual. Chapters 2 and 3 deal with fraudulent disbursements. Chapters 4 and 5 deal with financial statement fraud and corruption schemes. Chapter 6 presents a general discussion of CAATT, Chapter 7 provides step-by-step instructions on how to perform ten CAATT-based audit tasks and tests using IDEA V.10, and Chapter 8 outlines a “lab” exercise that I assign every semester in my own Fraud Examination course. I have found this to be a great class exercise, as it combines not only a research component, but is a very effective means of helping students better relate to my other course material. Finally, since the lab output is a group oral presentation deliverable, it provides students an opportunity to also exercise their group management and oral presentations skills.

Figure 1.1 The ACFE Fraud Tree. (Source: www.acfe.com/fraud-tree.aspx)

In order for readers to derive maximum benefit from this publication, we followed a specific organizational format for each book section as follows:

1. The Introduction Section: Each section of this compendium starts out with an introduction section where we introduce the scope of discussion as it pertains to a particular section of the ACFE Fraud Tree. This section contains some relevant statistics taken out from the 2018 edition of the ACFE’s Report to the Nations (RTTN) in order to provide readers some general norms and trends relevant to each type of organizational fraud. For those not familiar with ACFE’s RTTN, this survey-based report provides fraud professionals with relevant trends and statistics derived by sending out RTTN survey forms to ACFE members and compiling responses in an organized and easy-to-read format. RTTN is currently published about every other year. According to my own observations of previous editions of the report, although its various statistics do change slightly from one edition to the next, most fraud scheme trends seem to remain the same in every edition. The 2018 RTTN is a compilation of various fraud statistics from 2,690 real cases of occupational fraud reported by ACFE members spanning over 125 countries and 23 industry categories. The 2018 RTTN statistics estimate global occupational fraud losses at over $7 billion with a median loss per case of $130,000. While these statistics are based on secondary sources of data (surveys completed by ACFE members, based on their own fraud investigation cases), it is nonetheless one of the most important sources for audit and fraud prevention professionals to gain an understanding of fraud norms and trends. As such, both professionals and students are highly encouraged to take the time to study each updated edition of the RTTN as an effective way to familiarize themselves with fraud facts, statistics, and considerations that are bound to come into play, especially during the planning stage of most audits and/or fraud investigations. RTTN can be accessed and downloaded for free at the ACFE site (www.acfe.com).
2. Case Studies: In each section, we have briefly identified and discussed several recent, real-life, related fraud cases. These case studies serve to better familiarize entry-level audit professionals and/or audit students with how a certain fraud scheme could work in the real world. Case studies have always been – and continue to remain – a very vital component of how we teach fraud examination to our MISAM students. Every few years, we identify a number of more recent fraud cases relating to a particular category on the ACFE Fraud Tree. We then ask our students to dig further into a number of these cases with the aim of analyzing the motivations of the perpetrators according to the Fraud Triangle theory, assess control failures that led to the occurrence of the fraud, and discuss the lessons learned from the occurrence of the fraud scheme. The study of real-life fraud cases enables both professionals and audit students to develop a better understanding of the nature and inner workings of each type of fraud scheme. The numerical citation system used in this compendium easily allows the reader to refer to the original source used by our team, as the first step for those interested in finding out more granular details about each case study. Educators or corporate trainers interested in incorporating case study assignments into their academic or professional courses can refer to the section entitled “Student Case Study Research and Oral Presentation Project” at the end of this manual for additional guidance on how to create such case study-based assignments.
3. The Discussion Section: This section is, in essence, the main body for each section aimed at providing a concentrated discussion of each major category of occupational fraud. When we were in the midst of completing each section of this project, I kept telling my MISAM students: “One of your important objectives for each section of this project is to create a relatively short and concentrated literature review section where you are running the reader through a 15- to 20-min crash course about the nuts and bolts of the occupational fraud category under study!” For those interested in a more expansive discussion of each major fraud category, there are a number of excellent books and articles available. Our primary “go to” guide continues to be ACFE’s The Fraud Examiners’ Manual, a comprehensive reference guide compiled and regularly updated by the ACFE.
4. The Conclusion Section: This wrap-up section provides the reader with statistics related to our mapping efforts for each section. For example, this section identifies how many related audit tests and controls were identified for each type of occupational fraud categories. This section can be regarded as the introduction section of the subsequent parts of each section, namely, the internal control/good practices and audit worksheet tables.
5. Recommended Internal Controls and/or Good Practices Section: This section is formatted as a series of tables where a number of recommended controls and/or good practices are presented and organized according to each fraud subcategory (scheme). Less experienced auditors are likely to find value in using these tables as a resource to formulate appropriate internal control recommendations for their audit reports.
6. For Further Reading Section: The numerical citation system seen at the end of most paragraphs used in this work refers to the source where various concepts or statistics discussed in those paragraphs were derived. Researchers and other professionals interested in further expanding their understanding related to the discussed concepts or topics in a paragraph can easily refer to this section to find more detailed information regarding various points discussed.
7. Audit Worksheets: This final part in Sections 2–5 is comprised of a series of small tables where relevant audit tests for each section are presented and discussed in a concise, yet easy-to-read manner. Information provided for each CAATT-based audit test includes the following: what occupational category/subcategory the audit test relates to; the purpose of the test; a quick explanation of the test itself including the test’s overall procedure, explanation related to assertion that it aims to test, and the CAATT expression(s) to use; and finally, what fraud possible red flags to look for when reviewing/analyzing the results of the test.

As a graduate program research supervisor, I often ask my research supervisees what “contributions to knowledge” can be expected from their research proposal. The term contribution to knowledge is not solely limited to the synthesis of new knowledge. This is not what we intended to accomplish with this manual. Instead, the primary goal – as I mentioned before – was to compile and present the existing knowledge in a new format, one that I knew would be of benefit to audit students and/or audit professionals. It is my hope that this manual can act as an effective catalyst in encouraging both students and professionals to feel more comfortable in employing CAATT tests for their various audit projects.

In my audit and fraud examination classes, I always make it a point to emphasize the fact that as an educator, I can only aim at providing students with an overall understanding of how to use a certain technology to accomplish an information systems security or assurance objective. As such, just like learning a new language, it is highly unlikely that one can become fluent in a language, by simply taking a semester-long introductory language course. Learning a language can be both a fun and a manageable task, if an individual can have the discipline to study that language in frequent and short durations. I offer the very same advice to those who are interested in becoming more proficient with CAATT technology. Make sure to not only read this manual but also get a demo copy of your preferred CAATT software (if you do not have access to a fully functional version of it at work), and begin practicing with it in frequent and short practice sessions. It is fairly easy to choose one of the audit tests demonstrated step-by-step in the last section of this book and practice performing it within a 20- to 30-min self-study session. If you are interested in obtaining a demo copy of IDEA, please visit: http://bit.ly/IDEA10EduDL.

Another point that I also keep repeating to my students is the idea that to become proficient at performing these CAATT audit tests, one must develop a thorough understanding and familiarity with not only the purpose of test but also the data to be used in conducting an audit test. As you look up various tests in the audit worksheet tables of each section, make sure to understand the purpose of each test and how the various CAATT expressions used for the test can help achieve its purpose. As mentioned before, the CAATT auditor must also understand what exact data – in terms of its content, range, currency, and relevancy – is needed to ensure meaningful results.

I could not possibly think ...

Table of contents

• Cover
• Half Title
• Series Page
• Title Page
• Copyright Page
• Table of Contents
• Author
• Chapter 1 A Pedagogical Approach to Using This Manual
• Chapter 2 Compendium of CAATT-Based Audit Tests for the Detection of Asset Misappropriation (Cash and Inventory)
• Chapter 3 Asset Misappropriation II – Fraudulent Disbursements
• Chapter 4 Compendium of CAATT-Based Audit Tests for the Detection of Financial Statement Fraud
• Chapter 5 Compendium of CAATT-Based Audit Tests for the Detection of Corruption
• Chapter 6 CAATT in Fraud Auditing
• Chapter 7 Audit Test Manual for ACFE Fraud Tree Schemes Using IDEA®
• Chapter 8 Student Case Study Research and Oral Presentation Project
• Index