Comments on: Why audits are near worthless (yes, internal audit too)

By: Should Big 4 audit firms release their financial statements? | Sequence Inc. Fraud Files Blog

Sun, 17 May 2009 16:21:41 +0000

[...] companies? What on earth do their own financial statements have to do with whether or not audits are effective at protecting [...]

By: tapiwa

tapiwa — Sat, 07 Feb 2009 14:37:26 +0000

One has to understand that an act of fraud is usually accompanied by a series of premeditaded acts to conceal it, thus auditors are not to be held for non detection of fraud.Management and those charged with governance are actually responsible for putting in place systems that detect or deter fraud.

By: Tracy Coenen

Tracy Coenen — Thu, 04 Dec 2008 11:25:02 +0000

Here’s a good sample engagement letter:
http://naplia.com/resources/engagement%20letters/Example%20Audit.doc

It includes this:
Because an audit is designed to provide reasonable, but not absolute, assurance and because we will not perform a detailed examination of all transactions, there is a risk that material errors, fraud, or illegal acts, may exist and not be detected by us. In addition, an audit is not designed to detect immaterial errors, fraud, or other illegal acts or illegal acts that do not have a direct effect on the financial statements. Our engagement cannot, therefore, be relied upon to disclose errors, fraud, or other illegal acts that may exist. However, we will inform you of any material errors that come to our attention and any fraud that comes to our attention. We will also inform you of any other illegal acts that come to our attention, unless clearly inconsequential. Our responsibility as auditors is limited to the period covered by our audit and does not extend to any later periods of which we are not engaged as auditors.

I am mistaken in saying that the audit report disclaims responsibility regarding fraud. It is the management representation letter which does that. (i.e. The auditors give management a template letter that management must put on their own letterhead, and the wording of that letter states that fraud is management’s problem, not the auditors’.)

By: Tracy Coenen

Tracy Coenen — Thu, 04 Dec 2008 11:12:13 +0000

No, they are not. I will post a letter or two.

By: Andy

Andy — Thu, 04 Dec 2008 03:34:42 +0000

Yes, please…

You have me curious. But audits are SUPPOSED to be designed to obtain reasonable assurance about whether F/S are free of material misstatement, whether caused by error or fraud, correct?

By: Tracy Coenen

Tracy Coenen — Thu, 04 Dec 2008 02:30:33 +0000

Andy – Have you seen the types of letters that I reference? Would it be helpful for me to post examples?

By: Tracy Coenen

Tracy Coenen — Wed, 03 Dec 2008 23:53:47 +0000

If you read the engagement letters and audit reports, you see that the auditors specifically disclaim responsibility for finding fraud.

By: Andy

Andy — Wed, 03 Dec 2008 20:39:24 +0000

Isn’t the assessment of the risk performed in the planning stage and then the audits are designed based on those assessments?

AU312.36 “The auditor must perform the audit to obtain reasonable assurance of detecting misstatements that the auditor believes could be large enough, individually or in the aggregate, to be quantitatively material to the financial statements.”

SAS 107 par. 18: “In determining the nature, timing, and extent of audit procedures … the auditor should design audit procedures to obtain reasonable assurance of detecting misstatements that the auditor believes … could be material… Auditors use various methods to design audit procedures to detect such misstatements.”

By: Tracy Coenen

Tracy Coenen — Wed, 03 Dec 2008 06:04:38 +0000

No, they’re not designed to DETECT misstatement by fraud. Audits are supposed to ASSESS THE RISK of misstatement by error or fraud. But they are not designed to detect misstatement due to fraud.

By: Andy

Andy — Wed, 03 Dec 2008 00:40:48 +0000

I knew I should’ve looked it up before I said that. However, they are still designed to detect MISSTATEMENT (what I should have said), whether by error or fraud. So I guess it’s not directly designed to detect fraud, but they are still designed on a risk-based approach, or at least should be. So if fraud is suspected in certain areas, those areas should be tested more than others.