This chapter will explain a methodology for using fraud data analytics in the search for fraud scenarios in financial statement accounts. Chapters 14 and 15 will explain how to use the methodology for revenue and journal entry testing.

This chapter will focus on uncovering fraud scenarios that are recorded in the general ledger or omitted from the general ledger either in a source journal or through a manual journal entry. This chapter will not focus on standards of care required by the professional auditing standards to uncover material misstatement through an intentional error. It is assumed the reader has knowledge of GAAS and will incorporate the standards into the data analytics plan.

I would encourage the reader to study the known financial statement frauds that occurred to improve their personal knowledge of how management has misstated financial statements. The knowledge will assist the auditor in the data interpretation aspect of the methodology. It is always easier to see a fraud scenario the second time versus the first time. Through the study of previous financial statement fraud cases, the auditor will learn the concept of fraud predictability or the logic of building the fraud analytics plan.

In one publicly traded company, revenue was materially overstated through a series of small‐dollar general journal entries that in the aggregate caused a material misstatement. Therefore, financial statement history has taught the profession that fraud can be recorded in one large transaction or a series of transactions in the aggregate that can cause a misstatement of a financial statement account. In one publicly traded company, management intentionally failed to write off damaged or lost assets. Once again, history has taught the profession, the absence of a write‐off journal entry would have highlighted this fraud scenario. Remember the famous phrase: Knowledge is power.

The methodology for fraud in financial accounts is the same as described in the first five chapters but needs to be adapted for the nuances of fraud in financial statements versus asset misappropriation or corruption. The fraud scenario statement has the same four components. However, the concept of a material overstatement or understatement must be included in the fraud scenario. The fraud action statement needs to be adapted for how, where, and when the fraudulent transaction is recorded in the general ledger.

The auditor is responsible for detecting misstatements, whether caused by error or fraud in the financial statements that are material and would impact an investor's decision to purchase the stock or for a bank to provide a loan to a company. The auditor is not responsible for uncovering all fraud but fraud that is material. Therefore, the fraud data analytics plan should incorporate the concept of fraud and materiality.

Lastly, because fraud in financial statements requires the intent to conceal the fraud, the element of concealment needs to be considered in building the fraud data analytics plan. Remember from our discussion in Chapters 2 and 3 that concealment is separate from the fraud scenario. Concealment also has three levels of sophistication.

Within this chapter, there are two overall approaches for searching for fraud in financial statements. First, search for the fraud data profile of the recorded fraud scenario. Second, search for the predictable concealment strategies associated with the fraud scenario. Before we start the discussion, we need to explain a few terms associated with financial statement misstatement.

What Is an Error?

An error is a mistake in the recognition, presentation, or disclosure in the financial statements. The error could be caused by a mistake in applying GAAP, internal control weakness resulting in improper recognition, or an error in judgment or assumptions. In one sense, the list is endless. However, an error does not occur with intent to misstate the financial statements. Therefore, there is no desire to conceal the error at the time the error occurs. However, the error may result in a material misstatement of the financial statements. Fraud data analytics can assist the auditor in searching for an error by searching for the fraud data profile of the transaction. However, fraud data analytics will not detect the misstatement through the search for the predictable concealment strategies because there was no intent to conceal the truth.

To illustrate, let's assume expenses were understated at year‐end. The search for 2016‐dated vendor invoices in the 2017 purchases journal would detect the error. If the error was intentional, the 2016 invoices would be recorded in the journal after the opinion date or with a 2017 date versus the correct date.

What Is Earnings Management?

The concept has many terms associated with the phrase: income smoothing, cookie jar, creative accounting, and aggressive accounting. By whatever name, earnings management is a strategy used by management to achieve a predefined earnings target. It usually occurs through changes in accounting practices or through aggressive estimates for accruals or adjustments. It can either result in understatement in the current year to assist in achieving next year's earnings or result in overstatement in the current year through aggressive accounting practices.

Earnings management is sometimes called the gray area between errors causing misstatement and intent by management causing misstatement of the financial statements. It may not be a clear violation of GAAP but does distort the true financial picture of the company or a material misstatement. The planning reports may highlight areas of misstatement but fraud data analytics is not really intended to search for the type of misstatement caused by earnings management through the improper application of GAAP.

What Is Financial Statement Fraud?

Financial statement fraud is the process of intentionally misleading the reader of the financial statements. It is the deliberate misrepresentation, misstatement, or omission of financial data to provide the impression that the organization is financially sound.

The key aspect in determining whether the misstatement is fraudulent is through establishing the intent of management. Is there clear and convincing evidence that management intended to misstate the financial statements, or the misstatement was caused by an unintentional error? The job of the fraud data analytics auditor is to identify the fraud scenario in the general ledger. The job of the fraud auditor is to offer that opinion that the scenario occurred with intent to conceal the fraud scenario and whether the fraud scenario is material to the financial statements.

How Does an Error Differ from Fraud?

The answer is simple. An error is a mistake, whereas fraud is an intentional act that management conceals from the auditor. For this reason, using the predictable concealment strategies is an effective method for searching for misstatement through fraudulent efforts.

The starting point for building the fraud data analytics plan is for the fraud auditor to understand the inherent fraud scheme concept, and how to write a fraud scenario for the inherent fraud scheme.

Inherent Fraud Schemes and Financial Statement Fraud Scenarios

The inherent fraud scheme concept for financial statement fraud or the methodology for writing a fraud scenario described in earlier chapters is the same for financial statement fraud scenarios. What changes is the addition of the financial account, which is impacted by the fraud scenario, type of misstatement, and how to write the fraud action statement. In Chapter 14 and 15, respectively, we will describe the nuances of writing fraud scenarios for revenue and journal entries.

Let's review the component of fraud scenario for financial statement fraud:

1. Person committing is less critical for financial statement fraud versus asset misappropriation and corruption. Based on most fraud statistics, financial management or senior management is responsible for most financial statement fraud. Therefore, a simple statement of the controller or senior management would suffice. However, those schemes involving other members of management should identify at the minimum the department or function responsible for committing the fraud scenario.
2. Direction of misstatement is whether the general ledger account is overstated or understated. The type of misstatement is critical to understanding which operating year to search for the fraud scenario. This statement also describes when the transaction is recorded to achieve the desired misstatement.
3. General ledger account is the financial account that is the focus of the fraud data analytics plan. This tells the fraud auditor where the transaction is recorded or where to search for the concealment technique.
4. Type of entity—the same structure identified in the shell company chapter is relevant for financial reporting. The one difference is that the entity is not always a legal entity. For example, in inventory, the entity is sku number versus a legal entity such as a vendor. However, the sku number is either false or real.
5. Fraud action statement is the basis for developing the fraud data interrogation routine. The statement describes how the fraud scenario occurs and how the transaction is recorded in the financial account. The fraud action statement describes whether the transaction is false or real, whether the entity is false or real, and whether the transaction is recorded through a source journal or journal entry. The type of entity and fraud action statement describes how the transaction is recorded.
6. Impact statement—as a matter of style, the fraud auditor may use a generic statement, causing the financial statements to be materiality misstated, or a specific impact statement, causing revenue to be misstated. Remember, the direction of misstatement is described in the first part of the fraud scenario.

The following provides examples of how to write a financial statement fraud scenario using the prescribed format:

1. Controller intentionally/overstates/revenue/by recording false sales through a false customer/in the sales journal/causing the financial statements to be materially misstated.
2. Controller intentionally/overstates/revenue by recording false sales through a real customer/in the sales journal/causing the financial statements to be materially misstated.
3. Controller intentionally/overstates/revenue by recording real sales (improper recognition) through a real customer/in the sales journal/causing the financial statements to be materially misstated.

All three fraud scenarios involve overstatement of revenue by the controller. However, the important point is to understand that the fraud data analytics for the three scenarios is very different. As follows for each scenario:

1. The fraud data analytics for scenario one can search for a false customer, a false revenue transaction, or the eventual reversal of the false revenue.
2. The fraud data analytics for scenario two can search for false revenue transaction or the eventual reversal of the false revenue.
3. The fraud data analytics for scenario three must search the current‐year source journal for the specific technique used to prematurely record the revenue transaction in the source journal.

The proceeding three scenarios demonstrate the concept that the fraud data analytics must be designed for a specific fraud scenario.

Additional Guidance in Creating the Fraud Action Statement

Creating the fraud scenario requires the fraud auditor to be able to identify the fraud action statement in order to build the fraud interrogation routine. To repeat, a fraud action for financial statement fraud has the following components:

1. Where is the transaction recorded: revenue or expense/asset or liability or equity?
2. Is the entity real or false?
3. Is the transaction real or false?
4. For a real transaction, the method of improper recognition must be stated.
5. GAAP requirements must be understood and stated. Remember, fraud in the financial statement is an intentional error in GAAP, so this aspect of the fraud action statement is critical.
6. Is the transaction recorded through a source journal?
   1. Was the initial transaction recorded in the balance sheet or the income statement?
   2. Was the transaction recorded in the right account for purposes of misstatement, or will the transaction need to be reclassified?
   3. Was there a failure to record a real transaction?
7. Is the event recorded through a journal entry?
   1. Was there a failure to adjust an account balance?
   2. Was there a failure to adjust or reclassify a previously recorded transaction?
   3. Was there a failure to write off the transaction that was previously recorded?
8. Location of the transaction on the financial statement. Depending on the size and complexity of the financial statement, the fraud action statement may also include the section of the financial statement, such as cost of sales, operating expenses, or other expenses.

Building the fraud action statement starts with creating the list of permutations by changing the variables and then changing the generic permutations to be account‐specific. Once the permutation analysis is understood, the fraud auditor then links the specific technique to the person committing the fraud scenario.

Starting with the concept of using generic permutation analysis to create fraud action statements:

1. Recording a false transaction to a false entity in the source journal.
2. Recording a false transaction to a real entity in the source journal.
3. Recording a real transaction to a real entity in the source journal.
4. Failure to record a real transaction for a real entity in the source journal.
5. Recording a false event associated with a real entity through a journal entry.
6. Recording a real event associated with a real entity through a journal entry.
7. Failure to adjust or reclassify a real event initially recorded from a source journal with a general journal entry.
8. Failure to write off the transaction previously recorded.

Remember, the fraud auditor does not know which fraud scenario the controller is going to commit, but the fraud auditor does know all the fraud scenarios the controller can commit. By starting with the generic fraud action statement and applying the generic statement to the specific account, the fraud auditor is assured regarding the completeness of the fraud scenario listing. Using the generic fraud action statement, we will identify the applicable fraud scenarios to be included in our fraud data analytics plan. Let's assume the balance sheet has an asset entitled capitalized advertising expenditures.

1. Controller intentionally overstates assets by recording a false operating expense incurred from a false vendor through the purchase journal as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
2. Controller intentionally understates assets by failing to record a real operating expense incurred from a real vendor through a general journal entry or purchase journal as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
3. Controller intentionally overstates assets by recording a real operating expense incurred from a real vendor through the purchase journal as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
4. Controller intentionally overstates assets by recording a false operating expense incurred from a real vendor through the purchase journal as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
5. Controller intentionally overstates assets by recording a false operating expense incurred from a real vendor through a general journal entry as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
6. Controller intentionally overstates assets by recording a real operating expense incurred from a real vendor through a general journal entry as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
7. Controller intentionally overstates assets by failing to adjust or reclassify a real operating expense incurred from a real vendor through a general journal entry as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.
8. Controller intentionally overstates assets by failing to write off a real operating expense incurred from a real vendor through a general journal entry as a capitalized expenditure, causing the capitalized advertising expenditures to be materially misstated.

The first step is now completed. The fraud auditor has built the foundation of the fraud data analytics plan by identifying the permutations of the fraud scenario. GAAS will require the fraud auditor to assess the likelihood of the scenarios. Assuming the likelihood assessment has labeled the fraud scenario as an identified fraud risk for purposes of testing, the fraud auditor knows the answers to the where, when, and how questions in order to build the data interrogation routine. The astute auditor understands that the list of previous scenarios can be easily converted to each asset account by adapting the fraud action statement for the financial account.

The second step is to incorporate the GAAP implications into the fraud scenario. As a matter of style, the GAAP assertion can be written into the fraud scenario or documented as part of the overall plan. The problem with incorporating GAAP into the statement is that the fraud scenario may become too wordy.

How Does the Inherent Fraud Scheme Structure Apply to the Financial Statement Assertions?

The GAAS standards as described in SAS #106 (audit evidence) discusses the concept of the risk of material misstatement at the financial statement and assertion levels. The fraud data analytics plan must link to the assertions described in the standard. The following illustrates how the fraud action statement links to the assertion statements for class of transactions and events:

1. Occurrence. Transactions have been recorded that have occurred and relate to the company. The search is for false transactions in the general ledger.
2. Completeness. All transactions that should have been recorded are recorded. The search is for improper recognition in the general ledger.
3. Accuracy. All transactions have been recorded appropriately. Incorporating the GAAP implications into the fraud scenario.
4. Cutoff. Transactions have been recorded in the proper period. The planning associated with the right operating year to search for the fraud scenario or the associated concealment technique.
5. Classification. Transactions are recorded in the proper account. The planning associated with the direction of testing and the impact statement.

Answering the fraud action statement questions of where, when, and how will help the auditor achieve the goals of SAS #106.

Do I Understand the Data?

Effective financial statement analysis and interpretation begins with an understanding of the types of questions that a fraud auditor needs to ask concerning where, when, and how the financial statements maybe misstated. The profession abounds with ratios and variance analysis, both vertical and horizontal analysis. Fraud data analytics is another tool for the auditor to understand the data. One difference between the traditional tools and the fraud data analytics tool is that the fraud auditor is searching for an intentional error that is material and embedded in the transactional history of a source journal or a general journal entry. A second difference is that fraud data analytics is looking at all transactions versus a random sample of transactions. Fraud data analytics should complement the existing tools versus replace the traditional tools.

Understanding the data starts with understanding what transactions created the account balance. The use of disaggregated analysis of an account balance is a powerful tool for the fraud auditor to determine what journal created the account balance. The tool allows the auditor to understand whether the account was created through a source journal or a general journal entry. This knowledge tells the auditor from a materiality factor whether it is more predictable that the scenario is embedded in the source journal or general journal entry.

The trial balance is the starting point of understanding where, when, and how the financial statements are misstated through fraud scenarios. The first report should be an analysis of each general ledger account as to whether the balance was created through a source journal or through a journal entry. The analysis should provide a net summary of the debits and the credits that compose each financial account through the source journals and the general journal entries.

The purpose of the report is to understand how the account balance was created. All account balances are created through a source journal or a general journal entry. By understanding the composition and the dollar value of the recorded transactions, the fraud auditor can start to develop the fraud data analytics plan. The analysis does require the fraud auditor to understand whether the account balance should be created from a source journal or through general journal entries.

• A control account such as accounts receivable should be created through source journals; therefore, a general journal entry in the control account would be suspicious.
• If the inventory is seasonal, such as the apparel industry, the lack of a journal entry to write down inventory would be suspicious.

For a simple illustration, if 95 percent of the revenue total is created from a source journal and 5 percent of total revenue is created from general journal entries, then the most likely location for a material overstatement is in the source journal. If the source journal is the primary source of the balance, then the most likely fraud scenarios are associated with either false revenue or improper recognition of real revenue. The next round of reports would be designed to determine the likelihood of false revenue or improper recognition.

For key financial statement accounts supported by a sub‐ledger, the use of disaggregated analysis would recreate the control account balance by each account in the sub‐ledger. The second level of disaggregated analysis is to determine whether the sub‐account was created by source journal or general journal entries. The purpose of the analysis is to determine where the material entries are located in the sub‐ledger. Is the source journal creating the account balance or a general journal entry?

To illustrate the concept, using the work‐in‐process inventory account, let's assume the disaggregated analysis indicates that a general journal entry is creating 60 percent of the balance for three accounts in the sub‐ledgers. Then the analysis would perform a disaggregated analysis on the journal entry. In another example, we will assume that the analysis indicates that 100 percent of the account balance for one account in the sub‐ledger was created from the accounts payable source journal. Furthermore, the disaggregated analysis of the accounts payable transaction reveals that one vendor invoice from a real vendor for $500,000 was recorded on December 31. Should this be suspicious?

The second tool is the data summarization feature of existing software to summarize journal activity based on a specific criterion:

• Summarize expenditures by vendor by debits and credits. Large credits may indicate that accounts payable was overstated by posting false or real invoices in the wrong period. The credit is reversing the vendor invoice.
• Summarize journal entries by dollar control level, which may indicate fraud in the aggregate if there is a high frequency of small‐dollar journal entries.
• Summarize journal entries by key accounts in the last month and journal entries after year‐end by dollar control level. Compare the summary to the previous year. A significant difference between the two years may indicate management is attempting to reach a financial target.

The understanding the data concept is the same concept described in earlier chapters in the planning reports section. The purpose of this stage of fraud data analytics is to improve the predictability of the planning stage of the audit by highlighting those accounts or transactions that have the highest predictability of being associated with a fraud scenario.

What Is a Fraud Data Analytics Plan for Financial Statements?

In Chapter 4, we discussed the steps of building a fraud data analytics plan. The same steps apply for financial statements; however, due to the unique nature of financial statements, we need to answer additional questions to build a comprehensive plan to detect fraud scenarios in the financial accounts.

What Are the Accounting Policies for Assets, Liabilities, Equity, Revenue, and Expense Accounts?

The accounting policies identify how a transaction should be recorded to comply with GAAP. The auditor needs to ensure that the accounting practices comply with GAAP. However, from a fraud data analytics perspective, the company's accounting policies will identify how a transaction should be recorded. Therefore, an anomaly can be described as a transaction recorded contrary to the company's accounting guidelines.

Summary

The purpose of this chapter was to describe a methodology for creating a fraud data analytics plan for financial accounts. The next two chapters will describe how to apply the methodology to the revenue source journal and general journal entries. The fraud auditor will need to adapt the methodology to their industry and their company. Issues such as nature, timing, and extent of audit procedures will impact the success of fraud data analytics in searching for the material error. However, those issues are under the control of the auditor.

The good news is that financial statement fraud is in the general ledger. The bad news is, financial fraud is in the general ledger. The sheer amount of transactions and journal entries recorded in a general ledger makes it imperative that auditors use fraud data analytics. Generally speaking, the fraud auditor has access to all the data necessary to locate financial statement fraud scenarios, whereas in asset misappropriation schemes and corruption schemes the fraud auditor does not have all the necessary data or information to formulate a conclusion.