Hacker News Reader

Comment by bigjimmyk3 | Hacker News Reader

Married to an accountant, and her words are echoing in my head (loudly): "The purpose of an audit is not to discover fraud!" An audit is a written opinion on the reliability of a company's financial statements (my words this time). It is not an opinion about the company's business model, ethics, or future viability. Saying, "the auditors should have caught that" misses the point of an audit (a financial audit, anyway).

I think people may have conflated these auditors' jobs with that of, say, an auditor from a government entity like the IRS whose job duties can include discovering fraud.

View on HN

Several of the concerns raised in the article didn't related to frauds which the author felt should have been found, but with mis-statements of financial affairs, which should theoretically be commented on by the auditor (the audit statment will generally confirm that the accounts present a "true and fair view" of the companies financial affairs).

So if an organization is taking undue risks and not presenting them in the accounts, the auditor should make comment on that. In the example of HBOS, that could have been that they were understating the risk of bad debts and therefore had not provisioned sufficient reserves to address that risk.

The suggestion of the article is that they don't do that due to a cosy relationship with their clients.

It's hard to argue that there is an issue in the general case, auditors are paid by their customers, and therefore have an incentive not to rock the boat.

The counterweight to that is meant to be the personal liability of the partners in question should there be a legal issue resulting from an audit, however I'm not aware of many suits against big-4 partners relating to collapses from the financial crash...

Last time I looked into this this most suits are settled quietly out of court, at levels covered by very good professional insurance.

Who is actually going to raise the suit? Not so easy to pull together investors / debtors of very large entities.

> reliability of a company's financial statements

I don't really understand the difference.

Can you give an example of accounting fraud in which the company's financial statements are still reliable?

The difference is one of scale. For example, a Walmart sized company could easily have some fraud going on the scale of a couple million dollars - the financial statements are considered to be materially correct (i.e. in that investors would not consider numbers off by a couple million to be a big deal), but there would still be fraud going on.

You have to understand that the underlying concept of audit that a small team of auditors is responsible for ensuring that a huge (relatively) company is going about things correctly - there's no way to obtain a 100% assurance with that scale of manpower, and there's no appetite from companies to significantly increase the audit fees to obtain that level of assurance. Instead, a sampling/risk-based approach is taken in order to ensure that there cannot be a large error within the financials.

But the point is that auditors didn't catch massive amounts of fraud either. Where financial statements did not match reality at all.

Ok, I think I understand now. The layers are:

reality -> accounting books -> financial statements

The auditors don't look at the first mapping "reality -> accounting books" but only at the second one "accounting books -> financial statements"?

And even in the second mapping, they check with a sampling-based approach?

>The auditors don't look at the first mapping "reality -> accounting books" but only at the second one "accounting books -> financial statements"?

That's not entirely correct. A good portion of SOX audit efforts in the US, for instance, is spent on examining configuration of the various systems on which financial reporting is dependent (e.g. examining exactly how segregation of duty controls are implemented in the ERP system). A good portion of time is also spent examining if human-executed processes (e.g. employee on boarding/off boarding, granting permissions to data and financial system capabilities, manual review of backup job reports, etc) are actually being carried out in a manner that complies with the organization's SOX controls.

No, all testing is down all the way down to 'reality'. But testing is statistically scaled to detect large errors. The threshold for 'large' shifts with how large the audited company is. i.e. a couple million dollars is a rounding error at Walmart.

Additionally, pretty much 90% of an audit flows through a limited number of client contacts. Audits are not designed to defend against a concerted effort to prevent the auditors from seeing 'reality' (i.e. un-doctored documents), due to the manpower requirements to validate information at that level.

Conceptually, it's the difference between 'I-trust-you-but-I-need-to-check-that-you-did-your-homework' and 'Trust no one, everything you see is a lie'.

What Tyrek said.

Also, I could have phrased it better as "assurance that the company's financial statements accurately portray the activity in their accounting ledger(s)." An audit is about matching the financial statements to "the books" rather than looking for impropriety.

Audits also check that the book's transactions are correct, but this is done through a risk based approach. In my opinion, most practitioners do not understand risk quite well enough.

Think of it as the difference between undergoing code review versus trying to find instances of malware and hacking on a person's computer.

An auditor makes sure that when GE releases financial statements, it's the same kind of thing as when Ford releases financial statements. They're making sure that when a manager at the factory gets equipment on an installment plan that the company is going to report that as debt, rather than pretend its a rental agreement (and when it's one over the other is complicated which is why you need accountants).

If investors and creditors are going to get any use out of financial statements, Ford has to prepare its financial statements in the same way and according to the same principles that GE does. In order to make sure they're doing that, someone (an auditor) has to periodically make sure they're doing that.

What might show up on an audit is if the accounting department is inherently dysfunctional and not keeping proper records. What they're not going to do is figure out if someone is intentionally trying to deceive an auditor. Accountants are experts in how you're supposed to prepare financial statements so that everyone follows the same standard of what should be reported as what. But unless they're specifically forensic accountants, they're not private investigators uncovering crimes.

So is your wife's view that KPMG had no responsibility to further investigate or report on the irregularities their audits were turning up in HBOS's accounts of their loan risks? What is the value of their "opinion on the reliability of a company's financial statements," if that's the case?

This. An audit's goal is to determine whether the accounting systems and processes at a company are reliable. This is why auditors will test and document the internal controls of a business in the summer to make sure the controls are working properly. Then the audit rolls around, they can use what's called a "reliance strategy" which is based on the fact that the internal controls are reliable and working. They collect documentation and select a statistically representative sample of transactions, but analyzing the minutiae looking for fraud is not the goal. Auditing is about studying accounting systems.

The accounting firms do fraud examination as well, but that is a wholly separate business than audit.

"It is not an opinion about the company's ... future viability."

This is incorrect. Financial statements are prepared on a 'going concern' basis, except where management is planning to liquidate the company's assets. When these accounts are audited, the auditors consider whether the company is likely to be able to continue on its current path (i.e. without becoming insolvent, or raising additional capital beyond that already committed). If that future looks like it will be less than a year, then the auditor will include a 'going concern note' in the audit opinion.

So they definitely look at future viability.

Sources:

- Am an accountant and have engaged external auditors

- https://www.icaew.com/-/media/corporate/archive/files/about-...

The reason everyone misunderstands this and thinks that a clean bill of health from the accounts means there is little or not fraud going on, is that the accounting field believes it is in its own best interests if the public has this misunderstanding, and so has decided to not explain to it what is really going on.

Let me say some more about this, since it is an example of something that is going really wrong today.

When the economy crashed in 2007, a great many people said the financial industry is all crooked. Many in the industry said that their own branch was honest and responsible,and that when the housing bubble was going on, they had looked at it as an example of the sort of bad finance they themselves would never practice.

But the thing is, if most of the finance people saw the bubble fraud for what it was, why didn't they all speak up and warn the nation? I say it was because they were too focused on making money in their own field, and felt no responsibility to the society as a whole.

That is what is going on in the accounting field. They know there is massive fraud,and many practices that may not be fraud, but are bad for the economy and the world, but they don't explain it because it would get in the way of their making money doing something technically honest.

You know, a society like ours can function well only if everyone looks at the bigger picture, and not at just a narrow definition of what they are being paid to do. Does anyone really disagree?

The reliability of accounts surely covers a huge subsection of financial fraud.

I knew that phrase was going to bite me! See my reply above, where I clarify that "reliability" is better said as "reliability as a summary representation of our books."

that's the central conflict of interest revealing itself right there (of auditors being paid by their client). it's in the best interest of the auditor to ignore potential fraud so as to have plausible deniability in any legal actions.

while financial audits are primarily focused on how good the numbers match up and how well the controls in place help to do that, an audit wouldn't be done if it weren't for the potential for uncovering fraud up and down the hierarchy.

forensic accounting is also a thing, outside of government.

Have you been talking to my wife today? Because she reminded me of forensic accounting as soon as I got home. Yes, that is a thing but it's not part of a normal financial audit (at least not in the US).

ha, no i haven't been, but you're right that forensic auditing isn't normally included in ordinary audits. an honest auditor will recommend one however, if they see something fishy in the regular audit.

> forensic accounting

This should have its own TV crime series.

Reply on news.ycombinator.com