External Auditors’ Roles and Responsibilities

1. External Auditors’ Roles and Responsibilities Chapter IX

2. External Auditing and Corporate Governance

3. External Auditor Responsibility Current auditing standards require that independent auditors provide reasonable assurance that the financial statements are free from material misstatements, whether caused by error or fraud, to render an unqualified opinion on the financial statements. External auditors are not and should not be expected to provide absolute assurance regarding reliability of financial statements, but the public expectations concerning external auditors performance are high. Users of audited financial statements generally expect external auditors to detect financial statement fraud and employees’ illegal acts and fraud, which affects the integrity of financial reports. External auditors, however, are more concerned with material misstatements in the audited financial statements.

4. Auditor Competency Professional competencies.To audit public companies, auditors should register with the PCAOB and meet all registration and inspection requirements. Technical competencies. Auditors should be knowledgeable in professional standards, rules, laws and regulations, and understand their clients’ industry and business, corporate governance, financial reporting process, and internal controls. Process competencies. Auditor’sability to choose appropriate evidence-gathering procedures (tests of controls, substantive tests) and execute auditing procedures Reporting competencies. Reporting competencies refer to the auditors’ ability and willingness to discover and report material misstatements.

5. Reports Accompanying Financial Statements • Report on financial statements and related disclosures (prepared by auditor) • Are financial statements and disclosures according to GAAP? • Report on internal control over financial reporting (prepared by management) • Has company maintained effective internal control over financial reporting? • Report on internal control over financial reporting (prepared by auditor) • Is management’s assessment of its internal control appropriate? • Has company maintained effective internal control over financial reporting?

6. The Purpose of the Audit Report • Definition of auditing: “... communicating results to interested users.” • Indicate whether the FS are in accordance with GAAP • Provide indication of what the FS would be like if GAAP were followed • Provide any company-omitted disclosures • Indicate any unusual aspects of the audit examination • Scope limitations • Division of responsibility • Indicate any unusual matters related to the company • Going concern uncertainty • Consistency • Emphasize a matter

7. Four Categories of Audit Reports • Standard unqualified (clean opinion) • Unqualified with explanatory paragraph or modified wording • Qualified • Adverse or disclaimer

8. Definitions: Webster’s New Unabridged Dictionary • Qualified: • Having met conditions or requirements set • Limited, modified • Unqualified: • Not having the usual or requisite talents, abilities, or accomplishments • Not modified, limited, or restricted by conditions or exceptions

9. Types of Audit Reports

10. Unqualified Reports

11. Standard Unqualified Report The five necessary conditions have been met: • All four required statements are included. • The three general standards have been followed in all respects on the engagement. • Sufficient evidence has been accumulated and the auditor has conducted the engagement in a manner that enables the conclusion that the three standards of field work have been met.

12. Standard Unqualified Report • 4. The financial statements are presented in accordance with GAAP (including adequate disclosures. • 5. There are no circumstances requiring the addition of an explanatory paragraph or modification of the report wording.

13. Standard Unqualified Audit Report (Nonlisted Companies) Title Report of Independent Auditor Address to client To the Board of Directors and stockholders of Any company Audit notice Audit notice We have audited the accompanying balance sheets of Any company as of December 31, 1990 and 1989, and the related statements of income, retained earnings, and cash flows for the year then ended. These financial statements are the responsibility of the company’s management. Our responsibility is to express an opinion on these financial statements based on our audits. Management responsibility Identify the financial statements Auditor responsibility

14. We conducted our audits in accordance with generally accepted auditing standards. Those standards require that we plan and perform the audit to obtain reasonable assurance about whether the financial statements are free of material misstatement. An audit includes examining, on a test basis, evidence supporting the amounts and disclosures in the financial statements. An audit also includes assessing the accounting principles used and significant estimates made by management, as well as evaluating the overall financial statement presentation. We believe that our audit provides a reasonable basis for our opinion. Description of the audit Opinion on financial statements No special mention of adequate disclosure or consistency In our opinion, the financial statements referred to above present fairly, in all material respects, the financial position of Any company as of December 31, 1990 and 1989, and the results of its operations and its cash flows for the years then ended in conformity with generally accepted accounting principles. Refer to GAAP Signature Date February 28, 1991

15. Audit Failures and Audit Quality Following is the list of the initiatives that have been suggested to improve audit quality, as well as transparency. Publication of audit engagement letters Shareholders’ rights to question auditors Publication of auditor resignation statements Lead audit partner’s signature on audit reports Active audit committee participation in evaluating the scope and results of the integrated audit of both ICFR and financial statements Mandatory rotation of the audit firm every seven to twelve years in the context of the quality of audit work performed by the firm and the audit efficacy Mandatory shareholder vote on the ratification of the independent auditor each year

16. Public Company Accounting Oversight Board The PCAOB created by SOX to regulate the auditing profession. The PCAOB’s primary functions are to: 1. Register public accounting firms that audit public companies. 2. Inspect the registered public accounting firms on a regular basis. 3. Establish auditing, attestation, ethics, quality control, and independence standards. 4. Conduct investigations and disciplinary proceedings.

17. PCAOB Auditing Standards The PCAOB has issued five auditing standards as of September 2007: 1. PCAOB Auditing Standard No. 1 (audit is conducted in accordance with auditing standards of PCAOBUS, the city and state has to be disclosed) 2. PCAOB Auditing Standards No. 2 and 5 (New PCAOB AS No. 5 superseded AS No. 2 and requires the independent audit to opine only on the effectiveness of ICFR, not the management processes and assessments concerning ICFR) 3. PCAOB Auditing Standard No. 3 (auditors are required to maintain the audit documentation in a sufficient manner and keep the records for at least seven years) 4. PCAOB Auditing Standard No. 4 (voluntary engagement for the auditor’s report on the company’s elimination of previously reported material weaknesses in its ICFR)

18. Roles and Responsibilities—Internal Control over Financial Reporting Management: Designs and implements the system of internal control over financial reporting; evaluates the effectiveness of the company’s internal control over financial reporting and provides a public report on that assessment; prepares the financial statements. Audit Committee: Has responsibility for oversight of the company’s financial reporting process. Independent Auditor: Performs an audit of internal control over financial reporting and issues a report on management’s assessment of internal control over financial reporting and on the effectiveness of internal control over financial reporting; also performs an audit of the company’s financial statements.

19. What Management’s Report Will Include Under the SEC rules, management’s report on internal control over financial reporting should include the following information: Statement of management’s responsibility for establishing and maintaining adequate internal control over financial reporting. Statement identifying the framework used by management to evaluate the effectiveness of internal control over financial reporting. Management’s assessment of the effectiveness of the company’s internal control over financial reporting as of the end of the company’s most recent fiscal year, including an explicit statement as to whether that control is effective and disclosing any material weakness identified by management in that control. Statement that the registered public accounting firm that audited the financial statements included in the annual report has issued an attestation report on management’s internal control assessment.

20. PCAOB Auditing Standard No. 2:An Audit of Internal Control over Financial Reporting Performed in Conjunction with an Audit of Financial Statements AS No. 2 required three integrated reports on: Financial statements audited by registered public accounting firms. Management’s assessment of the effectiveness of internal control over financial reporting (Section 404). The effectiveness of internal control over financial reporting over financial reporting based on the auditor’s attestation of internal control. AS No. 2 was effective beginning June 17, 2004.

21. The Independent Auditor’s Opinion The content of the auditor’s report is prescribed by the PCAOB standard. The most common opinions on the effectiveness of internal control over financial reporting will be: Unqualified Opinion. An opinion that internal control over financial reporting is effective: no material weaknesses in internal control over financial reporting exist as of the fiscal year-end assessment date. Adverse Opinion. An opinion that internal control over financial reporting is not effective: one or more material weaknesses exist as of the fiscal year-end assessment date. Disclaimer of Opinion. A report stating that restrictions on the scope of the auditor’s work prevent the auditor from expressing an opinion on the company’s internal control over financial reporting.

22. Report of Independent Registered Public Accounting Firm 1. Introductory Paragraph 2. Scope Paragraph 3. Definition Paragraph 6. Inherent Limitations Paragraph 5. Explanatory Paragraph* 4. Opinion Paragraph 7. Signature 8. City and State or County 9. Date

23. PCAOB Auditors Independence The new rules restrict public accounting firms in performing a variety of tax services to their audit clients. The new rules are intended to prevent the selling of abusive tax shelters.

24. Audit Committee Oversight of External Auditors The extended oversight responsibilities for the audit committee are: 1. Appointment, compensation, and retention of registered public accounting firms 2. Preapproval of audit services and permissible nonaudit services 3. Review of the independent auditor’s plan for an integrated audit of both ICFR and annual financial statements 4. Review and discussion of financial statements audited or reviewed by the independent auditor 5. Monitoring the auditor’s independence 6. Auditor rotation requirement

25. Audit Committee Oversight of External Auditors The number of companies that change auditors, and the number of auditors changed

26. Independent Auditors Communications with the Audit Committee

27. Auditor Independence Auditor Independence

28. Consolidation and Competition in Public Accounting Firms SEC rules require public companies that change their public accounting firms to file a Form 8-K, Item 4.01, to disclose changes within four days, whereas auditors are required to provide standard letters within ten days stating whether they agree with the company’s disclosure without specifying any reasons.

29. Integrated Audit Approach

30. Audit Strategy Audit Strategy: No limited tests of controls No use of cycle rotation in tests of controls Dual testing of controls and substantive audit procedures Auditors should focus on prevention, detection, and correction of controls at both the company level and the transaction level. Auditors should perform tests of controls as a basis for forming an opinion on the effectiveness of ICFR. Auditors should also perform substantive tests as a basis for expressing an opinion on the fair presentation of financial statements, regardless of the identified significant deficiencies and material weaknesses in internal controls.

31. Auditor’s Responsibility for Detecting Fraud

32. Brief History Fraud Investigation • 1900s -- Fraud detection was a primary objective of the audit • 1940s -- Detection of fraud considered to be a “responsibility not assumed” • 1960s -- Auditor acknowledged responsibility for detecting fraud that would normally be uncovered by an examination performed in accordance with GAAS. • 1980s -- Auditor had responsibility to search for fraud that may have a material affect on the financial statements. • 1997 -- SAS No. 82; 2002 – SAS No. 99

33. Types of Fraud Financial Statement Fraud Misrepresentation of material facts Misappropriation of assets Concealment of material facts Management Fraud Illegal Acts Bribery Conflict of Interest FRAUD Embezzlement of money or property Breach of fiduciary duty Employee Fraud Theft of trade secrets of intellectual property Illegal acts

34. Why People Commit Fraud Studies show that employees are likely to commit fraud when four conditions exist: • PRESSING FINANCIAL NEED • OPPORTUNITY • REASONABLE JUSTIFICATION • LACK OF MORAL PRINCIPLES

35. Embezzlement Formula MOTIVE + OPPORTUNITY + RATIONALIZATION = CRIME [FRAUD]

36. Profile of Fraud Perpetrators The fraud perpetrator is more likely to be an ordinary member of the community: intelligent, respected, never suspected of dishonesty, NOT YOUR TYPICAL CRIMINAL TYPE. • MORE LIKELY TO BE: • A woman • Married • Church member • Older • Heavier • Have children • Have a higher education • Never been arrested • Have high self-esteem • High achiever • LESS LIKELY TO BE: • Divorced • Alcoholic • Tattooed

37. Financial Statement Fraud • Definition – Deliberate misstatements or omissions of amounts or disclosures of financial statements to deceive financial statement users, particularly investors and creditors • Financial statement fraud has become a daily thing. Press reports challenge the corporate responsibility and integrity of major companies such as Lucent, Xerox, Rite-Aid, Waste Management, Microstrategy, KnowledgeWare, Sunbeam, Cendent, and ZZZ Best, Enron, WorldCom, Qwest, Madoff, Satyam, Stanford Financial, and Parmalat.

38. High-Profile Financial statement Fraud

39. Symptoms of Financial Statement Fraud • Continuous Deterioration of Quality and Quantity of Earnings • Inadequacy of Cash Flow • Overstatement of Inventories • Overly Aggressive Accounting • Management “Short-termism” • Improper Revenue Recognition • Overstatement of Assets

40. Elements of Fraud • A false representation of a material nature • Knowledge that the representation is false or reckless disregard for the truth (Scienter) • Reliance on the false representation by the victim • Financial damages are incurred (to the benefit of the perpetrator). • The act was intentional.

41. Auditor and Investigator Responsibilities • External Auditors (CPAs) • SAS 99: Consideration of Fraud in a Financial Statement Audit • Design audit to provide reasonable assurance of detecting fraud that could have a material effect on the financial statements. • Perform fraud-related procedures • SAS 54: Illegal Acts • Focused primarily is on direct-effect illegal acts • SAS 61: Communication with Audit Committees • Internal Auditors (CIAs) • SIAS 3: Deterrence, Detection, Investigation, and Reporting of Fraud • Governmental Auditors • Focus on laws and regulations (compliance), design audit to detect abuse and illegal acts, report to the appropriate authority • Certified Fraud Examiners (CFEs) • Assignments begin with predication (probable cause)

42. Auditor’s Responsibility for Detecting Fraud • GAAS makes NO DISTINCTION between the auditor’s responsibilities for searching for errors or for fraud • Per SAS No. 99, auditors must specifically assess the risk of material misstatement due to fraud

43. Assessing the Risk of Fraud • Pressure or incentive to commit the fraud • Direct financial gain, such as misappropriation of assets or retaining job • Indirect financial gain, such as increase in stock price • Perceived opportunity to commit the fraud • Can fraud be perpetrated without detection?

44. Misappropriation of Assets Risk Factors • Susceptibility of assets to misappropriation • Employee relationships or pressures • Deficiencies in internal control

45. Red Flags • Personal financial pressure • Vices (drugs, alcohol or gambling) • Extravagant lifestyles • Real or imagined grievances against company • Related parties • Increased stress • Internal pressures

46. How Frauds Occurred • Poor internal controls • Management override of internal controls • Collusion between employees and third parties • Collusion between employees or management • Lack of control over management • Poor or nonexistent corporate ethics policy

47. Reasons Auditors Fail to Detect Fraud • Over reliance on client representations • Lack of awareness or failure to recognize that an observed condition may indicate a material fraud • Lack of experience • Personal relationships with clients

48. SAS No. 99 The Fraud Triangle Rationalization Incentives/ Pressures Opportunities

49. The Fraud Triangle • Incentives/Pressures • 95 percent of all fraud cases involve either: • Financial pressures • Vice-related pressures, including drug or alcohol addiction • Expensive romantic relationships • Need to maintain a particular lifestyle • Medical problems

50. The Fraud Triangle • Rationalization is the reconciliation of what we are doing with what our conscience tells us we should do. • "I was only borrowing it; I planned to return it after things improved."