Brian Fox, CPA

How Did Satyam Get Away with It?

I've now worked with and spoken to hundreds of CPA firms and in almost all cases, firms are failing to perform the confirmation process correctly. We used to think that "Controlling" the confirmation process as SAS 67 and ISA 505 require meant that we needed to put the confirmations in the blue mailboxes ourselves and that the responses must come back to our offices and not the client's. In truth, we lost control of the confirmation process when we relied on and took the address of where to send the confirmations from either (1) the client or material in the client's posession, or (2) last year's workpapers where at some point someone simply asked the client for the mailing address/fax number/email for where to send the confirmation or took that information off of client provided material. The client's laughed at us as we trodded down to the blue mailbox to mail the confirmation because the client, not the auditor, was in full control of the confirmation process. Some firms think that receiving an unopened bank statement provides some form of authenticity to the statement. That assertion is false. A client can simply mail themselves the fake bank statement and give the auditor an unopened statement to fool the auditor.

I would submit, that the audit standards are actually well written and what is needed is not more standards, but instead auditors need to understand how confirmation fraud happens and update their confirmation processes to limit the risk of confirmation fraud. If auditors would actually validate where they are sending the confirmations and authenticate the authorization and identity of the person who responded to the confirmation, or use a service like Confirmation.com which does that for them, then we as a profession can reduce our exposure to frauds involving fake confirmations. Otherwise frauds involving fake confirmations - like Parmalat, Satyam, Ahold, Take-Two Interactive, Just-for-Feet, CF Foods, ZZZZ Best and others - will continue to happen.

Brian Fox, CPA
confirmation.com