as an Auditing Tool
Linda M. Leinicke, Joyce A. Ostrosky, W. Max Rexroad, James
R. Baker, and Sarah Beckman
2005 - In response to the increased emphasis on fraud prevention,
deterrence, and detection connected with recent corporate
failures, the AICPA issued Statement on Auditing Standards
(SAS) 99, Consideration of Fraud in a Financial Statement
Audit. SAS 99 is effective for periods beginning on or
after December 15, 2002, and it significantly changes how
CPAs must consider fraud in their audits of financial statements.
In light of this increased emphasis on uncovering fraud, auditors
may want to consider the benefits of interviews as an audit
are a useful audit tool to gather information about internal
controls and fraud risks for several reasons. First, employees
involved in the day-to-day operations of a functional area
possess the best knowledge of that area. They are in an
excellent position to identify weak internal controls and
fraud risks. Second, although most employees are not directly
involved in fraud, they may have knowledge of suspected,
or actual, frauds that interviews can bring to light. Third,
employees may be reluctant to tell management about needed
internal controls and suspected or actual fraud, even when
a company has an ethics hotline, a compliance officer, or
other reporting mechanisms. When interviewed, however, employees
are often willing, even relieved, to talk about these issues.
the Information Needed
difference between SAS 82 and SAS 99, which superseded it,
is that the latter includes expanded requirements for inquiries
of management. Making inquiries of management is important
because senior management is often in the best position
to perpetrate and conceal fraud. In obtaining information
necessary to identify the risk of fraud in a financial statement
audit, SAS 99 requires auditors to ask the following questions:
Does management communicate its views on ethical business
behavior to its employees?
Does management have programs and internal controls designed
to prevent, deter, and detect fraud?
Does management discuss with the audit committee of the
board of directors how its internal control system serves
to prevent, detect, and deter fraud?
Does management understand the fraud risks specific to
Does management monitor fraud risks relevant to specific
components or divisions within the entity?
Does management have any knowledge or suspicion of fraud?
Is management aware of any allegations of fraud?
addition to management inquiries, SAS 99 also requires an
auditor to inquire of the audit committee and of internal
audit personnel about their views on the company’s
fraud risks. Significantly, SAS 99 mandates that other
individuals within the company also be questioned about
the risk of fraud. Paragraph 24 of SAS 99 states:
auditor should use professional judgment to determine
those others within the entity to whom inquiries should
be directed and the extent of such inquiries. In making
this determination, the auditor should consider whether
others within the entity may be able to provide information
that will be helpful to the auditor in identifying risk
of material misstatement due to fraud.
99 suggests that auditors inquire of operating personnel
with varying levels of authority, of in-house legal counsel,
and of others knowledgeable of fraud risk. Because employees
are often aware of where specific fraud risks lie, auditors
should understand employees’ views on the risk of
fraud. Additionally, auditors should look for discrepancies
in information received from various interviewees. Unusual
situations or conditions identified through interviews with
management and others can be revealing.
Mechanics of a Good Interview
of management and others in the form of fact-finding interviews
can be highly effective in obtaining “the information
needed to identify the risks of material misstatement due
to fraud” (SAS 99). For these interviews to be useful,
effective, and efficient, the following techniques are recommended.
Audit staff must be trained in how to conduct an effective
fact-finding interview. Conducting professional interviews
is a learned skill; only through training and practice does
one become proficient at it. Generally, a three-to-five-day
training course will be necessary to get an auditor started.
Then, the more interviews auditors conduct, or observe along
with a skilled interviewer, the better they will become
at interviewing. A combination of both classroom training
and on-the-job training is another excellent approach. CPAs
that already possess good interpersonal and verbal communication
skills are ideal candidates.
AICPA’s CPA2Biz (www.cpa2biz.com)
offers interviewing courses such as “Finding the Truth:
Effective Techniques for Interview and Communication.”
Additional interview training resources include the Association
of Certified Fraud Examiners (www.cfenet.com)
and the Institute of Internal Auditors (www.theiia.org).
versus interrogation. Understanding the difference
between an interview and an interrogation is important.
The typical audit interview is a question-and-answer-formatted
discussion normally conducted at the interviewee’s
workstation. The purpose of the interview is to learn new
facts or to confirm previously obtained information. An
interrogation, or “truth-seeking interview,”
is in many ways the opposite. The primary difference is
the state of mind of the interviewee. In an interview, the
interviewee is generally a willing participant assisting
the interviewer in the process of determining the facts.
An interrogation occurs only when a suspected fraudster
has been identified. The interviewer’s task is to
persuade the individual to admit to an act or omission that
he has no intention of divulging.
requires the ability to organize thoughts and discussion
along a logical path. Interrogation requires those skills
coupled with the ability to persuade an individual to say
something that runs contrary to his survival instincts.
the interview. The interview should have a
tone that is formal, friendly, and nonthreatening; should
follow a predetermined structure; and should result in meaningful
fact-finding. An interviewer should prepare a set of questions
and an introductory statement that explains the purpose
of the interview. This preparation will set the tone for
a serious, purposeful, and effective interview.
interviewer should be matched to the interviewee. Building
a rapport with an interviewee is partially a function of
who interviews whom. For example, it is more difficult for
a staff auditor to build rapport and connect with an intimidating
CEO or CFO than for the engagement partner to do so. But
for the engagement partner to conduct every interview is
simply not cost-effective, so partners or experienced audit
managers might interview most senior management. Managers,
seniors, and staff accountants can be matched to other interviewees,
interview should always be conducted in private. If the
interviewee’s workstation is not sufficient, then
the interviewer should use a meeting room. An interview
is most successful when the subject is comfortable and at
ease. Most people are more comfortable in their own work
environment and when they can answer questions without concern
that a coworker might be eavesdropping.
is essential in the early part of the interview for the
auditor to build a rapport with the interviewee in order
to encourage an open discussion. Structuring questions to
progress from the general to the specific allows the interviewer
to first build a rapport, and then observe changes in an
interviewee’s behavior that may signal a suspicious
or sensitive topic as the questions become more focused.
Skilled interviewers are always cognizant of indicators
of deception that may be displayed by any individual attempting
to mislead the interviewer. False statements, however, are
not always indicators of fraud; they may be covering up
an individual’s perceived personal or professional
a false statement during an audit interview is stressful
for most people. When a false statement is made, the interviewee
releases the stress verbally, nonverbally, or in both ways.
Indicators of deception vary from individual to individual.
They can be as subtle as a change in voice tone or as obvious
as a sudden change in complexion. A skilled interviewer
must be trained to identify these indicators and have a
thorough understanding of their potential significance.
the main purpose of the fact-finding interview is to seek
information, open-ended questions should be emphasized.
Questions should be structured to encourage the interviewee
to volunteer information. For example, “What internal
control problems do you have in your department with respect
to cash receipts?” will likely provide more information
than the closed-ended question, “Are all daily cash
receipts deposited intact?” Interviewers should be
good listeners and never interrupt an open-ended response.
One of the last questions asked in each interview should
be very open-ended; for example, “Is there anything
else you would like to tell me regarding the operations
of your department?” or “Have I failed to discuss
an important topic with you?” Joseph Wells, chairman
and founder of the Association of Certified Fraud Examiners,
advises that the last question should be whether the interviewee
has participated in any fraudulent activities against the
company. Asking this question provides documentation that
may prove invaluable if a lawsuit involving financial statement
fraud or asset misappropriation occurs later.
minimize legal risk, auditors should gear the discussion
solely toward fact-finding questions or statements and away
from accusatory questions or statements. For example, asking,
“Have you stolen any inventory from the company?”
is acceptable, but asking, “You have stolen inventory
in the past from the company, haven’t you?”
is not, due to the embedded accusation.
99, paragraph 6, identifies the two types of fraud that
auditors should be aware of as “misstatements arising
from fraudulent financial reporting and misstatements arising
from misappropriation of assets.” As a result, inquiries
should be directed toward individuals concerned with financial
reporting as well as those with direct or indirect access
to the company’s assets.
CEO and the CFO should be carefully interviewed by a partner
or experienced audit manager about their knowledge or suspicion
of fraud. These executives have the power to override internal
controls, and therefore are in a position to perpetrate
and conceal fraud. Their administrative assistants may be
privy to sensitive information and may suspect or be aware
of fraudulent activity, and should also be interviewed.
Individuals may be aware of fraudulent activities but not
disclose them unless specifically asked.
financial reporting. To obtain information
about misstatements arising from fraudulent financial reporting,
the following people could be interviewed: the controller;
all employees involved in “initiating, recording,
or processing complex or unusual transactions”; and
the vice president of sales and selected subordinates.
statement fraud is usually due to the overstatement of sales
revenues. The vice president of sales and the sales staff
could be under direct pressure to misrepresent sales transactions
for individual or company-related purposes. According to
SAS 99, paragraph 41, “the auditor should ordinarily
presume that there is a risk of material misstatement due
to fraud relating to revenue recognition.”
of assets. When inquiring about the possibility
of financial-statement fraud due to misappropriation of
assets, interviews should be conducted with employees that
handle cash, which is frequently misappropriated. Employees
involved in inventory management are knowledgeable about
proper inventory control procedures, and they could be aware
of any inappropriate handling of inventory. Employees involved
in purchasing may be aware of kickbacks, fictitious vendors,
and similar schemes. Employees involved in similar areas
with direct or indirect access to significant corporate
assets should be interviewed as well.
the CEO first. Although senior management
may be in the best position to perpetrate fraud, employees
in lower positions are often aware of such fraud. Auditors
should interview senior management first, and then follow
the corporate ladder downward. The audit committee must
be aware of, and approve of, the use of interviews as an
audit technique. In addition, if the CEO is informed of
and endorses the use of fact-finding interviews, his approval
can be conveyed to subordinates, who would then be more
likely to cooperate. Auditors do not want the CEO to be
blindsided about interviews being used to obtain information
about the risk of fraud. The engagement letter should indicate
that the audit team will use fact-finding interviews to
help identify the risk of material misstatement due to fraud.
an interview, note taking is a function of the style and
memory of the interviewer. A consistent pattern of note
taking—either taking many notes or taking very few
notes—should be maintained throughout the interview.
The goal is not to distract the interviewee and not to disrupt
the flow of the interview. A sudden change in note-taking
style might affect the interviewee’s answers. Once
the interview has been completed, however, the interviewer
should immediately write a memo documenting the proceedings.
This memo satisfies the requirement in SAS 99, paragraph
83, that an auditor should document the “procedures
performed to obtain information necessary to identify and
assess the risks of material misstatement due to fraud.”
Interviewers should keep their handwritten notes, which
will corroborate the formal memo in case of subsequent litigation.
the Interview in the Audit
all interviews have been completed, the audit manager should
read all of the interview documentation memos, looking for
themes and patterns. If the interview results indicate a
lack of internal controls, overrides of internal controls,
potential fraudulent activities, or other specific risks
of material misstatement due to fraud, the auditor should
expand procedures in the identified areas. In addition,
according to SAS 99, paragraph 83, “specific risks
of material misstatement due to fraud that were identified
… and a description of the auditor’s response
to those risks” should be documented.
here to see the accompanying Sidebar.
M. Leinicke, PhD, CPA, and Joyce A. Ostrosky,
PhD, CMA, CPA, are professors of
accounting, and W. Max Rexroad, PhD, CPA,
is an emeritus professor of accounting, all at Illinois State
University, Normal, Ill.
James R. Baker, CFE, is investigator for
the Royce City Police Department, Royce City, Texas.
Sarah Beckman is a master’s of science
in accountancy student at Illinois State University, Normal,