Interviewing as an Auditing Tool

By Linda M. Leinicke, Joyce A. Ostrosky, W. Max Rexroad, James R. Baker, and Sarah Beckman

E-mail Story Print Story

Interviews are a useful audit tool to gather information about internal controls and fraud risks for several reasons. First, employees involved in the day-to-day operations of a functional area possess the best knowledge of that area. They are in an excellent position to identify weak internal controls and fraud risks. Second, although most employees are not directly involved in fraud, they may have knowledge of suspected, or actual, frauds that interviews can bring to light. Third, employees may be reluctant to tell management about needed internal controls and suspected or actual fraud, even when a company has an ethics hotline, a compliance officer, or other reporting mechanisms. When interviewed, however, employees are often willing, even relieved, to talk about these issues.

Obtaining the Information Needed

A primary difference between SAS 82 and SAS 99, which superseded it, is that the latter includes expanded requirements for inquiries of management. Making inquiries of management is important because senior management is often in the best position to perpetrate and conceal fraud. In obtaining information necessary to identify the risk of fraud in a financial statement audit, SAS 99 requires auditors to ask the following questions:

• Does management communicate its views on ethical business behavior to its employees?
• Does management have programs and internal controls designed to prevent, deter, and detect fraud?
• Does management discuss with the audit committee of the board of directors how its internal control system serves to prevent, detect, and deter fraud?
• Does management understand the fraud risks specific to its business?
• Does management monitor fraud risks relevant to specific components or divisions within the entity?
• Does management have any knowledge or suspicion of fraud?
• Is management aware of any allegations of fraud?

In addition to management inquiries, SAS 99 also requires an auditor to inquire of the audit committee and of internal audit personnel about their views on the company’s fraud risks. Significantly, SAS 99 mandates that other individuals within the company also be questioned about the risk of fraud. Paragraph 24 of SAS 99 states:

The auditor should use professional judgment to determine those others within the entity to whom inquiries should be directed and the extent of such inquiries. In making this determination, the auditor should consider whether others within the entity may be able to provide information that will be helpful to the auditor in identifying risk of material misstatement due to fraud.

SAS 99 suggests that auditors inquire of operating personnel with varying levels of authority, of in-house legal counsel, and of others knowledgeable of fraud risk. Because employees are often aware of where specific fraud risks lie, auditors should understand employees’ views on the risk of fraud. Additionally, auditors should look for discrepancies in information received from various interviewees. Unusual situations or conditions identified through interviews with management and others can be revealing.

The Mechanics of a Good Interview

Inquiries of management and others in the form of fact-finding interviews can be highly effective in obtaining “the information needed to identify the risks of material misstatement due to fraud” (SAS 99). For these interviews to be useful, effective, and efficient, the following techniques are recommended.

Training. Audit staff must be trained in how to conduct an effective fact-finding interview. Conducting professional interviews is a learned skill; only through training and practice does one become proficient at it. Generally, a three-to-five-day training course will be necessary to get an auditor started. Then, the more interviews auditors conduct, or observe along with a skilled interviewer, the better they will become at interviewing. A combination of both classroom training and on-the-job training is another excellent approach. CPAs that already possess good interpersonal and verbal communication skills are ideal candidates.

The AICPA’s CPA2Biz (www.cpa2biz.com) offers interviewing courses such as “Finding the Truth: Effective Techniques for Interview and Communication.” Additional interview training resources include the Association of Certified Fraud Examiners (www.cfenet.com) and the Institute of Internal Auditors (www.theiia.org).

Interviewing versus interrogation. Understanding the difference between an interview and an interrogation is important. The typical audit interview is a question-and-answer-formatted discussion normally conducted at the interviewee’s workstation. The purpose of the interview is to learn new facts or to confirm previously obtained information. An interrogation, or “truth-seeking interview,” is in many ways the opposite. The primary difference is the state of mind of the interviewee. In an interview, the interviewee is generally a willing participant assisting the interviewer in the process of determining the facts. An interrogation occurs only when a suspected fraudster has been identified. The interviewer’s task is to persuade the individual to admit to an act or omission that he has no intention of divulging.

Interviewing requires the ability to organize thoughts and discussion along a logical path. Interrogation requires those skills coupled with the ability to persuade an individual to say something that runs contrary to his survival instincts.

Conducting the interview. The interview should have a tone that is formal, friendly, and nonthreatening; should follow a predetermined structure; and should result in meaningful fact-finding. An interviewer should prepare a set of questions and an introductory statement that explains the purpose of the interview. This preparation will set the tone for a serious, purposeful, and effective interview.

The interviewer should be matched to the interviewee. Building a rapport with an interviewee is partially a function of who interviews whom. For example, it is more difficult for a staff auditor to build rapport and connect with an intimidating CEO or CFO than for the engagement partner to do so. But for the engagement partner to conduct every interview is simply not cost-effective, so partners or experienced audit managers might interview most senior management. Managers, seniors, and staff accountants can be matched to other interviewees, as appropriate.

The interview should always be conducted in private. If the interviewee’s workstation is not sufficient, then the interviewer should use a meeting room. An interview is most successful when the subject is comfortable and at ease. Most people are more comfortable in their own work environment and when they can answer questions without concern that a coworker might be eavesdropping.

It is essential in the early part of the interview for the auditor to build a rapport with the interviewee in order to encourage an open discussion. Structuring questions to progress from the general to the specific allows the interviewer to first build a rapport, and then observe changes in an interviewee’s behavior that may signal a suspicious or sensitive topic as the questions become more focused. Skilled interviewers are always cognizant of indicators of deception that may be displayed by any individual attempting to mislead the interviewer. False statements, however, are not always indicators of fraud; they may be covering up an individual’s perceived personal or professional deficiencies.

Making a false statement during an audit interview is stressful for most people. When a false statement is made, the interviewee releases the stress verbally, nonverbally, or in both ways. Indicators of deception vary from individual to individual. They can be as subtle as a change in voice tone or as obvious as a sudden change in complexion. A skilled interviewer must be trained to identify these indicators and have a thorough understanding of their potential significance.

Because the main purpose of the fact-finding interview is to seek information, open-ended questions should be emphasized. Questions should be structured to encourage the interviewee to volunteer information. For example, “What internal control problems do you have in your department with respect to cash receipts?” will likely provide more information than the closed-ended question, “Are all daily cash receipts deposited intact?” Interviewers should be good listeners and never interrupt an open-ended response. One of the last questions asked in each interview should be very open-ended; for example, “Is there anything else you would like to tell me regarding the operations of your department?” or “Have I failed to discuss an important topic with you?” Joseph Wells, chairman and founder of the Association of Certified Fraud Examiners, advises that the last question should be whether the interviewee has participated in any fraudulent activities against the company. Asking this question provides documentation that may prove invaluable if a lawsuit involving financial statement fraud or asset misappropriation occurs later.

To minimize legal risk, auditors should gear the discussion solely toward fact-finding questions or statements and away from accusatory questions or statements. For example, asking, “Have you stolen any inventory from the company?” is acceptable, but asking, “You have stolen inventory in the past from the company, haven’t you?” is not, due to the embedded accusation.

Interview Subjects

SAS 99, paragraph 6, identifies the two types of fraud that auditors should be aware of as “misstatements arising from fraudulent financial reporting and misstatements arising from misappropriation of assets.” As a result, inquiries should be directed toward individuals concerned with financial reporting as well as those with direct or indirect access to the company’s assets.

The CEO and the CFO should be carefully interviewed by a partner or experienced audit manager about their knowledge or suspicion of fraud. These executives have the power to override internal controls, and therefore are in a position to perpetrate and conceal fraud. Their administrative assistants may be privy to sensitive information and may suspect or be aware of fraudulent activity, and should also be interviewed. Individuals may be aware of fraudulent activities but not disclose them unless specifically asked.

Fraudulent financial reporting. To obtain information about misstatements arising from fraudulent financial reporting, the following people could be interviewed: the controller; all employees involved in “initiating, recording, or processing complex or unusual transactions”; and the vice president of sales and selected subordinates.

Financial statement fraud is usually due to the overstatement of sales revenues. The vice president of sales and the sales staff could be under direct pressure to misrepresent sales transactions for individual or company-related purposes. According to SAS 99, paragraph 41, “the auditor should ordinarily presume that there is a risk of material misstatement due to fraud relating to revenue recognition.”

Misappropriation of assets. When inquiring about the possibility of financial-statement fraud due to misappropriation of assets, interviews should be conducted with employees that handle cash, which is frequently misappropriated. Employees involved in inventory management are knowledgeable about proper inventory control procedures, and they could be aware of any inappropriate handling of inventory. Employees involved in purchasing may be aware of kickbacks, fictitious vendors, and similar schemes. Employees involved in similar areas with direct or indirect access to significant corporate assets should be interviewed as well.

Interview the CEO first. Although senior management may be in the best position to perpetrate fraud, employees in lower positions are often aware of such fraud. Auditors should interview senior management first, and then follow the corporate ladder downward. The audit committee must be aware of, and approve of, the use of interviews as an audit technique. In addition, if the CEO is informed of and endorses the use of fact-finding interviews, his approval can be conveyed to subordinates, who would then be more likely to cooperate. Auditors do not want the CEO to be blindsided about interviews being used to obtain information about the risk of fraud. The engagement letter should indicate that the audit team will use fact-finding interviews to help identify the risk of material misstatement due to fraud.

Documenting the Interview

During an interview, note taking is a function of the style and memory of the interviewer. A consistent pattern of note taking—either taking many notes or taking very few notes—should be maintained throughout the interview. The goal is not to distract the interviewee and not to disrupt the flow of the interview. A sudden change in note-taking style might affect the interviewee’s answers. Once the interview has been completed, however, the interviewer should immediately write a memo documenting the proceedings. This memo satisfies the requirement in SAS 99, paragraph 83, that an auditor should document the “procedures performed to obtain information necessary to identify and assess the risks of material misstatement due to fraud.” Interviewers should keep their handwritten notes, which will corroborate the formal memo in case of subsequent litigation.

Using the Interview in the Audit

Once all interviews have been completed, the audit manager should read all of the interview documentation memos, looking for themes and patterns. If the interview results indicate a lack of internal controls, overrides of internal controls, potential fraudulent activities, or other specific risks of material misstatement due to fraud, the auditor should expand procedures in the identified areas. In addition, according to SAS 99, paragraph 83, “specific risks of material misstatement due to fraud that were identified … and a description of the auditor’s response to those risks” should be documented.

Click here to see the accompanying Sidebar.