Error and fraud
Error and fraud
An error is unintentional — something recorded wrongly, or not recorded at all. A fraud is an intentional act involving deception, to gain an unjust or illegal advantage. Both harm the organisation and both mislead the people who rely on its records, so both are attacked by the same machinery: a system of internal control.
This chapter takes the errors first, then fraud and why it happens, then the controls that prevent and detect them.
About the lecture for this chapter.
The recording below covers this chapter well. Two things to hold as you listen:
Section 3.2 — the named types of fraud and the control that catches each one — is covered only in these notes.
Section 6.1 — the prevention and detection methods the syllabus names by name — is largely covered in these notes, not the recording. The recording reaches spot checks and reconciliations in passing; control accounts and comparison with external evidence are not in the recording.
One point of terminology the recording gets right: the accounting term is an error of principle, not an error of principal.
1 Introduction
All organisations keep financial records, for control, for planning and for measuring performance. If errors occur in recording, using or presenting that information, the organisation is likely to be harmed — so it is important to try to prevent, detect and correct them.
Fraud is different in kind, not just in degree. It implies the deliberate theft of assets, understatement of liabilities or overstatement of results. It harms the organisation and it misleads shareholders and other stakeholders. Because it is deliberate, it is also concealed, which is why it is harder to find than an error.
2 Errors
2.1 The five types of error
Errors are categorised by what went wrong with the double entry. The examples below are numbered, because section 2.2 refers back to them.
Type of error | Examples |
Error of omission — the transaction, or one side of it, never gets into the books at all | 1. An invoice arrives from a supplier but gets mislaid. There is no entry of any sort in the records. |
Error of commission — the entry is made, but in the wrong account of the right type, or in the wrong amount on both sides | 4. An invoice for rent is debited to the repairs account. |
Error of original entry — the right accounts, but the wrong figure, entered the same way on both sides | 8. A receipt of $341 from a customer is debited to cash and credited to the customer as $431. (Right accounts, wrong amount, but the two sides still agree.) |
Error of principle — a posting to a completely wrong type of account | 9. An invoice for rent is debited to non-current assets. Rent is an expense; a non-current asset is not. |
Compensating error — two separate errors that happen to cancel each other out | 11. The rent account is added up as $1,000 too much and the wages account is added up as $1,000 too little. |
Be careful with the spelling. It is an error of principle — a matter of principle, of which kind of account a transaction belongs in. It has nothing to do with a principal, which is a person who appoints an agent, or a capital sum. Older printed material often gets this wrong, and it is the kind of slip that costs a mark.
2.2 Which errors does the trial balance catch?
This is the point the five categories exist to make. A trial balance only checks one thing: that total debits equal total credits. It therefore catches an error only if the error made the two sides unequal.
Of the eleven examples above, numbers 1, 3, 4, 5, 6, 8, 9, 10 and 11 will NOT cause the trial balance to disagree — because in every one of them the double entry is complete, even though it is wrong. An invoice posted to the wrong account still has a debit and a matching credit.
Errors that do cause a trial balance to be out of balance are:
One-sided errors — examples 2 and 7. In example 2 the debit was made and the credit was not; in example 7 one account was cast wrongly, so its balance no longer matches the entries behind it.
Incorrect extraction of the trial balance itself — for instance leaving an account out of the list, or copying a balance into the wrong column.
So a trial balance that balances proves very little, and a trial balance that does not balance proves that something is definitely wrong. That asymmetry is why a business needs controls and checks, not just a trial balance.
Classifying errors
For each of the following, choose the category that best describes the error, and say whether it will cause the trial balance not to balance.
Error of omission | Error of commission | Error of principle | Trial balance out of balance | |
An invoice from a customer gets lost in the post | ||||
An invoice from a customer for $541 is entered into the bookkeeping system as $451 | ||||
Repairs of $1,200 are debited to the cost of non-current assets instead of the repairs account | ||||
A purchase of $240 is entered as: Dr Purchases 240 / Dr VAT 40 / Cr Supplier 240 |
Show answerHide answer
3 Fraud
3.1 What fraud is, and the two levels it happens at
Fraud
An intentional act involving deception to gain an unjust or illegal advantage.
Three things distinguish it from an error: it is deliberate, it involves deception, and it is therefore concealed. That is why a fraud is usually found by somebody looking, not by the records failing to add up.
Fraud happens at two levels, and the distinction matters because the people, the motives and the controls are different:
Level | Who does it | Examples | What it damages |
Fraudulent financial reporting | Management and directors — the people who prepare or influence the accounts | Deliberate incorrect accounting to boost profits: to raise the value of the company, perhaps ahead of a sale or a buy-out; or to hit a profit target on which directors' bonuses depend | The reported results, and therefore every decision anybody takes on the strength of them |
Misappropriation of assets | Employees at any level, sometimes with outsiders | Theft of cash, inventory or non-current assets, and the false records made to hide the theft | The assets themselves, and the reliability of the records that should have shown them |
3.2 Types of fraud, and what catches each one
The syllabus asks for types of fraud. Each of the following has a control that finds it, which is why this section sits immediately before the controls.
Type of fraud | How it works | What catches it |
Teeming and lading | Cash received from customer A is stolen; when customer B pays, that money is posted to A's account to hide the gap, and so on. The hole is permanently rolled forward. | Receivables statements sent to customers; independent bank reconciliation; rotating who opens the post and who posts the ledger. |
Ghost employees | A leaver is never removed from the payroll, or a fictitious employee is added, and the wages are paid into an account the fraudster controls. | Payroll reconciliations period to period; a starters-and-leavers report authorised by human resources; distributing payslips independently of the payroll clerk. |
Fictitious suppliers | An invoice is raised by a supplier that does not exist, or a real supplier's bank details are changed, and payment is made. | A supplier master file that only a separate person can amend; matching every invoice to a purchase order and a goods received note; confirming bank-detail changes by telephone. |
Expense and procurement fraud | Inflated or duplicated expense claims; purchases from a company the buyer secretly owns; kickbacks from a supplier. | Authorisation limits and independent approval; declarations of interest; supplier tendering and rotation. |
Theft of inventory or assets | Goods walk out of the warehouse, or an asset is written off as scrapped and then sold. | Physical security and access control; inventory counts and asset verification; a disposals procedure requiring authorisation and proceeds to be banked. |
Revenue and expense manipulation | Recording sales before they have been earned, holding the books open past the year end, understating liabilities and provisions, or capitalising costs that should be expenses. | Cut-off testing; analytical review of margins period by period; an audit committee that reviews the significant judgements (Chapter 4 §6.3). |
4 Why fraud happens: the fraud triangle
Fraud needs three things together — incentive, opportunity and attitude. Take away any one of them and it does not happen, which is what makes the triangle useful rather than merely descriptive.
Risk factor | In fraudulent financial reporting | In misappropriation of assets |
Incentive / motive | Profitability is threatened, so directors ‘boost' the results; pressure to perform; incentives such as a bonus linked to profit | Personal financial pressure; dislike of the employer; greed |
Opportunity | Many estimates and judgements; complex transactions; a dominant chief executive who bullies staff into changing amounts; poor internal controls | Cash; high-value portable stock; poor IT systems; poor internal controls |
Attitude / dishonesty | Poor ethical guidance; dishonesty; aggressive targets; poor morale | Other people's behaviour — “everyone over-claims expenses”; dislike of the employer; dishonesty |
Most of us have at some point been under financial pressure and had the opportunity to take money or goods from an employer. Most of us do not, because the third condition is missing: we are not dishonest. That is worth noticing, because it tells you where an organisation's effort goes. Internal control attacks opportunity — it is the only one of the three an organisation can engineer directly. A code of ethics and the tone set by senior management attack attitude. Very little can be done about incentive, except not to create it: a bonus scheme that pays out on one year's reported profit is an incentive the company has built itself.
5 Internal control
A good internal control system is essential to preventing and detecting fraud and error.
Internal control
“The management system of controls, financial and otherwise, established in order to provide reasonable assurance of: (a) effective and efficient operation; (b) internal financial control; and (c) compliance with laws and regulations. Good internal control systems should make accounting records more reliable and the occurrence of fraud and error more difficult.”
CIMA, Official Terminology (2005 edition — the wording is long-standing and is quoted here as CIMA's own definition).
Note the words reasonable assurance. No control system makes fraud impossible; a system good enough to do that would cost more than the losses it prevented, and would stop the business functioning. Controls are designed to make fraud and error difficult and likely to be found, which is a different objective.
The elements of an internal control system are:
Element | What it means |
Control environment | The culture of the organisation, as set by senior management. Are they concerned about internal control, or do they treat it as a nuisance? Are they proud of the company's records, or sloppy about them? Everything else rests on this. |
Risk assessment | What could go wrong, and where are we vulnerable? High risk implies more control. |
Control procedures / activities | The detailed controls that are put in place — section 6. |
Information and communication | Watching the results and reports, so that something that looks wrong is noticed and reported to somebody who can act. |
Monitoring | Is the system still effective? Are people operating it as they should? Internal audit does much of this work (Chapter 5). |
The system should be fully documented, so that employees know how to handle transactions, obtain authorisation and safeguard assets — and new employees should be trained in the parts of it that are relevant to them. A control that only one long-serving person understands is not a control.
6 Control procedures and activities
These are the procedures and measures that make up the internal control system. There are seven categories, and they are worth learning as a list because the exam asks for them as a list.
Procedure | What it involves |
Segregation of duties | Split a transaction so that no one person controls all of it — one to order the goods, one to count them when they arrive, one to post the invoice, one to pay the supplier. It increases the chance of an error being spotted, and it makes fraud harder because employees would have to collude, which raises their risk of being found out. |
Physical | Lock up valuable assets. Keep valuable inventory in secure stores; bank cash every night; carry out spot checks on cash and inventory; make sure every non-current asset can be accounted for. |
Authorisation and approval | All overtime authorised by the employee's manager; purchases over, say, $500 requiring two authorisations. Different authorisation limits for different management levels are the normal pattern. |
Management and supervision | Managers and supervisors actually managing and supervising: are people coming in late, are they taking shortcuts through the control procedures? |
Organisation | Duties and reporting lines clearly defined, so that everyone knows their function and their responsibilities — and so that it is clear who should have done something when it was not done. |
Arithmetic and accounting | Calculations independently checked; reconciliations carried out regularly, for example between the balance on a supplier's account and the supplier's own statement; control accounts maintained. |
Personnel | Recruit people of the right quality, take up references, and train them for the job they are given. Most controls are operated by people, so the quality of the people is itself a control. |
6.1 Prevention and detection — the methods to name
The syllabus asks separately for methods of prevention and methods of detection, and it names them. The distinction is worth holding: a preventive control stops the thing happening; a detective control finds it after the event. A system needs both, because no preventive control is perfect and because the knowledge that detection happens is itself a deterrent.
Prevention — stopping it happening | Detection — finding it afterwards |
Levels of authorisation. Nothing of consequence is committed by one person alone, and the higher the value the higher the authority needed. | Spot checks. Unannounced counts of cash and inventory, and unannounced tests of whether a procedure is being followed. Their value is that they are unpredictable. |
Documentation. Pre-numbered, controlled documents for every transaction, and a written record of who authorised what. A fraud that has to create a document leaves evidence. | Comparison with external evidence. Independent confirmation from outside the organisation — the bank statement, the supplier's statement, a customer's confirmation of a balance. External evidence is the hardest thing for an internal fraudster to manipulate. |
Staff organisation. Segregation of duties, clear reporting lines, rotation of duties and compulsory holidays — a fraud that must be maintained daily is exposed when its operator is away. | Reconciliations. Regularly agreeing one record to another: the cash book to the bank statement, the purchase ledger to suppliers' statements, the payroll to the previous period. |
Physical security and access control, and recruitment and training of the right people. | Control accounts. A total account kept independently of the individual ledger accounts — for example a receivables control account written up from the day-book totals. If the control account does not agree with the sum of the individual balances, something is wrong in the detail, and it is found without checking every account. |
7 Prevent, detect, respond
The approach to the risk of fraud has three parts:
Prevention — the internal control system set out above.
Detection — the checks and reconciliations above, plus internal audit, much of whose time is spent evaluating and testing the operation of internal control (Chapter 5).
Response — what the organisation does when a fraud is discovered. This is the third weapon, and it is the one companies most often neglect.
The response should establish:
How much did the fraud amount to?
Over what period was it carried out?
How was it carried out?
Who were the perpetrators?
Who suffered the losses?
How can it be prevented in future?
The company then has to decide what to do about the perpetrators. Presumably they will be dismissed. But companies often will not report a fraud to the police, because it brings unwelcome publicity and is an admission of failings in the company's own systems.
That reluctance is short-sighted, and it is where response feeds back into prevention. A declared policy that every incident of fraud will be reported to the police is a powerful preventive control in its own right: potential fraudsters who know they might face a prison sentence are substantially deterred from starting.
The two levels of fraud
At what two levels can fraud occur, and who typically commits each?
Show answerHide answer
The fraud triangle
What are the three prerequisites for fraud, and which of them can an organisation do most about?
Show answerHide answer
Managing fraud
What are the three approaches to fraud management?
Show answerHide answer
The seven control procedures
What are the seven categories of internal control procedure described in this chapter?
Show answerHide answer
8 Test your knowledge
Two quick checks before you move on: work through the flashcards to fix this chapter’s key terms and definitions, then sit the objective questions for exam-style practice. Both mark themselves and explain the answers as you go.
Error and fraud
12 questionsAnswer the questions one at a time. Your progress is saved so you can leave and come back.
Open chapter practice