Chapter 11:

Introduction to Business
Ethics and Fraud

IT Auditing & Assurance, 2e, Hall &

IT Auditing & Assurance, 2e, Hall & Singleton
Singleton
 ETHICS
Pertains to the principles of conduct that
individuals use in making choices and
guiding their behavior in situations that
involve the concepts of right and wrong.
Business Ethics
ØHow do managers decide on what is right
in conducting business?
ØOnce managers have recognized what is
right, how to they achieve it?
ØThe necessity to have an articulate
foundation for ethics and a consistent
application of the ethical standards.
IT Auditing & Assurance, 2e, Hall & Singleton
 BUSINESS ETHICS
Basis of Ethical Standards
Ø Religious
Ø Philosophical
Ø Historical
Ø IBM combination of all three
Ethical Issues in Business [Table 11-1]
Ø Equity Ø Honesty
q Exec. salaries q Conflicts of interest
q Pricing q Security of data & records
Ø Rights q Foreign practices [FCPA]
q Health (screening) q Accurate F/S reporting
q Privacy Ø Exercise of Corp. Power
q Sexual harassment q PAC, and politics
q Equal opportunity q Workplace safety
q Whistleblowing q Downsizing, closures
IT Auditing & Assurance, 2e, Hall & Singleton
IMPLEMENTING BUSINESS ETHICS
1990 Business Roundtable
Ø Greater commitment of top management
Ø Written codes (policy) that clearly
communicate standards and expectations
Ø Programs to implement ethical guidelines
Ø Techniques to monitor compliance
q Boeing
§ Uses line managers to lead ethics training
§ Toll-free number to report violations
q General Mills
§ Published guidelines with vendors, competitors, customers
q Johnson & Johnson
§ Creed integral to its culture
§ Uses surveys to ascertain compliance
q SAIC
§ Toll-free number, required training, separate dept.

IT Auditing & Assurance, 2e, Hall & Singleton

IMPLEMENTING BUSINESS ETHICS
Role of Management
Ø Create and maintain appropriate ethical atmosphere
Ø Limit the opportunity and temptation for unethical
behavior
Ø Management needs a methodology for including
lower-level managers and employees in the ethics
schema
q Many times, lower-level managers responsible to uphold
ethical standards
q Poor ethical standards among employees are a root cause of
employee fraud and abuses
Ø Managers and employees both should be made
aware of firm’s code of ethics
Ø What if management is unethical? e.g., Enron

IT Auditing & Assurance, 2e, Hall & Singleton

IMPLEMENTING BUSINESS ETHICS
Reported Abuses
Ø Typically junior employees (Wall Street Journal)
Ø Half of American workers believe the best way
to get ahead is politics and cheating
Ø One-third of a group of 9,175 surveyed had
stolen property and supplies from employers
Ø Ethics Resource Center: 1994 study
q 41% falsified reports
q 35% committed theft

Ethical Development
Ø Most people develop a personal code of ethics from
family, formal education, and personal experience
Ø Go through stages of moral evolution [Figure 11-2]

IT Auditing & Assurance, 2e, Hall & Singleton

IMPLEMENTING BUSINESS ETHICS
Making Ethical Decisions
Ø Business schools can and should be involved in ethical
development of future managers
Ø Business programs can teach students analytical techniques to
use in trying to understand and properly handle a firm’s conflicting
responsibilities to its employees, shareholders, customers, and
the public
Ø Every ethical decision has risks and benefits. Balancing them is
the manager’s ethical responsibility:

Ethical Principles
Ø Proportionality: Benefits of a decision must outweigh the
risks. Choose least risky option.
Ø Justice: Distribute benefits of decision fairly to those who
share risks. Those who do not benefit should not carry any
risk
Ø Minimize Risk: Minimize all risks.
IT Auditing & Assurance, 2e, Hall & Singleton
 COMPUTER ETHICS
The analysis of the nature and social impact
of computer technology and the
corresponding formulation and justification
of policies for the ethical use of such
technology.
Levels of Computer Ethics
q POP: the exposure to stories and reports in popular media
q PARA: taking a real interest in computer ethics cases and
acquiring some level of skill and knowledge
q THEORETICAL: multi-disciplinary researchers who apply the
theories of philosophy, sociology, and psychology to computer
science, intending to bring some new understanding to the field.
That is, ethics research.

IT Auditing & Assurance, 2e, Hall & Singleton

 COMPUTER ETHICS
A new problem or just a new twist to an old
problem?

Although computer programs are a new type of

asset, many believe that they should not be
considered as different form other forms of
property; i.e., intellectual property is the same as
real property and the rights associated with real
property.

IT Auditing & Assurance, 2e, Hall & Singleton

COMPUTER ETHICAL ISSUES
1. Privacy:
§ Ownership of personal information
§ Policies
2. Security:
§ Systems attempt to prevent fraud and abuse of
computer systems, furthering the legitimate
interests of firm
§ Shared databases have potential to disseminate
inaccurate info to authorized users
3. Ownership of Property:
§ Federal copyright laws
4. Race:
§ African-Americans and Hispanics constitute 20%
of population but 7% of MIS professionals
IT Auditing & Assurance, 2e, Hall & Singleton
COMPUTER ETHICAL ISSUES
5. Equity in Access:
§ Some barriers are avoidable, some are not
§ Factors: economic status, affluence of firm,
documentation language, cultural limitations
6. Environmental Issues:
§ Should firms limit non-essential hard copies?
§ What is non-essential?
§ Disposal of equipment and supplies (toner)
7. Artificial Intelligence:
§ Who is responsible for faulty decisions from
an Expert System?
§ What is the extent of AI/ES in decision-making
processes?
IT Auditing & Assurance, 2e, Hall & Singleton
COMPUTER ETHICAL ISSUES
8. Unemployment & Displacement:
§ Computers and technology sometimes replace jobs
(catch-22, productivity)
§ Some people unable to change with IT, get displaced
and find it difficult to obtain new job
9. Misuse of Computer:
§ Copying proprietary software
§ Using a firm’s computers for personal benefit
§ Snooping through firm’s files
10. Internal Control Responsibility:
§ Unreliable information leads to bad decision, possible
financial distress
§ Management must establish and maintain a system of
appropriate internal controls to ensure integrity and
reliability of data (antithetical)
§ IS professionals and accountants are central to
adequate internal controls
IT Auditing & Assurance, 2e, Hall & Singleton
 FRAUD & ACCOUNTANTS
The lack of ethical standards* is fundamental to the occurrence of
business fraud.
No major aspect of the independent auditor’s role has caused more
difficulty for public accounting than the responsibility for detection of
fraud during an audit. [article]
This issue has gathered momentum outside the accounting profession to
the point where the profession faces a crisis in public confidence in
its ability to perform independent attest functions. [SAS 82]

Fraud denotes a false representation of a material

fact made by one party to another party with the
intent to deceive and induce the other party to
justifiably rely on the fact to his/her detriment, i.e.,
his/her injury or loss.
Synonyms: White-collar crime, defalcation,
embezzlement, irregularities.
IT Auditing & Assurance, 2e, Hall & Singleton
 FRAUD
A fraudulent act must meet the following
5 conditions:

1. False representation
2. Material fact
3. Intent
4. Justifiable reliance
5. Injury or loss

IT Auditing & Assurance, 2e, Hall & Singleton

 FRAUD TREE
Ø Asset misappropriation fraud
1. Stealing something of value – usually cash or inventory (i.e.,
asset theft)
2. Converting asset to usable form
3. Concealing the crime to avoid detection
4. Usually, perpetrator is an employee

Ø Financial fraud
1. Does not involve direct theft of assets
2. Often objective is to obtain higher stock price (i.e., financial fraud)
3. Typically involves misstating financial data to gain additional
compensation, promotion, or escape penalty for poor performance
4. Often escapes detection until irreparable harm has been done
5. Usually, perpetrator is executive management

Ø Corruption fraud
1. Bribery, etc.

IT Auditing & Assurance, 2e, Hall & Singleton

 FRAUD SCHEMES
Ø Fraudulent financial statements {5%}
Ø Corruption {10%}
§ Bribery
§ Illegal gratuities
§ Conflicts of interest
§ Economic extortion
Ø Asset misappropriation {85%}
§ Charges to expense accounts
§ Lapping
§ Kiting
§ Transaction fraud

IT Auditing & Assurance, 2e, Hall & Singleton

 EMPLOYEE FRAUD

Ø Employee Theft

1) Theft of asset
2) Conversion of asset (to cash, to
fraudster)
3) Concealment of fraud

IT Auditing & Assurance, 2e, Hall & Singleton

 MANAGEMENT FRAUD
Ø Special Characteristics:

1. Perpetrated at levels of management above the

one where internal controls relate
2. Frequently involves using the financial statements
to create false image of corporate financial health
3. If fraud involves misappropriation of assets, it
frequently is shrouded in a complex maze of
business transactions, and often involves third
parties. [e.g., ZZZZ Best fraud]

IT Auditing & Assurance, 2e, Hall & Singleton

 FRAUD TRIANGLE
Ø People engage in fraudulent activities as a result of forces
within the individual (their ethical system) and without (from
temptation and/or stress from the external environment)
1. Situational Pressures
2. Opportunity
3. Rationalization
Ø A person with a high level of personal ethics and limited
pressure and opportunity to commit fraud is most likely to
behave honestly [Figure 11-2]
Ø A person with low level of integrity, and moderate to high
pressures, and moderate to high opportunity is most likely
to commit fraud
Ø Auditors can develop a “red flag” checklist to detect
possible fraudulent activity
Ø A questionnaire approach could be used to help auditors
uncover motivations for fraud
IT Auditing & Assurance, 2e, Hall & Singleton
 POSSIBLE QUESTIONNAIRE
Do key executives have unusually high personal debt?
Do key executives appear to be living beyond their means?
Do key executives engage in habitual gambling?
Do key executives appear to abuse alcohol or drugs?
Do key executives appear to lack personal codes of ethics?
Do key executives appear to be unstable (e.g., frequent job or residence
changes, mental or emotional problems)?
Are economic conditions unfavorable within the company’s industry?
Does the company use several different banks, none of which sees the
company’s entire financial picture?
Do key executives have close associations with suppliers?
Do key executives have close associations with members of the Audit
Committee or Board?
Is the company experiencing a rapid turnover of key employees, either
through quitting or being fired?
Do one or two individuals dominate the company?
Does anyone never take a vacation?
IT Auditing & Assurance, 2e, Hall & Singleton
 FINANCIAL LOSSES FROM
FRAUD
Ø 1996, 2002, and 2004 study by Association of CFE (“Report to the
Nation”) estimated losses from fraud and abuse at 6% of annual
revenues! Based on GDP in 2002, that would be $600B, and in
2004 $660B in losses.
Ø Actual cost is difficult to quantify because:
1. All fraud is not detected
2. Of ones detected, not all are reported
3. In many cases, incomplete information is gathered
4. Information is not properly distributed to management or law
enforcement authorities
5. Too often, business organizations decide to take no civil or
criminal action against the perpetrator of fraud
Ø Organizations with 100 or fewer employees were the most
vulnerable to fraud
§ SEC fraud violations reported in COSO “Landmark Study” 1998
IT Auditing & Assurance, 2e, Hall & Singleton
 FINANCIAL LOSSES FROM
FRAUD
Ø Profile of perpetrator:
§ By position – Table 11-3
§ By gender – Table 11-5
§ By age – Table 11-6
§ By Education – Table 11-7
§ Conclusions about profile?
q Fraudsters do not look like crooks!
Ø Collusion – Table 11-4
1. Significant reason to adhere to segregation of
duties
2. Risks associated with a key position held by a
trusted employee who unknowingly has weak
ethics
IT Auditing & Assurance, 2e, Hall & Singleton
 UNDERLYING PROBLEMS

Ø Lack of auditor independence

Ø Lack of director independence
Ø Questionable executive
compensation schemes
Ø Inappropriate accounting practices

IT Auditing & Assurance, 2e, Hall & Singleton

 SARBANES-OXLEY ACT
Ø PCAOB
Ø Auditor independence
§ List of services considered non-
independent
Ø Corporate governance
Ø Issuer and management disclosure
Ø Fraud and criminal penalties

IT Auditing & Assurance, 2e, Hall & Singleton

ANTI-FRAUD PROFESSION
Ø Fraud auditors
Ø Forensic accountants
Ø Association of Certified Fraud Examiners
§ Certified Fraud Examiner certification
§ – http://www.acfe.org
Forensic Accounting
Ø Investigation
Ø Evidence for court
Ø Litigation
Ø CFE – Association of Certified Fraud
Examiners
Ø See newsletter sample at ACFE web site
IT Auditing & Assurance, 2e, Hall & Singleton
 IT Auditing & Assurance, 2e, Hall &
Gambar 11a- Pohon Kecurangan (Fraud Tree) {sumber; ACFE)
Singleton
Gambar 11b Pohon Kecurangan Internet (Unternet Fraud Trees (Sumber; ACFE)
Berbagai alat /metode deteksi Fraud
Behavior Sysmpton Analysis
Bedford Law
Chapter
Beneish’s Model
12:
Fraud Schemes &
Data Mining
Fraud
Follow The Money Detection
Open Invoice
Web Crawling & Web Scrapting
Fraud Theory

IT Auditing & Assurance, 2e, Hall &

Singleton
 Chapter 12:
Fraud Schemes &
Fraud Detection

IT Auditing & Assurance, 2e, Hall &

IT Auditing & Assurance,
Singleton 2e, Hall & Singleton
 FRAUD TREE
Ø Asset misappropriation fraud
1. Stealing something of value – usually cash or inventory (i.e.,
asset theft)
2. Converting asset to usable form
3. Concealing the crime to avoid detection
4. Usually, perpetrator is an employee

Ø Financial fraud
1. Does not involve direct theft of assets
2. Often objective is to obtain higher stock price (i.e., financial fraud)
3. Typically involves misstating financial data to gain additional
compensation, promotion, or escape penalty for poor performance
4. Often escapes detection until irreparable harm has been done
5. Usually, perpetrator is executive management

Ø Corruption fraud
1. Bribery, etc.

IT Auditing & Assurance, 2e, Hall & Singleton

ACFE 2004 REPORT TO THE NATION

IT Auditing & Assurance, 2e, Hall & Singleton

 FRAUD SCHEMES
Ø Fraudulent financial statements {5%}
Ø Corruption {13%}
q Bribery
q Illegal gratuities
q Conflicts of interest
q Economic extortion
Ø Asset misappropriation {85%}
q Charges to expense accounts
q Lapping
q Kiting
q Transaction fraud
Percentages per ACFE 2002 Report to the Nation – see Table 12-1
IT Auditing & Assurance, 2e, Hall & Singleton
 COMPUTER FRAUD
SCHEMES
Ø Data Collection
Ø Data Processing
Ø Database Management
Ø Information Generation

IT Auditing & Assurance, 2e, Hall & Singleton

AUDITOR’S RESPONSIBILITY FOR
DETECTING FRAUD—SAS NO. 99
Ø Sarbanes-Oxley Act 2002
Ø SAS No. 99 – “Consideration of Fraud in a
Financial Statement Audit”
1. Description and characteristics of fraud
2. Professional skepticism
3. Engagement personnel discussion
4. Obtaining audit evidence and information
5. Identifying risks
6. Assessing the identified risks
7. Responding to the assessment
8. Evaluating audit evidence and information
9. Communicating possible fraud
10. Documenting consideration of fraud
IT Auditing & Assurance, 2e, Hall & Singleton
FRAUDULANT FINANCIAL
REPORTING
Ø Risk factors:
1. Management’s characteristics and
influence over the control environment
2. Industry conditions
3. Operating characteristics and financial
stability

IT Auditing & Assurance, 2e, Hall & Singleton

 FRAUDULANT FINANCIAL
REPORTING
Ø Common schemes:
q Improper revenue recognition
q Improper treatment of sales
q Improper asset valuation
q Improper deferral of costs and
expenses
q Improper recording of liabilities
q Inadequate disclosures

IT Auditing & Assurance, 2e, Hall & Singleton

 MISAPPROPRIATION OF
ASSETS
Ø Risk factors:
1. Susceptibility of assets to
misappropriation
2. Controls

IT Auditing & Assurance, 2e, Hall & Singleton

 MISAPPROPRIATION OF
ASSETS
Ø Common schemes:
q Personal purchases
q Ghost employees
q Fictitious expenses
q Altered payee
q Pass-through vendors
q Theft of cash (or inventory)
q Lapping

IT Auditing & Assurance, 2e, Hall & Singleton

ACFE 2004 REPORT TO THE NATION

IT Auditing & Assurance, 2e, Hall & Singleton

AUDITOR’S RESPONSE TO RISK
ASSESSMENT
Ø Engagement staffing and extent of
supervision
Ø Professional skepticism
Ø Nature, timing, extent of procedures
performed

IT Auditing & Assurance, 2e, Hall & Singleton

AUDITOR’S RESPONSE TO DETECTED
MISSTATEMENTS DUE TO FRAUD
Ø If no material effect:
q Refer matter to appropriate level of management
q Ensure implications to other aspects of the audit
have been adequately addressed
Ø If effect is material or undeterminable:
q Consider implications for other aspects of the audit
q Discuss the matter with senior management and
audit committee
q Attempt to determine if material effect
q Suggest client consult with legal counsel

IT Auditing & Assurance, 2e, Hall & Singleton

AUDITOR’S DOCUMENTATION
Ø Document in the working papers
criteria used for assessing fraud risk
factors:
1. Those risk factors identified
2. Auditor’s response to them

IT Auditing & Assurance, 2e, Hall & Singleton

FRAUD DETECTION TECHNIQUES
USING ACL

Ø Payments to fictitious vendors

q Sequential invoice numbers
q Vendors with P.O. boxes
q Vendors with employee address
q Multiple company with same address
q Invoice amounts slightly below review
threshold

IT Auditing & Assurance, 2e, Hall & Singleton

FRAUD DETECTION TECHNIQUES
USING ACL

Ø Payroll fraud
q Test for excessive hours worked
q Test for duplicate payments
q Tests for non-existent employee

IT Auditing & Assurance, 2e, Hall & Singleton

FRAUD DETECTION TECHNIQUES
USING ACL

Ø Lapping A.R.

q Balance forward method

q Open invoice method

IT Auditing & Assurance, 2e, Hall & Singleton