Fraud discovered after year end
Why a fraud that happened before year end but was found afterwards is an adjusting event under IAS 10, and what the auditor must do before signing.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A few weeks after the year end, a new creditors clerk notices that one supplier's bank account belongs to her predecessor's brother. Pulling the file, she finds invoices for deliveries nobody remembers, paid every month for most of the year. The audit report has not been signed. The financial director's first instinct is that the year is closed and the matter belongs in next year's accounts.
It does not. A fraud that happened during the year is part of that year, whenever it comes to light. This article explains why IAS 10 treats it as an adjusting event, and what the audit team has to do before the report is signed.
What IAS 10 says about events after the reporting period
As quoted by ACCA, IAS 10 defines an adjusting event as an event after the reporting period that provides further evidence of conditions that existed at the end of the reporting period, including an event indicating that the going concern assumption for all or part of the enterprise is not appropriate.
The dividing line is about when the condition existed, not when anyone found out. An event that reveals something already true at year end is adjusting: the statements are corrected. An event that reflects a condition arising after year end, such as a fire in March, is non-adjusting: it may need disclosure, but the year-end figures stand. For the full framework, see events after the reporting period.
Why fraud found later is an adjusting event
ACCA explains that fraud, error and other irregularities that occurred before the year end but are discovered only after it are adjusting events. That follows directly from the definition. The fake invoices were paid during the year; the discovery in the new year simply provides evidence of what the year-end position really was.
The accounting needs care. In the supplier example, expenses include purchases that never happened and the money has gone. The statements need correcting for the misdescribed expense and for whatever the entity actually lost, with any recovery recognised only where the framework allows it. If the scheme ran across earlier years too, the prior-period figures need attention as well, and that is a separate decision about restatement.
Subsequent events procedures run up to the report date
ACCA explains that ISA 560 requires the auditor to obtain sufficient appropriate audit evidence that all events between the date of the financial statements and the auditor's report that require adjustment or disclosure have been identified, and it stresses that these procedures should be performed up to the date of the auditor's report. Its article on subsequent events sets out the auditor's duties before and after the report is signed.
A fraud discovered in this window is squarely within those procedures. It also changes how the rest of them should be done. If the client's controls allowed a year of fake invoices, the post-year-end cash book, the supplier master file and the management accounts all deserve a closer look than the standard subsequent events checklist would give them. The auditor's subsequent events work covers the routine procedures.
Quantifying the effect and asking for correction
ICAEW advises that an auditor who finds a fake invoice should assess whether it is isolated or points to a wider control failure, inform management and those charged with governance promptly while considering whether management were involved so as to avoid tipping anyone off, document the findings, and consider any regulatory, legal or professional reporting obligations.
In practice that means:
- Establish the extent. Identify every payment to the supplier and every other supplier sharing the same bank details or approver. Test whether the same weakness was used elsewhere.
- Quantify the misstatement for the current year, and separately for earlier years if the scheme began before.
- Reassess the audit. Revisit the risk assessment, any reliance placed on controls, and the reliability of representations from people who may have been involved.
- Request correction. As quoted by ACCA, ISA 450 requires the auditor to communicate on a timely basis all misstatements accumulated during the audit to the appropriate level of management, unless prohibited by law or regulation, and to request management to correct them.
- Consider reporting duties. Each country has its own rules on what an auditor must report about fraud and to whom. Check the rules that apply in South Africa, Nigeria or Kenya, as the case may be, before deciding what to say and when.
If management will not correct a material misstatement, the opinion will have to be modified.
Recording findings and consultations in Achekam
In Achekam, findings can be raised from a working paper and later closed or withdrawn, so the fraud, each related exception and its resolution sit on the file with a status rather than in an e-mail thread. Where the client corrects the statements, staff record the audit adjustment on the affected lead schedule line with a reason; lead schedules are built from the engagement's trial balance, with each figure traceable to its lines.
A fraud finding nearly always raises questions that deserve a second opinion: whether earlier years need restating, whether the matter must be reported outside the entity, whether the opinion is affected. Staff can take a technical consultation on the engagement from question to conclusion and closure. If the engagement partner and the consulted partner disagree, the firm can record the difference of opinion with each party's position, the escalation and the resolution.
Telling those charged with governance
Tell the right people, in the right order. If there is any possibility that management was involved, go to those charged with governance directly, whether that is the board, an audit committee or the shareholders of an owner-managed company, rather than through the person who may be implicated. Explain what was found, the effect on the statements, the control weakness that allowed it and what the audit has done in response.
Put the communication in writing and keep it on the file, together with any response. Then make sure the control weakness also appears in the management letter, so the conversation does not end with this year's correction.
A fraud found after year end is unwelcome news, but it arrives at the best possible moment: before the report is signed, while the statements can still be put right.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
