After my father passed away in late 2003, I went to Zimbabwe for a few months to spend time with my family, mostly my mother and sister. A lot of this spending time with my mother involved driving. Before my father passed, with his retirement looming, my mother had decided that she wanted to fulfill her childhood dream and become a farmer. They had bought a farm but they were still renovating the farmhouse. As a result, every day, my mother and I would drive from my grandmother’s home to the farm, hang out doing farm stuff, and then head back to my grandmother’s. Even though I was quite useless on the farm (I am allergic to nature) my mother let me tag along as we spent at least an hour on the road, daily. The car that my mother drove came with a tape deck and a shortwave radio. I am not sure why we never listened to cassette tapes; all I know is that we listened to a whole lot of BBC World Service. During one of these Coca Cola fueled drives, the story of the Parmalat bankruptcy broke on BBC. The reporter mentioned that, among many things, Parmalat had given their auditors fake bank confirmations. The confirmation fraud was a simple “cut and paste” fraud. Here, pasted a Bank of America letterhead onto a document confirming that a bank account held almost $5 billion (yes billion with a ‘b’). The document was then passed through a fax machine several times so that it looked authentic.
As I listened to the story, I started yelling, at no one in particular, “A faxed confirmation? You can’t accept a confirmation that is faxed to the client! Plus, you really want the original document. Faxes are so dangerous.” My mother looked at me as though I had lost my mind – I don’t think she had ever heard me get so worked up about auditing. But what had happened was quite unbelievable to me. When I worked in audit, the partners I reported to and my study materials, emphasized the importance of third party confirmations especially when it came to cash.
It does not matter how much you like a client or coworker, you should still practice professional skepticism and, although it is nice to trust, it is always smart to verify. Verification from an independent third party is the method that gives the most comfort but in order for the confirmation to be effective, it must be done correctly. Some ways to help ensure this are:
- Begin by knowing what your goals are in the verification process. Are you trying to find out about assets, liabilities or both? Are you looking to find out if there are hidden accounts that you did not know about? Are you looking to find out balances on a particular date?
- You should maintain control over the entire process. Do not let whomever you are verifying get involved in any part of the process, no matter how small. Do not let them give you the contact information, or let them send the confirmation out for you. You should know exactly what is going on every step of the way.
- Do not let the confirmation be sent to the client or coworker whose information you are trying to verify. Have it sent back to you, preferably as an original. Photocopies and faxes are ways that counterfeiters try to hide the signs that a document is forged.
- When I was an auditor, all my confirmations arrived via snail mail. Nowadays, balances and banks can be checked online. Because it is so convenient and easy, it is essential to ensure that you are getting your information from a valid source. If you can, verify a company’s website independently. Do not click on a link that client or coworker has provided – enter it manually. It is simple and relatively inexpensive to create a fake website so be vigilant.
It may feel a bit tedious to go through the steps of the confirmation but the information and level of comfort that you can get from a confirmation that is done correctly are very worth it.
If a company is trying to make its books look good and they know that no one is checking or that they can foil attempts at third party confirmation, it then becomes relatively easy to hide cash fraud. According to the Association of Certified Fraud Examiner’s, in frauds involving the misappropriation of assets, cash is the targeted asset 93.4% of the time. I am not sure how the city of Dixon’s auditors confirmed bank balances, but they were not doing a good job. The discovery of its comptroller’s multi-year theft of over $53 million began with a confirmation sent by an employee to the city’s bank. People who steal, really like to steal money – shouldn’t you make sure that what you think is there really is?