Internal Controls and Comprehensive Auditing Essential for Checks and Balances

Article Submitted by Jennifer Norris, Former E&CD Director

In my role as the economic developer for the Town of Lisbon, I discovered fraudulent use of funds which helped me to learn how important the auditing function is. Auditors need to provide the best service possible in an effort to ultimately protect the taxpayers and the employees. The following scenario is provided to help you understand why an auditing firm needs to provide holistic services.

SCENARIO:

One of the first functions I performed in my role as an economic developer for the Town of Lisbon was to review all of the current revolving loan fund recipient files and the financials in general. I learned that the Economic Development office had five bank accounts: Signs, Housing, Community Development Block Grant (CDBG), FAME, and USDA-IRP. Although there were no written procedures giving guidance as to their appropriate use, I learned from expenditures of the past and interviews with the Finance Director, AVCOG, and USDA-IRP that the FAME account and the USDA-IRP account came with strict procedures. The rest of the accounts had no procedures but they did show a theme. The signs account was used for the purchase of business directories and was where incoming sign rental payment from businesses was deposited. The Housing account was used to provide grants to low income individuals and/or families who had heating emergencies and façade improvements on both businesses and homes in the business districts. The CDBG account was used for miscellaneous economic development expenses and for providing first lender loans in the amount of $15,000 or less to local businesses. This is the account that showed the most irregularities. The FAME and USDA-IRP funds were audited by outside agencies. There were files for them (created by AVCOG prior to my employment) but they were incomplete.

All of the other loan recipients had no files. I learned that loans were granted to businesses and individuals without a clear mechanism. In some cases, an application was filled out but did not show a clear picture as to whether or not the business or individual was a calculated risk for the town. There were no business plans or financials to accompany the loan applications. At one point, there was a loan committee to help determine whether or not the loan was a good investment for the community but this committee had not been utilized in over ten years. Although, not in writing, it was the practice of the economic developer to get the final loan approval from the Town Council in executive session. In most cases, there was a promissory note which indicated the name of the loan recipient, the loan amount, and the guaranteed percentage rate but the collateral and the means by which the Town of Lisbon would be able to collect on their investment if the recipient defaulted on the loan was unclear. An attorney was not consulted to ensure that the Town of Lisbon was protected, i.e. signatures were not collected, signatures were incomplete (e.g. only one of the partners signed the document), and there were no witnesses to verify the agreement, etc. And, finally, there were only two people who had the authority to sign checks, the economic developer and the finance director.

The economic developer was the primary signature on most of the checks and there were no internal control procedures. The economic developer filled out the purchase order and signed the check. A copy of the purchase order was provided to the finance director for accounting purposes only. And, in most cases, there was no back-up with the purchase orders. It was the responsibility of the economic developer to track the loan payments to include following up with those who may be late. There were no procedures outlined as to what needed to occur should someone be late on a monthly payment. If someone was to stop paying back their loan, it was the responsibility of the economic developer to collect the payment. The finance director’s only role in the scenario was to document outgoing and incoming revolving loan funds for accounting purposes. The finance director was not apprised of the arrangements made with recipients of the loans, therefore, did not have the authority to act on payment or non-payment issues.

ISSUES:

There was no easily accessible historical data for revolving loan fund recipients, no written procedures as to how the bank accounts were supposed to be used, and either a missing file or an incomplete file for the loan recipients. Therefore, the economic developer could not easily determine who had been paying or not paying back their loans and if the monies were used without following the parent loan holder’s protocol. This not only presented a problem for the Town but the employee as well. There were no checks and balances. The economic developer decided who would get the loan and signed the check. A purchase order was provided to the finance director for accounting purposes but was usually not accompanied with any back up. There were no written procedures as to who was eligible for a loan, why someone may get turned down for a loan, or the terms of payment. This presented issues because it looked like loan recipients were “hand picked” and the Town could be accused of violating the equal opportunity lending laws. The economic developer was the only person who had knowledge of the “lending protocol” and had the power to set interest rates, determine loan amounts, and decide the terms of the payments back to the Town. If the economic developer didn’t follow up with those who stopped paying, no one else in the organization would have the authority or even know that they needed to follow up. Again, the finance director had the economic development financial information for accounting purposes only. As a result, it was quite easy for the economic developer to use the funds for personal gain and no one in the organization would know any better. If the loan recipient didn’t pay back the loan, it would just show up as a non-pay and eventually be written off. And, even if the economic developer did everything by the book, there was no documentation to prove that or internal controls in place to verify and justify the decision to grant loans or make large expenditures. The lack of procedures and policies put the economic developer and the Town at risk.

IMPLICATIONS FOR AUDITORS:

Looking at a list of the current loans and balances owed does not tell a story. Sampling a small percentage of the loans to determine if the loan recipient agrees with the balance owed does not represent a truth. A true audit would entail looking at the bank accounts, historical data, written procedures, files, and conducting interviews with the department head and the others involved in the financial decision making process.

In the case of Lisbon, the auditors asked the department head for three files, one of which happened to be the fraudulent loan for $32,500. At the time of the audit, the economic developer was in the process of building files for all current loan recipients so the files provided to the auditor were incomplete. The economic developer was told by the Interim Town Manager and the Attorney not to talk to anyone about the details of the fraudulent loan. Because the files were incomplete, the economic developer explained to the auditors that there were no files until recently and that the files were in the process of creation. The auditors stopped there and in their final report stated that there may be a fraudulent loan and the economic development office needs files. Had the auditors interviewed me, they would have learned about the lack of internal controls in the economic development office, they would have discovered numerous red flags that warranted further investigation, and they would have made more recommendations to the Town Council in their final report.

The new auditing standards effective 12/31/07 provide guidance concerning the auditor’s assessment of the risks of material misstatement (whether caused by error or fraud) in a financial statement audit. These new standards will help to address some of the issues that I had discovered during my employment as an economic developer for the Town of Lisbon. An audit is more than looking at numbers on a piece of paper and the additional investigative steps should be included in the overall price of an audit, not as an extra. I feel that it is imperative that an audit consider the following: More in-depth understanding of the entity and its environment, including its internal control, to identify the risks of material misstatement in the financial statements and what the entity is doing to mitigate them; More rigorous assessment of the risks of where and how financial statements could be materially misstated based on that understanding; Reported assets and liabilities actually exist at the balance sheet date; All transactions and accounts that should be included in the financial statements are included.

Some questions to consider for the potential auditors:

Are you familiar with the new auditing standards as of 12/31/07?
How would you obtain an in-depth understanding of the entity and its environment?
How would you present the financial statements in conjunction with this understanding?
How do you determine what the internal control procedures are?
How do you decide whether or not an entity has appropriate internal controls?
How do you decide whether or not the entity is appropriately mitigating risks?
If you were to interview an employee, what would you ask them?
If during your audit, you discovered “red flags”, what would you do?
If during your audit, paperwork or files were missing, what would you do?
If you suspected fraud or error, would further investigation be included in the price?