The fraud risk factors identified in this Appendix are examples of such factors that may be faced by auditors in a broad range of situations. Separately presented are examples relating to the two types of fraud relevant to the auditor’s consideration — that is, fraudulent financial reporting and misappropriation of assets. For each of these types of fraud, the risk factors are further classified based on the three conditions generally present when material misstatements due to fraud occur: (a) incentives/pressures, (b) opportunities, and (c) attitudes/rationalisations. Although the risk factors cover a broad range of situations, they are only examples and, accordingly, the auditor may identify additional or different risk factors. Not all of these examples are relevant in all circumstances, and some may be of greater or lesser significance in entities of different size or with different ownership characteristics or circumstances. Also, the order of the examples of risk factors provided is not intended to reflect their relative importance or frequency of occurrence.

The following are examples of risk factors relating to misstatements arising from fraudulent financial reporting.

Financial stability or profitability is threatened by economic, industry, geopolitical, or entity operating conditions, such as (or as indicated by):

High degree of competition or market saturation, accompanied by declining margins.

High vulnerability to rapid changes, such as changes in technology, product obsolescence, or interest rates.

Increased volatility in financial and commodity markets due to fluctuations in interest rates and inflationary trends.

Significant declines in customer demand and increasing business failures in either the industry or overall economy.

Operating losses making the threat of bankruptcy, foreclosure, or hostile takeover imminent.

Recurring negative cash flows from operations or an inability to generate cash flows from operations while reporting earnings and earnings growth.

Rapid growth or unusual profitability especially compared to that of other companies in the same industry.

New accounting, statutory, or regulatory requirements.

Pandemics or wars triggering major disruptions in the entity’s operations, financial distress and severe cashflow shortages.

Economic sanctions imposed by governments and international organisations against a jurisdiction, including its companies and products.

Excessive pressure exists for management to meet the requirements or expectations of third parties due to the following:

Profitability or trend level expectations of investment analysts, institutional investors, significant creditors, or other external parties (particularly expectations that are aggressive or unrealistic), including expectations created by management in, for example, overly optimistic press releases or annual report messages.

Need to obtain additional debt or equity financing, or qualify for government assistance or incentives, to avoid bankruptcy or foreclosure, or to stay competitive — including financing of major research and development or capital expenditures.

Marginal ability to meet exchange listing requirements or debt repayment or other debt covenant requirements.

Perceived or real adverse effects of reporting poor financial results on significant pending transactions, such as initial public offerings, mergers and acquisitions, business combinations or contract awards.

Management enters into significant transactions that places undue emphasis on achieving key performance indicators to stakeholders (e.g., meeting earnings per share forecasts or maintaining the stock price).

Negative media attention on the entity or key members of management.

Information available indicates that the personal financial situation of management or those charged with governance is threatened by the entity’s financial performance arising from the following:

Significant financial interests in the entity.

Significant portions of their compensation (e.g., bonuses, stock options, and earn-out arrangements) being contingent upon achieving aggressive targets for stock price, operating results, financial position, cash flow, or other key performance indicators.

Personal guarantees of debts of the entity.

There is excessive pressure on management or operating personnel to meet financial targets established by those charged with governance, including sales or profitability incentive goals.

Considerations Specific to Public Sector Entities

Public sector entities subject to statutory limits on their spending may result in inaccurate reporting of expenditure incurred.

The nature of the industry or the entity’s operations provides opportunities to engage in fraudulent financial reporting that can arise from the following:

Significant related-party transactions not in the ordinary course of business or with related entities not audited or audited by another firm.

Assets, liabilities, revenues, or expenses based on significant estimates that involve subjective judgements or uncertainties that are difficult to corroborate.

Significant, unusual, or highly complex transactions, especially those close to period end that pose difficult “substance over form” questions.

Significant operations located or conducted across international borders in jurisdictions where differing business environments and cultures exist.

Use of business intermediaries for which there appears to be no clear business justification.

Modifying, revoking, or amending revenue contracts through the use of side agreements that are typically executed outside the recognised business process and reporting channels.

Significant bank accounts or subsidiary or branch operations in tax-haven jurisdictions for which there appears to be no clear business justification.

Non-traditional entry to capital markets by the entity, for example, through an acquisition by, or merger with, a special-purpose acquisition company.

Aggressive stock promotions by the entity through press releases, investment newsletters, website coverage, online advertisements, email, or direct mail.

The monitoring of management is not effective as a result of the following:

Domination of management by a single person or small group (in a non-owner-managed business) without compensating controls.

Oversight by those charged with governance over the financial reporting process and internal control is not effective.

Weakened control environment triggered by a shift in focus by management and those charged with governance to address more immediate needs of the business such as financial and operational matters.

There is a complex or unstable organisational structure, as evidenced by the following:

Difficulty in determining the organisation or individuals that have controlling interest in the entity.

Overly complex organisational structure involving unusual legal entities or managerial lines of authority.

Overly complex IT environment relative to the nature of the entity's business, legacy IT systems from acquisitions that were never integrated into the entity’s financial reporting system, or ineffective IT general controls.

High turnover of senior management, legal counsel, or those charged with governance.

Deficiencies in internal control as a result of the following:

Inadequate process to monitor the entity’s system of internal control, including automated controls and controls over interim financial reporting (where external reporting is required).

Inadequate fraud risk management program, including lack of a whistleblower program.

Inadequate controls due to changes in the current environment, for example, increased data security risks from using unsecured networks that makes the entity’s data and information more vulnerable to cybercrime.

High turnover rates or employment of staff in accounting, IT, or the internal audit function that are not effective.

Accounting and information systems that are not effective, including situations involving significant deficiencies in internal control.

Management and those charged with governance have not created a culture of honesty and ethical behaviour. For example, communication, implementation, support, or enforcement of the entity’s values or ethical standards by management and those charged with governance are not effective, or the communication of inappropriate values or ethical standards.

Non-financial management’s excessive participation in or preoccupation with the selection of accounting policies or the determination of significant estimates.

Known history of violations of securities laws or other laws and regulations, or claims against the entity, its senior management, or those charged with governance alleging fraud or violations of laws and regulations, including those dealing with corruption, bribery, and money laundering.

Excessive interest by management in maintaining or increasing the entity’s stock price or earnings trend.

The practice by management of committing to analysts, creditors, and other third parties to achieve aggressive or unrealistic forecasts.

Management and those charged with governance demonstrate an unusually high tolerance to risk or display an unusually high standard of lifestyle, a pattern of significant personal financial issues, or frequently engage in high-risk activities.

Management and those charged with governance make materially false or misleading statements in other information included in the entity’s annual report (e.g., key aspects of the entity's business, products, or technology).

Management failing to remedy known significant deficiencies in internal control on a timely basis.

An interest by management in employing inappropriate means to minimise reported earnings for tax- motivated reasons.

Applying aggressive valuation assumptions in mergers and acquisitions to support high purchase prices or overvalue acquired intangible assets.

Rationalising the use of unreasonable assumptions affecting the timing and amount of revenue recognition, for example, in an attempt to alleviate the negative effects of severe economic downturns.

Rationalising the use of unreasonable assumptions used in projections to account for impairment of goodwill and intangible assets, for example, to avoid recognising significant impairment losses.

Low morale among senior management.

The owner-manager makes no distinction between personal and business transactions.

Dispute between shareholders in a closely held entity.

Recurring attempts by management to justify marginal or inappropriate accounting on the basis of materiality.

The relationship between management and the current or predecessor auditor is strained, as exhibited by the following:

Frequent disputes with the current or predecessor auditor on accounting, auditing, or reporting matters.

Unreasonable demands on the auditor, such as unrealistic time constraints regarding the completion of the audit or the issuance of the auditor’s report.

Restrictions on the auditor that inappropriately limit access to people or information or the ability to communicate effectively with those charged with governance.

Domineering management behaviour in dealing with the auditor, especially involving attempts to influence the scope of the auditor’s work or the selection or continuance of personnel assigned to or consulted on the audit engagement.

Risk factors that relate to misstatements arising from misappropriation of assets are also classified according to the three conditions generally present when fraud exists: incentives/pressures, opportunities, and attitudes/rationalisation. Some of the risk factors related to misstatements arising from fraudulent financial reporting also may be present when misstatements arising from misappropriation of assets occur. For example, ineffective monitoring of management and other deficiencies in internal control may be present when misstatements due to either fraudulent financial reporting or misappropriation of assets exist. The following are examples of risk factors related to misstatements arising from misappropriation of assets.

Personal financial obligations may create pressure on management or employees with access to cash or other assets susceptible to theft to misappropriate those assets.

Adverse relationships between the entity and employees with access to cash or other assets susceptible to theft may motivate those employees to misappropriate those assets. For example, adverse relationships may be created by the following:

Known or anticipated future employee layoffs.

Recent or anticipated changes to employee compensation or benefit plans.

Promotions, compensation, or other rewards inconsistent with expectations.

Certain characteristics or circumstances may increase the susceptibility of assets to misappropriation. For example, opportunities to misappropriate assets increase when there are the following:

Large amounts of cash on hand or processed.

Inventory items that are small in size, of high value, or in high demand.

Easily convertible assets, such as bearer bonds, diamonds, or computer chips.

Fixed assets that are small in size, marketable, or lacking observable identification of ownership.

Inadequate controls over assets may increase the susceptibility of misappropriation of those assets. For example, misappropriation of assets may occur because there is the following:

Inadequate segregation of duties or independent checks.

Inadequate oversight of senior management expenditures, such as travel and other re- imbursements.

Inadequate management oversight of employees responsible for assets, for example, inadequate supervision or monitoring of remote locations.

Inadequate job applicant screening of employees with access to assets.

Inadequate record keeping with respect to assets.

Inadequate system of authorisation and approval of transactions (e.g., in purchasing).

Inadequate physical safeguards over cash, investments, inventory, or fixed assets.

Lack of complete and timely reconciliations of assets.

Lack of timely and appropriate documentation of transactions, for example, credits for merchandise returns.

Lack of mandatory vacations for employees performing key control functions.

Inadequate management understanding of IT, which enables IT employees to perpetrate a misappropriation.

Inadequate access controls over automated records, including controls over and review of computer systems event logs.

Inadequate controls in supplier management, including changes in the supply chain, that may expose the entity to fictitious suppliers, or unvetted suppliers that pay kickbacks or are involved in other fraudulent or illegal activities.

Lack of oversight by those charged with governance over how management utilised financial aid from governments and local authorities (e.g., bailouts during pandemics, wars, or impending industry collapse).

Considerations Specific to Public Sector Entities

Trust funds under administration – public sector entities often manage assets on behalf of others, including vulnerable individuals, which can be more susceptible to misuse.

The nature of certain revenue transactions (e.g., taxes and grants) may provide a greater opportunity to manipulate the timing or amount of revenue recognised in the current period.

Disregard for the need for monitoring or reducing risks related to misappropriations of assets.

Disregard for controls over misappropriation of assets by overriding existing controls or by failing to take appropriate remedial action on known deficiencies in internal control.

Behaviour indicating displeasure or dissatisfaction with the entity or its treatment of the employee.

Changes in behaviour or lifestyle that may indicate assets have been misappropriated.

Tolerance of petty theft.

Rationalising misappropriations committed during severe economic downturns by intending to pay back the entity when circumstances return to normal.

Appendix 2

(Ref: Para. A59, A127 and A135)