“We Have Never Had Fraud Here” Sounds Reassuring, but It Does Not End the Audit Question
Your company has operated in Singapore for fifteen years. The finance team is stable, several employees have worked with the business since its early days, and management cannot remember a single case of anyone stealing company money or deliberately manipulating the accounts. Then the annual audit begins, and the auditor starts asking questions about fraud. Who can create new suppliers? Who approves payments? Can senior management post journal entries? Has anyone been pressured to achieve financial targets? Are there unusual transactions near year-end? Has management identified any suspected fraud during the year? For a business with a clean history, these questions can sound unnecessarily suspicious. Management may wonder why an auditor providing auditing services Singapore would spend time discussing fraud when nobody has ever been caught committing it. The reason is simple: an audit considers what could cause a material misstatement in the financial statements, not only what happened in previous years. A clean history is useful information, but it is not proof that fraud risk does not exist today.
Auditors Are Not Accusing Management of Fraud
The first misunderstanding to clear up is that asking about fraud risk is not the same as accusing someone of fraud. Auditors ask questions about revenue recognition, estimates, inventory, receivables and internal controls without automatically assuming those areas are wrong. Fraud risk is approached in a similar way. Singapore’s auditing framework requires auditors to consider the possibility that financial statements could contain material misstatements caused by fraud, and ACRA has emphasised the need for auditors to maintain professional scepticism even when their previous experience with management has been positive. A well-run business should therefore not interpret fraud questions as a sign that the auditor distrusts its directors or employees personally. The auditor is assessing risk objectively and determining what procedures are appropriate for the engagement.
Past Honesty Does Not Guarantee Future Circumstances
Imagine a finance manager who has worked honestly for a company for twelve years. During the thirteenth year, that employee experiences financial pressure outside work. At the same time, the company changes its payment process and gives the finance manager additional system access because another employee resigns. The person now has both greater incentive and greater opportunity than in previous years. Nothing about the employee’s twelve-year history has changed, but the circumstances surrounding the role have. The same principle applies to management. A director who has always reported conservatively may suddenly face intense pressure from shareholders, lenders or investors to achieve a particular result. Fraud risk therefore cannot be assessed simply by asking whether the people involved have behaved honestly in the past. Auditors need to consider the current environment, responsibilities, pressures and controls.
Fraud Is Not Limited to Someone Stealing Cash
When business owners hear the word “fraud”, they often imagine an employee transferring S$100,000 into a personal bank account and disappearing. That is certainly one possible form of fraud, but financial statement audits are also concerned with fraudulent financial reporting. A company could deliberately recognise revenue too early, hide liabilities, manipulate accounting estimates, delay recording expenses or structure unusual transactions to make its financial position appear stronger. ACRA has specifically highlighted fraudulent financial reporting and management override as areas auditors need to consider, including inappropriate adjustments to assumptions, estimates and other amounts reported in financial statements. Therefore, a company can have no history of employees stealing money and still have fraud risks relevant to its financial statements.
Error and Fraud Can Produce the Same Wrong Number for Different Reasons
Suppose revenue is overstated by S$500,000. If an accountant accidentally records the same invoice twice, the problem may be an error. If management knowingly records revenue for goods that have not yet been delivered because it wants to achieve a profit target, the numerical effect could also be a S$500,000 overstatement, but the cause is fundamentally different. Intent matters. Fraud generally involves deliberate action, and deliberate actions can be more difficult to identify because someone may actively attempt to conceal what happened. ACRA has noted that the risk of an auditor failing to detect a fraud-related misstatement is higher than for an error because fraud can involve deliberate concealment and collusion. This is one reason fraud receives specific attention during an audit rather than simply being treated as another possible accounting mistake.
Strong Internal Controls Reduce Risk but Do Not Make Fraud Impossible
Management may respond that the company already has strong controls. Payments require two approvals, system access is restricted, bank reconciliations are prepared every month and transactions above certain amounts require management authorisation. These are valuable safeguards and can reduce risk considerably. However, no internal control system can guarantee that fraud will never occur. Employees may collude, authorised individuals may misuse their authority, controls may be performed mechanically, or senior management may have the ability to override procedures designed for other employees. The auditor therefore considers both the design of controls and how they operate in practice. A control that looks excellent in a procedure manual provides limited protection if employees routinely bypass it or approvers sign documents without reviewing them.
Management Override Is Why Seniority Does Not Remove Audit Risk
Many internal controls are designed around organisational hierarchy. A junior employee cannot approve a large payment, but the finance director can. An accountant cannot change certain assumptions without approval, but senior management can authorise the change. This authority is necessary for businesses to operate, yet it also means senior management may be capable of overriding controls that constrain other employees. ACRA’s guidance on SSA 240 specifically highlights management override of controls as a fraud risk auditors must address, including procedures around journal entries, accounting estimates and significant or unusual transactions. This does not mean auditors believe senior managers are dishonest. It means that an audit cannot conclude that fraud risk disappears simply because transactions were approved by someone senior.
Journal Entries Can Tell a Story That Ordinary Transactions Do Not
Most businesses process thousands of routine transactions through normal workflows. Customers are invoiced, suppliers submit bills, employees receive salaries and payments pass through established processes. Journal entries can sometimes operate differently because they allow accountants or management to make adjustments directly to the ledger. Many journal entries are entirely legitimate and necessary, particularly during month-end and year-end closing. However, unusual entries can also be used to alter reported results. This is why an auditor may analyse journal entries for characteristics such as unusual timing, unexpected account combinations, large round amounts, entries posted by senior personnel or adjustments made near the end of the reporting period. ACRA has reiterated that auditors need to design procedures addressing management override, including testing journal entries and other adjustments used in preparing financial statements.
The 31 December Journal Entry May Receive More Attention Than the 15 March Entry
Timing can change the risk profile of a transaction. Suppose a company normally earns S$500,000 to S$700,000 of revenue each month, but a manual journal posted late on 31 December increases annual revenue by another S$1 million. There may be a completely legitimate explanation, but the combination of size, timing and unusual method of recording naturally deserves attention. Auditors are trained to consider whether transactions or adjustments appear unusual in the context of the company and its normal operations. ACRA’s Audit Regulatory Report has highlighted the importance of understanding significant transactions outside the normal course of business and evaluating whether their commercial rationale indicates possible fraudulent financial reporting. The auditor’s question is therefore not simply whether a transaction exists, but why it happened, why it was recorded that way and whether the accounting treatment appropriately reflects its substance.
Revenue Often Deserves Particular Attention
Revenue is one of the most closely watched numbers in many businesses. Directors discuss it, investors track it, lenders may consider it, employees may have bonuses linked to it and sales teams frequently work towards annual targets. Those incentives can create pressure around when and how revenue is recorded. Imagine the company is S$300,000 short of its annual sales target on 29 December. Management may be tempted to record a transaction before all the conditions for recognition have been satisfied. Alternatively, employees may genuinely misunderstand when revenue should be recognised. The auditor therefore needs to understand the company’s revenue streams, contracts, cut-off procedures and any unusual year-end activity. Asking more questions about December sales does not mean the auditor has discovered fraud. It means the circumstances may justify closer examination.
A Profitable Company Can Still Have Pressure to Manipulate Results
Some directors assume fraud risk is relevant mainly to businesses experiencing financial difficulties. Financial pressure certainly can increase risk, but profitable businesses are not immune. A company earning S$5 million might have promised investors S$6 million. A rapidly growing business may fear disappointing the market if growth slows. A subsidiary may be expected to meet a target established by overseas headquarters. Management bonuses may depend on earnings or revenue. A business seeking financing may want to present stronger financial ratios. Pressure is therefore relative to expectations rather than simply whether the company made a profit or loss. A company can have healthy cash flow and still face incentives that influence financial reporting decisions.
Fraud Risk Can Increase When Business Conditions Change
A company may have operated with the same reliable controls for years before something changes. Rapid growth can overwhelm processes that worked when the company was smaller. Staff turnover can leave one employee performing responsibilities previously divided among three people. New software can create unfamiliar access permissions. Overseas expansion can introduce new suppliers, currencies and approval chains. Remote working can change how documents and approvals are handled. Economic pressure can make targets more difficult to achieve. ACRA has previously advised companies and audit committees to consider how changing processes, controls and economic conditions can affect fraud risk. Therefore, “we have always done it this way without a problem” may actually be a reason to check whether the old process still suits the current business.
Fraud Risk Can Exist Even When Nobody Has Been Caught
There is an important logical problem with saying a company has never had fraud. What management usually knows is that the company has never identified fraud. Those are not necessarily identical statements. Most businesses cannot prove with absolute certainty that every transaction made during the past decade was legitimate. Good controls, reconciliations and oversight can provide strong confidence, but deliberate misconduct is sometimes designed specifically to avoid detection. This does not mean management should assume hidden fraud exists everywhere. It simply explains why auditors cannot treat the absence of discovered cases as conclusive evidence that fraud risk is zero.
Collusion Can Defeat Controls That Look Strong on Paper
Consider a company where one employee prepares payments and another independently approves them. This is generally stronger than allowing one person to perform both activities. However, if those two employees deliberately cooperate, the control becomes less effective. The same issue can arise when an employee colludes with a supplier, customer or other external party. ACRA notes that fraud can be particularly difficult to detect because it may involve collusion as well as deliberate concealment. This is why auditors use professional scepticism and seek appropriate supporting evidence rather than relying entirely on explanations provided by one individual. The objective is not to assume everyone is dishonest but to recognise the limitations inherent in any control system.
Long-Serving Employees Can Be Trusted and Still Need Controls
A common SME situation is the employee who has handled finance for fifteen years and is considered almost part of the family. Management may trust this person completely and therefore allow them to create suppliers, prepare payments, access online banking, record transactions and reconcile the bank account. The employee may indeed be completely honest. The problem is that the process depends heavily on personal trust rather than organisational controls. Good governance protects both the company and the employee. Separating responsibilities, requiring independent review and maintaining audit trails reduce the possibility of wrongdoing while also protecting trusted employees from unfair suspicion if something later goes wrong. Controls should therefore not be interpreted as a statement about someone’s character.
The Auditor May Ask Employees Questions Separately
Management can sometimes be surprised when auditors ask different employees similar questions. The auditor might ask a director whether they know of any suspected fraud, then ask finance personnel, operational managers or those responsible for governance. Different people have different visibility into the organisation. A director may not know about an unusual supplier relationship noticed by accounts payable, while a junior employee may not know about concerns discussed at board level. Asking questions across the organisation helps the auditor develop a broader understanding of potential risks. It can also reveal differences between the formal process management believes is operating and the process employees actually follow every day.
Strange Transactions Are Not Automatically Fraudulent Transactions
Imagine the auditor notices that a company provided a large loan to a newly established entity shortly before year-end. The transaction may be entirely legitimate, but it differs from the company’s normal activities. The auditor will therefore want to understand who the counterparty is, why the loan was made, whether the terms are commercially reasonable, how it was approved and how it should be accounted for. ACRA’s Audit Regulatory Report specifically highlights significant transactions outside the normal course of business as an area requiring appropriate understanding and consideration of business rationale. Management should not interpret these questions as a conclusion that the transaction is fraudulent. Unusual simply means the transaction may require more evidence and explanation than an ordinary recurring purchase.
Accounting Estimates Can Create Another Area of Fraud Risk
Not every financial statement number comes directly from an invoice or bank statement. Companies make estimates involving matters such as expected credit losses, inventory obsolescence, asset impairment, provisions and valuations. These estimates can involve significant judgement. Suppose management believes only S$50,000 of receivables will be uncollectible, while a more cautious assessment might suggest S$300,000. That difference could materially affect profit. Auditors therefore examine whether estimates are reasonable and whether management’s judgements show possible bias. ACRA’s guidance on fraud considerations specifically refers to inappropriate changes to assumptions and judgements used in estimates as possible mechanisms for fraudulent financial reporting. Again, questioning an estimate does not mean management has manipulated it. The judgement involved simply creates an area where appropriate audit evidence becomes particularly important.
Management Should Be Interested in Fraud Risk Too
Fraud risk assessment should not exist solely because the external auditor asks about it once a year. Directors and management have much more continuous visibility into the business and are primarily responsible for establishing an environment that prevents and detects fraud. ACRA has explicitly stated that the primary responsibility for fraud prevention and detection rests with management and those charged with governance. Businesses should therefore periodically consider where money, information or authority could be misused. Which employees can change supplier bank details? Who can create and approve payments? Who can modify customer credit notes? Who reviews unusual journal entries? What happens when an employee’s access is no longer appropriate? These are useful management questions regardless of whether the company is currently undergoing an audit.
Fraud Prevention Should Focus on Opportunity as Well as Character
Businesses sometimes try to manage fraud risk by hiring people they trust. Character matters, but a strong control environment does not rely exclusively on predicting who might behave dishonestly. It reduces opportunities for inappropriate activity and increases the likelihood that unusual behaviour will be identified. Independent approvals, segregation of duties, restricted system access, regular reconciliations, supplier verification procedures and management review can all contribute. These controls also help prevent ordinary mistakes. A payment process requiring independent verification of changed supplier bank details, for example, can protect the business from both internal misconduct and fraudulent external instructions. Good controls therefore have value even in organisations where management has complete confidence in its employees.
An Audit Is Not a Guarantee That No Fraud Exists
Another important expectation to manage is what the financial statement audit actually provides. Auditors perform procedures to obtain reasonable assurance that the financial statements are free from material misstatement, whether caused by fraud or error. That is not the same as guaranteeing that every fraudulent transaction, regardless of size or nature, will be discovered. Fraud can involve sophisticated concealment, forged documentation or collusion, making detection more difficult than ordinary error. Businesses seeking auditing services Singapore should therefore understand that a statutory financial statement audit and a dedicated fraud investigation have different objectives. The fact that an audit did not identify fraud should not be interpreted as a certification that fraud is impossible or that every transaction has been individually examined.
A Financial Statement Audit Is Different From a Fraud Investigation
This distinction becomes particularly important when management already suspects misconduct. A standard financial statement audit is designed around the financial statements and material misstatement. An investigation has a different purpose and can involve tracing particular transactions, identifying individuals, reconstructing financial trails, reviewing control breaches and gathering evidence relating to suspected irregularities. Lee & Hew PAC describes its investigative audit and forensic accounting work as focusing on suspected financial irregularities, fraudulent activities and breaches of internal controls, including analysis of questionable transactions and financial trails. If a company has a specific allegation or discovers suspicious activity, management should not simply assume the normal annual audit will automatically function as a full forensic investigation.
Professional Scepticism Does Not Mean Professional Cynicism
The auditor’s role requires a questioning mind, but that does not mean approaching every employee as though they are lying. Professional scepticism means remaining alert to information that may contradict other evidence, considering whether explanations make commercial sense and obtaining appropriate support for important assertions. ACRA continues to regulate audit quality through requirements for public accountants to comply with Singapore Standards on Auditing and through its Practice Monitoring Programme. An auditor who accepts every explanation simply because management has been trustworthy for many years would not be applying the required level of professional judgement. Equally, an auditor should not assume wrongdoing without evidence. The objective is balanced, independent assessment.
Good Businesses Should Welcome Sensible Fraud Questions
A director may initially feel uncomfortable when an auditor asks, “How could management override this control?” Yet the question can be valuable even when the answer reveals no problem. It forces the company to think about weaknesses that daily familiarity may have made invisible. Perhaps one employee has accumulated too much system access over ten years. Perhaps supplier bank-account changes are verified only by email. Maybe senior journal entries are not independently reviewed. Perhaps nobody analyses unusual transactions because every department assumes finance is doing it. Identifying these gaps before someone exploits them is far better than discovering them after money has disappeared or financial statements have been misstated.
Lee & Hew PAC Brings Audit and Investigation Experience Together
Lee & Hew PAC provides financial statement audit, group audit, internal audit and other professional services to businesses in Singapore, with a stated mission of enhancing trust between stakeholders through its work. For businesses looking for auditing services Singapore, that combination is relevant because fraud risk can touch financial reporting, internal controls and governance at the same time. Lee & Hew also provides investigative and forensic accounting services where unusual or suspected activity requires examination beyond the scope of a normal financial statement audit. This allows the wider conversation to move from simply asking whether the accounts contain material misstatements to understanding what may have happened when a genuine irregularity is suspected.
Internal Audit Can Help Before Something Goes Wrong
Companies do not necessarily need to wait for suspected fraud before examining their controls more closely. Internal audit can review processes, responsibilities, access rights, reconciliations and control effectiveness from a risk perspective. Lee & Hew PAC’s internal audit capabilities include reviews relating to financial controls, reconciliations, access issues, operational incidents and control gaps. For growing businesses, this can be particularly useful because processes often evolve informally. A company may start with five employees, where the founder personally sees every payment, then grow to fifty employees while still relying on controls designed for the smaller organisation. Reviewing the control environment as the company grows can help management identify gaps before those gaps contribute to financial loss or reporting problems.
The Best Fraud Control Is Not Saying “It Could Never Happen Here”
A strong company culture can certainly reduce risk. Employees who feel accountable, management that behaves ethically and directors who take governance seriously all contribute to a healthier environment. However, confidence should not turn into complacency. Many controls exist precisely because businesses recognise that circumstances and people can change. A company locks its office door at night without accusing its employees of theft. It requires passwords without assuming everyone will misuse the system. Financial controls operate on the same principle. They protect the organisation by making inappropriate actions harder to perform and easier to identify. The most resilient businesses are not those convinced fraud is impossible. They are those confident enough to examine where it could happen and strengthen the process before it does.
Conclusion: A Clean History Is Good News, Not a Reason to Ignore Fraud Risk
If your company has operated for many years without identifying fraud, that is certainly preferable to the alternative. However, it does not remove the auditor’s responsibility to consider fraud risk during the current audit. Business conditions change, employees change, systems change, pressures change and opportunities can emerge where none existed before. Fraud can involve theft, but it can also involve deliberate financial reporting manipulation, management override, inappropriate estimates or unusual transactions designed to influence reported results. Singapore auditing requirements therefore expect auditors to maintain professional scepticism and consider the possibility of material misstatement due to fraud even when management has historically demonstrated honesty and integrity. The fraud questions are not an accusation. They are part of obtaining appropriate assurance over the financial statements.
Lee & Hew PAC Helps Businesses Build Confidence Through Independent Assurance
For companies seeking reliable auditing services Singapore, the value of an audit lies partly in having an independent professional examine financial information without relying solely on assumptions built from previous years. Lee & Hew PAC’s audit and accounting services are designed to support financial transparency, stakeholder confidence and compliance, while its internal audit and investigative capabilities can help organisations examine control weaknesses or suspected irregularities when deeper work is required. A company does not need to have experienced fraud before fraud risk becomes worth discussing. In fact, the best time to understand weaknesses is usually while the company still has a clean record and has the opportunity to strengthen its controls before a problem becomes a loss.