I trained in audit in the late 1960s, when internal control questionnaires were new and plastic flowchart templates represented the cutting edge of technology. I know that it's all different now but, even so, I am somewhat bemused by reports that Wirecard's auditors didn't get independent confirmation of bank balances.
Checking the existence of balance sheet items used to be a very basic audit task. We pursued written confirmation from banks and debtors. We supervised stocktaking - sometimes we even had to count things ourselves (carcasses at Smithfield Market, ugh!). We even went to look at items of plant and machinery to confirm that they existed.
I was also taught to be sceptical. I learned to quickly scan the papers on a desk, to read upside down and to sense if someone might, for whatever reason, be trying to divert my attention. (Sometimes the men were just having a little game to test out the only female member of the audit team...)
We tried to pass on this critical scepticism in our module on Audit Practice which involved role play. Students conducting the audit of a fictitious client were provided with accounting information and duly met up with relevant employees, played by lecturers. The students collected information from them all but few really questioned what they were told until they encountered me, the crooked CEO, who contradicted what they had been told, refused to answer questions, and ended up by shouting at them and sending them away. Great fun! I wish that we had followed up those who went on to accountancy training to find out if it had been a useful experience.
But the fundamental audit problem of independent authentication of information is rarely addressed. The continuing discussion about the independent status of auditors tends to obscure this. Some years ago Peter Wolnizer wrote a very interesting book about this entitled "Auditing as Independent Authentication". He argued that accounts "must be descriptions of empirical phenomena, the veracity of which must be ascertained by recourse to evidence which is beyond the control and influence of those who prepare them." (p5) Follow this link to read the first few pages of the book, which gives a sense of his argument.
It's a book that should be required reading for every auditor and regulator.
