Accounting & Auditing

By Suzanne M. Holl, CPA

Economic conditions long have had a significant impact on CPA professional liability claims. CPAs need to be prepared and vigilant now to minimize the potential for additional liability exposures during these challenging times.

Research among juries shows that the public, including clients, perceive the CPA’s fundamental job to be “advise and warn” – to advise clients of opportunities and to warn them about risks. Juries also believe the CPA’s advising and warning “antennae” should be hypersensitive during economic downturns. Some even believe that “anyone can do a CPA’s job when times are good; it’s during difficult times that the CPA really needs to bear down.” In other words, expectations are elevated when economic times are challenging.

When something goes wrong with a business during difficult economic times, behaviors begin to change. Sometimes they devolve to the point where clients perceive that the CPA has failed to advise and warn. Clients may rationalize: “What occurred isn’t necessarily my fault; is it possible someone else allowed this to happen? ... If it was someone else, maybe I can recover our loss. ... Yeah, I think it was their fault.”

Looking at events in hindsight offers some the opportunity to rewrite history to benefit the client: “Why didn’t my CPA warn me about what was going to happen? I was relying on my CPA’s expertise for financial help.” Also, history has proven that desperate times will cause some clients to take desperate measures, leading to deceit. Thus, in difficult times, professional skepticism must increase – not just to protect yourself and your client, but to protect other key stakeholders (e.g., the readers of the financial statements, lenders, etc.).

Do not carry the burden of your client’s problems and permit yourself to become a victim. Loyalty to a client doesn’t take precedence over maintaining your professional standards of integrity, independence, and objectivity. It is not worth jeopardizing your reputation or your own financial security in an attempt to mitigate client dilemmas.

Risk of Fraud

Financial strain increases pressure and rationalization for fraudulent behavior. Understanding the gravity of these pressures is crucial to effective fraud prevention and detection.

For example, let’s say many organizations in a particular sector are cutting expenses and laying off workers. This can compromise existing internal controls and lead to fewer fraud prevention measures. This is a bad sign. CAMICO’s claims experience has shown that when people perceive an opportunity to commit fraud and get away with it, some are more inclined to do so.

Fraud can have a devastating impact on CPAs too if firms don’t embrace due professional care in defining the scope of their services and properly responding when fraud is identified or suspected. The public believes CPAs have a nose for fraud, regardless of the limitations of the engagement. Because this high bar is extremely difficult to meet, advising and warning actions provided to clients of their fraud/defalcation exposures and responsibilities can help minimize liability stemming from the unrealistic expectation that CPAs will detect all fraud.

CPA firms can help mitigate the risks arising from clients during difficult economic times:

• Identify clients that may pose higher risk
• Increase the level of professional skepticism
• Prioritize defensive documentation, including the engagement letter and written memorialization of significant client meetings and conversations

Fraudulent Wire Transfers

CPAs are at high risk of social engineering hacking attempts due to the types of information firms gather and store, and there has been an uptick in the frequency of these attempts. Phishing, for example, is one of the more common social engineering scams.

One scam on the rise is the fraudulent email request for wire transfers. If the fraudster has access to the client’s and the firm’s email – commonly referred to as a “man in the middle” attack – and the fraudulent request mimics previous legitimate requests, it is very difficult for the firm to identify the request as illegitimate. When the fraud is discovered after the transfer, the funds are usually not recoverable, and they are frequently large dollar losses.

Use your professional skepticism to avoid being lulled into a false sense of security. Any requests for money to be transferred to a bank account unfamiliar to you should be a red flag, especially if the new account is in another country. If the firm’s protocol with clients is to permit email requests for wire transfers establish and follow procedures to confirm requests using a mechanism other than email. Only proceed with the transfer after confirming with the client (ideally by phone or in person) that the request is legitimate. This includes, but is not limited to, confirming the dollar amounts, the name of the financial institution, and the bank account number. To validate the authenticity of the request, confirm information only known to the client (ask questions to which hackers would not know the answers).

Here are a few loss-prevention tips to minimize fraudulent wire transfer exposure:

• Slow down – Whether working in the office or remotely, take the time to validate suspicious or unexpected email.
• Establish written protocols – The firm should establish written protocols with clients for handling client funds, especially as it relates to handling wire transfer requests. Consider establishing dollar thresholds above which verbal consent would be required if clients do not want to be “bothered” to approve each request. In addition, document who the authorized client representative(s) would be for providing such consent if/when the client is not available.
• Proceed with caution – With the increased number of claims related to fraudulent wire transfers, best practice in the absence of any written protocols to the contrary would be to verbally confirm all wire transfer requests with these clients to minimize risk.

Suzanne M. Holl, CPA, is senior vice president of loss prevention services with CAMICO. She can be reached at sholl@camico.com.

Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form. 

Ethics

By Suzanne M. Holl, CPA

Economic conditions long have had a significant impact on CPA professional liability claims. CPAs need to be prepared and vigilant now to minimize the potential for additional liability exposures during these challenging times.

Research among juries shows that the public, including clients, perceive the CPA’s fundamental job to be “advise and warn” – to advise clients of opportunities and to warn them about risks. Juries also believe the CPA’s advising and warning “antennae” should be hypersensitive during economic downturns. Some even believe that “anyone can do a CPA’s job when times are good; it’s during difficult times that the CPA really needs to bear down.” In other words, expectations are elevated when economic times are challenging.

When something goes wrong with a business during difficult economic times, behaviors begin to change. Sometimes they devolve to the point where clients perceive that the CPA has failed to advise and warn. Clients may rationalize: “What occurred isn’t necessarily my fault; is it possible someone else allowed this to happen? ... If it was someone else, maybe I can recover our loss. ... Yeah, I think it was their fault.”

Looking at events in hindsight offers some the opportunity to rewrite history to benefit the client: “Why didn’t my CPA warn me about what was going to happen? I was relying on my CPA’s expertise for financial help.” Also, history has proven that desperate times will cause some clients to take desperate measures, leading to deceit. Thus, in difficult times, professional skepticism must increase – not just to protect yourself and your client, but to protect other key stakeholders (e.g., the readers of the financial statements, lenders, etc.).

Do not carry the burden of your client’s problems and permit yourself to become a victim. Loyalty to a client doesn’t take precedence over maintaining your professional standards of integrity, independence, and objectivity. It is not worth jeopardizing your reputation or your own financial security in an attempt to mitigate client dilemmas.

Risk of Fraud

Financial strain increases pressure and rationalization for fraudulent behavior. Understanding the gravity of these pressures is crucial to effective fraud prevention and detection.

For example, let’s say many organizations in a particular sector are cutting expenses and laying off workers. This can compromise existing internal controls and lead to fewer fraud prevention measures. This is a bad sign. CAMICO’s claims experience has shown that when people perceive an opportunity to commit fraud and get away with it, some are more inclined to do so.

Fraud can have a devastating impact on CPAs too if firms don’t embrace due professional care in defining the scope of their services and properly responding when fraud is identified or suspected. The public believes CPAs have a nose for fraud, regardless of the limitations of the engagement. Because this high bar is extremely difficult to meet, advising and warning actions provided to clients of their fraud/defalcation exposures and responsibilities can help minimize liability stemming from the unrealistic expectation that CPAs will detect all fraud.

CPA firms can help mitigate the risks arising from clients during difficult economic times:

• Identify clients that may pose higher risk
• Increase the level of professional skepticism
• Prioritize defensive documentation, including the engagement letter and written memorialization of significant client meetings and conversations

Fraudulent Wire Transfers

CPAs are at high risk of social engineering hacking attempts due to the types of information firms gather and store, and there has been an uptick in the frequency of these attempts. Phishing, for example, is one of the more common social engineering scams.

One scam on the rise is the fraudulent email request for wire transfers. If the fraudster has access to the client’s and the firm’s email – commonly referred to as a “man in the middle” attack – and the fraudulent request mimics previous legitimate requests, it is very difficult for the firm to identify the request as illegitimate. When the fraud is discovered after the transfer, the funds are usually not recoverable, and they are frequently large dollar losses.

Use your professional skepticism to avoid being lulled into a false sense of security. Any requests for money to be transferred to a bank account unfamiliar to you should be a red flag, especially if the new account is in another country. If the firm’s protocol with clients is to permit email requests for wire transfers establish and follow procedures to confirm requests using a mechanism other than email. Only proceed with the transfer after confirming with the client (ideally by phone or in person) that the request is legitimate. This includes, but is not limited to, confirming the dollar amounts, the name of the financial institution, and the bank account number. To validate the authenticity of the request, confirm information only known to the client (ask questions to which hackers would not know the answers).

Here are a few loss-prevention tips to minimize fraudulent wire transfer exposure:

• Slow down – Whether working in the office or remotely, take the time to validate suspicious or unexpected email.
• Establish written protocols – The firm should establish written protocols with clients for handling client funds, especially as it relates to handling wire transfer requests. Consider establishing dollar thresholds above which verbal consent would be required if clients do not want to be “bothered” to approve each request. In addition, document who the authorized client representative(s) would be for providing such consent if/when the client is not available.
• Proceed with caution – With the increased number of claims related to fraudulent wire transfers, best practice in the absence of any written protocols to the contrary would be to verbally confirm all wire transfer requests with these clients to minimize risk.

Suzanne M. Holl, CPA, is senior vice president of loss prevention services with CAMICO. She can be reached at sholl@camico.com.

Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form. 

Leadership

By Suzanne M. Holl, CPA

Economic conditions long have had a significant impact on CPA professional liability claims. CPAs need to be prepared and vigilant now to minimize the potential for additional liability exposures during these challenging times.

Research among juries shows that the public, including clients, perceive the CPA’s fundamental job to be “advise and warn” – to advise clients of opportunities and to warn them about risks. Juries also believe the CPA’s advising and warning “antennae” should be hypersensitive during economic downturns. Some even believe that “anyone can do a CPA’s job when times are good; it’s during difficult times that the CPA really needs to bear down.” In other words, expectations are elevated when economic times are challenging.

When something goes wrong with a business during difficult economic times, behaviors begin to change. Sometimes they devolve to the point where clients perceive that the CPA has failed to advise and warn. Clients may rationalize: “What occurred isn’t necessarily my fault; is it possible someone else allowed this to happen? ... If it was someone else, maybe I can recover our loss. ... Yeah, I think it was their fault.”

Looking at events in hindsight offers some the opportunity to rewrite history to benefit the client: “Why didn’t my CPA warn me about what was going to happen? I was relying on my CPA’s expertise for financial help.” Also, history has proven that desperate times will cause some clients to take desperate measures, leading to deceit. Thus, in difficult times, professional skepticism must increase – not just to protect yourself and your client, but to protect other key stakeholders (e.g., the readers of the financial statements, lenders, etc.).

Do not carry the burden of your client’s problems and permit yourself to become a victim. Loyalty to a client doesn’t take precedence over maintaining your professional standards of integrity, independence, and objectivity. It is not worth jeopardizing your reputation or your own financial security in an attempt to mitigate client dilemmas.

Risk of Fraud

Financial strain increases pressure and rationalization for fraudulent behavior. Understanding the gravity of these pressures is crucial to effective fraud prevention and detection.

For example, let’s say many organizations in a particular sector are cutting expenses and laying off workers. This can compromise existing internal controls and lead to fewer fraud prevention measures. This is a bad sign. CAMICO’s claims experience has shown that when people perceive an opportunity to commit fraud and get away with it, some are more inclined to do so.

Fraud can have a devastating impact on CPAs too if firms don’t embrace due professional care in defining the scope of their services and properly responding when fraud is identified or suspected. The public believes CPAs have a nose for fraud, regardless of the limitations of the engagement. Because this high bar is extremely difficult to meet, advising and warning actions provided to clients of their fraud/defalcation exposures and responsibilities can help minimize liability stemming from the unrealistic expectation that CPAs will detect all fraud.

CPA firms can help mitigate the risks arising from clients during difficult economic times:

• Identify clients that may pose higher risk
• Increase the level of professional skepticism
• Prioritize defensive documentation, including the engagement letter and written memorialization of significant client meetings and conversations

Fraudulent Wire Transfers

CPAs are at high risk of social engineering hacking attempts due to the types of information firms gather and store, and there has been an uptick in the frequency of these attempts. Phishing, for example, is one of the more common social engineering scams.

One scam on the rise is the fraudulent email request for wire transfers. If the fraudster has access to the client’s and the firm’s email – commonly referred to as a “man in the middle” attack – and the fraudulent request mimics previous legitimate requests, it is very difficult for the firm to identify the request as illegitimate. When the fraud is discovered after the transfer, the funds are usually not recoverable, and they are frequently large dollar losses.

Use your professional skepticism to avoid being lulled into a false sense of security. Any requests for money to be transferred to a bank account unfamiliar to you should be a red flag, especially if the new account is in another country. If the firm’s protocol with clients is to permit email requests for wire transfers establish and follow procedures to confirm requests using a mechanism other than email. Only proceed with the transfer after confirming with the client (ideally by phone or in person) that the request is legitimate. This includes, but is not limited to, confirming the dollar amounts, the name of the financial institution, and the bank account number. To validate the authenticity of the request, confirm information only known to the client (ask questions to which hackers would not know the answers).

Here are a few loss-prevention tips to minimize fraudulent wire transfer exposure:

• Slow down – Whether working in the office or remotely, take the time to validate suspicious or unexpected email.
• Establish written protocols – The firm should establish written protocols with clients for handling client funds, especially as it relates to handling wire transfer requests. Consider establishing dollar thresholds above which verbal consent would be required if clients do not want to be “bothered” to approve each request. In addition, document who the authorized client representative(s) would be for providing such consent if/when the client is not available.
• Proceed with caution – With the increased number of claims related to fraudulent wire transfers, best practice in the absence of any written protocols to the contrary would be to verbally confirm all wire transfer requests with these clients to minimize risk.

Suzanne M. Holl, CPA, is senior vice president of loss prevention services with CAMICO. She can be reached at sholl@camico.com.

Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form. 

Practice Management

By Suzanne M. Holl, CPA

Economic conditions long have had a significant impact on CPA professional liability claims. CPAs need to be prepared and vigilant now to minimize the potential for additional liability exposures during these challenging times.

Research among juries shows that the public, including clients, perceive the CPA’s fundamental job to be “advise and warn” – to advise clients of opportunities and to warn them about risks. Juries also believe the CPA’s advising and warning “antennae” should be hypersensitive during economic downturns. Some even believe that “anyone can do a CPA’s job when times are good; it’s during difficult times that the CPA really needs to bear down.” In other words, expectations are elevated when economic times are challenging.

When something goes wrong with a business during difficult economic times, behaviors begin to change. Sometimes they devolve to the point where clients perceive that the CPA has failed to advise and warn. Clients may rationalize: “What occurred isn’t necessarily my fault; is it possible someone else allowed this to happen? ... If it was someone else, maybe I can recover our loss. ... Yeah, I think it was their fault.”

Looking at events in hindsight offers some the opportunity to rewrite history to benefit the client: “Why didn’t my CPA warn me about what was going to happen? I was relying on my CPA’s expertise for financial help.” Also, history has proven that desperate times will cause some clients to take desperate measures, leading to deceit. Thus, in difficult times, professional skepticism must increase – not just to protect yourself and your client, but to protect other key stakeholders (e.g., the readers of the financial statements, lenders, etc.).

Do not carry the burden of your client’s problems and permit yourself to become a victim. Loyalty to a client doesn’t take precedence over maintaining your professional standards of integrity, independence, and objectivity. It is not worth jeopardizing your reputation or your own financial security in an attempt to mitigate client dilemmas.

Risk of Fraud

Financial strain increases pressure and rationalization for fraudulent behavior. Understanding the gravity of these pressures is crucial to effective fraud prevention and detection.

For example, let’s say many organizations in a particular sector are cutting expenses and laying off workers. This can compromise existing internal controls and lead to fewer fraud prevention measures. This is a bad sign. CAMICO’s claims experience has shown that when people perceive an opportunity to commit fraud and get away with it, some are more inclined to do so.

Fraud can have a devastating impact on CPAs too if firms don’t embrace due professional care in defining the scope of their services and properly responding when fraud is identified or suspected. The public believes CPAs have a nose for fraud, regardless of the limitations of the engagement. Because this high bar is extremely difficult to meet, advising and warning actions provided to clients of their fraud/defalcation exposures and responsibilities can help minimize liability stemming from the unrealistic expectation that CPAs will detect all fraud.

CPA firms can help mitigate the risks arising from clients during difficult economic times:

• Identify clients that may pose higher risk
• Increase the level of professional skepticism
• Prioritize defensive documentation, including the engagement letter and written memorialization of significant client meetings and conversations

Fraudulent Wire Transfers

CPAs are at high risk of social engineering hacking attempts due to the types of information firms gather and store, and there has been an uptick in the frequency of these attempts. Phishing, for example, is one of the more common social engineering scams.

One scam on the rise is the fraudulent email request for wire transfers. If the fraudster has access to the client’s and the firm’s email – commonly referred to as a “man in the middle” attack – and the fraudulent request mimics previous legitimate requests, it is very difficult for the firm to identify the request as illegitimate. When the fraud is discovered after the transfer, the funds are usually not recoverable, and they are frequently large dollar losses.

Use your professional skepticism to avoid being lulled into a false sense of security. Any requests for money to be transferred to a bank account unfamiliar to you should be a red flag, especially if the new account is in another country. If the firm’s protocol with clients is to permit email requests for wire transfers establish and follow procedures to confirm requests using a mechanism other than email. Only proceed with the transfer after confirming with the client (ideally by phone or in person) that the request is legitimate. This includes, but is not limited to, confirming the dollar amounts, the name of the financial institution, and the bank account number. To validate the authenticity of the request, confirm information only known to the client (ask questions to which hackers would not know the answers).

Here are a few loss-prevention tips to minimize fraudulent wire transfer exposure:

• Slow down – Whether working in the office or remotely, take the time to validate suspicious or unexpected email.
• Establish written protocols – The firm should establish written protocols with clients for handling client funds, especially as it relates to handling wire transfer requests. Consider establishing dollar thresholds above which verbal consent would be required if clients do not want to be “bothered” to approve each request. In addition, document who the authorized client representative(s) would be for providing such consent if/when the client is not available.
• Proceed with caution – With the increased number of claims related to fraudulent wire transfers, best practice in the absence of any written protocols to the contrary would be to verbally confirm all wire transfer requests with these clients to minimize risk.

Suzanne M. Holl, CPA, is senior vice president of loss prevention services with CAMICO. She can be reached at sholl@camico.com.

Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form. 

Technology

By Suzanne M. Holl, CPA

Economic conditions long have had a significant impact on CPA professional liability claims. CPAs need to be prepared and vigilant now to minimize the potential for additional liability exposures during these challenging times.

Research among juries shows that the public, including clients, perceive the CPA’s fundamental job to be “advise and warn” – to advise clients of opportunities and to warn them about risks. Juries also believe the CPA’s advising and warning “antennae” should be hypersensitive during economic downturns. Some even believe that “anyone can do a CPA’s job when times are good; it’s during difficult times that the CPA really needs to bear down.” In other words, expectations are elevated when economic times are challenging.

When something goes wrong with a business during difficult economic times, behaviors begin to change. Sometimes they devolve to the point where clients perceive that the CPA has failed to advise and warn. Clients may rationalize: “What occurred isn’t necessarily my fault; is it possible someone else allowed this to happen? ... If it was someone else, maybe I can recover our loss. ... Yeah, I think it was their fault.”

Looking at events in hindsight offers some the opportunity to rewrite history to benefit the client: “Why didn’t my CPA warn me about what was going to happen? I was relying on my CPA’s expertise for financial help.” Also, history has proven that desperate times will cause some clients to take desperate measures, leading to deceit. Thus, in difficult times, professional skepticism must increase – not just to protect yourself and your client, but to protect other key stakeholders (e.g., the readers of the financial statements, lenders, etc.).

Do not carry the burden of your client’s problems and permit yourself to become a victim. Loyalty to a client doesn’t take precedence over maintaining your professional standards of integrity, independence, and objectivity. It is not worth jeopardizing your reputation or your own financial security in an attempt to mitigate client dilemmas.

Risk of Fraud

Financial strain increases pressure and rationalization for fraudulent behavior. Understanding the gravity of these pressures is crucial to effective fraud prevention and detection.

For example, let’s say many organizations in a particular sector are cutting expenses and laying off workers. This can compromise existing internal controls and lead to fewer fraud prevention measures. This is a bad sign. CAMICO’s claims experience has shown that when people perceive an opportunity to commit fraud and get away with it, some are more inclined to do so.

Fraud can have a devastating impact on CPAs too if firms don’t embrace due professional care in defining the scope of their services and properly responding when fraud is identified or suspected. The public believes CPAs have a nose for fraud, regardless of the limitations of the engagement. Because this high bar is extremely difficult to meet, advising and warning actions provided to clients of their fraud/defalcation exposures and responsibilities can help minimize liability stemming from the unrealistic expectation that CPAs will detect all fraud.

CPA firms can help mitigate the risks arising from clients during difficult economic times:

• Identify clients that may pose higher risk
• Increase the level of professional skepticism
• Prioritize defensive documentation, including the engagement letter and written memorialization of significant client meetings and conversations

Fraudulent Wire Transfers

CPAs are at high risk of social engineering hacking attempts due to the types of information firms gather and store, and there has been an uptick in the frequency of these attempts. Phishing, for example, is one of the more common social engineering scams.

One scam on the rise is the fraudulent email request for wire transfers. If the fraudster has access to the client’s and the firm’s email – commonly referred to as a “man in the middle” attack – and the fraudulent request mimics previous legitimate requests, it is very difficult for the firm to identify the request as illegitimate. When the fraud is discovered after the transfer, the funds are usually not recoverable, and they are frequently large dollar losses.

Use your professional skepticism to avoid being lulled into a false sense of security. Any requests for money to be transferred to a bank account unfamiliar to you should be a red flag, especially if the new account is in another country. If the firm’s protocol with clients is to permit email requests for wire transfers establish and follow procedures to confirm requests using a mechanism other than email. Only proceed with the transfer after confirming with the client (ideally by phone or in person) that the request is legitimate. This includes, but is not limited to, confirming the dollar amounts, the name of the financial institution, and the bank account number. To validate the authenticity of the request, confirm information only known to the client (ask questions to which hackers would not know the answers).

Here are a few loss-prevention tips to minimize fraudulent wire transfer exposure:

• Slow down – Whether working in the office or remotely, take the time to validate suspicious or unexpected email.
• Establish written protocols – The firm should establish written protocols with clients for handling client funds, especially as it relates to handling wire transfer requests. Consider establishing dollar thresholds above which verbal consent would be required if clients do not want to be “bothered” to approve each request. In addition, document who the authorized client representative(s) would be for providing such consent if/when the client is not available.
• Proceed with caution – With the increased number of claims related to fraudulent wire transfers, best practice in the absence of any written protocols to the contrary would be to verbally confirm all wire transfer requests with these clients to minimize risk.

Suzanne M. Holl, CPA, is senior vice president of loss prevention services with CAMICO. She can be reached at sholl@camico.com.

Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form. 

Tax

By Suzanne M. Holl, CPA

Economic conditions long have had a significant impact on CPA professional liability claims. CPAs need to be prepared and vigilant now to minimize the potential for additional liability exposures during these challenging times.

Research among juries shows that the public, including clients, perceive the CPA’s fundamental job to be “advise and warn” – to advise clients of opportunities and to warn them about risks. Juries also believe the CPA’s advising and warning “antennae” should be hypersensitive during economic downturns. Some even believe that “anyone can do a CPA’s job when times are good; it’s during difficult times that the CPA really needs to bear down.” In other words, expectations are elevated when economic times are challenging.

When something goes wrong with a business during difficult economic times, behaviors begin to change. Sometimes they devolve to the point where clients perceive that the CPA has failed to advise and warn. Clients may rationalize: “What occurred isn’t necessarily my fault; is it possible someone else allowed this to happen? ... If it was someone else, maybe I can recover our loss. ... Yeah, I think it was their fault.”

Looking at events in hindsight offers some the opportunity to rewrite history to benefit the client: “Why didn’t my CPA warn me about what was going to happen? I was relying on my CPA’s expertise for financial help.” Also, history has proven that desperate times will cause some clients to take desperate measures, leading to deceit. Thus, in difficult times, professional skepticism must increase – not just to protect yourself and your client, but to protect other key stakeholders (e.g., the readers of the financial statements, lenders, etc.).

Do not carry the burden of your client’s problems and permit yourself to become a victim. Loyalty to a client doesn’t take precedence over maintaining your professional standards of integrity, independence, and objectivity. It is not worth jeopardizing your reputation or your own financial security in an attempt to mitigate client dilemmas.

Risk of Fraud

Financial strain increases pressure and rationalization for fraudulent behavior. Understanding the gravity of these pressures is crucial to effective fraud prevention and detection.

For example, let’s say many organizations in a particular sector are cutting expenses and laying off workers. This can compromise existing internal controls and lead to fewer fraud prevention measures. This is a bad sign. CAMICO’s claims experience has shown that when people perceive an opportunity to commit fraud and get away with it, some are more inclined to do so.

Fraud can have a devastating impact on CPAs too if firms don’t embrace due professional care in defining the scope of their services and properly responding when fraud is identified or suspected. The public believes CPAs have a nose for fraud, regardless of the limitations of the engagement. Because this high bar is extremely difficult to meet, advising and warning actions provided to clients of their fraud/defalcation exposures and responsibilities can help minimize liability stemming from the unrealistic expectation that CPAs will detect all fraud.

CPA firms can help mitigate the risks arising from clients during difficult economic times:

• Identify clients that may pose higher risk
• Increase the level of professional skepticism
• Prioritize defensive documentation, including the engagement letter and written memorialization of significant client meetings and conversations

Fraudulent Wire Transfers

CPAs are at high risk of social engineering hacking attempts due to the types of information firms gather and store, and there has been an uptick in the frequency of these attempts. Phishing, for example, is one of the more common social engineering scams.

One scam on the rise is the fraudulent email request for wire transfers. If the fraudster has access to the client’s and the firm’s email – commonly referred to as a “man in the middle” attack – and the fraudulent request mimics previous legitimate requests, it is very difficult for the firm to identify the request as illegitimate. When the fraud is discovered after the transfer, the funds are usually not recoverable, and they are frequently large dollar losses.

Use your professional skepticism to avoid being lulled into a false sense of security. Any requests for money to be transferred to a bank account unfamiliar to you should be a red flag, especially if the new account is in another country. If the firm’s protocol with clients is to permit email requests for wire transfers establish and follow procedures to confirm requests using a mechanism other than email. Only proceed with the transfer after confirming with the client (ideally by phone or in person) that the request is legitimate. This includes, but is not limited to, confirming the dollar amounts, the name of the financial institution, and the bank account number. To validate the authenticity of the request, confirm information only known to the client (ask questions to which hackers would not know the answers).

Here are a few loss-prevention tips to minimize fraudulent wire transfer exposure:

• Slow down – Whether working in the office or remotely, take the time to validate suspicious or unexpected email.
• Establish written protocols – The firm should establish written protocols with clients for handling client funds, especially as it relates to handling wire transfer requests. Consider establishing dollar thresholds above which verbal consent would be required if clients do not want to be “bothered” to approve each request. In addition, document who the authorized client representative(s) would be for providing such consent if/when the client is not available.
• Proceed with caution – With the increased number of claims related to fraudulent wire transfers, best practice in the absence of any written protocols to the contrary would be to verbally confirm all wire transfer requests with these clients to minimize risk.

Suzanne M. Holl, CPA, is senior vice president of loss prevention services with CAMICO. She can be reached at sholl@camico.com.

Sign up for weekly professional and technical updates from PICPA's blogs, podcasts, and discussion board topics by completing this form.