The Chief Audit Executive just sent you an email requesting that you perform a fraud audit of the bank’s administration of the Payroll Protection Program. So, where do you start?
FYI, the goal of this blog is not to create a comprehensive fraud audit program, but rather to illustrate the questions that must be answered to create the fraud audit scope.
The first question, as with any government program, what is it? What are the program requirements? By now I suspect most Americans are familiar with the program. For my global readers I would encourage a quick visit to the SBA web site.
Paycheck Protection Program Loan Information
The Paycheck Protection Program is a loan designed to provide a direct incentive for small businesses to keep their workers on the payroll.
SBA will forgive loans if all employees are kept on the payroll for eight weeks and the money is used for payroll, rent, mortgage interest, or utilities.
You can apply through any existing SBA 7(a) lender or through any federally insured depository institution, federally insured credit union, and Farm Credit System institution that is participating. Other regulated lenders will be available to make these loans once they are approved and enrolled in the program. You should consult with your local lender as to whether it is participating in the program.
Source SBA Web Site
Planning Meeting for a Payroll Protection Program Fraud Audit
Question: What type of fraud are we looking for?
What is the scope of my assignment? The fraud universe provides the answer to the question. The primary fraud categories for consideration in this fraud audit are Asset misappropriation, Avoidance of government regulations and Conflict of interest.
First, you need to decide what type of fraud you are looking for. For purpose of this illustration this blog has selected Conflict of Interest with an element of asset misappropriation.
Question: Who might be involved?
Identify the permutations of the offender and the victim. There are four primary players: the banks / lender, real recipients, fraudulent recipients and the government (SBA).
The offender & victim analysis can include all permutations or selected permutations. For purpose of the blog, the offender is the Employer / Recipient & Bank and the victim is the Government SBA.
Question: What are the fraud action statements?
The next step is to determine the fraud action statements that correlate to your type of fraud. The following demonstrates the type of fraud action statements you could create:
Asset Misappropriation fraud action statement: The action results in the issuance of a loan with no intent to repay the loan associated with the following:
- Intentional misrepresentation of allowable costs to achieve loan forgiveness
- Use of dormant or false companies to obtain a loan with no intent to repay the loan
- Use of hidden companies to obtain multiple loans with no intent to repay the loan
- False reimbursement to bank / lender for PPP loans which were falsely reported as delinquent loans.
- Misuse of loan funds
Conflict of Interest fraud action statement: the duty of an individual or organization to make decisions for the benefit of a third party is adversely affected by personal interest. Conflicts can be either in fact or in appearance.
- Favoritism in awarding loans
- Appearance of favoritism in awarding loans
- Issuing a loan to a company in which the bank officers or the bank has an ownership interest
- Issuing a loan to bank customer that use the PPP loan to repay delinquent bank loans
- Obtaining a PPP loan from multiple banks
- Government Regulation fraud action statement, intentional disregard of government regulations for loan issuance, loan forgiveness and loan repayment
- Intentional misrepresentation of payroll costs to obtain a larger loan than allowed by the eligibility requirements
- Loans to an ineligible borrower
- Misuse of loan proceeds
- Use of hidden companies to obtain multiple loans
- Failure to perform due diligence requirements for loan issuance
- Failure to perform due diligence for loan forgiveness
Question: What is the impact statement?
The answer to the fraud action statement question will depend on how you define the impact statement. Is the impact loss of funds or adverse publicity? Are we focusing on abuse, violation of a regulation or the commission of a crime?
For illustration, we will select the fraud action statement of Conflict of Interest / Issuing loans to bank customers that use the PPP loan to repay delinquent bank loans. The impact is loss of company funds and violation of a regulation.
Now we are ready to write fraud risk statements
Once we have determined the scope of the audit plan, we can write the fraud risk statements that are the basis of developing our fraud audit program. A fraud risk statement has the following components. See blog on how to write a fraud risk statement.
Now that we have identified one fraud risk statement in our overall scope, let’s build our audit plan. The process starts with defining our population of loans, our sample plan, our audit procedure and our conclusion statements.
- Population is all PPP Loans with a recipient default.
- Sample population is all defaulted PPP loans by bank customers who had bank loans (non PPP Loan) during the PPP loan period.
-
Audit Test Procedure
- Determine if non PPP bank loans were repaid during the PPP loan period.
- Determine the date non PPP bank loan was issued and name of loan approver.
- Determine if non PPP bank loan was secured or unsecured.
- Determine bank customer payment history on non PPP bank loans.
- Determine non PPP bank loan repayment date and source of funds used to repay the non PPP bank loan.
- Determine repayment history of PPP bank loan.
- Determine bank account activity of loan recipient after PPP loan default.
- Determine if bank customer has filed bankruptcy and the date of the filing.
- Conclusion Statement
The key to the conclusion statement is the fact and circumstances, referred to as the basis of opinion, surrounding the bank loan and the PPP loan. The auditor must report the basis for their opinion(s).
There (is or is not) credible evidence that PPP loan funds were used by bank customers to retire bank loans and the bank customer subsequently defaulted on the PPP loan.
There (is or is not) credible evidence that the bank had knowledge that a bank customer(s) intended to use PPP loans to repay bank loans.
Now before you say, nice try, you may want to research PPP loan fraud. The justice departments has started the process of investigating PPP loan fraud. To-date, the cases involve inflated loans, misuse of the money and the use of a fake company to obtain loan proceeds. My guess, there will be more coming.
To my friends in the financial services industry that issued PPP loans, I encourage you to perform a comprehensive fraud risk assessment and or fraud audit of your company’s administration of PPP loans. We know that fraud has occurred and will be committed. Is your financial institution ready to answer the regulators tough questions?
