FYI, the goal of this blog is not to create a comprehensive fraud audit program, but rather to illustrate the questions that must be answered to create the fraud audit scope.
The first question, as with any government program, what is it? What are the program requirements? By now I suspect most Americans are familiar with the program. For my global readers I would encourage a quick visit to the SBA web site.
Paycheck Protection Program Loan Information
The Paycheck Protection Program is a loan designed to provide a direct incentive for small businesses to keep their workers on the payroll.
SBA will forgive loans if all employees are kept on the payroll for eight weeks and the money is used for payroll, rent, mortgage interest, or utilities.
You can apply through any existing SBA 7(a) lender or through any federally insured depository institution, federally insured credit union, and Farm Credit System institution that is participating. Other regulated lenders will be available to make these loans once they are approved and enrolled in the program. You should consult with your local lender as to whether it is participating in the program.
Source SBA Web Site
Planning Meeting for a Payroll Protection Program Fraud Audit
What is the scope of my assignment? The fraud universe provides the answer to the question. The primary fraud categories for consideration in this fraud audit are Asset misappropriation, Avoidance of government regulations and Conflict of interest.
First, you need to decide what type of fraud you are looking for. For purpose of this illustration this blog has selected Conflict of Interest with an element of asset misappropriation.
Identify the permutations of the offender and the victim. There are four primary players: the banks / lender, real recipients, fraudulent recipients and the government (SBA).
The next step is to determine the fraud action statements that correlate to your type of fraud. The following demonstrates the type of fraud action statements you could create:
Asset Misappropriation fraud action statement: The action results in the issuance of a loan with no intent to repay the loan associated with the following:
Conflict of Interest fraud action statement: the duty of an individual or organization to make decisions for the benefit of a third party is adversely affected by personal interest. Conflicts can be either in fact or in appearance.
The answer to the fraud action statement question will depend on how you define the impact statement. Is the impact loss of funds or adverse publicity? Are we focusing on abuse, violation of a regulation or the commission of a crime?
For illustration, we will select the fraud action statement of Conflict of Interest / Issuing loans to bank customers that use the PPP loan to repay delinquent bank loans. The impact is loss of company funds and violation of a regulation.
Once we have determined the scope of the audit plan, we can write the fraud risk statements that are the basis of developing our fraud audit program. A fraud risk statement has the following components. See blog on how to write a fraud risk statement.
Now that we have identified one fraud risk statement in our overall scope, let’s build our audit plan. The process starts with defining our population of loans, our sample plan, our audit procedure and our conclusion statements.
The key to the conclusion statement is the fact and circumstances, referred to as the basis of opinion, surrounding the bank loan and the PPP loan. The auditor must report the basis for their opinion(s).
Now before you say, nice try, you may want to research PPP loan fraud. The justice departments has started the process of investigating PPP loan fraud. To-date, the cases involve inflated loans, misuse of the money and the use of a fake company to obtain loan proceeds. My guess, there will be more coming.
To my friends in the financial services industry that issued PPP loans, I encourage you to perform a comprehensive fraud risk assessment and or fraud audit of your company’s administration of PPP loans. We know that fraud has occurred and will be committed. Is your financial institution ready to answer the regulators tough questions?