I85PREP
⌘ K
ICAP CFAP study materials
ICAP CFAP study resources

Whistleblowing and Board Response to a Fraud Allegation

ICAP CFAP · Put your knowledge to work in context.

All case studies

Whistleblowing and Board Response to a Fraud Allegation

An anonymous letter is sent to the chair of the audit committee of Delta Holdings, a listed company. It alleges that the regional sales director has been inflating revenue by recognising sales to a related party, 'Nova Trading', which is owned by his brother-in-law. The letter claims Rs 60 million of revenue in the current year is affected, and that the CFO 'knows about it'. The audit committee chair calls you, the finance director, for advice. The external auditor has just begun the year-end audit. The regional director is a high performer and is due a bonus of Rs 5 million based on regional revenue.

1. What immediate steps should the audit committee take, and who should lead the investigation?

Read the worked answer

Immediate steps:

  1. Preserve evidence – do not confront the regional director; secure emails, contracts, invoices and the Nova Trading relationship records. Suspend deletion rights.
  2. Constitute an investigation – the audit committee should appoint an independent investigator (external forensic firm or independent non-executive director), not management, because the CFO is implicated.
  3. Exclude implicated parties – the CFO and regional director should be recused from the investigation and from access to relevant records.
  4. Notify the external auditor – the auditor has a duty to consider fraud under ISA 240; withholding this would itself be a problem.
  5. Consider regulatory notification – depending on jurisdiction, a listed company may need to notify the regulator and/or make a market announcement if the amount is material.
  6. Protect the whistleblower – ensure anonymity and no retaliation; check the company's whistleblowing policy is being followed.

Who leads: The audit committee chair, supported by an independent forensic investigator. The finance director should provide information but not lead, given the CFO allegation.

2. How should the alleged related-party transaction be assessed and accounted for if confirmed?

Read the worked answer

Assessment:

  1. Is Nova Trading a related party? The brother-in-law relationship may make it a related party under IAS 24 depending on the definition (close family member of key management personnel). The regional director is likely KMP.
  2. Was the revenue genuine? Check whether goods/services were delivered, whether the price was arm's length, and whether Nova has the ability to pay. If sales were circular or to an entity with no substance, revenue should be reversed.
  3. Accounting if confirmed:
    • Reverse the Rs 60m revenue and associated COGS/receivable.
    • Disclose the related-party transaction and the fraud in the notes.
    • Restate prior periods if the practice is ongoing.
    • Recover the Rs 5m bonus if it was based on inflated revenue.
  4. Controls failure – assess why the related-party relationship was not captured in the related-party register and why the sales approval process failed.

Materiality: Rs 60m may be material to revenue and profit; assess against the audit materiality threshold.

3. What are the external auditor's responsibilities and the potential consequences for the audit opinion?

Read the worked answer

Auditor responsibilities (ISA 240 / ISA 550):

  1. Fraud – the auditor must consider the risk of fraud, make enquiries of management and the audit committee, and perform procedures to address the risk of management override.
  2. Related parties – identify and assess related-party relationships; the auditor should have enquired about family relationships of KMP.
  3. Communicate – fraud involving management must be reported to the audit committee; if the auditor suspects the CFO, escalate to the chair.
  4. Document – record the fraud risk assessment and the response.

Impact on the opinion:

  • If management refuses to adjust and the misstatement is material → qualified opinion.
  • If pervasive (e.g., it undermines the reliability of revenue generally) → adverse opinion.
  • If the auditor cannot obtain sufficient evidence → disclaimer.
  • If the fraud indicates going concern issues → include an emphasis of matter / material uncertainty paragraph.

Additional consequences:

  • The auditor may need to report to the regulator (e.g., under UK/ISA (UK) 250 or equivalent).
  • Consider whether the audit firm itself missed red flags - quality review and potential professional negligence exposure.