The Satyam scam, where around Rs5,040 crore of cash on the companys books simply didnt exist, has raised several questions about the role of the firms external auditor (PricewaterhouseCoopers). To understand how external audit firms go about auditing a companys books, Mint spoke to senior partners at two audit firms, who did not want to be named given the events at Satyam and the sensitivity of the subject. This article is based on these conversations.

Under Indian law, every firm needs to have a statutory auditor or an external auditor. These auditors are normally appointed for a year and if an audit firms services are terminated by a company without citing reasons, it has the right to represent itself at the annual general meeting of the firm.

Apart from an external auditor, large firms such as Satyam Computer Services Ltd are required to have an internal audit team, but this function can be outsourced as well. The internal auditors are the first check on the systems, processes and controls of a company, and they report to the chief executive officer and the audit committee of the board.

For a large firm such as Satyam, the statutory audit team would consist of at least 20 people working some six-eight months a year, led by a an audit manager at the clients offices. It is normal to have a team where some members are familiar with the business of the client.

Such a team first puts out an audit plan to figure out its deliverables. At the second stage, it makes a preliminary assessment of the systems and processes in the firm. This, in fact, is the core of any audit exercise. At a parallel level, an assessment is made of risk management and financial accounting systems.

Each member of the team is usually given a checklist of things to do, and most of the work is tallying and checking numbers.
However, some part of it has scope for discretion or personal judgement. An example could be the value of investment made by a company in an unlisted subsidiary.

As the financial year comes to a close, the focus shifts to the profit and loss account and the balance sheet. The auditors main job is to check whether processes are being followed and they are adequate and accurate. They normally check them once a year and if satisfied, they do not do it again and again.

If they have reservations about some thing, say, the truth of the financial numbers, auditors add a qualification in their reports which are carried in the firms annual report. But even before that, they write to the audit committee and board of directors, expressing their reservations. And they can point out anything they feel a company should do. For example, if 80% of a firms customers are in the financial services business in troubled times, the auditors can recommend that services be provided against advance payments. This will turn into a qualification that finds a place in the annual report only when the recovery of debtors becomes questionable.

The Satyam case raises several questions as its chairman has confessed to inflating cash and bank balances of at least Rs5,000 crore, and one of the key audit tests is to validate a firms cash and bank balances.

The cash balance of any firm is possibly the easiest thing for an audit firm to validate. It can be done physically.
In the case of cash balances with offices of the company in different parts of the country or the world, an auditor just needs to ask the company to produce the receipts in support of its claims.

In case of bank balances, the auditor needs to check what is reflected in bank statements. Typically, the auditors write to the banks asking for a confirmation of the funds parked with them and the banks send notes to the auditors in sealed envelopes. Often, in a rush to close books, auditors may ask the company to check with their banks on their (auditors) behalf. In such cases, the company gets an opportunity to forge bank certificates and pass them on to auditors.

Typically, auditors also try to reconcile the differences in the bank statements and the balance sheet of the company by checking receipt vouchers. For example, the bank statement may show Rs100 crore and the companys books Rs120 crore. This could happen if the company deposits cheques worth Rs20 crore on the last day of the financial year and these are not reflected in the bank statements. An auditor should follow this up by checking the next months bank statements.

It is relatively easy for a service company to inflate revenues as there are no physical goods or products that have to be accounted for. Service companies have ongoing relationships with clients who are continually billed for the services provided. For a large company, such transactions add up to a huge number and, typically, an auditor checks only around 1% of all transactions.

And for large firms, it is not easy to check each transaction, especially those occurring at the fag end of a financial year. As a rule of thumb, auditors check transactions in the interim period. They might write to the debtors (customers who have to pay the company for services rendered) asking them whether the entries tally. But such confirmation may not always be forthcoming as they might be in a different phase of the accounting cycle. Once the auditors satisfy themselves that the samples they checked are indeed true transactions and reflect in the books correctly, they assume that all transactions are okay.