​​Catfishing Auditing

Comments Views

The internal audit world was recently rocked by revelations emerging from FI Industries and its nationally famous internal audit department. What was, six months ago, an uplifting story of a talented audit group bucking the odds to reach national prominence has turned into an incomprehensibly bizarre situation involving fabricated personalities providing unsubstantiated evidence, assessments of control that appear to be based on nothing but false leads and phony documentation, and an audit department that was either the victim of an incredible hoax or the perpetrators of just as great a hoax. Currently, it is impossible to tell who is telling the truth and where that truth might actually lie. 

FI Industries' internal audit department first reached prominence within the audit community with its no-holds barred approach to audit work, reaching its peak when the department was runner-up for the prestigious Heistman Trophy presented to the internal audit department whose performance exemplifies the best in pursuit of fraud risks while exhibiting outstanding integrity. This fame was gained because of the department's work around executive expense reports – work which eventually lead to the discovery of significant control breakdowns, fraudulent activity, and the termination of senior executives within the organization.

However, it all came crashing down just days ago when the website Auditspin broke the news that the entire story was fake – there was no informant, the charges against the executives were all false, and the internal audit department had fabricated the entire plot in an attempt to bolster their morale. 

On the heels of this announcement, FI Industries countered that it had just completed its own investigation with plans to hold a press conference in the coming week. FI was forced to come forward sooner than planned after Auditspin's revelations. 

FI Industries' investigation revealed a completely different set of circumstances surrounding the fabrications. There's was a story of an innocent audit department that, by conducting all its audit work virtually, fell prey to manufactured identities and lying scammers who were in it for the fame. FI Industries' version of the story shows an audit department that became too reliant on the available technological tools – email, social media, internet, teleconferencing, etc. – to the point where they based their conclusion on support that was dubious at best.

Following are the convoluted facts as they are currently known.

Two years ago, the FI Industries audit department began conducting a review of the accounts payable systems. Reports were issued showing the process ran well–controls were efficient and effective. However, shortly after the issuance of the report, an individual (later identifying herself as Elaine Kaponzi) used the audit department's hot line to report potential expense report fraud. She continued to call and supplied additional information through emails, phone conversations, and the audit department's social media accounts. While some people indicate internal audit met with Ms. Kaponzi during the investigation, the internal audit department has stated no such meetings ever occurred.

Two months later, the audit department announced there were significant breakdowns in the controls. They provided copies of procedures where basic controls had not been established, and transcriptions of conversations from undisclosed sources who stated existing controls were not appropriately followed. 

For the next few months, the audit department continued to provide information documenting its dogged pursuit of the issue. The incriminating evidence continued to mount. Then, six months ago, the resignation of FI Industries' CFO, along with a number of other highly-placed individuals, was announced. Of course, FI's legal department would not allow the release of documents, but the indications from all involved were that internal audit had large volumes of emails, transcriptions, photocopies, and faxes to support contentions of fraud and malfeasance.

One week ago it became obvious that none of the allegations were correct, the informants didn't exist, and the reams of documentation were all from secondary sources. It has become clearly evident that auditing did not meet with any individuals – informants or suspects – making assumptions about the identities of people they talked to on the phone; the department did not review any original documents, basing its conclusions on copies received electronically; and the department never verified that reports issued electronically were actually received, assuming no need to follow-up. This was all made worse as the audit staff was located in an off-site location, separating them from the rest of the company. 

And so there continue to be more questions than answers. Is this a situation where an out-of-touch audit department fell prey to a group of scammers who took advantage of the department's naiveté regarding electronic communication?

Or is it, as Auditspin would contend, an audit shop fabricating evidence to make itself seem more important and gain prestige within the organization and the profession. It should be noted that, shortly after the terminations, the audit shop was moved into corporate headquarters; the CAE was given the CFO's office; and audit began being invited to important officer, strategy, and planning meetings.

And the audit department is not the only group about which questions continue to arise. Are we to believe senior management at FI Industries when they say they did not follow-up on the termination of the CFO and others (terminations which did not occur) assuming they were gone because they were deleted from approved email lists? 

We will probably never know the truth – who knew what, who was lying to whom, where the line exists between truth and fiction. However, there is one thing we definitely know – every internal audit department needs to be more involved than just phone calls, emails, and copies of unverified documents.

​The opinions expressed by Internal Auditor's bloggers may differ from policies and official statements of The Institute of Internal Auditors and its committees and from opinions endorsed by the bloggers' employers or the editors of Internal Auditor. The magazine is pleased to provide you an opportunity to share your thoughts about these blog posts. Some comments may be reprinted elsewhere, online or offline.



Comment on this article

comments powered by Disqus
  • Your-Voices-Recruitment-January-2022-Blog-1
    • IT-General-Controls-Certificate-January-2022-Blog-3