RISKY BUSINESS - SAS 99 - A NONPROFIT CASE STUDY

A Nonprofit Closes after being labeled High Risk: SAS 99 - A Nonprofit Case Study
by pam ashlund

“The worst lies are the lies we tell ourselves” Richard Bach

Looking for how auditors assess risk?

On July 31, 2006, The Washington Times reported that the Arlington Community Action Program (ACAP) was shutting its doors. Community Action Agencies have been providing poverty prevention programs since 1964 and Arlington was no exception, having just celebrated it's 40th anniversary and being awarded a commendation from Congress.

What do we feel when one of our fellow nonprofits goes down? Worried that the situation will cast its dark shadow upon us? Sad that maybe it was unfair; or that they did good work; or that they didn’t know any better?

In the end the best we can do is a careful post-mortem and then…learn from their mistakes…and hope that history won’t repeat itself.

What happened at ACAP?

First ask yourself “what makes you feel safe”?

How about “We’ve been in business for over forty years and have earned the publics trust”? That didn’t work out for ACAP. Founded in 1964, in 2005 this reputable agency found itself labeled a “high risk” by its independent auditors. One year later they were out of business.

How about “We are good people”? That was certainly what the folks at ACAP felt. In fact, the audit found no evidence of fraud. So what went wrong? If you aren’t managing right, it doesn’t matter if you weren’t doing something overtly wrong.

How about “We have great Financial Policies and Procedures”? Take a look at the procedures, they are good, sound practices. But what we say we do is not always what we actually do. At ACAP, the inspector general found "a failure to implement sound fiscal policies and procedures”.

How about “If we show a profit (or don’t run a deficit) we are healthy financially”? In 2004, ACAP showed a $121,000 profit.

What does the High Risk Designation Mean?

ACAP was designated as a high-risk organization for failure to maintain proper Internal Controls to safeguard Head Start assets. A high-risk organization is one whose management practices raise serious questions about its ability to assure proper programmatic use and financial stewardship of grant funds.

What Areas do Auditors Look At to Assess Risk?

SAS 99 tells auditors what areas to look at to assess risk. Those areas are:

Incentives/Pressures - Is something turning up the heat that might make you want to "stretch the truth"? Your auditors are trained to look at these situations as a fraud risk

Opportunities - If someone had no scruples, would it be easy for them to take you to the cleaners?

Attitudes/Rationalizations - Have you (or your staff) become too jaded? Do you make comments like "well the government regs are made to be broken"? and the like. Do you justify rule bending as a "necessary evil"?

Risk Factors Relating to Misstatements Arising from Misappropriation of Assets - When's the last time you checked that inventory? Do you know what's on your balance sheet? Do you even know what a balance sheet IS?

Want to get proactive? See the AICPA's Fraud Detection Toolkit.

Technorati Tags: Community Action, Fraud Detection, Nonprofit, AICPA,, SAS 99, NPaccounting