SAS 99 is a US-Based standard established to provide guidelines to auditors (in the USA) when considering fraud in the audit of financial statements. The standard was drawn in
response to accounting scandals such as
Enron, WorldCom, Adelphia, and Tyco, the Statement on
Auditing Standards 99 (SAS 99) was issued by the Auditing Standards Board of
the AICPA in 2002 within the powerful legislation of the Sarbenes-Oxley Act
2002. The Sarbanes-Oxley Act or more
commonly known as SOX “requires all public companies to provide more financial
information than ever before, and holds corporate directors and officers
personally accountable for the accuracy of financial disclosures”. Essentially, the Act which is enforceable to all companies in
the USA (and their respective subsidiary and associate companies elsewhere
globally) is administered by the Securities and Exchange Commission (SEC). For
public companies, the SEC sets deadlines for compliance and publishes rules on
requirements. Because
it is rules-driven, any standards or guidelines issued within its legislation
are known as “rules-based”. SAS 99 is
one example of rules-based auditing standards.
Effectively, auditors must comply with all the detail rules when auditing a company’s financial
statements. Many accountants and auditors favor the prospect
of using rules-based standards, because in the absence of rules they could be
brought to court if their judgments of the financial statements were incorrect.
When there are strict rules that need to be followed, the possibility of
lawsuits is diminished. Having a set of rules can increase accuracy and reduce
the ambiguity that can trigger aggressive reporting decisions by management. SAS 99 is part of the AICPA’s
anti-fraud program which aims to provide accountants and auditors with
clarified and focused auditing guidance on fraud. Similarly, it reemphasizes the role of entity management and
boards in preventing and detecting fraud.
With the prospect of using SAS as a guideline to consider fraud when
auditing financial statements, the standard has been arranged to cover nine key
components: Description and characteristics of fraud; Professional skepticism; Brainstorming
sessions among key engagement personal; Information gathering; Risk Identification; Evaluation of an entity's programs and controls; Results of the Assessment; Communication of possible fraud and
Documentation of the auditor's consideration of fraud.