Government Audit Fraud Responsibilities

Why This Topic Matters

Government audits sit at the intersection of public trust and public money. Every dollar spent by a government entity or passed through to a grantee, contractor, or nonprofit is, in effect, taxpayer money, and the auditors who examine those funds carry responsibilities that go beyond those of a typical private-sector financial statement auditor. For a Certified Fraud Examiner, understanding these responsibilities is essential for three reasons. First, CFEs frequently work alongside or within government audit shops, Inspectors General offices, and state audit agencies. Second, many fraud examinations begin with a referral from a government auditor who uncovered red flags during a compliance or performance audit. Third, the ACFE CFE Exam tests this topic directly within the Financial Transactions and Fraud Schemes section under Auditors' Fraud-Related Responsibilities, and candidates who confuse government auditing standards with ordinary commercial auditing standards routinely lose easy points.

What It Is: The Framework of Government Auditing

In the United States, government auditing is governed primarily by Generally Accepted Government Auditing Standards (GAGAS), published by the U.S. Government Accountability Office (GAO). Because of its yellow cover, the standards document is universally known as the Yellow Book. GAGAS applies to audits of federal, state, and local government entities, as well as audits of nongovernmental organizations that receive government awards (such as grants, loans, and contracts) when law, regulation, or agreement requires it.

A key concept to master is that GAGAS does not replace the AICPA's auditing standards; it incorporates them and then adds requirements. When a government auditor performs a financial audit, he or she follows the AICPA Statements on Auditing Standards (including AU-C 240, Consideration of Fraud in a Financial Statement Audit) and layers on the additional GAGAS requirements for independence, continuing professional education, quality control, peer review, and expanded fraud, noncompliance, and reporting duties.

GAGAS covers several types of engagements:
- Financial audits: providing an opinion on whether financial statements are fairly presented.
- Attestation engagements and reviews of financial statements: examinations, reviews, or agreed-upon procedures on subject matter other than full financial statements.
- Performance audits: objective analyses of program effectiveness, economy, efficiency, internal control, and compliance, intended to help management and oversight bodies improve operations and accountability.

Other important pieces of the framework include:
- The Single Audit Act (1984, amended 1996) and the OMB Uniform Guidance (2 CFR Part 200), which require a nonfederal entity that expends federal awards above a dollar threshold in a fiscal year to undergo one organization-wide audit (a single audit) covering both the financial statements and compliance with federal program requirements. The long-standing threshold was $750,000; for fiscal years beginning on or after October 1, 2024, it rises to $1,000,000. The OMB Compliance Supplement tells auditors which compliance requirements to test for each major federal program.
- The Inspector General Act of 1978, which created Offices of Inspector General (OIGs) within federal agencies. IGs conduct independent audits and investigations, operate fraud hotlines, keep agency heads and Congress informed through semiannual reports, and refer suspected criminal violations to the Department of Justice.
- The Federal Managers' Financial Integrity Act and related laws requiring agency heads to maintain and evaluate internal controls.

How It Works: Fraud Responsibilities in Practice

1. Fraud in Financial Audits Under GAGAS
Because GAGAS incorporates AICPA standards, the government auditor must plan and perform the audit to obtain reasonable assurance that the financial statements are free of material misstatement, whether caused by error or fraud. This includes holding a brainstorming session among the engagement team, maintaining professional skepticism, assessing fraud risk factors (the fraud triangle of pressure, opportunity, and rationalization), presuming revenue recognition risk, and testing journal entries and management override controls. GAGAS then expands the auditor's duties in these ways:
- Auditors must extend the AICPA requirements to noncompliance with provisions of laws, regulations, contracts, and grant agreements that could have a direct and material effect on the financial statements. In government, noncompliance is often how fraud manifests, so this is a critical extension.
- Auditors should consider internal control deficiencies and communicate significant deficiencies and material weaknesses in writing.
- Regarding waste and abuse: the 2018 Yellow Book revision clarified that auditors are not required to perform specific procedures to detect waste or abuse, but if they become aware of it, they should consider its effect on the audit and whether to report it. Exam questions sometimes test this nuance: abuse is behavior that is deficient or improper compared with what a prudent person would consider reasonable, and it does not necessarily involve fraud or illegal acts.
- When the auditor identifies or suspects fraud or noncompliance, GAGAS requires the auditor to evaluate the effect on the audit objectives and to extend audit steps and procedures as necessary to determine whether the fraud or noncompliance occurred and its likely effect.

2. Fraud in Performance Audits
In performance audits, the auditor is not expressing an opinion on financial statements, so the fraud responsibility is framed around the audit objectives. GAGAS requires performance auditors to:
- Assess the risk of fraud occurring that is significant within the context of the audit objectives. This involves gathering information about the program and discussing fraud risk among team members, including factors such as incentives, opportunities, and attitudes that could lead to fraud.
- Design procedures to provide reasonable assurance of detecting fraud that is significant to the objectives.
- When information comes to the auditor's attention indicating that fraud significant to the objectives may have occurred, extend audit steps and procedures to determine whether it occurred and, if so, its effect on the findings.
- Consider the risk of noncompliance with laws, regulations, contracts, and grant agreements that is significant to the objectives.

3. Reporting Fraud and Noncompliance
Reporting is where government standards most visibly exceed private-sector requirements. Under GAGAS:
- Auditors must report fraud and noncompliance that has a material effect on the financial statements (or that is significant within the context of performance audit objectives) in the auditor's report, usually in a separate report on internal control and compliance.
- Matters that are less than material but more than inconsequential should be communicated in writing to those charged with governance or management.
- Auditors have a duty of direct reporting to outside parties in two situations: (a) when management fails to satisfy a legal or regulatory requirement to report fraud or noncompliance to specified external parties, and (b) when management fails to take timely and appropriate steps to respond to known or likely fraud or noncompliance that is likely to have a material effect and that involves funding received directly or indirectly from a government agency. In the second case, the auditor first reports the matter to those charged with governance; if the entity still fails to act, the auditor reports directly to the funding agency or oversight body. This duty continues even if the auditor resigns or is dismissed from the engagement.
- Auditors should also report the views of responsible officials and may need to consider whether confidential or sensitive information (such as details that could compromise an ongoing investigation) should be omitted or limited in the public report, while still complying with legal requirements.

4. Independence, Competence, and Quality
GAGAS strengthens the auditor's ability to confront fraud by imposing rigorous independence rules built on a conceptual framework (identifying threats such as self-review, management participation, and undue influence, and applying safeguards). Auditors must complete 80 hours of continuing professional education every two years, with at least 24 hours directly related to government auditing or the specific environment of the audited entity. Audit organizations must maintain a system of quality control and undergo an external peer review at least once every three years. These requirements exist in part to ensure auditors are competent and independent enough to identify and report fraud without being pressured by the entities they audit.

5. Interaction With Investigators
Government auditors are generally not responsible for conducting fraud investigations. When indicators of fraud arise, the auditor's role is to extend procedures sufficiently to understand the matter and then refer it to the appropriate authority, such as an Inspector General, a prosecutor, or a fraud examiner. Auditors must take care not to interfere with legal proceedings or investigations and should coordinate with investigators to avoid compromising evidence.

Exam Tips: Answering Questions on Government Audit Fraud Responsibilities

Tip 1: Know who issues what. The GAO issues GAGAS (the Yellow Book). The AICPA issues Statements on Auditing Standards. The PCAOB sets standards for public company audits. OMB issues the Uniform Guidance and Compliance Supplement for single audits. If a question asks which body publishes government auditing standards, the answer is the GAO, not the AICPA or OMB.

Tip 2: Remember that GAGAS incorporates and expands, rather than replaces. A common distractor claims that government auditors follow GAGAS instead of AICPA standards. The correct view is that GAGAS incorporates AICPA standards by reference and adds requirements. Any option describing GAGAS as a complete substitute is usually wrong.

Tip 3: Look for the words material and significant. In financial audits, the trigger for reporting fraud is a material effect on the financial statements. In performance audits, the trigger is fraud that is significant within the context of the audit objectives. Questions often swap these terms to test whether you understand the difference between the two engagement types.

Tip 4: Master the direct-reporting rules. Auditors ordinarily report to those charged with governance, not to the police. Direct external reporting is required only when management fails to meet a legal reporting requirement or fails to respond appropriately to known or likely fraud or noncompliance involving government funding. If a question describes management that promptly reports and corrects a problem, external reporting by the auditor is typically not required.

Tip 5: Handle the abuse nuance carefully. If a question asks whether auditors are required to design procedures to detect abuse, the answer under current GAGAS is no. If it asks what auditors should do upon becoming aware of abuse, the answer is to consider its effect on the audit and whether to communicate it. Abuse is distinct from fraud and does not require intent to deceive.

Tip 6: Understand the auditor's response to red flags. When fraud indicators emerge, the expected action is to extend audit steps and procedures to determine whether fraud likely occurred and its effect, then evaluate the impact on the audit and report appropriately. The wrong answers typically have the auditor either ignoring the indicator because it is immaterial or immediately launching a full criminal investigation. The auditor's role is to extend procedures and refer, not to investigate and prosecute.

Tip 7: Memorize the key numbers. Single Audit threshold: $750,000 in federal expenditures (rising to $1,000,000 for fiscal years beginning on or after October 1, 2024). CPE: 80 hours every two years, with 24 in government-related subjects. Peer review: at least once every three years. Inspector General Act: 1978. Single Audit Act: 1984, amended 1996.

Tip 8: Recognize the role of Inspectors General. IGs perform both audits and investigations, maintain hotlines, report semiannually to Congress and agency heads, and refer criminal matters to the Department of Justice. When a question describes an entity within a federal agency that both audits programs and investigates fraud, think OIG.

Tip 9: Think like a CFE, not just an auditor. Exam scenarios may ask what a fraud examiner should expect from a government auditor's report or workpapers. Remember that the auditor provides reasonable, not absolute, assurance, that materiality limits what gets reported, and that immaterial fraud may appear only in a management letter or communication to those charged with governance. A fraud examiner should never assume a clean audit opinion means no fraud exists.

Tip 10: Eliminate absolutes. Options containing words like always, never, all, or guarantee are rarely correct in auditing questions. Government auditors are responsible for reasonable assurance, professional skepticism, and appropriate extension of procedures, not for guaranteeing that every instance of fraud is detected.

Quick Review Summary
- GAGAS (Yellow Book) is issued by the GAO and governs audits of government entities and recipients of government awards.
- GAGAS incorporates AICPA standards and adds requirements for fraud, noncompliance, internal control, independence, CPE, quality control, and reporting.
- Financial audits: detect material misstatements from fraud; extend to noncompliance with laws, regulations, contracts, and grant agreements; consider but not required to detect waste and abuse.
- Performance audits: assess fraud risk significant to the audit objectives; extend procedures when indicators appear.
- Reporting: material fraud and noncompliance in the report; lesser matters to governance; direct reporting to outside parties when management fails to report or act.
- Single Audit Act and Uniform Guidance govern organization-wide audits of federal award recipients above the expenditure threshold.
- Inspectors General audit, investigate, and report to Congress under the Inspector General Act of 1978.

Master these concepts and the logic behind them, and questions on government audit fraud responsibilities become some of the most predictable points you can earn on the CFE Exam.