https://egrove.olemiss.edu/aicpa_news/2847/thumbnail.jp

Cockburn, Donald J.

English

eGrove (Univ. of Mississippi)

University of Mississippi eGrove Newsletters American Institute of Certified Public Accountants (AICPA) Historical Collection 9-1993 Fax Magic; Technology Alert, September 1993 Donald J. Cockburn Follow this and additional works at: https://egrove.olemiss.edu/aicpa_news  Part of the Accounting Commons SEPTEMBER 1993FAX MAGICby Donald J. Cockburn, FCADonald J. Cockburn is the auditing department editor of the CA Magazine and is a partner in die national accounting and auditing services group at Ernst & Young, Toronto, Canada. In this Alert he explains how easy it is to tamper with a fax, and die cross-checks that are essential to maintain security. The following which appeared in die May 1993 issue of CA Magazine has been reprinted with die permission of die publisher, the Canadian Institute of Chartered Accountants.Transmission problems notwithstanding, the fax machine has carved out an enviable niche for itself in the world of corporate communication. It stands to reason, therefore, that faxes are finding their way into an increasing number of audit files. Harmless as this practice may seem, however, problems can arise when auditors, rely on these confirmations as audit evidence without carrying out corroborating procedures.To understand the problems, it’s important to consider what exactly we are dealing with when we receive a fax. In simple terms, a fax communication can be viewed as a photo­copy. of the relevant document by the transmitting fax machine, a conversion of the visual document into machine-audible form, a transmission of that audible information through the telephone network, and a reconversion of that information and printing of the photocopied document by the receiving fax machine. The receiving machine also prints the date and time of receipt at the top or bottom of the document, and will print the transmitter’s name and fax number, unless these are withheld for confidentiality (or other) reasons.Now, for the problems. To start with, it’s possible for a fax machine to be preprogrammed with an incorrect transmitting number and name. This leaves the recipient with no other information about the source of the document than something that is incorrect. Therefore, a dishonest client or other meddlesome party can send a falsified confirmation which, when received by the auditor, appears to come from the expected source. The recipe for falsification is simple: The dishonest party just has to take photocopies of the appropriate letterhead and signatures, do a quick cut-ancl-paste, then preprogram the transmitting fax machine with the name and fax number of the purported sender.For a fax to be totally reliable as audit evidence, there must be no doubt as to its origin. Like an ordinary phone call, however, a fax is merely an application of the telephone network. Thus, the recipient has no other information about the origin of the call than that provided by the transmitter. Without proof of origin, confirmations by fax cannot be held as totally reliable audit evidence.AICPA Information Technology Membership SectionTECHNOLOGY ALERTAmerican Institute of Certified Public Accountants©1993 AICPAA second problem is that information contained in the faxed document itself can be easily manipulated. In cases where a fax can be intercepted, a dishonest party can therefore remove and replace key information to improve the apparent status of the confirmation.Yet another problem is that some faxes are still printed on thermographic paper. This paper varies in grade and quality according to the capacity of the fax machine used. Information printed on such paper is physically vulnerable in two ways: It can be easily erased, and it fades within a relatively short time (usually a few years) of printing. Low quality paper and ink, and excessive exposure to light and dampness, will further speed the fading process. This means that some faxes kept in audit files may not provide appropriate evidence of confirmation at a time when they are needed (in the case of litigation, for example).None of the above-mentioned problems are insurmountable, however. For example, most fax machines have a facility that enables them to “pull” a fax from a transmitting machine, rather than simply receiving it. For this to happen, the transmitting machine must have the facility activated and the fax document is transmitted when the operator of the receiving machine activates the facility and dials the transmitting machine’s number. With this system, the origin of the fax can be assured since the call is initiated by the receiver rather than the sender. It requires, however, that transmitter and receiver make contact prior to transmission. Also, in the case of long distance, telephone charges are borne by the receiver.The “pull” facility provides the only definite proof of origin. Since not all machines are equipped with this feature, however, the next best solution is to call the purported sender to ensure the confirmation received was valid. Any manipulation of information on the fax document itself could also be detected by confirming the contents with the transmitter.Since a fax must be intercepted before it can be manipulated, the possibility of falsification will always be reduced if the fax is received by the auditor, rather than the client. Of course, this is not always possible. But if thermographic paper is used, an alteration can usually be detected through close inspection, since erasures leave a slightly visible mark. When the fax confirmation consists of several pages, however, it may be difficult to detect a full- page replacement. Confirmation of the contents via telephone may be the most suitable precaution to take in such circumstances.As for the fading problem (which arises only in cases where thermographic paper is used), it’s possible to avoid it altogether by filing a photocopy of the fax rather than, or in addition to, the original fax document.It is clear, then, that confirmations received by fax cannot be considered totally reliable. This is due to the sourcing problems discussed above, as well as the physical vulnerability of the faxed documents themselves. Accordingly, fax confirmations should not, in normal circumstances, be considered as self-standing, appropriate, and durable audit evidence, unless additional precautions are taken to confirm their validity and enhance their durability. In most instances, such confirmations should be used as backup or interim evidence until the original confirmations are received.Editor’s Noto: With the increase of scanned documents, including facsimiles, many courts are cautious about accepting these documents as evidence. Each court can set its own standards in this area. In addition, the admissibility of scanned documents as evidence of a binding contract has NOT yet been litigated. Readers may also want to read paragraph 29 of SAS No. 67, The Confirmation Process (AICPA, Professional Standards, vol. 1, AU Sec. 330), which provides guidance under U.S. generally accepted auditing standards when audit confirmations are received via fax.

Fax Magic; Technology Alert, September 1993

https://egrove.olemiss.edu/cgi/viewcontent.cgi?article=2847&context=aicpa_news

Fax Magic; Technology Alert, September 1993

Abstract

Similar works

Full text

Available Versions

eGrove (Univ. of Mississippi)