Cooperatieve Centrale Raiffeisen-Boerenleenbank BA v Stout & Company LLP, 2017 ABQB 637

Court of Queen’s Bench of Alberta Citation: Cooperatieve Centrale Raiffeisen-Boerenleenbank BA v Stout & Company LLP, 2017 ABQB 637 Date: 20171020 Docket: 1301 07048 Registry: Calgary Between: Cooperatieve Centrale Raiffeisen-Boerenleenbank B.A., “Rabobank International”, New York Branch Plaintiff - and - Liebig & Keown LLP, Stout & Company LLP, Grant Thornton LLP, Brett Liebig Professional Corporation, Chris L. Keown Professional Corporation, and James Stout Professional Corporation Defendants _______________________________________________________ Reasons for Judgment of the Honourable Madam Justice K.D.

Nixon _______________________________________________________ Introduction [ 1 ] The Plaintiff, Cooperatieve Centrale Raiffeisen-Boerenleenbank BA, “Rabobank International”, New York Branch (“Rabobank”), is a Dutch cooperative bank with international operations. Its operations in North America focus on food and agricultural business financing.

Rabobank sues the Defendant, Stout & Company LLP, an Edmonton, Alberta chartered accountancy firm, and its principal, the Defendant James Stout Professional Corporation, (collectively “Stout”) arising out of an approximately $42 Million (USD) fraud perpetrated upon Rabobank through Agra Services Canada, Inc. (“Agra”), a company whose financial statements were audited by

Stout. The Plaintiff’s action against the other Defendants, Liebig & Keown LLP (“Liebig & Keown”), Grant Thornton LLP, Brett Liebig Professional Corporation and Chris L. Keown Professional Corporation, was dismissed in two decisions of Master Robertson, reported at 2015 ABQB 628 and 2015 ABQB 669 , which were upheld on appeal by Justice Sullivan at 2016 ABQB 417 . [ 2 ] Agra was a company registered in Alberta that carried on the business of purchasing agricultural commodities and selling them in Mexico.

Agra’s sole source of financing was through the sale of its receivables at a discount to Rabobank, a type of financing referred to as factoring. For 10 years, the relationship between Rabobank and Agra was a profitable one for the bank and largely uneventful. In December 2011, Rabobank was advised by Mr. Herrera, one of the two principals of Agra, that Mr. Guzman, the other principal, had died. Thereafter, all of the receivables that became due went unpaid.

A subsequent extensive forensic investigation on behalf of Rabobank determined that most of Agra’s customers disputed the existence or validity of the receivables and, further, that funds had been “cycled” through Agra’s accounts with no apparent commercial purpose since September 2009. [ 3 ] Rabobank seeks to recover its losses from Stout.

It alleges that Stout was negligent in issuing its audit opinions in 2010 and 2011 that Agra’s financial statements for its 2009 and 2010 fiscal years respectively were free from fraud and material misrepresentations when, in fact, they contained fictitious purchase and sale transactions. Rabobank asserts that it continued to purchase receivables from Agra in reliance on Stout’s audit opinions, and that had Stout not issued the opinions it would not have purchased any of the uncollected receivables. Background [ 4 ] Agra first began to factor receivables to Rabobank in 2001.

At the time, Agra had three shareholders: Horner Brothers Company Ltd., (“Horner Co.”), owned by Alberta businessmen Bruce and Doug Horner (the “Horner brothers”), and two numbered companies, each owned by a Mexican resident: one by Mr. Eduardo Guzman and the other by Mr. Francisco Herrera. [ 5 ] In September 2004, Rabobank and Agra entered into a Master Receivables Purchase Agreement (amended in September 2005) (“MRPA”).

It sets out the terms pursuant to which receivables were purchased by the bank . [ 6 ] To qualify for purchase by Rabobank pursuant to the MRPA, the receivables were required to be a “legal, valid and binding obligation” of a customer not affiliated with Agra, be for a minimum of $100,000 and be short term (due within 90-120 days). Before purchase by Rabobank, Agra was required to put in place insurance for the receivable (typically for 80-90% of the balance) and to put 10-20% of the value of the receivable into a cash collateral account.

Agra was also required to provide a package of documents to the bank including the invoice, bill of lading, insurance policy and contract for each receivable. [ 7 ] Agra was responsible for the collection of the receivables and payment to Rabobank. Personal guarantees were obtained from all of Agra’s principals at the time, the Horner brothers (through Horner Co.) and Messrs.

Guzman and Herrera pursuant to which each was liable for the amounts due on unpaid receivables not covered by insurance. [ 8 ] It was a term of the MRPA that Agra provide to Rabobank annual audited financial statements from a recognized firm of Canadian chartered accountants. Liebig & Keown, an Alberta chartered accountancy firm, provided audit opinions for the financial statements for the 2004, 2005 and 2006 fiscal years. Mr. Keown, a partner with Liebig & Keown, approached Stout in May 2008 to take over the audit of the 2007 financial statements.

Stout continued as Agra’s auditor through 2011, providing audit opinions for the financial statements from the 2007, 2008, 2009 and 2010 fiscal years. [ 9 ] By the time of the 2009 audit of the 2008 financial statements, a change in Agra’s business had occurred, with all of Agra’s suppliers and customers, along with its administrative staff, then being located in Mexico. In October 2007, Horner Co. entered into an agreement to sell its shares to Agra leaving Mr. Guzman’s and Mr. Herrera’s numbered companies as the sole shareholders.

In March 2011, Rabobank released Horner Co. from its guarantee. [ 10 ] Each year, Rabobank undertook a comprehensive review of its lending relationship with Agra before extending the MRPA for a further year.

Its review included “collateral inspections”, the purpose of which were “to identify/verify the existence, quantity, quality, title and value of collateral pledged.” The bank’s standards for the collateral inspections required “that the inspection be planned and performed to obtain reasonable assurance that … financial information reviewed is free of material misstatement….” [ 11 ] No significant issues were identified by Rabobank as a result of any of its collateral inspections. The relationship with Agra was a profitable one for Rabobank, and the bank found the principals of Agra to be trustworthy and reliable.

Over time, the bank increased the maximum cumulative value of receivables it could purchase. Initially, the maximum cumulative value of the purchased receivables outstanding at any one time was $33.5 Million (USD). By 2007, this had increased to $42 Million (USD). Defaults were rare. [ 12 ] Unbeknownst to Rabobank, from at least September 2009, Agra began to enter into fake purchase and sales agreements and to pay the bank for maturing receivables with funds it received from the bank for the new receivables, thus “cycling” the bank’s funds back to the bank.

Neither Stout’s audit of the 2009 financial statements issued in 2010 (“the 2009 audit”), nor its audit of the 2010 financial statements issued in 2011 (“the 2010 audit”), identified the fake transactions. In each of these years, Stout issued an audit opinion that Agra’s financial statements presented “fairly, in all material respects, the financial position of the company” as at the year end. [ 13 ] All payments to the bank by Agra ceased immediately after the bank received an email on December 14, 2011 that Mr. Guzman had died.

At that time, 99 receivables remained outstanding, with a total cost $41,337,453 (USD), which had been purchased by Rabobank between July 28, 2011 and December 14, 2011. Rabobank terminated the MRPA on January 6, 2012 and made inquiries of certain Agra customers about the receivables. Most of the customers disputed the purchases. None of the 99 receivables was ever collected. Rabobank was not successful in recovering any money in Agra’s receivership or on any of the guarantees. No recovery was received from the insurance because the policies excluded a loss from fraud.

It was, however, successful in recovering $5,248,983 (USD) from the cash collateral account. Rabobank was left with a total loss of $36,088,470 (USD).

[14] The evidence established that at least 25% of the sales and costs of sales reported in the 2009 financial statements and 40% ofthose reported in 2010 were fictitious. [15] The 2009 financial statements reported sales of $127,660,297 (USD) and cost of sales of $123,793,176 (USD). The 2010financial statements reported sales of $122,908,912 (USD) and cost of sales of $119,249,633 (USD). In the 2009 financial statements,21% of the cost of sales (purchases) recorded were purportedly from Little Rock de Mexico S.A. de C.V. (“Little Rock”).

The purportedcost of sales from Little Rock comprised 26% of the sales reported in the 2010 financial statements. It was subsequently discovered thatLittle Rock had been dissolved on October 31, 2008. [16] In the 2009 financial statements, sales to Takasago de Mexico S.A. de C.V. (“Takasago”) were reported to be $1,398,246.Sales to Takasago were reported to be $2,697,334 (USD) in the 2010 financial statements. Mr.

Luna, a representative of Takasago,testified at trial that Takasago never did business with Agra. [17] The 2010 financial statements reported $4,447,830 (USD) in sales to Henkel Capital, S.A. de C.V. (“Henkel”). The evidenceat trial established that Henkel never did any business with Agra either. [18] The 2009 financial statements also reported $5,699,876.50 (USD) in sales to Nueva Wal Mart de Mexico, S.A. de C.V. (“WalMart”). The 2010 financial statements reported $9,797,457.50 (USD) in sales to Wal Mart.

As with Henkel and Takasago, the evidenceestablished that Wal Mart never did any business with Agra. [19] As a result of the forensic investigation conducted on behalf of Rabobank, Deloitte Transactions and Business Analytics LLP(“Deloitte”) was able to partially trace funds advanced by Rabobank to Agra in 2009 and 2010. In tracing funds into and out of Agra’sgeneral account at Rabobank, Deloitte determined that money sent to Mexico was immediately cycled back to Rabobank to pay maturingreceivables with no apparent commercial purpose.

Deloitte determined that none of it had been used to pay suppliers, and no accountsreceivable collections appeared to have been received directly from customers. Further, of the funds it was able to trace, none of thefunds paid to Rabobank for maturing receivables was collected from customers of Agra. [20] Stout did not discover the fraud. In performing its audits, it assessed the overall risk of fraud as low. It performed auditprocedures in accordance with that risk assessment.

Rabobank asserts that Stout ought to have assessed the risk of fraud as high and,commensurate with a high risk, confirmed with Agra’s purported suppliers and customers that the cost of goods sold and the salesrecorded in Agra’s financial statements were genuine. It submits that had Stout done so, it would have discovered that some or all of thetransactions were fake, with the result that Stout would have issued its audit opinions and Rabobank would have stopped purchasingreceivables in April 2010 or in April 2011 when the audit opinions were issued.

It submits that it would not have suffered a loss becauseit would not have purchased any of the 99 unpaid receivables between July and December 2011.

Issues [21] Rabobank sues Stout for negligent misrepresentation. [22] The court in Queen v Cognos Inc, (SCC), [1993] 1 SCR 87 at para 34 identified five required elements for asuccessful claim of tort of negligent misrepresentation: (1) a duty of care based on a special relationship” between the representor and therepresentee; (2) the representation was untrue, inaccurate, or misleading; (3) the representor acted negligently in making themisrepresentation; (4) the representee relied, in a reasonable manner, on the negligent misrepresentation; and (5) the reliance wasdetrimental to the representee, that is, it suffered damages as a result. [23] To succeed, therefore, Rabobank must establish, on a balance of probabilities that: 1.

Stout owed Rabobank a duty of care; 2. Stout made a misrepresentation; 3. Stout was negligent in making its representation; 4. Rabobank reasonably relied on the negligent misrepresentation; and 5. Rabobank suffered damages as a result. Analysis 1. Did Stout Owe Rabobank a Duty of Care? [24] A prima facie duty of care arises when there is sufficient proximity between the parties such that (

a) the defendant oughtreasonably to foresee that the plaintiff will rely on the defendant’s actions and (

b) the plaintiff’s reliance is reasonable in thecircumstances: Hercules Managements Ltd v Ernst & Young, (SCC), [1997] 2 SCR 165 at paras 21 and 24. It is notdisputed that the relationship between Stout and Rabobank gave rise to a prima facie duty of care. [25] In the context of negligent misrepresentation, however, an auditor’s duty of care will be negated where there is a risk ofindeterminate liability: Hercules at para 36. Stout submits that the risk of indeterminate liability exists in the present case, negating theprima facie duty of care. [26] In Hercules, La Forest, J. speaking for the court noted that the possibility of indeterminate liability looms in the case of

auditor’s liability because their reports are relied on by many people for a wide variety of purposes. It would almost always beforeseeable not only that the reports would be relied upon but also that it would be reasonable to do so: at paras 31-32.

La Forest, Jexpressed the concern as follows: Indeed, while indeterminate liability is problematic in and of itself inasmuch as it would mean that successful negligence actions againstauditors could, at least potentially, be limitless, it is also problematic in light of certain related problems to which it might give rise: atpara 33. [27] Policy considerations negating a duty of care of an auditor, however, will not always exist. The court must investigate whetheror not indeterminate liability is truly a concern: at para 44.

Factors such as knowledge of the plaintiff and use of the statements for theprecise purpose or transaction for which they were prepared are relevant considerations: at para 46.

This is so because “…the presence ofsuch factors in a given situation will mean that worries stemming from indeterminacy should not arise, since the scope of potentialliability is sufficiently delimited”: at para 37. [28] La Forest, J noted that concern about indeterminate liability will not exist: …[I]n cases where the defendant knows the identity of the plaintiff…and where the defendant’s statements are used for the specificpurpose or transaction for which they were made, policy considerations surrounding indeterminate liability will not be of any concernsince the scope of liability can readily be circumscribed.

Consequently, such considerations will not override a positive finding on thefirst branch of the Anns/Kamloops test and a duty of care may quite properly be found to exist: at para 37. [29] The Supreme Court of Canada rejected a duty of care being imposed on the auditor in Hercules, but imposed one in Haig vBamford, (SCC), [1977] 1 SCR 466. [30] In Hercules, the plaintiff shareholders relied on the audited statements to make personal investment decisions.

Despite beingaware of the shareholders, liability did not arise because the statement at issue was not used for “precisely the purpose or transaction forwhich it was prepared”: at para 46.

LaForest, J concluded that the auditor’s report was prepared pursuant to the Manitoba CorporationsAct, RSM 1987, c C225 to be put before the shareholders at the annual meeting in order for them, as a body, to make decisions about themanner in which they wanted the corporation to be managed, to assess the performance of the directors and officers and to decidewhether they wished to retain or replace existing management: at para 49.

The court rejected the appellants’ argument that the statementshad also been prepared for the purpose of providing them with information to make personal investment decisions, and that the auditorshad been engaged to look out for the individual interests of the shareholders: at para 50. [31] In contrast, auditors were found liable for negligent misrepresentation in Haig because they had been informed at the timethey were engaged that the audited statements would be used for the purpose of attracting a specific investment from a limited number ofpotential investors.

Policy considerations and concerns about indeterminate liability were not engaged in that case. As explained byDickson, J writing for the majority: …The very end and aim of the financial statements prepared by the accountants… was to secure additional financing…; the statementswere required primarily for these third parties and only incidentally for use by the company: Haig at para 27, cited in Hercules at para40. [32] Rabobank argues that concerns of indeterminate liability as to class or amount do not arise here.

Stout acknowledged that thebank was the “main user” of financial statements and that the only reason audited statements were prepared was because it was arequirement of the MRPA. Further, Stout was aware that Rabobank relied on the audited financial statements to assess its lending underthe MRPA and, therefore, knew its maximum liability.

Agra’s financial statements refer to the $42 Million (USD) maximum forpurchased accounts receivables and to contingent liabilities of Agra to Rabobank of $40,190,116 (USD) as of December 31, 2010, and$41,974,427 (USD) as of December 31, 2009. [33] Stout acknowledges that Agra’s purpose for engaging it to provide an audit opinion respecting the financial statements was tocomply with Agra’s obligation to Rabobank pursuant to the MRPA. It submits, however, that it does not follow that this is the samepurpose for which it issued its auditor’s reports.

Stout submits that the policy considerations identified in Hercules negating a duty ofcare apply because Rabobank used the audit reports for a purpose for which they were not prepared.

In this regard, Stout relies on theterms of its audit engagement letters with Agra. [34] In its engagement letters, Stout states that the audited statements “ . . . are prepared solely for the use of the client with whomwe have entered into a contract, and there are no representations of any kind made by us to any party with whom we have not enteredinto a written contract.” The letters further state that Stout’s statutory function as auditor is to report to the shareholders and that “[t]heexamination of the financial statements and the issuance of our audit opinion are solely for the use of Agra…and those to whom ourreport is specifically addressed by us.” The engagement letters go on to state that Stout “makes no representations of any kind to anythird party…and we accept no responsibility for their use by any third party.” [35] Stout submits that knowledge that Rabobank required the statements under the MRPA is insufficient to obviate concerns overindeterminate liability because the scope and extent of the audits, its responsibilities and its compensation were based on its engagementletters. [36] Rabobank replies that Stout cannot rely on the disclaimer for two reasons: first, because Stout knew and expressly acceptedthat Rabobank was the ultimate end-user of the audit reports and Rabobank relied on the reports to assess future lending.

The secondreason is because Rabobank had no knowledge of the terms of the engagement letters. In support of its arguments, Rabobank relies uponKumar v Picco, 2007 BCSC 1669 and Haig, where accountants were found to owe duties of care to third parties where they knew thatthe report were being used by third parties. The court concluded in Kumar: …While the Reports were not initially prepared to assist Mr. Kumar in his deliberations, Mr. Picco knew that they were being used forthat purpose and did not demur. There is, in these circumstances, no concern of indeterminate liability: at para 25.

[37] In Haig, the accountants were aware that the company intended to provide the reports to a limited group of third partiesalthough the accountants did not know the name of the plaintiff who was a member of that limited class. Provision of the reports by thecompany to the third parties was found to be no different than provision of the reports directly to the third parties by the accountants.

Inthis regard, the court concluded: …I can see no good reason for distinguishing between the case in which a defendant accountant delivers information directly to theplaintiff at the request of his employer…and the case in which the information is handed to the employer who, to the knowledge of theaccountant, passes it to members of a limited class (whose identity is unknown to the accountant) in furtherance of a transaction thenature of which is known to the accountant.

I would accordingly hold that the accountants owed Haig a duty to use reasonable care in thepreparation of the accounts: at para 34. [38] I do not agree with Stout that the prima facie duty of care owed by Stout to Rabobank was negated. Stout, therefore, owedRabobank a duty of care. [39] The disclaimers in the engagement letters do not provide a policy reason in the circumstances of this case to negate a duty ofcare. There is no evidence that Stout brought the disclaimer to the attention of Rabobank or that Rabobank was otherwise aware of it.While Mr.

Fitzgerald acknowledged that audit letters are the norm, he did not see the letters between Stout and Agra until after-the-fact. [40] Stout was aware that Rabobank was the end-user of the audited statements and that it was using them in to make its decisionwith respect to future lending to Agra. While the disclaimer states that Stout’s statutory function is to provide a report to shareholders,the shareholders in this case were management. The real purpose of the audited statements was to comply with the MRPA in order forAgra to continue to receive funding from Rabobank.

Concerns about indeterminate liability do not arise in this case. It is artificial toseparate Agra’s purpose in requesting the audited statements and Stout’s purpose in issuing its audit opinion. [41] On the facts of this case and given my finding on duty of care, it is unnecessary to discuss whether the disclaimer would haveprecluded liability had it been brought to the attention of the bank. 2. Was There a Misrepresentation By Stout? [42] A misrepresentation is a statement that is untrue, inaccurate or misleading: Cognos at para 34.

Stout does not dispute that thefinancial statements prepared by Agra contained untrue, inaccurate and misleading statements. It denies, however, that its audit opinionswith respect to those financial statements were untrue, inaccurate or misleading because it provided reasonable assurance, not a guaranteeof their accuracy. [43] The Generally Accepted Auditing Standards (“GAAS”), articulated in the Canadian Institute of Chartered AccountantsHandbook – Assurance, vol 1 (“CICA Handbook”), apply to the 2009 audit completed in 2010.

The Canadian Auditing Standards in theCPA Canada Handbook - Assurance (“CAS”) apply to the 2010 audit completed in 2011. Collectively, they are referred to as the “auditstandards” or the “standards”. [44] The audit standards provide that it is the auditor’s responsibility to test the financial statements being audited to obtain“reasonable assurance” that they are not materially misstated, whether due to fraud or error. The auditor must obtain “sufficientappropriate audit evidence” to support the audit opinion.

Stout issued the opinion that Agra’s 2009 and 2010 financial statements“present fairly, in all material respects, the financial position, results of operations and cash flows in accordance with Canadian generallyaccepted accounting principles.” [45] Contrary to Stout’s opinion, Agra’s financial statements were materially misstated. At least 25% of the 2009 sales and cost ofsales reported in the financial statements and 40% of the 2010 sales and cost of sales were fictitious. The sales reported in the financialstatements included sales to companies that never did business with Agra.

The statements also included product purportedly purchasedfrom a company that had been dissolved in 2008. [46] Stout argues that although Agra’s financial statements were materially misstated, its audit reports did not contain a materialmisrepresentation because it did not certify or guarantee that the financial statements were true, but only provided “reasonable assurance”that they were.

It asserts that its audit opinions that the financial statements fairly represented the financial position of the company werenot misrepresentations by Stout in the context of the provisos to those opinions, including the proviso that the financial statements are theresponsibility of management. In other words, Stout asserts that it did not make any misrepresentations because its opinions were basedon its audit. It did not assert, as a fact, that the financial statements fairly represented Agra’s financial position.

It submits that Rabobankmust, but did not, establish that Stout’s opinions, which were based on the audits, were inaccurate. [47] I do not agree with Stout. If Stout’s position is correct, an auditor could never be held liable for a negligent audit opinionabout financial statements unless the opinion stated in the audit report did not accurately reflect the auditor’s opinion. [48] Both the financial statements prepared by Agra and the opinions of Stout contained material misrepresentations.

The formerbecause they included fictitious sales and purchases, and the latter because they state that the financial statements “present fairly, in allmaterial respects” Agra’s position when, in fact, they did not. The same type of opinion, which was found to be a negligentmisrepresentation, was expressed in Haig and in Kripps v Touche Ross & Co (1997), (BC CA), 33 BCLR (3d) 254(CA), leave to appeal to SCC refused, 26118 (November 6, 1997). 3.

Was Stout Negligent in Making the Misrepresentation? [49] A person making a representation must exercise such reasonable care as the circumstances require to ensure that therepresentation is accurate: Cognos at para 56. An auditor must exercise the skill, care and caution of a reasonably competent, careful andcautious auditor in the circumstances of the particular case: Livent Inc v Deloitte & Touche, 2016 ONCA 11 at para 189, leave to appeal

to SCC granted, 36875 (June 9, 2016). [ 50 ] The standard of care is a matter of law for the court to determine, but it is informed by expert opinion and the audit standards. The standards of the profession provide guidance with respect to the standard of care: Livent at para 199. They are not, however, determinative: Kripps at paras 70 and 73 . [ 51 ] There are no material differences between the relevant provisions of the GAAS and the CAS.

The audit standards provide that the auditor’s task is to obtain “reasonable assurance” that the financial statements are free from material misstatements, whether due to error or fraud. In doing so, the auditor must “obtain sufficient appropriate audit evidence” to support the audit opinion. [ 52 ] The audit standards recognize, and specifically state, that an audit involves the exercise of professional judgment. The exercise of that judgment, however, must meet the standard of care.

As stated in CAS 200-A26, an auditor’s judgment must reflect “a competent application of auditing and accounting principles and [be] appropriate in light of, and consistent with, the facts and circumstances that were known to the auditor up to the date of the auditor’s report.” [ 53 ] The need for an auditor to make a competent judgment is reflected in CAS 200-A27: Professional judgment is not to be used as the justification for decisions that are not otherwise supported by the facts and circumstances of the engagement or sufficient appropriate audit evidence. [ 54 ] Professional judgment requires application of relevant training, knowledge and experience to make informed decisions about the courses of action that are appropriate in the circumstances of the audit engagement: CAS 200-13(k). [ 55 ] Relying on the opinion of its expert witness, Mr.

Henry, Rabobank submits that Stout was negligent in issuing its audit opinion for two reasons: 1. it did not properly assess whether it had the skills required to perform the audit of a company with all of its operations in Mexico; and 2. it failed to identify the risk of fraud as high and, therefore, failed to perform the audit procedures appropriate for that level of risk, namely, confirming the existence and accuracy of the sales (receivables) and cost of goods sold in the financial statements by contacting suppliers and customers of Agra to verify receipt of goods from the supplier and shipment of goods to the customer. [ 56 ] In Mr.

Henry’s opinion, Stout did not have the necessary language capabilities or Mexican business knowledge to perform the audits. Further, in his opinion, there was a high risk of fraud here because Agra was a small company with little segregation of duties and extensive involvement of management that carried out all of its business in Mexico and relied on Rabobank for all of its financing. [ 57 ] Mr. Muccilli, the expert for the defence, was of the opinion that Stout properly assessed that it had the skills to perform the audits.

He was not critical of Stout’s assessment of the risk of fraud as low to moderate and the overall risk of misstatement from fraud or error in the financial statements as low. In his opinion, the audit procedures performed by Stout to confirm sales and cost of sales were appropriate for the risk of fraud assessed by Stout.

In his opinion, it was not necessary to confirm the existence and accuracy of sales and cost of sales by contacting suppliers and customers. [ 58 ] Before addressing the evidence with respect to the specific breaches of the standard of care alleged to have been made by Stout, the general submissions made by each party for why its expert should be preferred will be addressed. [ 59 ] Rabobank asserts that Mr. Henry’s opinion should be preferred to that of Mr. Muccilli on the basis that: 1. Mr. Henry is better qualified than Mr. Muccilli with respect to the standard of care for conducting audits; 2. Mr.

Henry’s manner of giving evidence made his evidence more persuasive; and 3. having reviewed and relied upon the transcripts from questioning of Mr. Stout, the audit partner responsible for the Agra audit, and Ms. Elliott, the audit senior who managed the audit team, and having relied on communications with them in preparing his opinion, Mr. Muccilli’s opinion should be given no weight because it was not founded in the evidence. [ 60 ] Stout asserts that Mr. Muccilli’s opinion should be preferred to that of Mr.

Henry on the basis that: 1. having limited his review to Stout’s working papers for the 2009 and 2010 audits, Mr. Henry based his opinion on limited information; and 2. Mr. Henry gave his opinion with the benefit of hindsight. [ 61 ] Each of these arguments is considered below in assessing the merits of each expert’s approach, and the weight to be given to their respective opinions. Expert Opinions i. Qualifications of Mr. Henry and Mr. Muccilli [ 62 ] Mr. Henry and Mr.

Muccilli are both chartered professional accountants who were qualified by the court to give expert opinion evidence with respect to the standard of care to be met by an auditor of financial statements. Neither party opposed the qualification as an expert of the other party’s expert. Rabobank submits, however, that Mr. Muccilli’s opinion should be given little weight for the reasons stated above.

[63] The Supreme Court of Canada in R v Marquard, (SCC), [1993] 4 SCR 223 discussed the difference betweenadmission of expert opinion and the weight to be given to it. Admissibility is based on the witness possessing special knowledge andexperience beyond that of the trier of fact. Deficiencies in expertise go to weight: at para 35. [64] Mr. Henry has extensive experience in performing audits. Most of his professional work has been as an auditor.

In his over 30years’ experience as an auditor, he audited a wide variety of companies of various sizes, including audits of companies with foreignoperations and companies involved in financing by factoring receivables. [65] Mr. Muccilli’s experience is more diverse than that of Mr. Henry. He has an investigative and forensic accountingdesignation. He specializes in litigation support. In addition to his chartered professional accountant designation, he is a charteredbusiness valuator, an accredited senior appraiser as well as a certified fraud examiner. In providing litigation support, Mr.

Muccilli hasprovided expert opinions in a wide variety of areas, including professional negligence matters related to auditor negligence. He is well-versed in, and has experience with, the audit standards. In addition to being accepted as an expert by this court, Mr.

Muccilli has beenqualified in various other courts to give expert opinions with respect to accounting and auditing principles and policies and theassessment of accountants’ professional negligence. [66] It is open to a court to give more or less weight to, or to prefer the opinion of, one expert over that of another based on his orher experience and expertise. It is one factor that the court takes into consideration. It is not, however, determinative. [67] I do not find the extent of audit experience as between Mr. Henry and Mr. Muccilli to be a compelling factor in differentiatingbetween the two opinions.

Both experts are well-qualified to give expert opinions with respect to the standards of care of an auditor in thecircumstances of this case. I do not agree with Rabobank’s characterization of Mr. Muccilli as “an expert at only being an expert.” Mr.Muccilli has the requisite knowledge of the obligations of a professional accountant conducting an audit to speak authoritatively aboutthe standard of care. Further, Mr. Muccilli’s experience as a fraud investigator brought a helpful perspective in distinguishing between afraud investigation and an audit.

This distinction must be kept in mind when considering the standard of care of an auditor with respect tothe assessment of fraud risks and the planning and execution of an audit to address the assessed risk. [68] I agree with Rabobank that the qualifications and the audit experience of Ms. Dinshaw, who co-authored an expert report withMr. Muccilli but did not testify, cannot be used to “bolster” Mr. Muccilli’s qualifications. [69] Ms. Dinshaw is the partner responsible for professional practice at Crowe Soberman LLP, the firm where Mr. Muccillipractices.

Her responsibilities include ensuring audit standards are met by the firm in conducting the audits of its clients. As Ms.Dinshaw did not give evidence, neither her qualifications nor her opinion was subject to cross-examination. Her opinion was not beforethe court. I do not find it necessary to use Ms. Dinshaw’s qualifications to “bolster” Mr. Muccilli’s qualifications. Mr. Muccilli’squalifications stand alone. It is only his opinion that is being assessed. ii. Manner of testifying [70] Rabobank asserts that because Mr.

Henry spoke extemporaneously without reference to notes and answered questions “in realtime”, his evidence should be preferred to that of Mr. Muccilli, whom Rabobank criticized for reading from his report and adding detailfrom notes he made prior to testifying. [71] There was nothing about the manner in which either expert gave his evidence that causes me to prefer one over the other.Both experts presented their evidence in a professional and straight-forward manner. iii. Mr. Muccilli’s review of questioning transcripts [72] Rabobank argues that Mr.

Muccilli’s opinion should be given no weight because he relied on transcripts of the questioning ofMr. Stout and Ms. Elliott in formulating his opinion but did not articulate in his report what facts he relied upon.

Before weight can begiven to an expert opinion, the facts upon which it is based must be found to exist: R v Abbey, (SCC), [1982] 2 SCR 24at para 52. [73] Rabobank relies on Kitching v Devlin, 2016 ABQB 212, where the court stated that an expert can only rely on questioning ifhe specifies what evidence was relied on and that evidence is independently proven at trial: at para 170. [74] The issue in Kitching was whether the report of an expert who had relied on questioning transcripts should be admitted attrial.

While finding it less than ideal for the expert to rely on the transcripts, the court did not find the report inadmissible. It specifiedwhere in the report the transcript was relied upon, thus allowing the court to determine whether the references from the transcript werecorroborated by evidence at trial: at para 176. [75] Rabobank did not object to the admission into evidence of Mr. Muccilli’s report.

However, it argues that having failed in hisreport to identify the specific passages in the questioning transcripts upon which he relied, thereby preventing the court from determiningwhether the facts were independently proven at trial, his report is fundamentally undermined and his opinion that Stout exercisedappropriate professional judgment unfounded. [76] Mr.

Muccilli testified that his purpose in reviewing the transcripts was to try to understand the knowledge base of those whohad a significant role in the audits, the information they had available to them to help him to interpret the working papers files, and tohelp him to understand how they developed their professional judgment to make decisions. [77] The essential facts upon which Mr. Muccilli based his opinion were in evidence and it was clear from his opinion and hisreport what he was relying upon.

In his testimony, he described in detail his opinions and the basis for those opinions with specificreference to Stout’s audit records including the working papers, all of which were in evidence. This is not a case where an expert’sopinion is based on unproven facts.

iv. Information reviewed by Mr. Henry [ 78 ] Stout makes the reverse of Rabobank’s argument with respect to materials reviewed and relied upon by Mr. Henry. It submits that Mr. Henry’s opinion should be given little weight because he based his opinion on incomplete information. [ 79 ] When an expert fails to consider, or is unaware of, relevant and material facts, the value of his opinion may be limited. Stout argues that this is the case here. Mr. Henry limited his reviewed to Stout’s working paper files for the two audits in issue, the 2009 and 2010 audits.

He did not review or consider Stout’s permanent client file, the working paper files for prior audits conducted by Stout in 2008 of the 2007 financial statements, and in 2009 of the 2008 financial statements, nor Stout’s reports to Agra’s Board of Directors. [ 80 ] Rabobank submits that it was not necessary for Mr. Henry to review anything other than the working papers for the 2009 and 2010 audits conducted in 2010 and 2011, respectively, because the audit standards require the auditors to include in its working papers the audit work that the auditor has done to support the audit report.

CAS specifically provides that the auditor prepare audit documentation that is sufficient to enable an experienced auditor with no previous connection with the audit to understand the audit procedures performed, the results of the procedures and significant matters performed during the audit, the conclusions reached and the significant professional judgments made in reaching the conclusions.

Stout acknowledged that its working papers documented the audit teams’ work. [ 81 ] The audit standards provide that an auditor must make a judgment in light of the facts and circumstances known to the auditor at the time the audit report is issued. In limiting his review to the working papers for the 2009 and 2010 audits, Mr. Henry failed to consider everything known to Stout. As discussed later in these Reasons, his opinion allowed no room for the exercise of judgment by Stout based on all of the facts and circumstances known to it at the time of the audits.

It would be artificial to assess whether Stout met the standard of care without taking into consideration everything known to it, whether that information was documented in the 2009 and 2010 working papers, the working papers for other audits, or Stout’s permanent file. By not reviewing Stout’s permanent file or its working papers for audits prior to the 2009 and 2010 audits, Mr. Henry was unaware of relevant and material information known to and considered by Stout in accepting the initial and subsequent audit engagements and in assessing the risk of fraud. I agree with Mr.

Muccilli that not all matters considered, nor all judgments made, need to be documented. It is neither necessary nor feasible to do so. All of the documents as a whole must be considered in assessing whether Stout met the standard of care. [ 82 ] Mr. Henry’s limited review appears to have arisen from his opinion that, irrespective of any other information known to, or considered, by Stout, there were four fraud risk factors present in this case that, collectively, created a high risk of fraud. Any additional information, therefore, would be irrelevant to Mr. Henry’s opinion.

As discussed later in these Reasons, the approach taken by Mr. Henry in assessing whether the standard of care was met by Stout is problematic. As a result, less weight has been given to Mr. Henry’s opinion. v. The Benefit of Hindsight [ 83 ] Stout submits that Mr. Henry’s evidence was given with the benefit of hindsight because he knew that the bank had been defrauded of approximately $42Million (USD) when preparing his report. It was only through confirmations from suppliers and customers to verify the cost of sales and sales reported in the financial statements that the fraud could have been discovered.

Such confirmations would only be required if the risk of fraud was properly assessed as high. [ 84 ] Both experts were aware of the fraud at the time they prepared their opinions. It is often, if not always, that an expert opines on a matter knowing, unlike the professionals about whose conduct and judgment the expert opines, of a negative outcome. The court, in assessing the opinions of expert, and the experts in expressing those opinions, must guard against the influence of hindsight. It is critical that a professional’s conduct not be judged from the perspective of hindsight. [ 85 ] Mr.

Muccilli was particularly cognizant in giving his opinion of the need to guard against hindsight. In contrast, I am of the view that Mr. Henry’s assessment of the judgments made by Stout was influenced by the knowledge of the fraud. He looked at it retrospectively with the benefit of hindsight and failed to allow for the exercise of judgment by Stout based on all of the facts and circumstances known to Stout at the time. [ 86 ] I now turn to an analysis of the specific breaches of the standard of care alleged by Rabobank. Breaches of Standard of Care i.

Did Stout appropriately assess whether it had the skills required to perform the audits? [ 87 ] The audit standards require that an auditor, before accepting an audit engagement, determine whether the audit team is competent to perform the audit. As part of this process, the auditor must determine the integrity of the principal owners, key management and those charged with governance of the entity to be audited. [ 88 ] Mr. Henry was of the opinion that Stout did not have the necessary competence to perform the Agra audits and ought to have declined the audit engagement.

Specifically, he was of the opinion that Stout failed to comply with the audit standards because:

a) it did not assess the skills required to audit a company with all of its operations in a foreign country; specifically, it did not assess its Spanish language capabilities or its “Mexican business acumen”; and

b) it did not consider the integrity of the owners and key management of Agra. [ 89 ] In Mr. Henry’s opinion, Stout was required to address its ability to communicate in Spanish because all of Stout’s employees, customers and suppliers were in Mexico. In his view, Spanish language capabilities were required in order for Stout to make both

internal and external inquiries in order to do proper due diligence. With respect to internal inquiries, he was of the opinion that the auditor must be able to speak to those who exercise internal controls. With respect to external inquiries, he was of the opinion that, because there was a high risk of fraud, an auditor must be able to perform substantive procedures that involve direct contact with customers and suppliers. As the customers and suppliers were in Mexico, he concluded that fluency in Spanish was required. [ 90 ] Mr.

Henry asserted that because Stout’s working papers do not document that it considered its Spanish language competencies, it can be presumed that it gave this no consideration. [ 91 ] Mr. Muccilli was of the opinion that Stout appropriately considered its competencies and resources, both in accepting the initial audit engagement in 2008 and in continuing with the engagement in the following years. [ 92 ] The evidence of both Mr. Stout and Ms.

Elliott, along with documentation in Stout’s permanent file and its working papers, confirms that Stout assessed its ability to accept the initial audit engagement in 2008 and to continue with the engagement in subsequent years. I find that Stout reasonably assessed that it had the capabilities to perform the audit. [ 93 ] One member of the Stout audit team had a working knowledge of Spanish, but none was fluent in the language. There was, however, no language barrier encountered by Stout in conducting any of the audits from the initial audit in 2008 through to the last audit in 2011.

There were no difficulties in communicating with Agra’s office manager, Ms. Rosales, or Agra’s principals, who were all proficient in English. All responses to legal questions from Stout were received in English. Substantially all of the documents, including the sales contracts and promissory notes, were in both English and Spanish. There were no difficulties in translating into English documents that were in Spanish only. [ 94 ] Rabobank pointed to no instances of Stout’s inability to review documentation or to communicate with Agra’s personnel.

Although Rabobank identified certain documents received in Spanish that were not translated, Rabobank did not demonstrate why these documents ought to have been translated or what relevance they had to the audit. [ 95 ] Stout was able to obtain an understanding of Agra’s internal controls, as the standards required it to do, by speaking to Agra’s office manager, Ms. Rosales, who was proficient in English. I accept Mr. Muccilli’s opinion over that of Mr. Henry that it was not necessary for Stout to speak to everyone at Agra who exercised internal controls.

Nor, as discussed later in these Reasons, was it necessary for Stout to speak to customers and suppliers to verify the existence of the cost of goods sold and sales reported in the financial statements, given the level of fraud it reasonably assessed. [ 96 ] Had Stout encountered problems that caused it to raise the level of fraud risk, or ought to have anticipated that this could occur, there was no evidence Stout would have been unable to speak to customers of suppliers in English or retain the services of a translator or third party proficient in Spanish to make the necessary inquiries.

Notably, the representatives of the two companies Agra listed as customers who testified at trial were proficient English. [ 97 ] With respect to Rabobank’s assertion that Stout did not have the necessary “Mexican business acumen” to conduct the audit, neither Rabobank nor Mr. Henry specified what knowledge was required that Stout lacked. Rabobank, which has extensive experience in the agriculture business in Mexico, an office in Mexico, and a long-term lending relationship with Agra, did not provide any evidence about business in Mexico that Stout should have known but did not know.

In its argument, Rabobank pointed out that Ms. Elliott had no experience with the Mexican tax system or regulatory framework. However, she testified that during the course of the audits no problems with the tax system or regulatory framework were encountered. Rabobank provided no evidence about the Mexican tax system or regulatory framework that was required for the audit but lacking by Stout. [ 98 ] With respect to the requirement to assess the integrity of management in making its decision to accept the audit engagement and to continue with subsequent audits, neither Mr.

Henry nor Rabobank pointed to any facts or circumstances that should have caused Stout to question the integrity of Agra’s owners and management. As Mr.

Henry’s opinion was based on the working papers for the 2009 and 2010 audits, he was unaware of the extensive inquiries and investigations carried out by Stout prior to accepting the initial audit engagement and was unaware of Stout’s experience in conducting the audits prior to the 2009 and 2010 audits. [ 99 ] In considering whether to accept the initial audit engagement in 2008, Stout did assess whether it had the necessary skills to accept the audit engagement. It carried out investigations to understand both Agra’s business and its principals. Stout spoke with Agra’s previous auditor, Mr.

Keown, an Alberta-based chartered accountant who continued to assist Agra with its bookkeeping and the preparation of quarterly and annual financial statements. Stout reviewed the working papers for the previous audits conducted by Mr. Keown. Mr. Keown gave Stout documentation showing a typical Agra business transaction and informed Stout that Agra’s personnel were good to deal with. He told Stout that the Agra audit would be a good file for Stout to take on. Mr.

Keown did not identify any professional reasons why Stout should not accept the audit. [ 100 ] Before accepting the initial audit engagement in 2008, Stout spoke with Mr. Dave Horner of Horner Co., a well-respected Canadian businessman, who was at the time a shareholder of Agra. Mr. Horner assured Stout that Mr. Guzman, one of the two Mexican principals of Agra, whom Mr. Horner had known for 20 years, was a reputable businessman. Stout inquired of Mr. Horner whether there were any “kickbacks” or money-laundering going on. Mr. Horner assured Stout that, to the best of his knowledge, there was not. [ 101 ] Mr.

Horner also provided Stout with information about the factoring of Agra’s receivables to Rabobank including the security and cash collateral account requirements in the MRPA. He informed Stout that Agra had 25 customers, all of which had been pre- approved by the receivables insurer, and that the Mexican customers had signed a “pagare”, a financial instrument equivalent to a promissory note. Mr.

Horner also advised Stout that Agra had attempted unsuccessfully to have Rabobank reduce its fees and had been unsuccessful in finding another bank. [ 102 ] Prior to accepting the initial audit engagement in 2008, Stout also spoke with Ms. Whalen, who was a representative of the insurer, and with Mr. Guzman. In addition, it performed an internet search of Agra, its subsidiaries and principals. Nothing of concern was identified. Stout also reviewed the MRPA to understand the flow of funds. It obtained a copy of the receivables insurance policy.

[103] No problems or lack of cooperation by Agra’s staff or management and no issues with communication had been noted by thepredecessor auditor. Further, nothing of concern arose during any of the audits performed by Stout. It had total cooperation from Agra’smanagement and staff throughout. There were no instances of interference by Agra’s staff or management during any of the audits. [104] There were no breaches of the law or regulations. Nothing unusual was noted on internet searches of Agra, its subsidiaries or itsprincipals. No instances of management overriding controls were identified.

No information came to light that caused Stout to questionthe honesty or integrity of Stout’s management, nor has Rabobank identified any information that ought to have raised a concern. Despiteits expertise in the agricultural business in North America, including in Mexico, its long-term relationship with Agra, its own annualcollateral inspections of Agra – the purpose of which was to confirm the validity and existence of its collateral – and its review processfor each new receivable prior to purchase, Rabobank pointed to no instances of lack of integrity of Agra’s personnel.

To the contrary,Rabobank concluded, as did Stout, that Agra’s principals were trustworthy. [105] I find that Stout met the standard of care of a reasonable auditor in accepting the initial audit engagement in 2008 and incontinuing with the subsequent audit engagements. Stout carried out appropriate investigations to understand Agra’s business andreasonably assessed its capabilities and knowledge to perform the audits. It reasonably considered the honesty and integrity of Agra’sowners and key management. I accept Mr.

Muccilli’s opinion that Stout appropriately documented in its working papers that itconsidered its level of expertise, relevant industry knowledge and staffing. Stout had the necessary knowledge, experience and skills tocarry out the audits. ii. Did Stout Perform an Adequate Fraud Risk Assessment and Design and Carry Out the Appropriate AuditProcedures to Obtain Sufficient Audit Evidence to Support its Audit Opinions? [106] Stout was required to assess the risk of material misstatement in the financial statements due to fraud.

The appropriateassessment of fraud risk by an auditor is critical because it drives the planning and performance of audit procedures. The purpose ofidentifying the risk profile is to assess the level of evidence and testing required to support the audit opinion. [107] The level of suspicion that the particular circumstances ought to arouse on the part of the auditor is central to the determinationof whether the required standard of care was met: Revelstoke Credit Union v Miller, (BC SC), [1984] 2 WWR 297(BCSC) at 303-304. It is not necessary that there be a suspicion of fraud.

The obligation of the auditor is to “probe to the bottom” when“exposed to knowledge or information which might affect his opinion”: Revelstoke at 304. The question is whether suspicion is or shouldbe aroused.

As stated in Ronald Foerster, Accountants’ Liability in Canada (Toronto: Carswell, 2011) at 6-27 to 6-28, an auditor mustinvestigate until he is “reasonably able to support the opinion” and if “suspicions are or reasonably should have been aroused”, theauditor must “continue to investigate until those suspicions are reasonably resolved.” [108] “Reasonable assurance” is defined in the audit standards as a high, but not absolute, level of assurance.

An auditor must designand perform the audit to obtain sufficient appropriate audit evidence to give the audit opinion. [109] An audit is a review of financial statements to obtain reasonable assurance that the financial statements as a whole are free frommisstatement, whether from fraud or error. An audit is not a fraud investigation. As Mr. Muccilli testified, an audit is a very limitedexercise in fraud detection and prevention. Fraud is difficult to detect in audit circumstances by the public account.

There are inherentlimitations in an audit and much of the audit evidence available to an auditor is persuasive rather than conclusive in nature. Thedifficulties in discovering a fraud in the course of an audit were outlined by Mr. Muccilli in his testimony as follows: The discovery of well-considered or orchestrated fraud, especially involving upper management, and with accounting staff collusion,would be even less likely to be discovered under typical audit procedures. Since it’s possible for internal controls, even if they exist, to beoverridden and there’s likely an effort to conceal this misstatement.

Furthermore, collusion may cause the auditor to believe that audit evidence is persuasive when it is in fact false. Collusion amongmanagement may result in the fabrication of circumstances, documents to defeat typical audit procedure. … Audit procedures aren’t some big secret. The perpetrators understand what the auditor is doing.

And with enough cooperating amongdifferent people in management and in the accounting function, they can create circumstances purposely to defeat the audit steps thatthey know their auditor’s going to take. [110] It is evident that the fraud perpetrated upon Rabobank was well-orchestrated. Many were deceived. Nothing unusual orsuspicious was revealed during any of the audits. The fraud went undetected by Rabobank despite its extensive experience with Agra andits principals, and despite its knowledge of Agra’s business and the industry in Mexico.

It went undetected despite Rabobank’s annualcollateral inspections, the purpose of which was to confirm the existence of the collateral, here, the receivables it purchased from Agra. Itwent undetected by the receivables insurer. It went undetected by Mr. Keown, Agra’s former auditor who continued to assist Agra withits bookkeeping and preparing financial statements at the time of the 2009 and 2010 audits. An extensive forensic investigation byDeloitte on behalf of Rabobank revealed only a partial picture of what occurred.

Who was involved in the fraud and how it wasperpetrated remain unknown. [111] Given the inherent limitations of an audit, there is an unavoidable risk that some material misstatements in the financialstatements will not be detected despite a properly planned and performed audit. It is for this reason that the engagement letter betweenthe auditor and the audited company provides that it is the responsibility of management to prevent and to detect fraud. This does notmean that the auditor has no responsibility with regard to detecting fraud. The auditor clearly does.

As stated, the auditor’s responsibilityis to obtain reasonable assurance that the financial statements are free from material misstatement, whether due to fraud or error. [112] The audit standards require the auditor to identify and to assess the risks of material misstatement due to fraud in order toappropriately design and perform the audit. The standards direct that professional skepticism be maintained by the auditor recognizing

the possibility of a material misstatement due to fraud notwithstanding the auditor’s past experience with the entity about the honesty and integrity of management. [ 113 ] Stout assessed the risk of fraud as low to moderate and the overall risk of material misstatement, whether due to error or fraud, as low. It planned and carried out its audits in accordance with that assessment of the risk. It was not suggested by Mr. Henry or by Rabobank that the procedures carried out by Stout were inadequate for a low risk of fraud.

Nor was it suggested by Stout that the audit procedures it performed were appropriate where the risk of fraud is high. The critical question, therefore, is whether Stout’s assessment of the fraud risk met the standard of care. Specifically, ought it to have assessed the risk of fraud as high and, as a result, confirmed the existence and accuracy of the cost of goods sold and sales by direct contact with suppliers and customers. [ 114 ] In Mr.

Henry’s view, a combination of four risk factors created a high risk of fraud in respect of Agra’s audits: 1. inadequate segregation of duties; 2. significant operations conducted across international jurisdictions where differing business environments and cultures exist; 3. domination of management by a single person or small group; and, 4. the need to obtain additional debt financing to stay competitive. [ 115 ] It is not disputed that Stout recognized and considered the fourth factor identified by Mr. Henry.

Rabobank submits that Stout was negligent in failing to consider the other three factors and in failing to recognize that the four factors in combination created a high risk of fraud. It argues that as the audit standards require an auditor to record all significant issues and judgments, it can be concluded that because Stout mentioned only the one factor in the fraud risk registry in its working papers, it did not consider the other three. [ 116 ] Mr. Muccilli acknowledged that the audit standards include a list of potential fraud risk factors including the four identified by Mr.

Henry and that the four factors identified by Mr. Henry were risk factors to be considered. In his view, the level of fraud risk was a matter of professional judgment for the auditor taking into consideration all the circumstances known to it. He did not agree with Mr. Henry that the presence of these four factors compelled the conclusion that the risk of fraud was high.

(1) Need to Obtain Additional Debt Financing to Stay Competitive [ 117 ] Mr. Henry acknowledged that during its engagement acceptance process Stout identified Agra’s financial condition as a risk factor. Stout assessed this is a moderate risk factor, as Agra had incurred losses in the last three years and only had some cash resources as opposed to excess cash. [ 118 ] Information about the nature of Agra’s type of business and the typical gross margins was also obtained from Mr. Parry, a businessman who had customers similar to those of Agra and was knowledgeable in the agriculture business.

While acknowledging that the modest gross margins were not a red flag in the commodities business, Mr. Henry suggested that Stout ought to have questioned why Agra was continuing to operate with no obvious indications of profitability. Mr. Henry’s suggestion that Agra’s modest gross margins would “heighten his tentacles” during the fraud risk assessment. [ 119 ] Stout clearly considered Agra’s financial condition and cash flow and assessed this as a moderate risk factor. In my view, Mr.

Henry’s observation that Agra’s modest gross margins would have heightened his concern about the risk of fraud reflects the knowledge of hindsight.

(2) Lack of Segregation of Duties [ 120 ] Lack of segregation of duties creates the potential for employee fraud. As explained by Mr. Muccilli, employees at the non- management level have enough power to manipulate both cash flow and accounting records to their benefit. In a small company, segregation of duties is impractical. Where there is strong management presence, however, as there was in Agra, the risk of fraud from lack of segregation of duties is mitigated. Mr. Muccilli noted that the impact on fraud from segregation of duties when there is significant management involvement is quite low.

With smaller organizations, collusion among more than just management is generally necessary to orchestrate a fraud. As a result, fraud is difficult to detect. [ 121 ] The risk of fraud arising from lack of segregation of duties was expressly recognized by Stout. It made specific note in its working papers that because of the small size of the company, there was little segregation of duties. Stout identified the oversight by the stakeholders, who were involved in the day-to-day business, as mitigating the risk because they could monitor how transactions were posted.

The stakeholders had invested significant funds and had an interest in ensuring both the profitability of the company and that fraud was not committed against the company. [ 122 ] Rabobank acknowledged that Stout recognized the lack of segregation of duties. It argues that Stout’s error was in considering the involvement of Agra’s management/owners, Messrs. Herrera and Guzman, as a mitigating factor regarding employee fraud, but failing to consider it a risk with respect to management fraud.

Rabobank submits that Stout’s fundamental failing was in not identifying and addressing the risk that management’s involvement may create an opportunity for fraud. This relates to management override of controls, which is addressed below.

(3) Significant Operations Conducted Across International Borders [ 123 ] Stout was fully aware that all of Agra’s operations were in Mexico. Ms. Elliott acknowledged that significant operations conducted across international borders is a risk factor identified in the standards. She presented as a careful, thorough, honest and thoughtful professional. I accept her evidence that this factor was considered.

[ 124 ] I also agree with Mr. Muccilli that it was intuitive that Stout considered this factor. Not noting it in the risk registry in the working papers does not mean it was not considered. There was nothing about the specific circumstances of these audits that caused Stout to specifically note it as a factor that needed to be addressed by audit procedures beyond those that are mandated by the audit standards to address the risk of fraud that is presumed to exist in every audit. [ 125 ] Rabobank pointed to nothing specific with respect to Agra’s business being in Mexico that ought to have aroused Stout’s suspicion.

(4) Management Override of Controls [ 126 ] Internal controls are the controls and the control environment that management has created and maintained for the culture of honest and ethical behaviour. They are procedures and processes put in place to mitigate the risk of not achieving one of the attributes, i.e., completeness, existence, accuracy and valuation of particular accounts or transactions. [ 127 ] The risk associated with the possibility of management override of controls lies at the heart of Rabobank’s argument that Stout breached the standard of care. In Mr.

Henry’s view, the risk of management override of controls where there was a lack of segregation of duties required Stout to confirm the existence of the cost of the goods sold and the sales directly with suppliers and customers because of the risk of fraud was high. [ 128 ] Stout performed audit procedures that were designed to test internal controls, but also provided evidence of the existence and accuracy of the cost of goods sold and the sales by document review. In Mr.

Henry’s opinion, these audit procedures were a waste of Stout’s time because they could not provide sufficient assurance where the risk of fraud was high. The procedures performed by Stout are not sufficient where there is a high risk of fraud. For example, confirmation of cash recorded in bank statements does not provide conclusive evidence that sales transactions exist.

Confirming that an amount in bank records corresponds to an invoice does not show where the money is coming from and, therefore, is not proof of payment. [ 129 ] There is no dispute that the opportunity for management override of controls creates a risk of fraud. As explained by Mr. Muccilli, dominance by management in a very small management group is both a positive and a negative. Management oversight can compensate for defective controls and reduce the risk of employee fraud. However, it creates an opportunity for management override of internal controls put in place to prevent fraud.

In particular, CAS 204(31) specifically recognizes that “management is in a unique position to perpetrate fraud because of management’s ability to manipulate records and prepare fraudulent financial statements by overriding controls that otherwise appear to be operating effectively.” Further, CAS requires the auditor to maintain professional skepticism throughout the audit, considering the potential for management override of controls, and to recognize that audit procedures that are effective for detecting error may not be effective for detecting fraud, as fraud is intentional.

The audit standards confirm that an auditor must recognize and take into account in assessing the risk of fraud that an owner/manager may be more able to override controls when the system of internal controls is less structured. [ 130 ] As Mr. Muccilli stated, domination of management by a few individuals does not necessarily indicate the failure of management to display and to communicate an appropriate attitude toward internal controls.

Smaller, owner-managed entities with fewer individuals in management may not have formal internal controls or processes to address risk but this does not, in and of itself, indicate a higher risk of fraud. It does not necessarily indicate a failure of management to display and communicate an appropriate attitude with respect to internal controls. The audit standards direct the auditor to consider whether management has instilled a culture of honesty and cultural behaviour based on a strong set of values as part of management’s responsibility to prevent and detect fraud.

Stout specifically noted that management, with the oversight of those charged with governance, had created and maintained a culture of honesty and ethical behaviour. [ 131 ] The audit procedures performed to obtain evidence of the existence and accuracy of transactions is subject to the judgment of the auditor. While agreeing that reviewing bank statements does not prove payment from the actual customer, Mr. Muccilli noted that it does prove payment made on a specific receivable. Confirming receipt of the receivable gives comfort that it was paid based on the contract.

It usually proves payment from the actual customer, although it did not in this case. I accept Mr. Muccilli’s opinion that an auditor must obtain external confirmation if there are red flags – some reason to disbelieve the information. Direct external confirmation is necessary when there is no corroborative information available and certain fraud risks that which prevent the auditor from relying on evidence provided by the entity. That, however, was not the case here. [ 132 ] I agree with Mr. Muccilli that it is clear from the working papers that Stout considered management override from a risk perspective. Ms.

Elliott acknowledged that there is a risk of management override of controls in every audit, and that where internal controls are less structured an owner/manager may be more able to override controls. She agreed that an auditor must take this into account. I accept her evidence that this was taken into account in the Agra audits. To use Mr. Muccilli’s words, the possibility of management override of controls was “clearly on Stout’s radar.” Stout did not, as asserted by Rabobank, fail to exercise professional skepticism. [ 133 ] I accept Mr.

Muccilli’s opinion that the audit standards do not require direct confirmation with third parties when there is a risk of management override of controls because that risk is present in every audit. It is a matter of judgment for the auditor, based on its assessment of the risk, whether direct confirmation is required. I agree with Mr. Muccilli that the potential for override of controls by management does not suggest a high risk circumstance; otherwise, every audit would be a high-risk audit since the potential is always present.

I find that Stout reasonably assessed the overall risk of fraud as low and performed the appropriate audit procedures for that assessed risk. [ 134 ] Although the level of risk varies from entity to entity, the audit standards presume the risk of management override of controls and require that the auditor test for it. The audit standards require that an auditor presume there are risks of fraud in revenue recognition.

For example, GAAS requires that the auditor address the risks of fraud in revenue recognition and provides that “the auditor ordinarily presumes that there are risks of fraud in revenue recognition and considers which types of revenue, revenue transactions or assertions may give rise to such risks.” Stout addressed this presumed risk in its audit procedures.

[ 135 ] Stout performed all the mandated testing to address the assumed risk of management override of controls. For example, the standards require the auditor to test the appropriateness of journal entries in the general ledger because management can influence them. The standards also require that the auditor review accounting estimates for management bias, for example, estimates of depreciation of significant assets, and to look for unusual transactions.

Nothing of concern showed up in any of these tests. [ 136 ] Stout identified the lack of a formal risk assessment by management and large director/shareholder loans. It noted that there were no instances of known risk of management override of controls or known instances of management’s lack of integrity. It noted that were no significant pressures on management to meet targets or bonus thresholds and there were minimal opportunities for management override and other frauds.

Stout examined the specific potential for management override by testing expenses to ensure accuracy and testing sales cut-offs and allowances for doubtful accounts and bad debts, matters under management control. Nothing of concern arose. There were no difficulties in dealing with management or in obtaining documents. In Mr. Muccilli’s opinion, all the typical red flags were not there. [ 137 ] Stout identified a modest risk with respect to management bias to over-state revenues.

It concluded that controls over related transaction streams processes were expected to be reliable and, therefore, proceeded to a test of controls. Stout examined and tested internal controls and concluded that internal controls over revenue and cost of sales were expected to be reliable. It performed a test of internal controls that also provided substantive evidence of the existence and accuracy of sales and the cost of goods sold.

It concluded that fraud did not need be addressed with further audit procedures. [ 138 ] A test of controls is an audit procedure designed to evaluate the operating effectiveness of controls at preventing and detecting material misstatement. The purpose of a test of controls is to assess whether controls are adequate to ensure a transaction existed and is accurately recorded. It is important to understand, as explained by Mr.

Muccilli in his expert report, that an audit of financial statements, which is done with a view to providing reasonable assurance that the financial statements are not materially misstated, does not anticipate testing internal controls to prevent material fraud. Internal controls are considered by the auditor to be relevant to the entity’s preparation and fair presentation of financial statements in order to design audit procedures appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity’s internal controls .

An auditor looks at the strength of internal controls. In contrast, a fraud investigator evaluates their weaknesses to establish the mode of fraud, how it was perpetrated and how possible recoveries might proceed. A fraud investigator has a much lower, if any, threshold with respect to materiality. [ 139 ] To test controls, the auditor does a walk-through of the company’s system from receipt of a supplier’s invoice through to the sale to a customer to ensure that controls are the same processes that management represented were in place.

Stout selected a sample of transactions (25 in the 2009 audit and 35 in the 2010 audit) and matched the invoices to product purchases by Agra and sales to customers. [ 140 ] For the selected sample of transactions Stout compared invoices, contracts, bank statements, promissory notes, suppliers’ invoices, and amounts recorded in accounts and the general ledger to obtain substantive evidence of the transactions. Approximately $10 Million (USD) in sales was audited.

Stout examined contracts for approval, invoices for authorization, shipping documents as proof of delivery and bank statements as evidence of receipt of cash. It tested subsequent receipt of accounts receivable for amounts over $600,000 (USD) by matching sales contracts to ensure they were sales related to the year, and to bank statements to determine if payment was received. [ 141 ] Stout also obtained confirmation from Rabobank of payment of the receivables. This gave Stout a significant degree of comfort.

By the time Stout signed off on its audit report, everything in the financial statements would have cleared the bank. Cash would have been collected and suppliers would have been paid. As a result, as noted by Mr. Muccilli, Stout would take comfort that collections were done to the dollar based on the contracts. [ 142 ] As stated, although examination of contracts for approval and invoices for authorization is a control-based test, it also provides substantive evidence of the transaction.

In Stout’s opinion, these dual-purpose tests provided sufficient evidence of the existence and accuracy of the transactions for the assessed risks. In its opinion, it was not necessary to contact suppliers or customers to verify the transactions. [ 143 ] In addition to his criticism of Stout for its manner of testing internal controls, Mr. Henry criticized Stout for obtaining an understanding of Agra’s internal controls by speaking only to Ms. Rosales, the employee in charge of administration.

In his opinion, not only should Stout have spoken to everyone who exercised controls, it should have observed them exercising the control, preferably using original documents. [ 144 ] CAS requires the auditor to obtain evidence about the design and implementation of relevant controls. The auditor may do so in a number of ways, including inquiring of entity personnel, observing the application of specific controls, inspecting documents and reports, and tracing transactions through the information system relevant to financial reporting.

Inquiry alone is not sufficient to gain an understanding of controls. [ 145 ] In Mr. Muccilli’s opinion, observing a paper trail suffices to obtain an understanding of internal controls. It was not necessary that Stout speak to every person involved in exercising controls or observe each person performing the controls being tested. The purpose of obtaining an understanding of controls is to design a test of the controls. It is often the case that an auditor obtains an understanding of controls from one person. In Mr.

Muccilli’s view, it is not necessary or practical to observe controls being used by each person involved in order to gain an understanding of and to test those controls. [ 146 ] It did not make sense to Mr. Muccilli, nor does it to me, that observation of each person performing a control was required to understand internal controls. Stages of a transaction can take place over months. For example, watching a document get signed and three months later watching another document get signed is not necessary to obtain an understanding of controls. Observation of a signature on a contract is an observation.

It is not necessary to watch someone sign a contract, put it in a fax machine and send it. As Mr. Muccilli explained, what is important is that the auditor understand the internal controls because that affects the auditor’s understanding of the business, and its processes and risks. It is not necessary to rely on those internal contro

[…]