A Ponzi scheme pays returns to earlier investors with money taken in from later investors, not from profits of a real business or portfolio. It needs a steady inflow of new money. When inflows slow, or enough investors ask for money back at once, it collapses. The SEC's investor education site, Investor.gov, uses this description.
Auditors meet Ponzi schemes in three places: when auditing a fund, adviser or other investment-holding entity, when a client reports unusually steady investment income, and when a client's own money is placed with a promoter. This guide covers the red flags, what the books look like, and the procedures that separate a real portfolio from a fictional one.
What makes a Ponzi scheme different from other fraud
Most occupational fraud takes money out of an entity. A Ponzi scheme is an entity that exists to take money in, with reported gains that are not real. The entity's own financial statements are therefore part of the deception: statements, account balances and performance reports are produced to make the scheme look like an investment business.
Two features matter for audit planning:
- Reported assets do not exist or are far smaller than reported. The main audit risk is existence of investments and cash, not valuation.
- The paperwork is built to pass a superficial review. Statements on letterhead, internal ledgers and a cooperative manager do not substitute for evidence from an independent source.
Red flags in the investment itself
Investor.gov lists warning signs that investors, and advisers to them, should treat as serious. They include:
- high returns with little or no risk, and "guaranteed" returns
- overly consistent returns that stay steady regardless of market conditions
- investments that are not registered, and sellers that are not licensed or registered
- secretive or complex strategies that the manager will not explain
- problems with account statements and other paperwork
- difficulty receiving payments or withdrawing money
An auditor of an entity that holds an investment like this should treat each as a fraud risk factor under AU-C 240. Several appear at once in nearly every scheme.
Red flags in the books and the engagement
- Returns do not behave like the market. A portfolio said to hold equities that reports small positive returns in every month, including months when the market fell sharply, needs an explanation tested against trade records.
- No independent custodian. The manager holds the assets, or the only custodian is an affiliate or a small unknown firm.
- The manager controls all the paper. Statements arrive from the manager, not from the broker or custodian.
- Cash does not tie. Investor deposits, redemptions, distributions and fees do not reconcile to a bank account the auditor can confirm.
- A very small or unfamiliar auditor. The firm signing the fund's audit lacks the staff, experience or independence to examine a large portfolio.
- Related-party flows. Loans to the manager, transfers between funds and payments to affiliates that are not on arm's-length terms. See related party transactions.
- Pressure on the timeline. The client resists third-party confirmations, delays access to the custodian, or offers to "send it for you."
Audit procedures that test existence
Confirm directly with the custodian. Send confirmations for securities and cash to the independent custodian or broker, and control the process: address the request yourself, receive the reply yourself, and agree the confirmed positions to the ledger. A statement the manager forwards is not a confirmation. See audit confirmations under AU-C 505 and external confirmation.
Trace trades to settlement. For a sample of purchases and sales in the year, agree the ledger entry to the broker confirmation, then to the cash movement in the bank account, then to the custodian's activity statement.
Prepare a cash-in versus cash-out analysis. Total all money received from investors, all money paid out as redemptions, distributions and fees, and compare the remainder with confirmed cash and securities at cost. A gap between what the books say the investors own and what independent sources confirm is the signature of a Ponzi scheme.
Recompute returns. Recalculate reported performance from confirmed positions and prices, not from the manager's report. Compare to the relevant market benchmark.
Examine investor activity. Review subscriptions and redemptions around year-end. A scheme that pays redemptions only from new subscriptions often shows a pattern of new deposits arriving shortly before large payouts.
Reassess the team. Does your firm have the competence and independence to audit this client? See professional skepticism.
Worked example: cash-in versus cash-out
Illustrative numbers. A manager's statements show investors' accounts totaling $17,000,000 at year-end. The auditor assembles the entity's cash records for the life of the fund:
| Item | Amount |
|---|---|
| Subscriptions received from investors | $14,000,000 |
| Redemptions paid to investors | ($6,500,000) |
| Distributions labeled as "profit" paid to investors | ($2,100,000) |
| Management fees and other expenses paid to the manager | ($1,500,000) |
| Cash that should remain | $3,900,000 |
The independent custodian's confirmation shows $3,900,000 in cash and securities. The reported investor balances exceed what exists by $17,000,000 - $3,900,000 = $13,100,000. Reported profits were never earned; the "distributions" came from other investors' subscriptions. The auditor stops and reconsiders the entire engagement: the reliability of management's representations, whether the fraud involves management, and what must be communicated and to whom. This is a matter for those charged with governance and, on advice of counsel, possibly outside parties.
The SEC custody rule and fund audits
Under the SEC's custody rule for investment advisers (Rule 206(4)-2 under the Investment Advisers Act), an adviser that has custody of client funds or securities must have an independent public accountant verify them through a surprise examination, with an alternative for pooled investment vehicles: an annual audit of the pool's financial statements, distributed to investors within 120 days of fiscal year-end, by an accountant registered with and subject to inspection by the PCAOB. If your firm audits private funds, review the SEC's current staff guidance on the audit provision and its extended deadlines for funds of funds.
The auditor of such a fund is expected to be independent and competent in the work, and its report is one of the checks investors rely on. The case of Bernard Madoff's accountant is the best known example of that check failing: David Friehling pleaded guilty on November 3, 2009 to securities fraud and false filings with the SEC, among other charges, arising from his audit work for Madoff's firm.
Common mistakes
- Accepting a custodian statement that came through the client.
- Testing reported income without testing whether the underlying investments exist.
- Treating consistency of returns as a sign of stability.
- Reasoning that a long relationship with the client lowers risk.
Frequently asked questions
What is the difference between a Ponzi scheme and a pyramid scheme?
A Ponzi scheme pays existing investors from new investors' money while claiming to run an investment business. A pyramid scheme pays people for recruiting others. Both depend on a steady supply of new participants.
How do auditors detect a Ponzi scheme?
By testing existence with evidence from independent sources: direct confirmations from the custodian, trade tracing to settlement, and a reconciliation of all cash from investors to assets that can be confirmed.
Is the auditor liable if a client turns out to be a Ponzi scheme?
It depends on the facts, including whether the audit followed professional standards, the engagement terms and applicable law. Liability is a legal question for counsel.
What should a bookkeeper or controller do if they suspect one?
Tell the owner or board, document what they saw, and seek legal advice. Do not alter records or warn the promoter.
Sources
- SEC, Investor.gov, Ponzi Scheme, investor.gov
- SEC, Custody of Funds or Securities of Clients by Investment Advisers, Release IA-2968 (2009) and staff FAQs on the custody rule, sec.gov
- AICPA, AU-C 240 and AU-C 505, in AICPA Professional Standards
- Accounting Today and Journal of Accountancy, reports on the Friehling plea (November 2009)
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error