FRAUD RISKS Flashcards
What is fraud?
“Any illegal act characterized by deceit, concealment, or violation of trust. These acts are not dependent upon the threat of violence or physical force. Frauds are perpetrated by parties and organizations to obtain money, property, or services; to avoid payment or loss of
services; or to secure personal or business advantage.”
What are three main types of fraud?
1) Fraudulent financial reporting
2) Misappropriation (theft) of assets
3) Corruption
What are the three conditions necessary for committing fraud?
1) The person must be motivated to commit the fraud.
2) The person must have the opportunity to commit the fraud.
3) The person must be able to rationalize the fraud. Collectively, these three elements are called the fraud triangle. If the company can eliminate any of these three elements, the likelihood of fraud occurring is greatly
reduced.
What is the responsibility of management and the IAA in connection with fraud?
Management has the responsibility to establish and
maintain an effective control system.
The internal auditor is responsible for examining the controls to determine if they are adequate to prevent or detect fraud as well as looking for occurrences of fraud. However, the internal auditor is not responsible for
preventing fraud.
What is management override of controls?
Override of controls occurs when management overrides or in some way circumvents the controls in place in order to commit fraud.
What are the five key steps of fraud risk assessment?
1) Identify relevant fraud risk factors.
2) Identify potential fraud schemes and prioritize them based on risk.
3) Map existing controls to potential fraud schemes and identify gaps.
4) Test operating effectiveness of fraud prevention and detection controls.
5) Document and report the fraud risk assessment.
What is included in the fraud risk assessment?
- The types of fraud that have some chance of occurring.
- The inherent risk of fraud considering the availability of liquid and saleable assets, organizational morale, employee turnover, the history of fraud and losses.
- The adequacy of existing anti-fraud programs, monitoring, and preventive controls.
- The potential gaps in the organization’s fraud controls, including segregation of duties.
- The likelihood of a significant fraud occurring.
- The business impact of fraud.
What guidance is provided for auditors conducting
fraud engagements?
- Consider fraud risks in the assessment of internal control design and determination of audit steps to perform.
- Have sufficient knowledge of fraud to identify red flags indicating fraud may have been committed.
- Be alert to opportunities that could allow fraud, such as control deficiencies.
- Evaluate whether management is actively retaining responsibility for oversight of the fraud risk management program.
- Evaluate the indicators of fraud.
- Recommend investigation when appropriate.
What are red flags?
Anything that strongly suggests that an unethical or
suspicious event has taken place, or is a situation that would enable fraud to take place without detection.
What should the IAA do when there is reasonable certainty that a fraud has occurred?
If there is reasonable certainty that fraud has occurred, the CAE should notify the appropriate management level, usually the audit committee and perhaps also the board of directors.
Management then makes the decision whether or not to
start an investigation.
What role should the IAA have in respect to fraud engagements?
The specific role of the IAA in a fraud investigation should be outlined in the Charter and possibly in policies and procedures related to fraud.
The potential roles for the IAA include:
• Leading the investigation,
• Being a supporting resource to another party leading the investigation, or
• No role at all if the IAA does not have the resources.
What should the IAA do when conducting a fraud investigation?
• Assess the probable level and extent of complicity in the fraud within the organization.
• Determine the knowledge, skills, and other competencies needed to effectively carry out the investigation.
• Design procedures to identify the perpetrators, the extent of the fraud, the techniques used, and the cause of the fraud.
• Coordinate activities with management personnel, legal counsel, and other specialists as appropriate throughout the course of the investigation.
• Be aware of the rights of alleged perpetrators and personnel within the scope of the investigation
and the reputation of the organization itself.
What should the IAA do at the conclusion of a fraud investigation?
• Determine if controls need to be implemented or strengthened.
• Design engagement tests to help disclose frauds in the future.
• Maintain sufficient knowledge of fraud to identify
future incidents.
What is the first principle in Managing Business Risk Fraud: A Practical Guide
Principle 1: As part of an organization’s governance structure, a fraud risk management program should be in place, including a written policy (or policies) to convey the expectations of the board of directors and senior
management regarding managing fraud risk.
What is the second principle in Managing Business Risk Fraud: A Practical Guide
Principle 2: Fraud risk exposure should be assessed periodically by the organization to identify specific potential schemes and events that the organization needs to mitigate.
Ongoing risk management should consider three questions:
• How could someone exploit a weakness in the system?
• How could someone override or circumvent controls?
• How could someone conceal the fraud?
