acfe fraud prevention check-up - BKD

Fraud Risk Management Program ComponentsMost organizations have written policies and procedures to manage fraud risks, such as codes of conduct, expenseaccount procedures, and incident investigation standards. They usually have some activities that managementhas implemented to assess risks, ensure compliance, identify and investigate violations, measure and report theorganization’s performance to appropriate stakeholders, and communicate expectations. However, few havedeveloped a concise summary of these documents and activities to help them communicate and evaluate theirprocesses. We refer to the aggregate of these as the fraud risk management program (“program”), even if theorganization has not formally designated it as such.It is management’s prerogative, with oversight from the board, to determine the type and format of documentationit wishes to adopt for its program. Suggested formats include:• A single comprehensive and complete document that addresses all aspects of fraud risk management (i.e., afraud control policy 21 ).• A brief strategy outline emphasizing the attributes of fraud control, but leaving the design of specificpolicies and procedures to those responsible for business functions within the organization.• An outline, within a control framework, referencing relevant policies, procedures, plans, programs, reports,and responsible positions, developed by the organization’s head office, divisions, or subsidiaries. 22While each organization needs to consider its size and complexity when determining what type of formaldocumentation is most appropriate, the following elements should be found within a fraud riskmanagement program:CommitmentThe board and senior management should communicate their commitment to fraud risk management. One methodwould be to embed this commitment in the organization’s values or principles and code of conduct. Another methodis issuing a short document (e.g., letter) made available to all employees, vendors, and customers. This summarydocument should stress the importance of fraud risk mitigation, acknowledge the organization’s vulnerability tofraud, and establish the responsibility for each person within the organization to support fraud risk management.The letter should be endorsed or authored by a senior executive or board member, provided to employees as partof their orientation process, and reissued periodically. The letter could serve as the foundation for, and may be theexecutive summary of, a fraud control policy.Fraud AwarenessAn ongoing awareness program is a key enabler to convey fraud risk management expectations, as well asan effective preventive control. Awareness of fraud and misconduct schemes is developed through periodic21For examples of fraud control policies, see Appendices B and C.22Some organizations centralize fraud risk management information under the chief ethics officer or within a framework used by internalauditing or the chief financial officer. Others may have this information spread out across the organization — for example, investigationstandards and files in legal, hiring and training information in human resources, hotline information in internal auditing, risk assessment in theenterprise risk management group — and will need to compile it to do an effective evaluation and to enable concise reporting to the board.16