acfe fraud prevention check-up - BKD

Organizations can identify and assess fraud risks in conjunction with an overall enterprise risk assessment oron a stand-alone basis.Guidance for conducting a fraud risk assessment is provided in this section of the guide. Organizations can tailor thisapproach to meet their individual needs, complexities, and goals.The foundation of an effective fraud risk management program should be seen as a component of a largerenterprise risk management (ERM) effort and is rooted in a risk assessment that identifies where fraud may occurand who the perpetrators might be. To this end, control activities should always consider both the fraud scheme andthe individuals within and outside the organization who could be the perpetrators of each scheme. If the schemeis collusive 29 , preventive controls should be augmented by detective controls, as collusion negates the controleffectiveness of segregation of duties.Fraud, by definition, entails intentional misconduct, designed to evade detection. As such, the fraud risk assessmentteam should engage in strategic reasoning to anticipate the behavior of a potential fraud perpetrator. 30 Strategicreasoning, which is also important in designing fraud detection procedures that a perpetrator may not expect,requires a skeptical mindset and involves asking questions such as:• How might a fraud perpetrator exploit weaknesses in the system of controls?• How could a perpetrator override or circumvent controls?• What could a perpetrator do to conceal the fraud?With this in mind, a fraud risk assessment generally includes three key elements:• Identify inherent fraud risk 31 — Gather information to obtain the population of fraud risks that couldapply to the organization. Included in this process is the explicit consideration of all types of fraud schemesand scenarios; incentives, pressures, and opportunities to commit fraud; and IT fraud risksspecific to the organization.• Assess likelihood and significance of inherent fraud risk — Assess the relative likelihood and potentialsignificance of identified fraud risks based on historical information, known fraud schemes, and interviewswith staff, including business process owners.• Respond to reasonably likely and significant inherent and residual fraud risks — Decide what the responseshould be to address the identified risks and perform a cost-benefit analysis of fraud risks over which theorganization wants to implement controls or specific fraud detection procedures.29A collusive scheme is one performed by two or more individuals working together.30T. Jeffrey Wilks and M.F. Zimbelman, “Using Game Theory and Strategic Reasoning Concepts to Prevent and Detect Fraud,” AccountingHorizons, Volume 18, No. 3 (September 2004).31The initial assessment of fraud risk should consider the inherent risk of particular frauds occurring in the absence of internal controls. Afterall relevant fraud risks have been identified, internal controls are mapped to the identified risks. Fraud risks that remain unaddressed byappropriate controls comprise the population of residual fraud risks.20