acfe fraud prevention check-up - BKD

The Risk Assessment TeamA good risk assessment requires input from various sources. Before conducting a risk assessment, managementshould identify a risk assessment team. This team should include individuals from throughout the organizationwith different knowledge, skills, and perspectives and should include a combination of internal and externalresources such as:• Accounting/finance personnel, who are familiar with the financial reporting process and internal controls.• Nonfinancial business unit and operations personnel, to leverage their knowledge of day-to-day operations,customer and vendor interactions, and general awareness of issues within the industry.• Risk management personnel, to ensure that the fraud risk assessment process integrates with theorganization’s ERM program.• Legal and compliance personnel, as the fraud risk assessment will identify risks that give rise to potentialcriminal, civil, and regulatory liability if the fraud or misconduct were to occur.• Internal audit personnel, who will be familiar with the organization’s internal controls and monitoringfunctions. In addition, internal auditors will be integral in developing and executing responses to significantrisks that cannot be mitigated practically by preventive and detective controls.• If expertise is not available internally, external consultants with expertise in applicable standards, key riskindicators, anti-fraud methodology, control activities, and detection procedures.Management, including senior management, business unit leaders, and significant process owners (e.g., accounting,sales, procurement, and operations) should participate in the assessment, as they are ultimately accountable for theeffectiveness of the organization’s fraud risk management efforts.Fraud Risk IdentificationOnce assembled, the risk assessment team should go through a brainstorming activity to identify the organization’sfraud risks. Effective brainstorming involves preparation in advance of the meeting, a leader to set the agendaand facilitate the session, and openness to ideas regarding potential risks and controls 33 . Brainstorming enablesdiscussions of the incentives, pressures, and opportunities to commit fraud; risks of management override ofcontrols; and the population of fraud risks relevant to the organization. 34 Other risks, such as regulatory and legalmisconduct and reputation risk, as well as the impact of IT on fraud risks also should be considered in the fraud riskidentification process.The organization’s fraud risk identification information should be shared with the board or audit committee andcomments should be solicited. The board also should assess the implications of its own processes with respect to itscontribution to fraud risk, including incentive pressures.33Sources of information about good brainstorming practices include (a) Mark S. Beasley and Gregory Jenkins, “A Primer for BrainstormingFraud Risks,” Journal of Accountancy, December 2003, and (b) Michael J. Ramos, “Brainstorming Prior to the Audit,” in Fraud Detection in aGAAS Audit: Revised Edition, Chapter 2: “Considering Fraud in a Financial Statement Audit.”34Refer to Appendix E: Fraud Risk Exposures of this document for a list of potential fraud risk which could be used in brainstorming.22