acfe fraud prevention check-up - BKD

Incentives, Pressures, and OpportunitiesMotives for committing fraud are numerous and diverse. One executive may believe that the organization’s businessstrategy will ultimately be successful, but interim negative results need to be concealed to give the strategy time.Another needs just a few more pennies per share of income to qualify for a bonus or to meet analysts’ estimates.The third executive purposefully understates income to save for a rainy day.The fraud risk identification process should include an assessment of the incentives, pressures, and opportunities tocommit fraud. Incentive programs should be evaluated — by the board for senior management and by managementfor others — as to how they may affect employees’ behavior when conducting business or applying professionaljudgment (e.g., estimating bad debt allowances or revenue recognition). Financial incentives and the metrics onwhich they are based can provide a map to where fraud is most likely to occur. There may also be nonfinancialincentives, such as when an employee records a fictitious transaction so he or she does not have to explain anotherwise unplanned variance. Even maintaining the status quo is sometimes a powerful enough incentive forpersonnel to commit fraud.Also important, and often harder to quantify, are the pressures on individuals to achieve performance or othertargets. Some organizations are transparent, setting specific targets and metrics on which personnel will bemeasured. Other organizations are more indirect and subtle, relying on corporate culture to influence behavior.Individuals may not have any incremental monetary incentive to fraudulently adjust a transaction, but there may beample pressure — real or perceived — on an employee to act fraudulently.Meanwhile, opportunities to commit fraud exist throughout organizations and may be reason enough to commitfraud. These opportunities are greatest in areas with weak internal controls and a lack of segregation of duties.However, some frauds, especially those committed by management, may be difficult to detect because managementcan often override the controls. Such opportunities are why appropriate monitoring of senior management by astrong board and audit committee, supported by internal auditing, is critical to fraud risk management.Risk of Management’s Override of ControlsAs part of the risk identification process, it is important to consider the potential for management override ofcontrols established to prevent or detect fraud. Personnel within the organization generally know the controls andstandard operating procedures that are in place to prevent fraud. It is reasonable to assume that individuals whoare intent on committing fraud will use their knowledge of the organization’s controls to do it in a manner thatwill conceal their actions. For example, a manager who has the authority to approve new vendors may create andapprove a fictitious vendor and then submit invoices for payment, rather than just submit false invoices for payment.Hence, it is also important to keep the risk of management’s override of controls in mind when evaluating theeffectiveness of controls; an anti-fraud control is not effective if it can be overridden easily.Population of Fraud RisksThe fraud risk identification process requires an understanding of the universe of fraud risks and the subset of risksspecific to the organization. This may involve obtaining information from external sources such as industry news;criminal, civil, and regulatory complaints and settlements; and organizations such as The IIA, AICPA, ACFE, and CICA.23