acfe fraud prevention check-up - BKD

SECTION 4: FRAUD DETECTIONPrinciple 4: Detection techniques should be established to uncover fraud events when preventivemeasures fail or unmitigated risks are realized.Having effective detective controls in place and visible is one of the strongest deterrents to fraudulent behavior.Used in tandem with preventive controls, detective controls enhance a fraud risk management program’seffectiveness by providing evidence that preventive controls are working as intended and identifying fraud thatoccurs. Although detective controls may provide evidence that fraud is occurring or has occurred, they are notintended to prevent fraud.In some cases, the types of detective controls implemented may depend on the fraud risks identified for anorganization. For example, if an organization operates in countries that are identified as having high risks forcorruption, it may implement detective controls to identify possible violations of the FCPA, such as a recurringreview of expense reports or consulting fees. Similarly, if an organization has a high frequency of subjectiveestimates, it may implement detective controls related to regular internal audit review of such activity. Overall,additional detection controls may be necessary based on the fraud risks identified for the organization. As with fraudprevention, it is important that the organization assess and continuously monitor its fraud detection techniques tohelp detect fraud that is occurring or has occurred.Fraud Detective ControlsOrganizations can never eliminate the risk of fraud entirely. There are always people who are motivated to commitfraud, and an opportunity can arise for someone in any organization to override a control or collude with others todo so. Therefore, detection techniques should be flexible, adaptable, and continuously changing to meet the variouschanges in risk.While preventive measures are apparent and readily identifiable by employees, third parties, and others, detectivecontrols are clandestine in nature. This means they operate in a background that is not evident in the everydaybusiness environment. Such techniques will usually:• Occur in the ordinary course of business.• Draw on external information to corroborate internally generated information.• Formally and automatically communicate identified deficiencies and exceptions to appropriate leadership.• Use results to enhance and modify other controls.Although every organization is susceptible to fraud, it is not cost-effective to try to eliminate all fraud risk. Anorganization may choose to design its controls to detect, rather than prevent, certain fraud risks, as approved by theboard. If the estimated costs of designing, implementing, and monitoring the controls against fraud — such as tools,personnel, or training — exceeds the estimated impact of the risk, they may not be cost-effective to implement. Forexample, a property and casualty insurance company may set threshold limits on the total of losses paid plus thosereserved on large policies to identify that fraud may be occurring, rather than relying solely on the identificationof fraudulent individual claims. Important detection methods include an anonymous reporting mechanism34