acfe fraud prevention check-up - BKD

keep such information confidential. The board should approve a specific list of individuals who are permitted accessto the information and define its own level of information access related to fraud detection controls.Once the final fraud detection plan is completed, the team should develop a public communication regarding theplan and its implementation. Knowledge throughout the organization that a comprehensive fraud detection planexists is, in and of itself, a strong deterrent. By communicating this to employees, vendors, shareholders, and others,the organization affirms that it has a fraud detection plan in place and that it takes fraud seriously without revealingall the relevant characteristics of the organization’s fraud detection techniques.Assessing the Organization’s Fraud DetectionOrganizations just beginning to assess their fraud risk management program, as well as those striving to improvetheir fraud risk management program, should conduct overall assessments of their fraud detection techniques. TheFraud Detection Scorecard in Appendix G can be used to assess how comprehensive the organization’s detectivecontrols are and how well they are working. Organizations periodically should reassess their fraud detectiontechniques to ensure that progress is being made to get to an “all-green” fraud detection status and that noelements of fraud detection are deteriorating. Organizations with strong commitments to fraud detection may alsowish to engage independent outside experts to assess their fraud detection techniques.Continuous Monitoring of Fraud DetectionThe organization should develop ongoing monitoring and measurements to evaluate, remedy, and continuouslyimprove the organization’s fraud detection techniques. If deficiencies are found, management should ensure thatimprovements and corrections are made as soon as possible. Management should institute a follow-up plan to verifythat corrective or remedial actions have been taken.The organization should establish measurement criteria to monitor and improve fraud detection. These measuresshould be provided to the board on an ongoing basis.Measurable criteria include the:• Number of known fraud schemes committed against the organization.• Number and status of fraud allegations received by the organization that required investigation.• Number of fraud investigations resolved.• Number of employees who have/have not signed the corporate ethics statement.• Number of employees who have/have not completed ethics training sponsored by the organization.• Number of whistleblower allegations received via the organization’s hotline.• Number of allegations that have been raised by other means.• Number of messages supporting ethical behavior delivered to employees by executives.• Number of vendors who have/have not signed the organization’s ethical behavior requirements.• Benchmarks with global fraud surveys, including the type of fraud experienced and average losses.• Number of customers who have signed the organization’s ethical behavior requirements.• Number of fraud audits performed by internal auditors.38