acfe fraud prevention check-up - BKD

will vary depending on the nature, potential impact, and seniority of persons involved — should be defined clearlyand communicated to management by the board.The investigation and response system should include a process for:• Categorizing issues.• Confirming the validity of the allegation.• Defining the severity of the allegation.• Escalating the issue or investigation when appropriate.• Referring issues outside the scope of the program.• Conducting the investigation and fact-finding.• Resolving or closing the investigation.• Listing types of information that should be kept confidential.• Defining how the investigation will be documented.• Managing and retaining documents and information.The process approved by the board should include a tracking or case management system in which all allegations offraud are logged. Designated senior management approved by the board and the board itself may be given accessto this system if necessary to ensure that appropriate action is being taken.Evaluating the AllegationOnce an allegation is received, the organization should follow the process approved by the board to evaluate theallegation. The process should include designating an individual or individuals with the necessary authority andskills to conduct an initial evaluation of the allegation and determine the appropriate course of action to resolve it.In cases that involve the board or senior management, the board may want to hire outside independent advisers toassist in this evaluation.The allegation should be examined to determine whether it involves a potential violation of law, rules, or companypolicy. Depending on the nature and severity of the allegation, other departments may need to be consulted, such asHR, legal counsel, senior management, IT, internal auditing, security, or loss prevention. The organization’s externalauditor must also be advised of any fraud that could affect the organization’s financial statements.If an allegation involves senior management, or if the allegation affects the financial statements, there may bestandards, regulations, or laws that require that others (e.g., audit committee, board, external auditors, counsel) benotified of the allegation. For example, if the allegation relates to misconduct involving the CEO, the board shouldbe notified of the allegation and should ensure that the CEO is not overseeing the investigation.Investigation ProtocolsInvestigations should be performed in accordance with protocols approved by the board. A consistent process forconducting investigations can help the organization mitigate losses and manage risks associated with the investigation.40