Fraud Prevention Flashcards
Which of the following controls can help minimize the pressures that might lead an employee to commit fraud?
A. Open-door management policies
B. Fair personnel policies and procedures
C. Employee support programs
D. All of the above
D. All of the above
See pages 4.616-4.618 in the Fraud Examiner’s Manual
While most internal controls are designed to reduce the opportunity to commit and conceal fraud, organizations should also be mindful of the pressures, such as financial hardships or family problems, that can lead to fraud. Unfortunately, such pressures can be difficult to detect in employees. However, companies should take steps to increase managers’ awareness of such potential problems, as well as to assist an employee who might be experiencing difficult times.
Examples of mechanisms that help alleviate the pressures to commit fraud include:
- Open-door management policies
- Fair and equitably applied personnel policies and procedures
- Measures to boost employee morale, such as career development opportunities, special events for employees, and recognition for jobs well done
- Employee support programs, such as counseling for addiction, family and marital problems, and financial difficulties
Managers should be instructed to observe employees’ lifestyles for warning signs of fraud, and employees should know that supervisors are watching for unexplained or suspicious anomalies of this nature.
A. True
B. False
A. True
See pages 4.608-4.609 in the Fraud Examiner’s Manual
It is common for employees who steal to use the proceeds for lifestyle improvements. Some examples include more expensive cars, extravagant vacations, expensive clothing, new or remodeled homes, expensive recreational property, and outside investments. Managers should be educated to be observant of these signs. To further increase the deterrent effect, employees should know that supervisors are watching for unexplained or suspicious anomalies of this nature.
To protect against third-party fraud risks, organizations should perform the same level of due diligence on each potential customer before entering into a transaction with them.
A. True
B. False
B. False
See pages 4.810-4.811 in the Fraud Examiner’s Manual
Customer due diligence (CDD) is a necessary element in effectively managing risk and protecting organizations from becoming involved in illegal activity. CDD procedures, also referred to as know your customer (KYC) in some industries, involve performing background checks based on the level of risk presented by the customer. In general, there are three levels of CDD procedures:
- Simplified CDD
- Standard CDD
- Enhanced CDD
Organizations can determine the level of risk the customer presents—and the appropriate level of due diligence—by evaluating the specifics of the transaction and the initial information provided about the customer. If the organization later receives additional information that suggests the customer might be a higher risk, a higher level of CDD procedures should be performed at that time.
Which of the following is FALSE regarding the communication of the fraud risk assessment process?
A. The communication should be in the form of a message from the assessment sponsor.
B. The communication should be limited to management and the board.
C. The communication should be personalized to make it more effective in encouraging employees to participate in the process.
D. The communication should be visibly disseminated throughout the business.
B. The communication should be limited to management and the board.
See pages 4.714 in the Fraud Examiner’s Manual
The fraud risk assessment process should be visible and communicated throughout the business. Employees will be more inclined to participate in the process if they understand why it is being done and what the expected outcomes will be. To that end, sponsors should be strongly encouraged to openly promote the process. The more personalized the communication from the sponsor, the more effective it will be in encouraging employees to participate in the process. Whether it is a video, town-hall meeting, or company-wide email, the communication should be aimed at eliminating any reluctance employees have about participating in the fraud risk assessment process.
Which of the following is TRUE regarding a fraud risk assessment?
A. It can be used to improve fraud awareness among employees
B. The results should be used to develop plans to mitigate fraud risk
C. It can help management identify individuals who put the organization at the greatest risk of fraud
D. All of the above
D. All of the above
See pages 4.704 in the Fraud Examiner’s Manual
Every organization should conduct a fraud risk assessment and create processes to keep the assessment current and relevant. It is not only a necessary part of effective corporate governance but also makes good business sense. The benefits of conducting a fraud risk assessment include enabling the organization to:
- Improve communication and awareness about fraud.
- Identify where it is most vulnerable to fraud and what activities put the company at the greatest risk.
- Know who puts the organization at the greatest risk.
- Develop plans to mitigate risk.
- Develop techniques to investigate and determine if fraud has occurred in areas of high risk.
- Assess anti-fraud controls.
- Comply with regulations and professional standards.
______________ is a process aimed at proactively identifying and addressing an organization’s vulnerabilities to internal and external fraud.
A. A fraud examination
B. A management ethics assessment
C. A fraud risk assessment
D. An internal control audit
C. A fraud risk assessment
See pages 4.703 in the Fraud Examiner’s Manual
Fraud risk assessment is a process aimed at proactively identifying and addressing an organization’s vulnerabilities to internal and external fraud. A fraud risk assessment starts with an identification and prioritization of fraud risks that exist in the business. The process evolves as the results of that identification and prioritization begin to drive education, communication, organizational alignment, and action around effectively managing fraud risk and identifying new fraud risks as they emerge.
During a fraud risk assessment, the assessment team should consider:
A. Opportunities for collusion
B. The inherent limitations of anti-fraud controls
C. Internal controls that might have been eliminated due to restructuring efforts
D. All of the above
D. All of the above
See pages 4.705-4.706 in the Fraud Examiner’s Manual
Many organizations rely heavily on their internal control system to prevent and detect fraud. Although an effective internal control system, including targeted anti-fraud controls, is critical in fraud prevention and detection, it is a dynamic system that requires constant reevaluation of its weaknesses. Performing a fraud risk assessment provides management the opportunity to review the effectiveness of the company’s anti-fraud controls, with consideration of the following factors:
- Controls that might have been eliminated due to restructuring efforts (e.g., elimination of separation of duties due to downsizing)
- Controls that might have eroded over time due to reengineering of business processes
- New opportunities for collusion
- Lack of anti-fraud controls in a vulnerable area
- Nonperformance of control procedures (e.g., control procedures compromised for the sake of expediency)
- Inherent limitations of anti-fraud controls, including opportunities for those responsible for a control to commit and conceal fraud (e.g., through management and system overrides)
The fraud risk assessment team might include:
A. External consultants
B. The general counsel
C. Accounting and finance personnel
D. All of the above
D. All of the above
See pages 4.711 in the Fraud Examiner’s Manual
The fraud risk assessment team members might include internal and external sources, such as:
- Accounting and finance personnel who are familiar with the financial reporting processes and anti-fraud controls
- Nonfinancial business unit and operations personnel who have knowledge of daily operations, customer and vendor interactions, and issues within the industry
- Risk management personnel who can ensure that the fraud risk assessment process integrates with the organization’s enterprise risk management program
- The general counsel or other members of the legal department
- Members of any ethics or compliance functions within the organization
- Internal auditors
- Internal security or investigative personnel who are familiar with investigations of past fraud incidents
- External consultants with fraud and risk expertise
- Any business leader with direct accountability for the effectiveness of the organization’s fraud risk management efforts
When establishing a whistleblower policy, organizations should emphasize that it applies to all employees, regardless of their positions or seniority.
A. True
B. False
A. True
See pages 4.611-4.612 in the Fraud Examiner’s Manual
Organizations can empower employees who wish to disclose information without the fear of negative consequences by creating a safe environment for them to voice their concerns. This can be accomplished by implementing a clear whistleblower policy that details standard reporting protocols and the consequences for retaliating against whistleblowers. This policy can stand alone or be part of the anti-fraud policy.
It is important for management to establish and publicize the organization’s whistleblower procedures so that individuals both inside and outside the organization are aware of the appropriate channels for reporting misconduct. The whistleblower policy should emphasize that it applies to all employees, regardless of their positions or seniority, as well as to anyone external to the organization who has knowledge of potential wrongdoing by any employees or on the company’s part.
When a customer presents a higher risk for engaging in illegal activity, which of the following customer due diligence (CDD) activities would be MOST APPROPRIATE for an organization to engage in?
A. Analyzing the customer’s overall net worth
B. Scrutinizing the customer’s method of payment
C. Quantifying the customer’s expected purchasing pattern
D. All of the above
D. All of the above
See pages 4.811-4.812 in the Fraud Examiner’s Manual
When certain customers present higher risks for engaging in illegal activity, organizations should undertake enhanced due diligence procedures. Factors that might prompt enhanced customer due diligence (CDD) include high-profile customers, large-value transactions, or foreign business dealings in countries known for corruption. While these enhanced due diligence procedures depend on the nature and severity of the risk presented by the customer, organizations should gather additional information to reduce their potential risk. Specifically, organizations should gather and analyze data to ensure that they are dealing with a customer who has good intentions.
Under enhanced due diligence procedures, the following customer elements should be examined with a greater level of scrutiny to ensure legitimacy and that the risk has been responded to appropriately:
- Identity (i.e., Is the customer who they claim to be?)
- Source of income and overall net worth (i.e., Can the customer pay for the transaction, especially if they are requesting to pay on credit?)
- Expected pattern of purchasing (i.e., Is this a onetime transaction or a series of transactions?)
- Expected value (i.e., How large is the cumulative financial risk?)
- Expected method of payment (i.e., Is the customer requesting to use a higher-risk payment method, such as a personal check or line of credit?)
When gathering information as part of a fraud risk assessment, both surveys and anonymous feedback mechanisms provide an effective way to conduct candid one-on-one conversations with employees.
A. True
B. False
B. False
See pages 4.712-4.713 in the Fraud Examiner’s Manual
Several techniques can be used to gather information successfully as part of a fraud risk assessment. These include:
- Interviews, which can be an effective way to conduct candid one-on-one conversations with employees
- Focus groups, which can enable the assessor to observe the interactions among a group of employees as they collectively discuss a question or issue
- Surveys, which are electronic or paper questionnaires that can be either anonymous or directly attributable to the individual participants
- Anonymous feedback mechanisms, which can include means for anonymous employee suggestions or responses to questions posed
Which of the following customer due diligence (CDD) procedures would be MOST APPROPRIATE for an organization to perform if it determines that a potential customer has little opportunity to commit fraud and therefore presents a minimal risk of engaging in illegal activity?
A. Identifying the customer
B. Analyzing the customer’s net worth
C. Contacting the customer’s bank
D. Verifying the customer’s identity
A. Identifying the customer
See pages 4.811 in the Fraud Examiner’s Manual
Simplified due diligence is the lowest level of due diligence that can be performed on a potential customer. Conducting simplified due diligence procedures would be most appropriate in situations where there is little opportunity or risk of a customer engaging in illegal activity. The only requirement for simplified due diligence is to identify the customer.
Organizations can determine the level of risk the customer presents—and the appropriate level of due diligence—by evaluating the specifics of the transaction and the initial information provided about the customer. If the organization later receives additional information that suggests the customer might be a higher risk, a higher level of customer due diligence (CDD) procedures should be performed at that time.
In response to a risk identified during a fraud risk assessment, management decides to implement appropriate countermeasures, such as prevention and detection controls. This response is known as:
A. Transferring the risk
B. Avoiding the risk
C. Mitigating the risk
D. Assuming the risk
C. Mitigating the risk
See pages 4.734 in the Fraud Examiner’s Manual
When responding to the organization’s residual fraud risks, management can help mitigate a risk by implementing appropriate countermeasures, such as prevention and detection controls. The fraud risk assessment team should evaluate each countermeasure to determine if it is cost effective and reasonable given the probability of occurrence and impact of loss.
What is the objective of a fraud risk assessment?
A. To establish the guilt or innocence of an employee suspected of committing fraud
B. To help an organization identify what makes it most vulnerable to fraud
C. To provide an estimate of an organization’s fraud losses
D. To assess the design and effectiveness of an organization’s internal controls over financial reporting
B. To help an organization identify what makes it most vulnerable to fraud
See pages 4.703-4.704 in the Fraud Examiner’s Manual
The objective of a fraud risk assessment is to help an organization identify what makes it most vulnerable to fraud. Through a fraud risk assessment, the organization can identify where fraud is most likely to occur, enabling proactive measures to be considered and implemented to reduce the chance that it could happen.
Fraudulent customer payments, collusion between contractors, corporate espionage, and hacking schemes are all fraud risks pertaining to which of the following categories?
A. Reputational risk
B. Regulatory and legal misconduct
C. External fraud
D. Asset misappropriation
C. External fraud
See pages 4.718 in the Fraud Examiner’s Manual
External fraud risks include:
- Fraud committed by customers (e.g., fraudulent customer payments)
- Fraud committed by vendors (e.g., overbilling by a vendor or collusion between bidding contractors to inflate contract price)
- Fraud committed by competitors (e.g., corporate espionage)
- Fraud committed by unrelated third parties (e.g., hacking)
_____________ controls are designed to stop something bad from happening before it occurs, and _____________ controls are designed to identify something bad that has already occurred.
A. Preventive; detective
B. Detective; investigative
C. Investigative; deterrent
D. Investigative; detective
A. Preventive; detective
See pages 4.702 in the Fraud Examiner’s Manual
Preventive controls are manual or automated processes that stop something bad from happening before it occurs. Detective controls can also be manual or automated, but their purpose is to identify something bad that has already occurred. With the right balance of preventive and detective controls, a good system of anti-fraud controls can greatly reduce an organization’s vulnerability to fraud.
Which of the following is FALSE regarding employee anti-fraud education?
A. Fraud awareness training efforts should be restricted to formal educational mechanisms.
B. Fraud awareness training should be required for employees both at time of hire and periodically thereafter.
C. All anti-fraud training should be based on the organization’s specific operations and fraud risks.
D. Mid-level managers should be tasked with assisting in training their teams about fraud.
A. Fraud awareness training efforts should be restricted to formal educational mechanisms.
See pages 4.605 in the Fraud Examiner’s Manual
Like any educational efforts, frequent exposure to anti-fraud topics is crucial to ensuring that employees absorb—and apply—the information provided. Formal fraud awareness training should be an ongoing process that begins at the time of hire. Employees should also participate in refresher training at least annually to help keep the program active and engrained in their minds.
Formal anti-fraud training can take many forms, including live, in-class instruction; recorded video or animated courses; or interactive self-study programs. In addition, the organization should use other informal means, such as periodic newsletters or notices in break rooms, to reinforce its anti-fraud stance on a more constant basis.
Perhaps most important, however, is that the training be based on the realities of the organization, rather than on generic anti-fraud messages. While providing general information is good and necessary, doing so without addressing the company’s specific concerns or providing employees with practical knowledge and ideas on how to apply it will render the training program ineffective.
As messages from an employee’s direct supervisor are often the most significant and impressionable to an employee, the concept of cascading training can be an especially effective means of anti-fraud education. In cascading training, managers are tasked with and specifically educated on how to provide anti-fraud training to their own staff. This allows training to be customized to each team’s own needs, as well as for the message to come directly from the team’s own leader.
Which of the following is among the audit committee’s responsibilities for fraud risk management?
A. Monitoring and proactively improving the fraud risk management program
B. Receiving regular reports on the status of reported or alleged fraud
C. Performing and regularly updating the fraud risk assessment
D. All of the above
B. Receiving regular reports on the status of reported or alleged fraud
See pages 4.816 in the Fraud Examiner’s Manual
As a sub-group of the board of directors, the audit committee is often assigned oversight of the organization’s financial, accounting, and audit matters and reports to the full board. As part of this responsibility, the committee must take an active role in overseeing the assessment and monitoring of the organization’s fraud risks. This involves:
- Receiving regular reports on the status of reported or alleged fraud
- Being aware of fraud risks that are common in the organization’s industry
- Meeting regularly with key internal parties (e.g., the chief audit executive [CAE] or other senior financial persons) to discuss identified fraud risks and the steps being taken to prevent and detect fraud
- Understanding how internal and external audit strategies address fraud risk
- Providing external auditors with evidence that the audit committee is dedicated to effective fraud risk management
- Engaging in open conversations with external auditors about any known or suspected fraud
- Seeking advice of legal counsel whenever it deals with allegations of fraud
Monitoring and improving the fraud risk management program and performing and maintaining the fraud risk assessment are both part of senior management’s responsibilities for addressing fraud risk.
In response to a risk identified during a fraud risk assessment, management decides to eliminate an asset or discontinue an activity because the control measures required to protect the organization against the identified threat are too expensive. This response is known as:
A. Transferring the risk
B. Assuming the risk
C. Avoiding the risk
D. Mitigating the risk
C. Avoiding the risk
See pages 4.734 in the Fraud Examiner’s Manual
When responding to the organization’s residual fraud risks, management may decide to avoid a risk by eliminating an asset or discontinuing an activity if the control measures required to protect the organization against an identified threat are too expensive. This approach requires the fraud risk assessment team to complete a cost-benefit analysis of the value of the asset or activity to the organization compared to the cost of implementing measures to protect the asset or activity.
When performing a fraud risk assessment, the fraud examiner should only designate an area as high-risk if the assessment has conclusively revealed that fraud is occurring there.
A. True
B. False
B. False
See pages 4.705 in the Fraud Examiner’s Manual
Assessing an area as having a high level of fraud risk does not conclusively mean that fraud is occurring there. However, the fraud risk assessment is useful in identifying areas that should be proactively investigated to determine whether fraud has occurred. In addition, putting activity in high-risk areas under increased scrutiny can deter potential fraudsters by increasing their perception of detection.
Which of the following is TRUE regarding an organization’s ethics policy?
A. In developing the policy, management should consider how various members of the organization define success.
B. The policy should be limited to external parties only.
C. In developing the policy, management should not consider the existing ethical tone set by leadership.
D. The policy should only be accessible to company employees.
A. In developing the policy, management should consider how various members of the organization define success.
See pages 4.623-4.624 in the Fraud Examiner’s Manual
A written ethics policy enables management to objectively communicate its ethical philosophy and provides a foundation for a successful ethics program. The policy should be shared among both new and old employees. Additionally, some companies have found it effective to share the ethics policy with their vendors, and many organizations make their ethics policies available for the public by posting them on the company’s website or on their social media platforms. Such exposure helps reinforce the importance the organization places on ethics and provides parties outside the organization with a tool to help identify and report breaches of expected employee conduct.
Identifying key organizational characteristics and issues is a start to the development of an ethics program. These considerations include:
- Understanding why good people can commit unethical acts
- Defining current—as well as desired—organizational values
- Determining if organizational values have been properly communicated
- Determining if ethics is currently a leadership issue in the organization
- Ascertaining how board members, stockholders, management, employees, and any other important members of the organization define success
- Producing written ethics policies, procedures, or structures
Of the following parties, who is responsible for the oversight of the organization’s financial, accounting, and audit matters?
A. The external auditors
B. The chief financial officer
C. The audit committee
D. The internal auditors
C. The audit committee
See pages 4.816 in the Fraud Examiner’s Manual
As a sub-group of the board of directors, the audit committee is often assigned oversight of the organization’s financial, accounting, and audit matters and reports to the full board. As part of this responsibility, the committee must take an active role in overseeing the assessment and monitoring of the organization’s fraud risks. This involves:
- Receiving regular reports on the status of reported or alleged fraud
- Being aware of fraud risks that are common in the organization’s industry
- Meeting regularly with key internal parties (e.g., the chief audit executive [CAE] or other senior financial persons) to discuss identified fraud risks and the steps being taken to prevent and detect fraud
- Understanding how internal and external audit strategies address fraud risk
- Providing external auditors with evidence that the audit committee is dedicated to effective fraud risk management
- Engaging in open conversations with external auditors about any known or suspected fraud
- Seeking advice of legal counsel whenever it deals with allegations of fraud
The fraud risk assessment team should include:
A. Individuals with experience in gathering and eliciting information
B. Individuals in a variety of roles, including finance, operations, and legal
C. Individuals with diverse knowledge, skills, and perspectives
D. All of the above
D. All of the above
See pages 4.711 in the Fraud Examiner’s Manual
Before conducting the fraud risk assessment, the organization should build a fraud risk assessment team consisting of individuals with diverse knowledge, skills, and perspectives that will lead and conduct the fraud risk assessment. The size of the team will depend on the size of the organization and the methods used to conduct the assessment. The team should have individuals who are credible and have experience in gathering and eliciting information. The team members might include internal and external sources, such as accounting and finance personnel, operations personnel, members of the legal department, internal auditors, internal security or investigative personnel, external consultants with fraud and risk expertise, and any business leader with direct accountability for the effectiveness of the organization’s fraud risk management efforts.
In response to a risk identified during a fraud risk assessment, management chooses to accept the risk rather than implement any responsive measures. This approach is known as:
A. Assuming the risk
B. Transferring the risk
C. Mitigating the risk
D. Avoiding the risk
A. Assuming the risk
See pages 4.735 in the Fraud Examiner’s Manual
Management may choose to assume the risk if it determines that the probability of occurrence and impact of loss are low. Management may decide that it is more cost effective to assume the risk than it is to eliminate the asset or discontinue the activity, buy insurance to transfer the risk, or implement countermeasures to mitigate the risk.
The Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management—Integrating with Strategy and Performance is composed of a set of principles organized into five interrelated components. Communication, as part of the information, communication, and reporting component, is defined as an organization’s:
A. Tone that reinforces the importance of risk management and establishes the oversight responsibilities for managing risks
B. Continual, iterative process of obtaining information and sharing it throughout the entity
C. Ability to assess substantial changes that might affect its strategy and objectives
D. Formal process of setting strategy and defining business objectives
B. Continual, iterative process of obtaining information and sharing it throughout the entity
See pages 4.803-4.805 in the Fraud Examiner’s Manual
The Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management—Integrating with Strategy and Performance is composed of a set of principles organized into five interrelated components and twenty supporting principles that are based on a holistic view of an organization’s risk portfolio. The five components of the enterprise risk management (ERM) framework are:
- Governance and culture
- Strategy and objective-setting
- Performance
- Review and revision
- Information, communication, and reporting
COSO’s ERM framework defines communication as “the continual, iterative process of obtaining information and sharing it throughout the entity.” Management must use information gathered from both internal and external sources to support ERM. The principles related to information, communication, and reporting are:
- The organization leverages information and technology to support ERM.
- The organization communicates risk information.
- The organization reports on risk, culture, and performance throughout the entity.
Which of the following is TRUE regarding the process of defining the objective of the fraud risk management program?
A. Management should examine previous fraud occurrences to determine how the ideal fraud risk management program would have prevented them
B. Management should incorporate the needs and goals of the organization into the fraud risk management program’s objectives
C. Management must balance the investment in anti-fraud controls with the benefit of those controls and the amount of risk it is willing to accept
D. All of the above
D. All of the above
See pages 4.825-4.826 in the Fraud Examiner’s Manual
Because the fraud risks and strategic initiatives of each organization differ, the detailed objectives of the fraud risk management program should be tailored to the organization’s specific needs and goals.
Like any corporate initiative, without an explicit definition of what the organization intends to accomplish through its fraud risk management program, the program will have limited success. Consequently, management must balance the following factors in determining the program’s objectives:
- Management’s risk appetite
- The investment in anti-fraud controls
- The prevention of frauds that are material in nature or amount
An important component in defining the objective of the fraud risk management program is determining management’s risk appetite. Without an adequate understanding and articulation of just how much risk those charged with governance are willing to accept, any stated objectives of the fraud risk management program will be inaccurate. Risk appetite should be expressed in a manner that is appropriate for the organization’s culture and operations, and it can be measured and expressed either qualitatively—low, medium, or high, for example—or quantitatively, using a numeric scale.
Another helpful starting point in determining the fraud risk management strategy is to examine previous occurrences of fraud and explore how management’s ideal fraud risk management program would have prevented, detected, and responded to them. In examining such incidents, management should consider the factors that allowed such frauds to occur.
Of the following, which is the MOST EFFECTIVE method of preventing fraud?
A. Having an open-door policy
B. Screening employees
C. Conducting covert audits
D. Increasing perception of detection
D. Increasing perception of detection
See pages 4.602 in the Fraud Examiner’s Manual
Increasing the perception of detection might be the most effective fraud prevention method. Controls, for example, are not very effective in preventing theft and fraud if those at risk do not know of the presence of possible detection. This means letting employees, managers, and executives know that auditors are actively seeking information concerning internal theft.
The fraud risk assessment should be formally incorporated into the annual audit planning process.
A. True
B. False
A. True
See pages 4.738 in the Fraud Examiner’s Manual
The fraud risk assessment should play a significant role in informing and influencing the audit process. In addition to being used in the annual audit planning process, the fraud risk assessment should motivate thinking and awareness in the development of audit programs for areas that have been identified as having a moderate-to-high risk of fraud. Although auditors should always be vigilant of things that might be indicators of fraud risk, the results of the fraud risk assessment can help them design audit procedures in a way that enables them to look for fraud in known areas of high risk.
Which of the following is NOT one of the components of the Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management—Integrating with Strategy and Performance?
A. Strategy and objective-setting
B. Review and revision
C. Risk tolerance
D. Information, communication, and reporting
C. Risk tolerance
See pages 4.803-4.805 in the Fraud Examiner’s Manual
The Committee of Sponsoring Organizations of the Treadway Commission’s (COSO) Enterprise Risk Management—Integrating with Strategy and Performance is composed of a set of principles organized into five interrelated components and twenty supporting principles that are based on a holistic view of an organization’s risk portfolio. The five components of the enterprise risk management (ERM) framework are:
- Governance and culture
- Strategy and objective-setting
- Performance
- Review and revision
- Information, communication, and reporting
Which of the following is one of the eight principles for risk management provided by International Organization for Standardization (ISO) 31000:2018?
A. The risk management program is structured and comprehensive
B. The risk management program facilitates continuous improvement
C. The risk management program is integrated into all organizational activities
D. All of the above
D. All of the above
See pages 4.807 in the Fraud Examiner’s Manual
The following eight International Organization for Standardization (ISO) 31000:2018 principles provide that an effective and efficient risk management program:
- Is integrated into all organizational activities
- Is structured and comprehensive
- Is customized and proportionate to the organization’s operations and objectives
- Is inclusive and provides for appropriate and timely consideration of stakeholders’ knowledge, views, and perceptions
- Is dynamic and responsive to change
- Is based upon the best available information
- Takes human and cultural factors into account
- Facilitates continuous improvement
Which of the following is NOT one of the eight principles for risk management provided by International Organization for Standardization (ISO) 31000:2018?
A. The risk management program is customized and proportionate to the organization’s operations and objectives.
B. The risk management program is based on effective leadership and commitment.
C. The risk management program is dynamic and responsive to change.
D. The risk management program takes human and cultural factors into account.
B. The risk management program is based on effective leadership and commitment.
See pages 4.807 in the Fraud Examiner’s Manual
The following eight International Organization for Standardization (ISO) 31000:2018 principles provide that an effective and efficient risk management program:
- Is integrated into all organizational activities
- Is structured and comprehensive
- Is customized and proportionate to the organization’s operations and objectives
- Is inclusive and provides for appropriate and timely consideration of stakeholders’ knowledge, views, and perceptions
- Is dynamic and responsive to change
- Is based upon the best available information
- Takes human and cultural factors into account
- Facilitates continuous improvement
According to ISO 31000, the framework for an organization’s risk management program should be based on a foundation set by effective leadership and commitment, but this is not one of the eight principles of risk management provided by ISO 31000:2018.
Which of the following types of customer due diligence (CDD) procedures should an organization engage in when determining whether to conduct business with a higher-risk customer who wants to pay on credit?
A. Enhanced CDD
B. Standard CDD
C. Simplified CDD
D. International CDD
A. Enhanced CDD
See pages 4.811-4.812 in the Fraud Examiner’s Manual
When certain customers present higher risks for engaging in illegal activity, organizations should undertake enhanced due diligence procedures. Factors that might prompt enhanced customer due diligence (CDD) include high-profile customers, large-value transactions, or foreign business dealings in countries known for corruption. While these enhanced due diligence procedures depend on the nature and severity of the risk presented by the customer, organizations should gather additional information to reduce their potential risk. Specifically, organizations should gather and analyze data to ensure that they are dealing with a customer who has good intentions.
Under enhanced due diligence procedures, the following customer elements should be examined with a greater level of scrutiny to ensure legitimacy and that the risk has been responded to appropriately:
- Identity (i.e., Is the customer who they claim to be?)
- Source of income and overall net worth (i.e., Can the customer pay for the transaction, especially if they are requesting to pay on credit?)
- Expected pattern of purchasing (i.e., Is this a onetime transaction or a series of transactions?)
- Expected value (i.e., How large is the cumulative financial risk?)
- Expected method of payment (i.e., Is the customer requesting to use a higher-risk payment method, such as a personal check or line of credit?)
Which of the following mechanisms can be used to help increase the perception of detection in an organization?
A. Employee anti-fraud education
B. Rewards for whistleblowers
C. Hotlines and reporting programs
D. All of the above
D. All of the above
See pages 4.602 in the Fraud Examiner’s Manual
Increasing the perception of detection might be the most effective fraud prevention method. Controls, for example, are not very effective in preventing theft and fraud if those at risk do not know of the presence of possible detection. This means letting employees, managers, and executives know that auditors are actively seeking information concerning internal theft. This can be accomplished in several ways, such as through employee anti-fraud education, reporting programs, hotlines, rewards for whistleblowers, and proactive audit policies.
Which of the following is NOT a topic that should be covered in employee anti-fraud training?
A. Common characteristics that lead individuals to commit fraud
B. What constitutes fraud, including examples of acceptable and unacceptable behavior
C. How fraud hurts the organization and its employees
D. Specific controls and procedures that the organization uses to detect fraud
D. Specific controls and procedures that the organization uses to detect fraud
See pages 4.606-4.608 in the Fraud Examiner’s Manual
The content covered by the organization’s anti-fraud training should focus on the specific risks encountered by the organization to provide employees with practical, implementable knowledge. However, it should not give employees the information they need to circumvent the normal rules by explaining the details of controls and procedures used to detect fraud. In that regard, the following topics form the basis of an effective training program:
- What fraud is, including examples of what behavior is acceptable and what is not
- How fraud hurts the organization
- How fraud hurts employees
- Common characteristics that lead individuals to commit fraud (i.e., pressure, opportunity, and ability to rationalize the act)
- How to identify fraud (i.e., specific examples of financial, transactional, behavioral, and other red flags to watch for)
- How to report fraud
- The punishment for dishonest acts, including examples of past transgressions and how they were managed
The fraud risk management program should include the formal procedures that management takes in response to a fraud, such as punishing the perpetrator, remediating the control weaknesses that allowed the fraud to occur, and rebuilding stakeholders’ confidence in the organization.
A. True
B. False
A. True
See pages 4.819-4.820 in the Fraud Examiner’s Manual
Fraud risk management programs must address fraud before, during, and after it occurs. Consequently, effective fraud risk management programs must incorporate policies and procedures designed to do all the following:
- Prevent fraud—These activities focus on proactively identifying and assessing fraud risks and taking steps to address those risks; they are the first line of defense against fraud in the organization and generally include policies, procedures, training, and communication.
- Detect fraud—These activities seek to identify fraud occurrences as soon as possible after they begin to limit the damage done.
- Respond to identified fraud—These activities include investigating the allegation to determine the party or parties responsible, the means of the infraction, and the extent of the resulting damage; punishing the perpetrator, whether through employment sanctions or legal action; remediating the control weaknesses that allowed the fraud to be undertaken; and rebuilding stakeholders’ confidence in the organization.
Which of the following individuals would generally be the BEST choice for a sponsor for a fraud risk assessment?
A. A staff accountant
B. An independent audit committee member
C. A mid-level sales manager
D. A CFO who commands the use of aggressive earnings-management practices
B. An independent audit committee member
See pages 4.707 in the Fraud Examiner’s Manual
Having the right sponsor for a fraud risk assessment is extremely important in ensuring its success and effectiveness. The sponsor must be senior enough in the organization and command the employees’ respect to elicit full cooperation in the process. The sponsor must be committed to learning the truth about where the company’s fraud vulnerabilities are. The sponsor cannot be prone to rationalization or denial; they must be a truth seeker. In the ideal situation, the sponsor would be an independent board director or audit committee member. However, a good chief executive officer (CEO) or another internal senior leader can be equally as effective.
The success of the fraud risk assessment process depends on how effectively the results are reported and what the organization then does with those results.
A. True
B. False
A. True
See pages 4.735 in the Fraud Examiner’s Manual
The success of the fraud risk assessment process depends on how effectively the results are reported and what the organization then does with those results. A poorly communicated report can undermine the entire process and stall the established momentum. The report should be delivered in a style most suited to the language of the business. For example, if management prefers succinct visual presentations, then the fraud risk assessment team should not deliver a fifty-page written document.
As part of its fraud-related responsibilities, the audit committee of an organization’s board of directors should meet regularly with key internal parties, such as the chief audit executive (CAE), to discuss identified fraud risks and the steps being taken to prevent and detect fraud.
A. True
B. False
A. True
See pages 4.816 in the Fraud Examiner’s Manual
As a sub-group of the board of directors, the audit committee is often assigned oversight of the organization’s financial, accounting, and audit matters and reports to the full board. As part of this responsibility, the committee must take an active role in supervising the assessment and monitoring of the organization’s fraud risks. This involves:
- Receiving regular reports on the status of reported or alleged fraud
- Being aware of fraud risks that are common in the organization’s industry
- Meeting regularly with key internal parties (e.g., the chief audit executive [CAE] or other senior financial persons) to discuss identified fraud risks and the steps being taken to prevent and detect fraud
- Understanding how internal and external audit strategies address fraud risk
- Providing external auditors with evidence that the audit committee is dedicated to effective fraud risk management
- Engaging in open conversations with external auditors about any known or suspected fraud
- Seeking advice of legal counsel whenever it deals with allegations of fraud
Proactive audit procedures, such as fraud assessment questioning and surprise audits, can help demonstrate management’s intention to aggressively look for fraud.
A. True
B. False
A. True
See pages 4.602-4.603 in the Fraud Examiner’s Manual
Implementing proactive audit procedures demonstrates management’s intention to aggressively look for possible fraudulent conduct instead of waiting for instances to be reported. Such techniques include the use of analytical review procedures, data and transaction monitoring and analysis, fraud assessment questioning, and surprise audits where possible.
Communications regarding the organization’s anti-fraud policy should be presented in a positive, non-accusatory manner.
A. True
B. False
A. True
See pages 4.621-4.622 in the Fraud Examiner’s Manual
It is ineffective to have an anti-fraud or ethics policy if it is not communicated to the employees. This communication can be accomplished in several ways, such as during employee orientation and annual training sessions, via interoffice memoranda or newsletters, and through notices displayed in common areas. In all these mechanisms, the communication of the policy should be presented in a positive, non-accusatory manner.
According to best practices, which of the following should be included in a formal whistleblower policy?
A. Any rewards available for providing credible tips
B. Types of misconduct that should be reported
C. Procedures for reporting suspicions or concerns
D. All of the above
D. All of the above
See pages 4.611-4.612 in the Fraud Examiner’s Manual
Organizations can empower employees who wish to disclose information without the fear of negative consequences by creating a safe environment for them to voice their concerns. This can be accomplished by implementing a clear whistleblower policy that details standard reporting protocols and the consequences for retaliating against whistleblowers. This policy can stand alone or be part of the anti-fraud policy.
It is important for management to establish and publicize the organization’s whistleblower procedures so that individuals both inside and outside the organization are aware of the appropriate channels for reporting misconduct. The whistleblower policy should emphasize that it applies to all employees, regardless of their positions or seniority, as well as to anyone external to the organization who has knowledge of potential wrongdoing by any employees or on the company’s part. It should detail what types of misconduct to report, how to report concerns, and any rewards available for disclosing credible information. In addition, a whistleblower policy should include an anti-retaliation component that details the protections the organization affords to whistleblowers and how people will be punished if they violate the policy. By instituting and transparently enforcing a zero-tolerance policy against retaliation, management can increase the likelihood that employees will feel comfortable raising concerns without fear of retribution.
Before agreeing to do business with a new vendor, it is recommended that an organization’s management inquire about the vendor’s internal audit department and the types of audits the vendor is subject to.
A. True
B. False
A. True
See pages 4.812-4.813 in the Fraud Examiner’s Manual
Management should conduct proper due diligence when seeking new vendors or evaluating the relationship of existing vendors to prevent and detect misconduct. An organization can assess a vendor’s commitment to compliance and ethics by performing the following due diligence procedures:
- Ensure that vendors have their own ethics and compliance program before engaging in any transactions.
- Provide the vendor with the organization’s code of conduct and require the vendor’s agents to sign and agree to abide by the code.
- Inquire about the vendor’s internal audit department and the types of audits the vendor is subject to.
- Include contract clauses that require vendors to report any misconduct.
- Alert the vendor that they will be liable for any unethical conduct that occurs in doing business with the organization.
Under the fraud control activities principle described in the Fraud Risk Management Guide, a joint publication by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the ACFE, organizations should select, develop, and deploy preventive and detective fraud control activities.
A. True
B. False
A. True
See pages 4.820, 4.823 in the Fraud Examiner’s Manual
The Fraud Risk Management Guide, a joint publication by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the ACFE, describes five broad principles of fraud risk management, one for each of the five interrelated components of internal control listed in COSO’s Internal Control—Integrated Framework: fraud risk governance, fraud risk assessment, fraud control activities, fraud investigation and corrective action, and fraud risk management monitoring activities. Each of these principles is then supported by several points of focus. The principles and underlying points of focus combine to create a full framework that can be used to design, implement, and assess an effective fraud risk management program.
Under the fraud control activities principle, the organization selects, develops, and deploys preventive and detective fraud control activities to mitigate the risk of fraud events occurring or not being detected in a timely manner.
To reinforce an anti-fraud culture, management should:
A. Create an environment in which employees feel safe challenging management’s decisions
B. Visibly adhere to the same set of ethics policies that is required of all employees
C. Show employees that unethical behavior will not be tolerated
D. All of the above
D. All of the above
See pages 4.613-4.614 in the Fraud Examiner’s Manual
To achieve an organizational culture with a strong value system founded on integrity, management must show employees through its words and actions that dishonest or unethical behavior will not be tolerated. Management must also create an environment in which employees feel safe to challenge management’s decisions or speak up if they think something is wrong. A culture that encourages employees to share their concerns can reduce the risk of fraud significantly because employees often feel more loyal to their superiors. Such a culture might also prevent unethical behavior because issues of anger or stress can be addressed before they escalate to the point of a fraud.
Additionally, management must demonstrate ethics to model the behavior that is expected of the staff. When management believes and acts as though it is irreproachable with respect to company policies, staff members are much less likely to follow rules. Staff members frequently resent management for expecting them to behave in a certain way when members of management do not behave in the same way themselves. However, when management acts ethically and follows organizational policies, the staff tends to respect and appreciate the behavior and copy it.
Management of Blue Top Inc. is implementing a formal background check policy for its employees. Which of the following is NOT a best practice that should be implemented as part of this initiative?
A. Conducting a background check on existing employees who are being promoted or moved to positions that include access to easily stolen assets
B. Asking a candidate’s previous employers whether the individual is eligible for rehire
C. Placing a low priority on checking professional references, since most people do not provide bad references
D. Checking the background of any employee who will have access to cash, checks, and credit card numbers
C. Placing a low priority on checking professional references, since most people do not provide bad references
See pages 4.614-4.615 in the Fraud Examiner’s Manual
Before hiring anyone, management should conduct a background check (where and to the extent permitted by law) to find out as much as possible about the employee’s previous experience with employers and law enforcement. At a minimum, employers should check the background of any employee who will have access to cash, checks, credit card numbers, or any other items that are easily stolen.
Background checks should also be conducted on existing employees who are being promoted or moved to positions that include access to sensitive or valuable company resources. Even if such a check was performed on the employee at the time of hire, updated background checks should be conducted to identify any significant changes or occurrences that have taken place during the individual’s time with the organization.
In assessing individuals for hire or promotion, employers should verify past employment. Even though most employers will only verify position and dates of employment, their tone of voice often indicates what they think of the employee. Also, previous employers should be asked whether the applicant is eligible for rehire.
Additionally, the hiring manager or human resources (HR) should contact the references provided by the candidate. Unfortunately, very few organizations actually do this. Most operate under the theory that someone would not provide a bad reference. However, some job applicants will list individuals who sound important as references with the hope that the hiring organization will not call. In addition, people often just assume, incorrectly, that a former supervisor or coworker will provide a good reference. But obtaining negative information from someone the candidate listed as a recommendation can be very revealing and should serve as a serious warning sign to the hiring organization.
An effective system of anti-fraud controls:
A. Mitigates the risk of fraud but cannot completely eliminate it
B. Increases the perception that fraud will be detected
C. Involves balancing preventive controls and detective controls
D. All of the above
D. All of the above
See pages 4.702 in the Fraud Examiner’s Manual
No system of anti-fraud controls can fully eliminate the risk of fraud, but well-designed and effective anti-fraud controls can deter the average fraudster by reducing the opportunity to commit the fraud and increasing the perception of detection. With the right balance of preventive and detective controls, a good system of anti-fraud controls can greatly reduce an organization’s vulnerability to fraud.
Theft of competitor trade secrets, anti-competitive practices, insider trading, and trade and customs regulations in areas of import and export are all fraud risks pertaining to:
A. Regulatory and legal misconduct
B. Fraudulent financial reporting
C. Asset misappropriation
D. Reputational risk
A. Regulatory and legal misconduct
See pages 4.718 in the Fraud Examiner’s Manual
Regulatory and legal misconduct includes a wide range of risks, such as conflicts of interest, insider trading, theft of competitor trade secrets, anti-competitive practices, environmental violations, and trade and customs regulations in areas of import and export. Depending on the particular organization and the nature of its business, some or all of these risks might be applicable and should be considered in the fraud risk assessment process.
