Developing and Implementing a Fraud Risk Assessment
Josh Shilts CPA/CFF, CFE
MY GOAL
HAVE YOU WALK AWAY WITH THE KNOWLEDGE AND TOOLS TO COMPLETE A FORMAL & USEFUL
FRAUD RISK ASSESSMENT!!!
Before We Begin, Remember…
The design of an organization’s formal and effective anti-fraud program evolves from the collaborative efforts of executive management, oversight committees, and specific departments within the organization…
We need ALL the help we can get…
OBJECTIVEPrevent or detect the occurrence of fraud and implement proactive solutions to reduce or eliminate fraud’s effects on the organization…
Today’s Focus is on Element #4 - Fraud Risk Assessment
“An organization’s fraud risk exposure should be assessed periodically by the organization to identify specific scenarios that the organization needs to mitigate”
Anti-Fraud Program
Source: The IIA, ACFE and AICPA’s “Managing the Business Risk of Fraud: A Practical Guide”, April 2008.
One Size Doesn’t Fit All NOR Should IT
Management should tailor the design of the assessment to fit the needs and objectives of the organization.
Assessment should be:
Efficient,
Practical,
Easy to Understand, and
Useful
NOT just for you and your department but for everyone in the Organization…
Identify
Present
Risk Assessment Process
5 Easy Steps1) IDENTIFY - Step one is identifying the specific risks your
organization is susceptible too while also considering how granular you should monitor fraud risks…
2) ANALYZE & ASSESS – Fraud risks measurement varies, but the types of measurements used may have a profound effect on how your organization assesses a risk…
3) PRESENT – Who is your audience? Is there a prescribed format they are already use to? These are the questions you need to consider…
4) PLAN & IMPLEMENT – Work with others and their schedules to ensure your efficiency in completing the assessment. Allow management time to digest and provide feedback and than work with control owners to implement proactive mitigation solutions…
5) MONITOR – Oh yea, monitor, monitor and do some more monitoring. Suggest an annual formal “refresh”, but the real value stems from constant assessment.
IDENTIFY: Fraud Risk CategoriesPresent your “FRA” at a level that board members, executive management and others within the organization can understand…
Don’t be so granular that you lose conveying the overall message. These aren’t fraud experts, but rather individuals who are on a “need to know” basis…
Bribery
Larceny
Fake Expenses
False Voids
ANALYZE & ASSESS - MeasuresKPIs and Mitigating Activities provide “real” data to support your assessment; however, Management should be updated and risks ranked by using the…
(1) Magnitude (i.e. Significance):High (3) = > $10 MillionMed (2) = Between $4 Million and $10 MillionLow (1) = < $4 Million
(2) Likelihood (i.e. Controls, Mitigating Activity):Strong (1) = Preferred PracticeGood (2) = AdequateLow (3) = Needs Improvement
(3) Likelihood (i.e. Pressure, Occurrence):High (3) = Significant pressureMed (2) = Moderate pressureLow (1) = Little to no pressure
Magnitude + Likelihood [(Controls) + (Pressure)] = Rank
(1) Velocity – Measurement of the rate of change… (Immediate, Rapid or Slow)
(2) Risk – Gross & ResidualGross before Mitigating Activities and Residual Measures After…(High, Medium or Low)
Other Measures
“ERM” should serve as the model for your FRA
FRA should have the same look and feel as your ERM presentation
PRESENT: Enterprise Risk Management
Magnitude
Major >$500M 5
Substantial >$250M 4
Moderate >$ 100M 3
Minor >$10M 2
Insignificant <$10M 1
Define how Financial Impact is measured (i.e. Net Income, Revenues, etc.)
1 2 3 4 5
Remote Unlikely Possible Likely Almost Certain
Likelihood
1
2
4
3
STRATEGIC
OPERATIONAL
FINANCIAL
COMPLIANCE
FRAUD
Your FRA should serve as a “Drill-Down” from the ERM Fraud Risk
PRESENT: Fraud Risk Assessment
Magnitude
Major >$50M 5
Substantial >$25M 4
Moderate >$ 10M 3
Minor >$1M 2
Insignificant <$1M 1
Define how Financial Impact is measured (i.e. Net Income, Revenues, etc.)
1 2 3 4 5
Remote Unlikely Possible Likely Almost Certain
Likelihood
12
11
3
10
4
6
5
14
13
2
15
9
8
1
7Theoretically the “SUM” equals the value of FRAUD as presented on the Company’s Enterprise Risk Management Map
FRAUD
FRAUD
1 + 2 + 3…+ 14 + 15 = FRAUD
PLAN/IMPLEMENT– Fraud Scheme Mngt.Using the categories defined for presentation purposes build a granular fraud scheme repository specific to your organization’s activities & risks…
The repository schemes can than be tracked and measured at a granular level and rolled up to assist in measuring the sub-risk and categories…
Vendor A is required to pay the bidding manager $2,000 to participate in the bidding process Extortion Corruption
Funds are misappropriated to a shell company. Vendor setup is colluding with accounts payable.
Fraudulent Disbursement – Billing Scheme
Asset Misappropriation
Management has decided to book revenue for items shipped and ships items to meet expectations.
Financial – Fictitious Revenues
Fraudulent Statements
KPIs Mitigation Actions1. Hotline Statistics 1. SOX Controls
2. SEC Enforcement Actions 2. Audit Procedures
Fraud Scheme Sub Risk Category
Prevention – Keep your Ears on the Track
Continue to improve & enhance these activities based on past experiences, new concepts and information from your fraud risk assessment…
1. Integrate current activities with anti-fraud objectives
2. Continue to assess preventative activities as part audit and SOX procedures and identify ways to improve prevention activities
3. Adjust preventive activities based upon new ideas, frauds, etc.
4. Seek feedback from business owners
5. Try to stay ahead of the Fraudster by educating yourself and your team
Detection – Use Existing KnowledgeLeading & Lagging Indicators
1. Hotline Complaints2. Fraud Risk Research Stats3. New Audits w/ Fraud Objectives
1. Ratio Analysis2. Prior Audit Findings3. Hotline Complaint Trends
AUDIT PLANNING & TESTING Training
SOX/ICFR Testing Continuous Monitoring Focus Areas
Fraud Risk Assessment
Audit Planning
Policy ObjectivesManagement/Employee Awareness
MONITORING – It Never Stops!!!
Understand what you or your department is currently doing to “monitor” or uncover additional fraud risks:
Audits
ICFR (e.g. “SOX”)
Continuous Assurance
Find new ways to monitor: Review prior audits and ICFR Fraud Controls
Meet with counterparts in the Company
Read periodicals, journals, etc.
Statistical Analysis (internal and external data)
Now What?
NEVER Stop Thinking of New Fraud Risks
Think of NEW ways to convey your message
TREAT your assessment like a tool
GET TO WORK!!!
