CAFS cheat sheet

Fraud triangle conditions: (1) pressure or incentive, (2) perceived opportunity, (3) rationalization; opportunity is the element most directly controllable by the organization.

Fraud risk assessment sequence: identify inherent fraud risks by scheme and account/process, rate likelihood and impact, map existing controls, compute residual risk, compare to risk appetite, then treat.

Residual fraud risk = inherent fraud risk reduced by the mitigating effect of designed and operating controls; residual risk above appetite requires additional control or acceptance by the board.

A quantified fraud risk appetite set by the board or audit committee is distinct from a zero-tolerance statement; zero tolerance defines conduct, not a measurable risk threshold.

Prevention controls act before or during the act: code of conduct, fraud awareness training, pre-employment screening, authorization limits, segregation of duties, physical and logical access restriction, vendor due diligence.

Segregation of duties rule: authorization, custody of assets, recordkeeping, and reconciliation must not be combined in one person; a single person holding two conflicting duties creates an unchecked opportunity.

Cost-benefit decision rule: a fraud control is justified when expected loss avoided (probability of scheme times exposure) exceeds the annual cost of the control plus its operating friction.

The control environment, driven by tone at the top and enforced codes of conduct, is the foundation on which all other anti-fraud controls depend.

Benford first-digit expectation: P(d) = log10(1 + 1/d), giving 30.1% for digit 1, 17.6% for 2, and 4.6% for 9; applies to large, naturally occurring, unconstrained numeric populations, not to assigned or constrained numbers.

Standard analytical tests: duplicate payment and duplicate invoice testing, gap detection in check or invoice sequences, round-amount testing, weekend and holiday posting tests, threshold-hugging tests just below approval limits, and Benford digit analysis.

Data integrity verification before testing: reconcile record counts and control totals (amount sums) from the extracted data back to the source system to confirm completeness and accuracy.

Red flag categories: behavioral (lifestyle beyond means, refusal to take leave, control aversion), documentary (altered or missing documents, photocopied signatures), analytical (unexplained margin shifts, growing write-offs, rising debit memos).

Statistical sampling supports extrapolation of results to the population; judgmental or non-statistical sampling does not permit projection and supports conclusions only about items tested.

Continuous monitoring applies automated rules and thresholds to transactions as they occur, generating alerts that are logged, triaged, and escalated on a defined timeline.

Exception triage decision rule: every alert receives a documented disposition (explained, control weakness, or referred for investigation); unexplained items are not closed without evidence.

An effective reporting channel is independently operated, allows anonymity, is widely publicized, and is paired with documented anti-retaliation enforcement to sustain report volume.

Evidence must be relevant to the allegation, competent (reliable and authentic), and sufficient in quantity to support the conclusion; sufficiency is about volume, competence is about quality.

Chain of custody record content: description of the item, source and location obtained, collector identity, date and time, each transfer with signatures, and storage conditions until disposition.

Digital evidence rule: never analyze the original; use a write-blocker, create a forensic image, compute a cryptographic hash (MD5 or SHA-256), and re-verify the hash after analysis.

Order of volatility for collection: processor registers and cache, system memory, network and running-process state, disk storage, then backups and archival media.

Evidence gathering sequence: secure and preserve documents and data first, then conduct witness interviews, and interview the subject last after the evidentiary record is established.

Fraud examination differs from audit: it is triggered by predication, resolves a specific allegation, is adversary-facing, and follows the evidence rather than testing a pre-defined assertion set.

A litigation hold suspends routine document destruction once litigation or investigation is reasonably anticipated; destruction after that point can constitute obstruction.

Evidence classes are testimonial, documentary, physical, demonstrative, and digital; testimonial evidence should be corroborated with documentary or digital evidence before reliance.

SOX Section 302 requires CEO and CFO certification of disclosure controls and financial accuracy; Section 404 requires management assessment of internal control over financial reporting with auditor attestation for accelerated filers.

SOX Section 802 criminalizes knowing destruction, alteration, or falsification of records in federal investigations (up to 20 years imprisonment); Section 806 and Section 1107 protect whistleblowers from retaliation.

FCPA has two limbs: anti-bribery provisions covering payments to foreign officials, and accounting provisions requiring accurate books and records plus a system of internal accounting controls; third-party agents create liability.

UK Bribery Act 2010 creates four offences: bribing another person, receiving a bribe, bribing a foreign public official, and failure of a commercial organization to prevent bribery, with adequate procedures as the defence.

Reporting escalation rule: suspected fraud is reported to the audit committee or board, and to external counsel, external auditors, insurers, or regulators as statute, contract, or materiality requires.

Attorney-client privilege attaches to confidential communications with counsel for legal advice; work-product protection is broader, but a fraud examiner's factual report prepared for business purposes is generally discoverable.

Anti-money-laundering regimes require suspicious activity or transaction reports to the financial intelligence unit, and tipping-off the subject about a filed report is generally prohibited.

Statute of limitations periods vary by jurisdiction and offence, so limitation analysis and the start of preservation obligations must be determined with counsel at the outset of the matter.

COSO internal control framework components: control environment, risk assessment, control activities, information and communication, and monitoring activities.

Three lines model: operational management owns and operates controls (first line), risk and compliance functions provide oversight and challenge (second line), internal audit provides independent assurance (third line).

Control classifications: preventive versus detective versus corrective, manual versus automated, and entity-level versus transaction-level; automation removes inconsistency but transfers risk to access and change management.

Procure-to-pay key controls: approved vendor master changes, purchase requisition and order approval, three-way match of order, receiving report and invoice, duplicate payment screening, and independent verification of bank detail changes.

Order-to-cash key controls: credit approval before shipment, matching invoice to sales order and shipping documents for price and quantity, independent cash application and reconciliation, and approved write-off authority.

Payroll fraud tests: ghost employee detection by matching payroll register to human resources and active badge or system records, review of master file changes, and segregation of payroll preparation from disbursement.

Journal entry controls: restrict manual posting rights, require approval above thresholds, review top-side and consolidation entries, and test for round amounts, off-hours posting, and unusual preparers.

Bank reconciliations must be prepared by someone independent of cash custody and cash recording, and reviewed and signed by a second person.

IT general controls underpinning financial cycles: access provisioning and timely de-provisioning, periodic privileged access review, change management, and tested backup and recovery.

The IIA Code of Ethics rests on four principles: integrity, objectivity, confidentiality, and competency, each supported by detailed rules of conduct.

The ACFE Code of Professional Ethics requires fraud examiners to act with integrity and diligence, maintain objectivity, avoid conflicts of interest, keep client information confidential, and refrain from unlawful or unethical conduct.

Objectivity is an individual state of mind free from bias and conflict; independence refers to the freedom of the audit activity or engagement from conditions that threaten impartiality.

Common threats to objectivity: self-interest, self-review, advocacy, familiarity, and intimidation; each threat is either eliminated, mitigated by safeguard, or disclosed.

Confidentiality is not absolute: disclosure is permitted when legally required, ordered by a court, or permitted by the client or employer, and then only to persons with a need to know.

A conflict of interest is disclosed in writing as soon as identified, and the professional recuses from the affected decision when a reasonable third party would question impartiality.

Professional skepticism requires corroboration of management representations with independent evidence rather than acceptance of assertions at face value.

Most fraud and audit credentials mandate annual continuing professional education including an ethics component, with completion records retained for verification.

Interview structure: preparation and evidence review, introduction and rapport, free narrative information gathering, specific closed questions, clarification, then summary and close with the interviewee confirming accuracy.

Question funnel rule: begin with open-ended questions (who, what, when, where, how), move to probing questions, and reserve closed or forced-choice questions for confirming details already volunteered.

Leading and compound questions are avoided during fact-finding because they suggest answers and contaminate recall; they are reserved for confirming previously established facts.

Cognitive interview techniques: reinstate the context, instruct the witness to report everything, vary the order of retrieval, and ask the witness to change perspective.

An admission is documented in the subject's own words, read back or shown to the subject, initialed or signed, and any correction is made so the original wording remains legible.

Interview documentation captures date, time, place, participants, questions asked, answers given, and the interviewer's identity; notes are contemporaneous and are never rewritten after review.

Report structure: addressee and authority, executive summary, scope and objectives, methodology, findings stated as who, what, when, where, how and amount, evidence references, conclusion, and recommendations.

Report writing rule: separate verified facts from opinion, label opinion expressly, quantify the loss, cite the supporting exhibit for each finding, and avoid stating legal conclusions reserved for counsel.

Workpaper standards require documentation that is complete, accurate, clear, concise, legible, dated, indexed, cross-referenced, and evidence of supervisory review.