CAFS common mistakes
CAFS · Understand the traps and how to avoid them.
Completing a fraud risk assessment once and filing it away without revisiting it when vendors, payment methods, systems, or staffing change.
Candidates treat the assessment as a compliance document rather than a living process, so they miss newly created fraud exposure.
What to do instead
Build trigger-based reassessment into the risk register: require review when a new vendor is onboarded, payment approval authority changes, a system is replaced, or a key finance employee leaves; document inherent risk, residual risk, and the specific controls mapped to each risk.
Treating an analytics hit or red flag as proof of fraud and writing the conclusion before corroborating the underlying transaction.
Confirmation bias and pressure to show results cause candidates to confuse an anomaly with intent.
What to do instead
For every hit, document the hypothesis, test false positives against a baseline, obtain independent corroboration from source documents or third parties, and record exculpatory explanations before forming any conclusion.
Collecting digital evidence by taking screenshots or exporting spreadsheets without preserving metadata, hashing the file, or recording who handled it.
Convenience and unfamiliarity with forensic acquisition lead candidates to create copies that cannot be authenticated later.
What to do instead
Use a forensically sound acquisition method, write-protect originals, compute and record a hash at collection, store the original in a controlled evidence repository, and maintain a contemporaneous chain-of-custody log for every transfer.
Interviewing the subject before securing documentary evidence, allowing the subject to learn the scope of the investigation and shape later explanations.
Urgency or overconfidence leads candidates to schedule the interview first because they believe they can extract a confession early.
What to do instead
Sequence the work: gather and secure documents and data first, prepare a documented interview plan, conduct witness interviews before the subject interview where appropriate, and use open-ended questions before confronting with specific evidence.
Assuming every substantiated internal fraud must be reported to an external regulator or police, or conversely assuming none ever must be.
Candidates conflate internal investigation outcomes with statutory reporting duties and do not separate jurisdiction-specific obligations from company policy.
What to do instead
Identify the applicable jurisdiction, entity type, and regulator before deciding; obtain legal counsel review; document the reporting analysis, the decision made, and the basis for it.
Accepting that a long-tenured trusted employee can both create a vendor and approve payments because 'someone has to do it' in a small office.
Candidates rely on trust and compensating oversight assumptions instead of mapping incompatible duties.
What to do instead
Map incompatible duties explicitly, identify the conflicting access or authority, and implement a specific compensating control such as independent owner review of vendor master changes and payment approvals, with evidence of that review retained.
Documenting only evidence that supports the fraud theory and omitting witness statements or documents that point away from the suspect.
An advocacy mindset develops when the investigator becomes invested in the initial hypothesis.
What to do instead
Maintain an evidence matrix that records both inculpatory and exculpatory material, document alternative explanations tested, and require a peer or supervisor review before conclusions are finalized.
Writing a report that states 'the manager stole funds' without separating the factual finding, the criteria violated, and the investigator's opinion.
Narrative writing habits and urgency cause candidates to blend conclusion, opinion, and fact in a way that weakens the report and exposes the organization legally.
What to do instead
Use a structured finding format: criteria, condition, cause, effect, and recommendation; attribute every factual assertion to a specific document or interview; label opinions as opinions and have the report reviewed before issuance.
Running a data analytics test without reconciling the extracted population to the general ledger or documenting the query logic and filters.
Candidates focus on the tool output and overlook completeness and reproducibility of the underlying data.
What to do instead
Reconcile record counts and totals from the source system to the general ledger or control total, version-control scripts, document joins, filters, and date ranges, and state the limitations of the analysis in the workpapers.
Recommending 'additional training' or 'heightened awareness' as the remediation for a control override or a deliberate fraud scheme.
Template recommendations are easy to copy and avoid the harder work of identifying the actual control failure.
What to do instead
Identify the specific control gap, design a preventive or detective control that addresses it, assign a named owner and due date, and specify how management will test that the new control is operating effectively.