CAFS key terms

A structured process for identifying where an organization is exposed to fraud, estimating how likely and how damaging each exposure is, and deciding which controls or responses should be prioritized.

A model describing three conditions that typically precede occupational fraud: pressure or incentive to commit it, an opportunity created by weak controls, and a rationalization letting the person justify the act.

The signals senior leaders send through their behavior, priorities, and decisions about whether ethical conduct and fraud prevention are genuinely valued or merely talked about.

A written set of rules stating which behaviors are prohibited, who must follow them, what controls support them, and what consequences follow a violation, approved and visibly supported by leadership.

An independent reporting channel that lets employees, vendors, and others raise concerns about suspected misconduct, usually anonymously, and routes those reports to people able to act on them.

Regular education that teaches staff to recognize common fraud schemes, understand how to use the reporting channel, and know their own responsibilities for preventing and reporting misconduct.

The use of software to examine large volumes of transaction or master-file data for patterns, anomalies, and relationships that manual review of small samples would not reveal.

An expected distribution of first digits in many naturally occurring number sets; large deviations from that pattern in transaction amounts can indicate fabricated or manipulated figures.

A listing of transactions that fail a predefined test, such as duplicates, amounts above a threshold, or payments to blocked vendors, produced for follow-up by an investigator.

A symptom, condition, or pattern that experience links to possible fraud; it signals a need for further inquiry rather than proving misconduct on its own.

An automated, ongoing review of transactions and controls that flags problems close to the time they occur rather than months later during a periodic audit.

Software-based procedures, such as data extraction, matching, and recalculation, used to test entire populations of records instead of relying only on manual samples.

A documented, unbroken record of who handled an item of evidence, when, and where it was kept, so its authenticity can be defended later.

Creating a verified, bit-for-bit copy of a device or storage medium so that analysis can proceed on the copy while the original stays preserved.

A short digital fingerprint calculated from a file or disk image; if the value matches before and after handling, the data is shown to be unchanged.

Independent evidence that supports a statement, document, or suspicion from another source, strengthening it enough to withstand challenge.

Proof supplied by records such as invoices, contracts, bank statements, emails, or ledgers, which is generally the strongest type in financial fraud cases.

Proof that comes from what people say, whether in interviews, depositions, or testimony, and whose weight depends on the speaker's credibility and consistency with other evidence.

The level of certainty a party must reach to win; it is high in criminal cases and lower in civil cases, and it shapes how much evidence an investigation must gather.

The civil standard requiring that a claim be more likely true than not, a lower threshold than the criminal standard and the usual test in fraud recovery suits.

A legal deadline limiting how long after an act a claim or charge may be brought; fraud work must preserve evidence early because deadlines can expire before matters resolve.

A U.S. law that prohibits bribing foreign officials and requires issuers to keep accurate books and effective internal accounting controls, with reach beyond U.S. borders.

A protection that keeps confidential communications between a lawyer and client from forced disclosure; it can be lost if outsiders are included or the advice is used to further a crime.

Laws and policies that shield people who report suspected wrongdoing from retaliation such as firing, demotion, or harassment, encouraging timely disclosure.

Splitting key tasks such as authorizing, recording, and safeguarding assets among different people so no single person can both commit and conceal a fraud.

A control that compares a purchase order, receiving record, and vendor invoice before payment, so purchases are paid only when ordered and received as approved.

The policies, procedures, and system settings an organization relies on to keep records accurate, operations orderly, and assets safe from loss or misuse.

A widely used model describing five components of internal control: control environment, risk assessment, control activities, information and communication, and monitoring, used to design and evaluate controls.

A periodic comparison of two independent records of the same balance, such as a bank statement and the general ledger, with differences investigated and resolved.

A policy requiring employees in sensitive roles to take consecutive leave while others cover their duties, which exposes schemes that need constant attendance to hide.

An attitude of questioning whether information is true, backed by follow-up inquiry and evidence, rather than accepting explanations at face value.

The state of judging facts and evidence on their merits, free from bias, prejudice, personal interest, or pressure from others.

Freedom from relationships, financial interests, or reporting ties that could sway an examiner's conclusions or make others doubt their impartiality.

The duty to protect information learned during an engagement and share it only with those entitled to receive it or as the law requires.

The obligation to perform work with the skill, diligence, and judgment a competent professional would apply to similar assignments, including proper planning and documentation.

A structured interviewing approach that asks a witness to reconstruct events in detail, from several perspectives and in different orders, to improve recall without leading.

An opening phase of an interview in which the person tells their account without interruption or prompting, giving an unprompted version that is harder to challenge later.

A statement by a person acknowledging involvement in or responsibility for an act; it is evidence to be corroborated, not a substitute for other proof.

The investigator's organized record of procedures performed, evidence obtained, and conclusions reached, supporting the final report and any later testimony.

A written account of the case facts, evidence, findings, and conclusions, prepared so a reader with no prior knowledge can follow what happened and why it matters.