Northwind Components: Rebuilding a Fragmented Fraud Risk Program
Northwind Components is a $1.2 billion automotive parts manufacturer with 6,800 employees across 14 plants. Its fraud risk program consists of an annual code-of-conduct acknowledgment (92% completion), a third-party hotline, and a fraud risk assessment performed by internal audit every three years. Last year the hotline received 31 reports (0.46 per 100 employees); only two were substantiated. The audit committee receives a one-page summary twice a year. The new chief audit executive has two additional FTE and $250,000, but cannot replace the ERP or add headcount outside internal audit. Management argues the low report volume proves the tone at the top is strong, citing the CEO's quarterly town halls. Plant controllers independently handle customer credits, and no one owns the enterprise fraud risk assessment between audit cycles. The board wants a redesigned program within nine months and has asked for measurable outcomes.
1. Identify the three most consequential design gaps and sequence the remediation, explaining why your order matters.
Read the worked answer
Three gaps matter most. First, the risk assessment is stale and unowned: a three-year cycle cannot capture plant-level changes such as new customer credit authority, so the program is not risk-based. Second, detection is weak: a hotline with 31 reports may indicate underreporting or poor intake, but the program lacks analytics, surprise audits, and vendor or customer monitoring. Third, oversight is thin: a one-page summary twice a year gives the audit committee no basis to challenge management.
Sequence matters because the risk assessment defines where prevention and detection dollars go; without it, hotline promotion and analytics are unfocused. I would first assign a fraud risk owner and refresh the assessment over 90 days using interviews, process walkthroughs, and prior investigation root causes. Next, redesign intake and awareness, then deploy targeted analytics in accounts payable and customer credits. Board reporting comes last but not late: it should show the risk heat map, remediation status, and management assertions. With two FTE and $250,000, prioritize analytics on existing ERP data rather than new software.
2. Evaluate the hotline metric. What additional data would you request before concluding the program is underperforming?
Read the worked answer
0.46 reports per 100 employees is low compared with common benchmarks of roughly one to two, but a benchmark is not a conclusion. Low volume can mean effective prevention, fear of retaliation, poor hotline accessibility, or reports being diverted to managers and never logged. Only two substantiations out of 31 may also reflect weak intake, inadequate investigation, or a narrow definition of substantiation.
Before declaring underperformance, request report categories, anonymous share, time from report to closure, reporter feedback, location and function mix, repeat reporters, and whether substantiated cases led to control changes. Compare with prior years and with employee survey questions on trust and willingness to report. Reconcile hotline reports to HR grievances, ethics cases, and internal audit findings; underreporting often appears as mismatched channels. If employees do not believe reports lead to action, promotion alone will not help. Recommend a short employee survey and intake review before setting volume targets, because chasing report counts can incentivize low-quality allegations.
3. Design the audit committee reporting package and assign accountability for each element.
Read the worked answer
Report a balanced scorecard, not a narrative. Include: top fraud risks by likelihood and impact, with changes since the last cycle; hotline and other detection metrics with trends and substantiation outcomes; open investigations by age and category; root causes and remediation status; training and code acknowledgment by business unit; third-party and vendor risk indicators; and management's assertions with internal audit's independent assessment.
Assign accountability explicitly: the CFO or general counsel owns program execution, business unit leaders own process-level controls, internal audit provides assurance, and the audit committee oversees and challenges. Each metric should have a definition, owner, target, and data source. Avoid a one-page summary that hides bad news; instead, use a dashboard with exceptions and a short memo on the three risks that changed most. Require management to present, not internal audit alone, so ownership is visible. Track whether prior remediation actually closed, not just whether a plan exists.