CFBE cheat sheet

Three lines of defense: operational management owns and manages risk; risk/compliance functions monitor and advise; internal audit provides independent assurance to the board or audit committee.

COSO fraud risk management principles: establish fraud risk governance, perform comprehensive fraud risk assessment, select preventive and detective control activities, establish investigation and corrective action, and monitor the program.

Tone at the top is evidenced by board-level oversight, a written code of conduct with acknowledged attestations, and a dedicated whistleblower channel reporting outside management.

Fraud risk management program components: governance and culture, risk assessment, prevention controls, detection controls, investigation and remediation, and monitoring and evaluation.

Program maturity model: ad hoc or reactive, then periodic and documented, then risk-based and integrated, then continuous and predictive monitoring with defined key risk indicators.

Segregation of program ownership: the fraud risk owner sets policy and appetite; internal audit tests control design and effectiveness; the board approves appetite and receives aggregate reporting.

Fraud risk appetite statements define tolerance by fraud category, such as zero tolerance for bribery and defined thresholds for low-value asset misappropriation.

Whistleblower program effectiveness metrics: report volume per 100 employees, substantiation rate, time to case closure, and percentage of reports resolved without retaliation findings.

Third-party and vendor risk governance assigns due diligence ownership, defines tiering by risk, and requires periodic re-screening for sanctions, adverse media, and ownership changes.

Fraud risk assessment steps: identify fraud schemes relevant to the entity, assess inherent likelihood and impact, evaluate control effectiveness, and compute residual risk for prioritization.

Fraud risk register fields: scheme, affected process or account, inherent likelihood, inherent impact, existing controls, control effectiveness rating, residual risk, and owner.

Benford's Law: first-digit expected frequencies approximate 30.1% for 1, 17.6% for 2, 12.5% for 3, 9.7% for 4, 7.9% for 5, 6.7% for 6, 5.8% for 7, 5.1% for 8, and 4.6% for 9.

Chi-square goodness-of-fit tests whether observed digit frequencies differ significantly from Benford expectations; large datasets with many orders of magnitude are the appropriate population.

Data analytics fraud tests: duplicate payments, round-dollar amounts, payments just below approval thresholds, weekend or holiday postings, and vendor and employee address matches.

Red flag scoring converts analytics hits into ranked alerts using weighted risk factors, then routes high-score exceptions to investigation rather than to the whole population.

Ratio and trend analytics for fraud detection: gross margin volatility, days sales outstanding spikes, inventory turnover decline, and growing revenue with flat or declining operating cash flow.

False positive management: tune thresholds against known-good populations, document rationale for rule changes, and track alert-to-substantiated-case conversion rates.

Data quality preconditions for analytics: completeness of the population extract, reconciliation of record counts to the general ledger, and documented scope and time period.

Segregation of duties requires separating authorization, custody of assets, record keeping, and reconciliation among different people.

Incompatible duty combinations: creating a vendor and approving payments, posting journal entries and performing the bank reconciliation, and maintaining the payroll master file and disbursing payroll.

Preventive controls stop an error or fraud before it occurs, such as approval workflows; detective controls identify it after the fact, such as reconciliations and exception reports.

Control design attributes: performed by a competent person, applied consistently, timely, and evidenced by retained documentation such as sign-off, log, or system record.

Compensating controls for small entities: owner-manager review of bank statements, mandatory vacation and rotation for bookkeeping staff, and independent review of journal entries.

Journal entry controls: restrict posting access, require supporting documentation and approval for manual entries, and review entries posted to unusual accounts or by unusual users.

Master data change controls: dual approval for vendor, customer, and employee master file changes, with audit trail capturing who changed what and when.

Access controls support segregation: role-based access, least privilege, periodic user access reviews, and immediate revocation on termination.

Key control testing: attribute sampling to test operating effectiveness, with deviation rate compared to tolerable rate before concluding reliance is possible.

The fraud triangle: pressure or incentive, opportunity, and rationalization; financial statement fraud typically adds a fourth element, capability of the perpetrator.

Common revenue schemes: fictitious revenue, premature recognition before delivery or acceptance, holding the books open past period end, and channel stuffing with side agreements.

Warning signs of revenue manipulation: revenue growth outpacing peers, rising days sales outstanding, unusual fourth-quarter spikes, and large returns shortly after period end.

Asset overstatement schemes: inflated inventory through unsupported capitalization of costs, overvalued receivables, and understated allowances for doubtful accounts or obsolete stock.

Liability and expense understatement: failing to record accrued liabilities, capitalizing operating costs, and shifting expenses to later periods or to unconsolidated entities.

Non-GAAP and disclosure manipulation: selectively excluding recurring costs, changing accounting estimates without basis, and omitting related-party transactions or contingencies.

Cash flow quality test: net income consistently exceeding operating cash flow across periods suggests accrual manipulation and warrants reconciliation analysis.

Related-party red flags: significant transactions with unconsolidated entities, unusual terms, undisclosed relationships, and loans to executives or board members.

Management override indicators: dominant CEO or CFO, high executive turnover, auditor changes with disagreements, and aggressive targets tied to compensation.

Cash larceny is theft of cash already recorded on the books; skimming is theft of cash before it is recorded, so skimming is harder to detect from the ledger.

Check tampering schemes: forged maker signature, forged endorsement, altered payee, and authorized-maker schemes where the signer is complicit.

Register disbursement schemes: false voids, false refunds, and false no-sale transactions used to extract cash from the register.

Billing schemes: shell company, pass-through vendor, and personal purchases with company funds; detection focuses on vendor master file and address matching.

Inventory schemes: theft of physical stock, false write-offs, misclassification of scrap, and understated receiving records; detection uses cycle counts and shrink trend analysis.

Payroll schemes: ghost employees, falsified hours, commission or bonus manipulation, and unauthorized pay-rate changes; detection matches payroll to human resources records and badge data.

Expense reimbursement schemes: overstating business expenses, fictitious expenses, multiple reimbursements, and mischaracterized personal expenses.

Anti-fraud cash controls: daily deposits, surprise cash counts, dual custody of cash, and mandatory reconciliation by someone without cash handling duties.

Shrink analysis decomposes inventory loss into known causes such as damage and returns; unexplained residual shrink is the indicator of possible theft.

Procurement fraud schemes: bid rigging, collusive bidding, bribery of buyers, fictitious vendors, duplicate invoicing, and change-order manipulation.

Bid rigging indicators: identical bid errors, rotating winning bidders, unusually narrow price spreads, and the same bidders appearing across unrelated tenders.

Vendor due diligence elements: beneficial ownership identification, sanctions and watchlist screening, adverse media review, and financial viability assessment.

Conflict of interest in procurement: undisclosed relationships between employees and vendors, gifts and hospitality above policy thresholds, and post-employment hiring of procurement staff by vendors.

Shell vendor red flags: address matching an employee or another vendor, sequential vendor numbers created in a burst, missing tax identifiers, and post office box addresses.

Three-way match control compares purchase order, receiving report, and vendor invoice before payment; a fourth match adds the approved contract or price list.

Duplicate payment detection matches invoices on vendor, amount, and invoice number across a rolling window and checks for near-duplicate amounts and dates.

Third-party risk tiering assigns enhanced due diligence to high-risk categories such as agents, intermediaries, and vendors in high-corruption jurisdictions.

Continuous vendor monitoring re-screens for sanctions, ownership changes, and litigation at defined intervals and on trigger events such as mergers.

Foreign Corrupt Practices Act prohibits bribery of foreign officials and requires accurate books and records and adequate internal accounting controls for issuers.

FCPA exceptions: facilitating or grease payments for routine governmental actions are permitted for non-official acts; the UK Bribery Act has no such exception and covers commercial bribery.

UK Bribery Act offenses: bribing another person, receiving a bribe, bribing a foreign public official, and the corporate failure to prevent bribery offense.

Adequate procedures defense under the UK Bribery Act rests on proportionate procedures, top-level commitment, risk assessment, due diligence, communication and training, and monitoring and review.

Red flags of corruption: unusual commissions to intermediaries, payments to third parties in high-risk jurisdictions, cash payments, and off-book accounts or slush funds.

Conflicts of interest management: annual disclosure, recusal from decisions affecting a disclosed interest, gifts and hospitality registers with thresholds, and independent review.

Kickback indicators: vendor prices above market, inflated invoices with rebates returned to an employee, and a buyer living beyond apparent means.

Third-party intermediary risk controls: written contracts with anti-corruption representations, audit rights, training, and certification of compliance before payment.

Books and records requirements mean payments must be accurately recorded with sufficient detail to reflect the true nature of the transaction.

Business email compromise impersonates an executive or vendor to redirect payments; verification by callback to a known number, not one supplied in the request, is the key control.

Payment fraud controls: dual approval for wire transfers, segregation of payment initiation from approval, and out-of-band verification for changes to vendor bank details.

Account takeover indicators: changed bank account details on a known vendor, urgent payment requests, unusual sender domains, and requests to bypass normal procedure.

Card fraud types: card-not-present fraud, skimming at terminals, and card testing with small transactions before larger fraudulent charges.

Identity theft in fraud programs: synthetic identities combine real and fabricated data to create a credit or account profile with no true owner.

Authentication controls: multi-factor authentication, device fingerprinting, behavioral analytics, and step-up verification for high-risk transactions.

Check fraud controls: positive pay matching issued checks to presented items, reverse positive pay, and check stock security features.

Ransomware and cyber fraud response: isolated backups, tested incident response plans, defined notification obligations, and preservation of forensic evidence.

Payment system risk: automated clearing house fraud uses unauthorized debits or credits; controls include debit blocks and account-level transaction limits.

Evidence types: documentary, testimonial, physical, and electronic; evidence must be relevant, competent, and sufficient to support a conclusion.

Chain of custody documents who handled each item, when, and where; breaks in the chain weaken admissibility and evidentiary weight.

Investigation steps: intake and triage, planning, evidence gathering, interviews, analysis, reporting, and remediation with control improvements.

Interview sequence in an investigation: witnesses first, then the subject last, after all documentary evidence is secured.

Interview structure: establish rapport, obtain a free narrative, then move to specific questions and, when appropriate, present evidence of the discrepancy.

Cognitive interviewing improves recall by reinstating context, asking open-ended questions, and discouraging leading or suggestive prompts.

Deception indicators are behavioral cues only, not proof; reliance on them alone is unreliable, and evidence-based questioning is preferred.

Forensic data collection: image devices before analysis, hash the image to prove integrity, and maintain a working copy while preserving the original.

Written investigation report components: scope and authority, evidence reviewed, findings of fact, conclusion, and recommendations for control remediation.