CFBE key terms

The board and executive-level structure of policies, oversight bodies, reporting lines, and accountability that sets how an organization identifies, tolerates, and responds to fraud risk.

The amount and type of fraud exposure leadership is willing to accept in pursuit of objectives, expressed in measurable tolerances that guide control investment and escalation thresholds.

An governance structure in which operating management owns and manages risk, a separate risk and compliance function monitors it, and internal audit provides independent assurance to the board.

The signals senior leaders send through conduct, incentives, and enforcement decisions that shape whether employees treat fraud control as a genuine priority or a formality.

A structured process that identifies fraud schemes relevant to an organization, estimates their likelihood and impact, and prioritizes controls and monitoring accordingly.

A maintained inventory of identified fraud schemes, affected processes, inherent and residual ratings, assigned owners, and linked controls that supports periodic reassessment.

The exposure to loss from a fraud scheme before considering the mitigating effect of any controls the organization has designed or operates.

The fraud exposure that remains after existing controls are applied, which determines whether additional treatment or acceptance by management is appropriate.

A model explaining misconduct through three conditions: pressure or incentive, opportunity created by weak control, and rationalization that lets the person justify the act.

The use of querying, matching, and statistical techniques across full populations of transactions to surface anomalies, outliers, and patterns indicative of fraud.

An expected distribution of leading digits in naturally occurring numeric data, used to flag datasets whose digit patterns suggest fabrication or manipulation.

Software-based methods such as data extraction, joins, duplicate testing, and gap analysis that let auditors test entire transaction populations rather than samples.

An observable indicator or pattern, such as unusual journal entries or lifestyle incongruity, that raises the probability of fraud and warrants follow-up inquiry.

Splitting authorization, custody, recording, and reconciliation among different people so no single individual can initiate and conceal a fraudulent transaction.

An alternative safeguard, such as independent review or exception reporting, that reduces risk when practical constraints prevent full separation of incompatible duties.

The circumvention of established controls by a person with sufficient authority, often through journal entries or unusual transactions, making it a persistent control limitation.

The targeted examination of manual, top-side, and unusual entries for characteristics such as round amounts, after-hours posting, or unfamiliar preparers that suggest manipulation.

Deliberate misstatement or omission in reported financial information, typically through premature revenue, hidden liabilities, or improper valuation, to mislead users.

Recording sales before they are earned or that lack economic substance, such as channel stuffing or side agreements, to inflate reported revenue in a period.

An excessive liability or allowance accumulated in strong periods and released in weak ones to smooth reported earnings across reporting periods.

The use of judgment or transaction structuring to steer reported results toward a target, ranging from legitimate discretion to abusive smoothing that crosses into fraud.

A scheme in which an entity sells goods or assets to a counterparty and buys them back, or arranges reciprocal deals, to create illusory revenue and activity.

Theft or misuse of an organization's resources by insiders, encompassing cash schemes, inventory and asset diversion, and payroll manipulation.

Removing cash from a business before it is recorded in the accounting system, so the theft never appears in the books and is hard to detect from records alone.

Stealing cash that has already been recorded on the books, often by taking receipts from a register or deposits after entry, requiring concealment of the resulting shortage.

A fictitious or departed person kept on the payroll, with wages diverted to the perpetrator, often enabled by weak hiring records and absent verification.

Manipulation of pay through ghost employees, inflated hours or rates, unauthorized commissions, or diverted direct deposits to obtain funds improperly.

Misconduct in sourcing and purchasing, such as bid rigging, split purchases, phantom vendors, or specification steering, that diverts value to insiders or colluding parties.

Collusion among bidders or with an insider to pre-determine a contract award through complementary bids, bid suppression, or rotating winning among conspirators.

A fictitious supplier created or reused to receive payments for goods or services never delivered, often supported by fabricated invoices and shell company records.

Periodic analysis of supplier records for duplicates, shared bank accounts or addresses, employee links, and inactive vendors that may signal fictitious or conflicted suppliers.

An entity with no meaningful operations or assets used to receive illicit payments, obscure ownership, or layer funds away from their true beneficiary.

Offering, giving, receiving, or soliciting something of value to influence an official act or business decision improperly, whether directly or through intermediaries.

A secret return of part of a payment to the person who influenced the transaction, commonly hidden in inflated invoices or supplier arrangements.

A small payment to a low-level official to speed a routine, non-discretionary action, treated differently from bribery under some laws but still a compliance risk.

A United States law prohibiting bribery of foreign officials and requiring accurate books and records plus internal accounting controls for issuers.

A situation where a person's private interest could improperly influence their professional judgment, requiring disclosure, recusal, or other mitigation.

Identification of the natural persons who ultimately own or control a legal entity, used to detect hidden interests behind vendors, accounts, and transactions.

A transfer of resources between an entity and parties with which it has a close relationship, requiring disclosure and scrutiny because terms may not be arm's length.

A social engineering attack in which a fraudster impersonates an executive, vendor, or colleague to redirect payments or obtain sensitive information.

A scheme where an attacker convinces a payer that a supplier's bank details have changed, diverting legitimate payments to a controlled account.

Manipulating people through impersonation, urgency, or authority to disclose information or perform actions that compromise controls.

Obtaining and using another person's identifying information without authorization to open accounts, obtain credit, or pass verification checks.

A fabricated identity combining real and fictitious data elements that is built over time into a credible profile used to obtain credit or services.

Due diligence procedures that verify a customer's or counterparty's identity, beneficial ownership, and risk profile before and during a business relationship.

A documented, unbroken record of who handled evidence, when, and how it was stored, supporting its integrity and admissibility in proceedings.

Creating a verified bit-for-bit copy of a digital device or storage medium so analysis occurs on the copy while the original remains unaltered.

Immediate steps to secure documents, data, and communications against deletion or alteration, including legal hold notices and suspension of routine purges.

A structured conversation to gather facts, assess credibility, and, where appropriate, obtain an admission, guided by planning, documentation, and legal constraints.

A written or recorded account in which a subject acknowledges involvement in misconduct, ideally voluntary, detailed, and obtained without improper coercion.

A confidential channel such as a hotline or reporting portal that lets staff and third parties raise concerns without fear of retaliation.

The possibility that conclusions drawn from testing a subset of transactions differ from what testing the entire population would reveal.