Fraud Risk Assessment and Data Analytics
Fraud risk assessment converts an abstract worry into a ranked, documented list of scheme-level exposures; analytics converts that list into tests that can run against full populations. CFBE questions test whether you can build a usable fraud risk register and match the right analytic to the right scheme.
Building the assessment
Inherent risk equals likelihood times impact, scored before controls. Residual risk is what remains after existing controls operate. A usable register names the scheme rather than the category, the actor who could execute it, the red flags, the data source that would reveal it, and the control that currently addresses it. Assess where money moves: procurement, payroll, revenue, treasury, and journal entries.
Analytics that find fraud
- Benford's Law - expected first-digit frequencies of 30.1%, 17.6%, 12.5%, 9.7%, 7.9%, 6.7%, 5.8%, 5.1%, 4.6%. It applies to naturally occurring data spanning several orders of magnitude, not to assigned numbers, capped amounts, or small samples (roughly under 1,000 records).
- Threshold clustering - amounts piling up just below an approval limit, e.g. many invoices at 9,850 when approval starts at 10,000.
- Duplicate testing - same vendor, invoice number, amount, or date; fuzzy matching on name, address, and bank account.
- Gap detection - missing check, purchase order, or invoice numbers indicating unrecorded transactions.
- Relative Size Factor - largest item in a group divided by the second largest; a high RSF flags an outlier for review.
- Off-hours postings, round-dollar amounts, and entries by users who rarely post.
Worked example
A first-digit Benford test on 42,000 purchase invoices shows digit 8 at 9.4% against an expected 5.1%. The examiner should not conclude fraud. She stratifies by amount band, finds the anomaly concentrated between 8,000 and 9,999, and identifies a cluster at 8,999 to 9,200. Cross-referencing the approval matrix shows these were split from larger purchases. The finding is invoice splitting, a control-avoidance scheme, and it is established by documentation, not by the digit test.
Traps
- Treating a Benford deviation as evidence of fraud; it is a red-flag generator.
- Skipping data completeness and integrity testing - analytics on a partial extract is worthless.
- Ignoring false-positive economics: a test producing 4,000 hits will never be investigated.
- Applying Benford to salary bands, check numbers, or capped reimbursements.