Fraud Prevention and Deterrence
What this domain tests
Fraud prevention and deterrence is about reducing the opportunity and the perceived payoff for fraud before a scheme begins. Distinguish three terms that questions deliberately blur: prevention (controls that make fraud physically harder), deterrence (measures that raise the perceived likelihood of detection and the severity of consequences), and detection (finding fraud after it happens). A hotline, surprise audits, and tone at the top are primarily deterrents; segregation of duties, system access restrictions, and physical safeguards are preventive.
Concepts to carry in
- Fraud triangle: pressure/incentive, opportunity, rationalization. Opportunity is the element the organization controls most directly.
- Fraud diamond: adds capability - position, technical skill, and confidence to both execute and conceal.
- Fraud risk management framework: governance and tone at the top, a documented fraud risk assessment, control activities, training and communication, monitoring, and a response protocol. The fraud risk assessment is the engine; controls selected without one are guesswork.
- Three lines of defense: operational management, risk/compliance functions, internal audit.
- Specific deterrents: mandatory vacations, job rotation, surprise cash counts, anonymous reporting channels, vendor master-file controls, and published enforcement of the code of conduct.
Traps
Questions conflate "the auditor must plan to detect material misstatement" with "the auditor guarantees fraud detection." Watch for candidates treating a written code of ethics as a control when it is only guidance unless enforced. Another frequent trap is labeling a whistleblower hotline as preventive.
Rule of thumb
For any cash-handling scenario, apply the three-function test: custody, recording, and authorization must never rest with one person. If a proposed answer leaves all three in a single role, eliminate it.
Worked example
A clerk opens the mail, posts customer payments to the ledger, and prepares the deposit. That is custody plus recording in one role - a textbook skimming and lapping opportunity. The fix is not better supervision alone; it is splitting the functions so the person who touches cash cannot also record it.