Fraud Risks and Controls
Fraud questions test a narrow point that is often missed: internal audit does not own fraud risk. The exam asks what auditors must know, what they must plan for, and how they must respond when fraud indicators appear.
Responsibilities
- Management is responsible for establishing fraud risk management and controls; internal audit evaluates whether that is adequate and effective.
- Standard 1210.A2: auditors must have sufficient knowledge to evaluate the risk of fraud and how it is managed, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.
- Standard 1220.A1: due care requires considering the probability of significant errors, fraud, and noncompliance when planning and performing work.
- Standard 2210.A2: engagement objectives must reflect the likelihood of significant irregularities, fraud, and noncompliance.
Fraud risk and response
- The fraud triangle: incentive or pressure, opportunity, and rationalization; an assessment that only looks at controls misses pressure and rationalization.
- Red flags are indicators, not proof: unusual journal entries, override activity, lifestyle changes, single-source vendors, and resistance to segregation of duties.
- When fraud indicators emerge, escalate promptly to the CAE and board, do not alert suspects, preserve evidence, and recommend investigation expertise if it is beyond the auditor's competence.
- Standard 2060 requires reporting significant risk exposures and control failures, including fraud risk, to senior management and the board.
Worked example
A payroll audit finds three employees with bank accounts matching a terminated supervisor's address. The auditor should not confront payroll staff, should not expand testing silently for weeks, and should not attempt to interview the implicated supervisor alone. The correct sequence is to notify the CAE immediately, secure the supporting records, and recommend that management engage specialists to investigate, while internal audit continues to assess the control failure that allowed it.
Traps that cost marks
- Assuming internal audit must detect or investigate all fraud.
- Treating a red flag as evidence of fraud and naming a suspect in the report.
- Concluding that a strong control environment eliminates fraud risk; management override persists.
- Letting an investigation proceed without the competence to conduct it.