Risk Management, Internal Controls, and Fraud Prevention
This domain tests the ability to identify risks and the controls that mitigate them. The classic control framework separates preventive controls (segregation of duties, dual control, authorization limits) from detective controls (reconciliations, audits, exception reports). A frequent exam trap is misclassifying a control - reconciliations are detective, not preventive.
Segregation of duties is the backbone: the person who records a transaction should not also authorize or custody the assets. Dual control requires two people for sensitive tasks (vault access, wire transfers). Mandatory vacation and job rotation deter and detect fraud by exposing concealment. The fraud triangle - pressure, opportunity, rationalization - explains why controls target opportunity most directly.
Common fraud schemes: check fraud (forgery, altered checks), kiting (exploiting float between accounts), embezzlement (often through fictitious loans or manipulated reconciliations), elder financial exploitation, and cyber/identity theft. Member-facing controls include transaction monitoring, alerts, and account restrictions.
Risk assessment uses likelihood × impact to prioritize. Internal audit provides independent assurance; the supervisory committee oversees it. Vendor/third-party risk and business continuity planning are increasingly tested.
Worked example: A teller both accepts deposits and posts them to the ledger with no review. This violates segregation of duties and creates opportunity for lapping (covering a stolen deposit with a later one). The corrective control is to separate cash handling from posting plus independent reconciliation.
Traps: assuming a policy document is itself a control; confusing internal audit (independent) with management's monitoring; and overlooking that the fraud triangle's "opportunity" is what controls reduce.