Fraud, IT, and Emerging Risk Considerations
Government audit teams face fraud, technology and fast-moving risks with limited resources. You are tested on what due professional care requires and where internal audit's role stops.
Core rules
- Standard 1210 requires reasonable care and competence, not infallibility. Fraud prevention and detection belong to management; internal audit assesses whether controls deter and detect fraud and considers fraud risk in engagement objectives (2120.A2, 2210.A2).
- Fraud risk is analyzed with the fraud triangle: pressure or incentive, opportunity, and rationalization. Opportunity usually maps to weak segregation of duties, override capability and poor master-file controls.
- IT assurance separates general IT controls (access management, change management, IT operations, backup, third parties) from application controls (input, processing, output). Automated controls can be relied on only where the general controls over them are effective.
- Emerging areas the exam favors: cybersecurity and incident response, cloud and third-party concentration risk, data privacy, artificial intelligence and model risk, ESG and grant-funding schemes.
Worked example
Analytics show two vendors using an employee's home address, and one shares that employee's bank details. Do not confront staff. The CAE notifies those charged with governance and legal or the ethics function, preserves the data extract, and the matter moves from assurance to a fraud examination under defined authority. The audit finding then addresses design gaps: vendor master-file change approval, independent verification of bank details, and duplicate-address monitoring.
Traps
Promising that an audit will "detect fraud"; investigating beyond your mandate; relying on a service organization's control report without checking complementary user-entity controls; running analytics on unvalidated data.