Fraud Prevention and Detection
Prevention versus detection
Prevention reduces the opportunity to commit fraud before it occurs; detection discovers fraud after it has happened. Candidates must know the fraud triangle (pressure/incentive, opportunity, rationalisation), the fraud diamond (adds capability) and the fraud scale (adds personal integrity). Preventive controls include segregation of duties, authorisation limits, physical security, pre-employment screening and a strong tone at the top. Detective controls include reconciliations, surprise audits, exception reporting, data analytics, tip lines and internal audit work.
Memorise that tips are consistently the most common initial detection method in occupational fraud surveys, followed by internal controls and internal audit - not external audit. External audit gives reasonable assurance on the financial statements; it is not a guarantee that fraud will be found.
Traps: (1) labelling a detective control as preventive (bank reconciliation is the classic one); (2) assuming the triangle is always the answer where 'capability' is offered as a distractor; (3) confusing a fraud risk assessment with control testing; (4) forgetting collusion, which defeats segregation of duties.
Rule of thumb: if a control stops the fraud from being possible, it is preventive; if it produces evidence after the event, it is detective.
Worked example: a clerk receives cash, posts to the receivables ledger and prepares the bank reconciliation. That is a textbook opportunity - the clerk can conceal a theft by teeming and lading. Remedy: separate custody (cashier), record-keeping (ledger clerk) and reconciliation (independent finance officer), and rotate duties.