Fraud Prevention and Deterrence
Fraud Prevention and Deterrence
This domain tests how an organization reduces fraud before it occurs and how it changes behavior once a fraud risk is identified. The exam expects you to distinguish prevention-removing opportunity-from deterrence-raising the perceived likelihood and cost of detection-and from detection, which finds fraud after it starts.
Core rules
- Fraud triangle: pressure, opportunity, rationalization. Opportunity is the element management can most directly control.
- A fraud risk assessment identifies inherent risks, evaluates likelihood and impact, and maps controls to residual risk.
- Preventive controls include segregation of duties, authorization limits, physical safeguards, reconciliations, and management review.
- Deterrent measures include anti-fraud policy, code of conduct, training, surprise audits, hotlines, and visible disciplinary action.
- Tone at the top matters: if leaders override controls, lower-level controls weaken.
- Detection controls include exception reports, data analytics, whistleblower channels, and internal audit.
Worked example
A Nigerien NGO pays field staff in cash. Duties are combined: one officer approves, pays, and reconciles. A risk assessment flags cash misappropriation. The fix is not to trust the officer more; it is prevention: separate approval, custody, and reconciliation; set per-diem limits; issue sequential receipts. Deterrence adds unannounced cash counts and a confidential hotline. Detection adds monthly variance analysis. Reasoning: the scheme needs opportunity, so removing it changes the economics; deterrence raises perceived detection, but does not replace control.
Traps
Do not say hotlines prevent fraud; they mainly detect and deter. Do not treat rationalization as a control target. Do not assume internal audit is a preventive control. Do not ignore management override.