Fraud Risk and Internal Fraud Controls
Fraud Risk and Internal Fraud Controls
This domain examines fraud risk assessment and controls against internal fraud in administrative roles. Expect questions on the fraud triangle, red flags, segregation of duties, vendor and expense fraud, whistleblowing and investigation independence.
Core rules
- The fraud triangle: pressure, opportunity and rationalisation. Controls mainly reduce opportunity; awareness and culture address pressure and rationalisation.
- Fraud risk assessment should cover asset misappropriation, corruption and financial statement fraud. Administrative hotspots include vendor master changes, expense claims, petty cash, procurement and payroll.
- Key controls: independent vendor approval, bank-account verification, duplicate-payment analytics, mandatory leave and rotation, surprise counts, and a confidential whistleblowing channel.
- Investigations should be independent of the line being investigated, documented and evidence-preserving. Do not promise confidentiality you cannot keep.
Worked example
An administrative officer creates a shell vendor, approves a small invoice below the review threshold and pays it to a personal account. Red flags: a new vendor with no trading history, a bank account changed soon after creation, and invoices just below approval limits. The control response is to require independent verification of new vendors and bank changes, run duplicate bank-account checks, and review all vendors created by the same officer. The investigation is assigned to internal audit, reporting to the audit committee. Reasoning: the fraud exploited an approval threshold and a weak master-data control; the fix targets both.
Traps
- Focusing only on external fraud and ignoring employee collusion.
- Relying on external audit to detect internal fraud.
- Treating a whistleblowing hotline as sufficient without independent follow-up.
- Allowing the suspect’s manager to lead the investigation.