Fraud Risk Identification/Assessment by Internal Auditors

2. Fraud Risk Identification/Assessment by Internal Auditors

3. Definition of Fraud The Institute of Internal Auditors’ IPPF defines fraud as: “Any illegal act characterized by deceit, concealment, or violation of trust. These acts are not dependent upon the threat of violence or physical force. Frauds are perpetrated by parties and organizations to obtain money, property, or services; to avoid payment or loss of services; or to secure personal or business advantage.”

4. Another definition of fraud from the publication “Managing the Business Risk of Fraud: A Practical Guide,” sponsored by The IIA, the AICPA, and the Association of Certified Fraud Examiners, states: “Fraud is any intentional act or omission designed to deceive others, resulting in the victim suffering a loss and/or the perpetrator achieving a gain.” Frauds are characterized by intentional deception or misrepresentation.

5. Impact of Fraud Fraud has negatively impacted organizations in different ways, including financial, reputational, psychological, and social. Organizations have been forced to cease operations due to the impact of financial and reputation damages, and the psychological and social effects have been especially shocking to the employees of the organizations.

6. Impact of Fraud Victims of fraud also suffer mental and emotional harm and stress-related physical effects in addition to their financial losses. The victims have felt robbed of not only their money, but also their security, self-esteem, and dignity. The bottom line is that fraud left unchecked can be damaging to any organization.

7. Reasons for Fraud • Pressure or incentive • Opportunity • Rationalization

8. Pressure or incentive Pressure or incentive represents a need that an individual attempts to satisfy by committing fraud. Often, pressure comes from a significant financial need or problem. This may include the need to keep one’s job or earn a bonus. In listed companies, there may be pressure to meet or beat analysts’ estimates. For example, a large bonus or other financial award can be earned based on meeting certain performance goals. The fraudster has a desire to maintain his or her position in the organization and to retain a certain standard of living to compete with perceived peers.

9. Opportunity Opportunity is the ability to commit fraud and not be detected. Since fraudsters do not want to be caught in their actions, they must believe that their activities will not be detected. Opportunity is created by weak internal controls, poor management, lack of board oversight, and/or through the use of one’s position and authority to override controls. Failure to establish adequate procedures to detect fraudulent activity also increases the opportunities for fraud to occur.

10. Opportunity Persons in positions of authority may be able to create opportunities to override existing controls because subordinates or weak controls allow them to circumvent the established controls. Opportunity often occurs because the fraudster knows what the auditor will do — the when, what, and how much of the auditor’s procedures. For example, if the fraudster knows that the auditor always tests only large transactions in December, the fraudster can commit the fraud on smaller transactions in other months.

11. Rationalization Rationalization is the ability for a person to justify a fraud, a crucial component in most frauds. Rationalization involves a person reconciling his/her behavior (e.g., stealing) with the commonly accepted ideas of decency and trust. For example, the fraudster places himself or herself as the priority (self-centered), rather than the wellbeing of the organization or society as a whole.

12. Rationalization The person may believe committing fraud is justified in the context of saving a family member or loved one so he/she can pay for high medical bills. Other times, the person simply labels the theft as “borrowing,” and intends to pay the stolen money back at a later time. Some people will do things that are defined as unacceptable behavior by the organization, yet are commonplace in their culture or were accepted by previous employers. As a result, they can rationalize their behavior as the rules don’t apply to them.

13. Reasons of Management fraud Management fraud usually occurs because of the ease with which management can circumvent the systems of internal control. Sawyer list eight reasons behind management fraud. These are motives (incentives or situational pressures). • Sometimes take rash steps from which they cannot move back. • Profit centers may distort facts to delay divestment. • Incompetent managers may deceive to survive.

14. Reasons of Management fraud • Performance may be distorted to justify larger bonuses. • The need to succeed can turn managers to cheating. • Corrupt managers may serve interests that conflict. • Profits may be inflated to obtain advantages in the market. • The one who controls both the assets and their records is in a perfect position to falsify the latter.

15. Examples of Fraud • Asset misappropriation involves stealing cash or assets • Skimming occurs when cash is stolen from an organization before it is recorded on the organization’s books and records. • Disbursement fraud occurs when a person causes the organization to issue a payment for fictitious goods or services, inflated invoices, or invoices for personal purchases. • Expense reimbursement fraud occurs when an employee is paid for fictitious or inflated expenses.

16. Examples of Fraud • Payroll fraud occurs when the fraudster causes the organization to issue a payment by making false claims for compensation. • Financial statement fraud involves misrepresenting the financial statements, often by overstating assets or revenue or understating liabilities and expenses. • Information misrepresentation involves providing false information, usually to those outside the organization.

17. Examples of Fraud • Corruption is the misuse of entrusted power for private gain. Corruption includes bribery and other improper uses of power. Corruption is often an off-book fraud, meaning that there is little financial statement evidence available to prove that the crime occurred. • Bribery is the offering, giving, receiving, or soliciting of anything of value to influence an outcome. • Bribes may be offered to key employees or managers such as purchasing agents who have discretion in awarding business to vendors.

18. Examples of Fraud • A conflict of interest occurs where an employee, manager, or executive of an organization has an undisclosed personal economic interest in a transaction that adversely affects the organization or the shareholders’ interests. • A diversion is an act to divert a potentially profitable transaction to an employee or outsider that would normally generate profits for the organization. • Unauthorized or illegal use or theft of confidential or proprietary information to wrongly benefit someone. • Tax evasion is intentional reporting of false information on a tax return to reduce taxes owed.

19. Potential Fraud Indicators Fraudsters often display certain behaviors or characteristics that may serve as warning signs or red flags. • High personnel turnover • Low employee morale • Paperwork supporting adjusting entries not readily available • Bank reconciliations not completed promptly • Increases in the number of customer complaints • Unusual rise in inventory and receivables • Deteriorating income trend when the industry or the organization as a whole is doing well.

20. Potential Fraud Indicators • Numerous audit adjustments of significant size • Write-offs of inventory shortages with no attempt to determine cause • Unrealistic performance expectations • Rumors of conflicts of interest • Use of duplicate invoices to support payments to suppliers • Use of sole-source procurement contracts • Overrides of controls by management or officers • Consistently exceeding goals/objectives regardless of changing business conditions and/or competition

21. Potential Fraud Indicators • Prevalence of non-routine transactions or journal entries • Rewriting records under the guise of neatness in presentation • Problems or delays in providing requested information • Significant unusual changes in customers or suppliers • Transactions that lack documentation or normal approval • Employees or management hand-delivering checks • Customer complaints about delivery

22. Potential Fraud Indicators • Replying to questions with unreasonable explanations • Not separating the functional responsibilities of authorization, custodianship, and record keeping • Failure to record transactions resulting in lack of accountability • Not comparing existing assets with recorded amounts • Transaction execution without proper authorization • Not implementing prescribed controls because of Lack of / Unqualified personnel • Lack of computer expertise by supervisors • Unlimited access to assets

23. Potential Fraud Indicators • Unrestricted access to computer disks • Location of computer terminals off-site without compensating controls • Use of untested off-the-shelf vendor software • Poor IT access controls such as poor password controls • Existence of liquid assets, such as cash, bearer securities, or highly marketable merchandise • An employee is trusted so completely that duties are not segregated • A manager continually handles the organization's most urgent problems

24. Organizational-Level Red Flags (Tone at the Top, The lIA November 2003) • Abnormally rapid growth or profits, particularly relative to the industry • Financial results excessively better than those of competitors absent significant operational differences. • Unexplained changes in trends or financial statement relationships • Decentralized operations coupled with a weak internal reporting system • Earnings growth combined with a lack of cash

25. Organizational-Level Red Flags • Excessively optimistic public statements about future growth • Use of accounting principles that conform with the letter (form) of requirements, not the substance, or that vary from industry practice • A debt ratio that is too high or difficulty in paying debt • Excessive sensitivity to interest rate fluctuations • End-of-period transactions that are complex, unusual, or significant • Non-enforcement of the organization’s ethics code

26. Organizational-Level Red Flags • Material related-party transactions not in the ordinary course of business • Potential business failure in the near term • Use of unusual legal entities, many lines of authority, or contracts with no obvious business reason. • Business arrangements that are difficult to understand and do not seem to have any practical applicability to the entity.

27. Personal red flags • Living beyond one’s means • Borrowing small amounts from fellow employees • Placing personal checks in change funds -- undated, postdated -- or requesting others to "hold" checks • Collectors or creditors appearing at the place of business, and excessive use of telephone to "stall off" creditors • Placing unauthorized IOUs in change funds, or prevailing on others in authority to accept IOUs for small, short-term loans

28. Personal red flags • Conveying dissatisfaction with the job to fellow employees • Severe personal financial losses • Addiction to drugs, alcohol or gambling • Change in personal circumstances • Developing outside business interests • Pronounced criticism of others so as to divert suspicion • Getting annoyed at reasonable questioning

29. Personal red flags • Refusing to leave custody of records during the day; working overtime regularly • Refusing to take vacations and avoid promotions for fear of detection • Constant association with and entertainment by, a member of a supplier's staff • Carrying an unusually large bank balance, or heavy buying of securities • Extended illness of self or family, usually without a plan of debt liquidation

30. Personal red flags • Proud about exploits, and/or carrying unusual amounts of money • Consistently rationalize poor performance • Identify beating the system to be an intellectual challenge • Provide unreliable communications and reports • Rarely take vacations or sick time (and when they are absent, no one performs their work)

31. These red flags are often indicators of misconduct, and an organization’s management and internal auditors need to be trained to understand and identify the potential warning signs of fraudulent conduct. While none of these mean an employee is actually committing fraud, a combination of these factors could indicate a need for inquiries and heightened audit attention.

32. Internal Auditor’s Responsibility in Assessment of Fraud Risk The International Professional Practices Framework (IPPF) outlines the following International Standards for the Professional Practice of Internal Auditing (Standards) pertaining to fraud and the internal auditor’s role in detecting, preventing, and monitoring fraud risks and addressing those risks in audits and investigations.

33. Internal Auditor’s Responsibility in Assessment of Fraud Risk 1210. A2 – Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud. 1220. A1 – Internal auditors must exercise due professional care by considering the probability of significant errors, fraud, or noncompliance.

34. Internal Auditor’s Responsibility in Assessment of Fraud Risk 2120. A2 – The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk. 2210. A2 – Internal auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing the engagement objectives.

35. Thank You & Good Luck