Topic 7: Consider the Potential for Fraud When Planning an Engagement

Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization, but are not expected to have the expertise of a person whose primary responsibility is detecting and investigating fraud.

The fraud triangle consist of the following elements:

• Motive - The reason why an individual acts or reacts
• Opportunity - The favorable circumstance that allows the individual to commit fraud
• Rationalization - How the individual justifies the fraudulent action

Fraud indicator denotes signs that indicate both the inadequacy of controls in place to deter fraud and the possibility that some perpetrator has already overcome these weak or absent controls to commit fraud. This can also be referred as red flags.

Risk assessment is the identification and measurement of risk and the process of prioritizing risk.

The following actions is considered as effective fraud risk assessment:

• Performed on a systematic and recurring basis
• Considers possible fraud schemes and scenarios, including consideration of internal and external factors. 
• Assesses risk at a company-wide, significant business unit and significant account level. 
• Evaluates the likelihood, significant and pervasiveness of each risk. 
• Assesses exposure arising from each category of fraud risk by identifying mitigating control activities and considering effectiveness of those control activities. 
• Is performed with the involvement of appropriate personnel
• Considers management override of controls
• Is updated when special circumstances arise

The final determination of whether or not the risk of fraud warrants special consideration when conducting the engagement involves the internal auditor's judgement skills. This mental attitude or judgment is a combination of the internal auditor's analytical skills and all information related to the organization to determine if internal control weaknesses exist and signal the potential for fraud activity.