Fraud Auditing, Detection, and Prevention Blog

Fraud Risk Assessment: A New Model and New Approach

When a financial crime occurs within an organization, chief auditors (or internal/external audit professionals) face intense scrutiny, potential termination, professional disciplinary actions, and legal liability if they were complicit in or grossly negligent regarding fraud.

Following up on last month’s blog, I want you to ask yourself: “What is my department’s knowledge proficiency level regarding understanding how and where financial crimes can occur in or against my organization?”  

Yes, I said financial crimes rather than fraud.

You should ask yourself: Is your fraud risk documentation at the basic level or the expert level? I warn you, when there are no issues, whatever you have is fine. But when a major financial crime occurs, how will an outside authority assess the competency of your fraud risk assessment?  Please do not tell yourself that you have passed peer review. 

Instead of the term fraud risk assessment, maybe we should call it a financial crime assessment. It is more encompassing; it includes acts committed against our company and acts committed by our company. Fraud, as used in the auditing profession, is a nebulous term and limits the scope of our assessment.

In July, I discussed a new rating system for fraud risk assessments. I said the residual risk calculation should not be the end point but the beginning of your strategy.

In my last blog, we discussed a new rating system for fraud risk assessments. I introduced the idea that the residual risk calculation should not be the end point but rather the beginning of your strategy. In this blog, we will discuss rating an internal control strategy.

Over the next few blogs, I will discuss the concept of a new approach to fraud risk assessment with a new model. This is for those who are open-minded to change. It is important to note that it is not my goal to say what we are doing is right or wrong. However, we as a profession must be willing to evolve in our thought process. If you study all the fraud literature, you will see a gradual change or improvement in the fraud risk guidance. What I am proposing should be the next leap forward for our profession.

Over the next few blogs, I will discuss the concept of a new model and a new approach to fraud risk assessment. Two things to note. First, you must be open-minded to change. Second, it is not my goal to say that what we are doing is wrong. As with so many theories, change is necessary. Fraud in companies has evolved and we must be willing to evolve along with it.

In my opinion, the professional standards are clear on the expectations:

"The auditor should design procedures to test the appropriateness of journal entries recorded in the general ledger and other adjustments.”

In one sense, there is nothing new when it comes to misstatement of revenue in financial statements. With a little effort, you can find real-life examples of these schemes in both publicly traded companies and privately held companies. How the scheme is perpetrated may differ by industry or by company. How the scheme is concealed may differ by industry or by company. So, how can auditors uncover these schemes?

 This year, we are focused on the fraud risk assessment process as both a management tool and an audit tool. The common theme of my blogs is, “Do you understand fraud risk?” I have raised a number of issues that I hope were helpful within your career as an auditor, investigator, risk manager, or senior leader.

The new fraud auditing standards require you to bring a “deeper understanding” of potential fraud schemes into audit planning and execution. The last two months we focused on what this means in when considering asset misappropriation. Over the next few months, we will focus on financial reporting.

As we have discussed in previous blogs, the new fraud auditing standards require you to bring a “deeper understanding of potential fraud schemes into their audit planning and execution.”