Fraud Risk Assessment: A New Model and New Approach
When a financial crime occurs within an organization, chief auditors (or internal/external audit professionals) face intense scrutiny, potential termination, professional disciplinary actions, and legal liability if they were complicit in or grossly negligent regarding fraud.
Following up on last month’s blog, I want you to ask yourself: “What is my department’s knowledge proficiency level regarding understanding how and where financial crimes can occur in or against my organization?”
Yes, I said financial crimes rather than fraud.
You should ask yourself: Is your fraud risk documentation at the basic level or the expert level? I warn you, when there are no issues, whatever you have is fine. But when a major financial crime occurs, how will an outside authority assess the competency of your fraud risk assessment? Please do not tell yourself that you have passed peer review.
Instead of the term fraud risk assessment, maybe we should call it a financial crime assessment. It is more encompassing; it includes acts committed against our company and acts committed by our company. Fraud, as used in the auditing profession, is a nebulous term and limits the scope of our assessment.
Where were the Auditors?
Let’s be honest, when a major financial crime occurs in a business, or a major financial crime is committed by a business, someone will always ask: Where were the auditors? So here are my questions for each Chief Audit Executive:
1. Does your fraud risk assessment identify the fraud risk statement?
2. Does your fraud risk assessment demonstrate sufficient competencies in understanding and describing the fraud risk to management?
3. Did you adequately warn management of the likelihood of financial crime occurring?
4. Does your risk assessment differentiate between fraud risk and financial crime?
5. Did your fraud risk assessment rate the residual fraud risk as low?
6. Did you audit that core business function in the last 3 years?
We need to understand that our organization may be committing a financial crime, ie., FCPA Violation, False Claims Violation, or Price Fixing. Or someone may be committing a financial crime against our company. Remember, the first step in describing your fraud risk statements is to identify the parties. The perpetrator could be your company, a vendor, a customer, an employee; the list just goes on.
My desire for this blog is to not only make you think but also to enhance your knowledge. So, as always, I have performed some research for you.
Internet Research
This was my search string: “what happens to chief auditors when financial crimes occur”
The primary difference between internal and external audit liability lies in who they owe a duty to and the legal standards used to hold them accountable. While internal auditors face severe professional and internal corporate consequences, external auditors bear much higher legal liability to third parties like shareholders and lenders.
| Liability Category | Internal Audit Liability | External Independent Audit Liability |
|---|---|---|
| Primary Duty Owed To | The organization's board and management. | The public, shareholders, and regulators. |
| Civil Lawsuits (Tort/Contract) | Rarely sued for professional negligence because they are employees; the company is responsible for employee actions (respondeat superior). | Frequently sued by shareholders, lenders, or bankruptcy trustees for professional malpractice and negligence. |
| Statutory & Securities Liability | Generally not liable under federal securities laws (like SEC Rule 10b-5) unless they directly participated in a fraudulent scheme. | Can be held liable under federal securities laws (e.g., Securities Act Section 11 and Rule 10b-5) for false or misleading audit opinions that investors relied on. |
| Criminal Liability | Highly vulnerable if they actively helped executives conceal fraud, destroy documents, or falsify internal records. | Vulnerable if they knowingly signed off on fraudulent financial statements or obstructed justice. |
Internal Audit Liability Focus: The Inside Agent
Internal auditors are employees of the company. Because of this relationship, their liability usually centers on employment termination and criminal complicity.
The "Blind Eye" Risk
If an internal auditor discovers fraud, alerts management, and management ignores it, the auditor must report it to the Audit Committee. If they stay silent to protect their job, they risk being charged as a co-conspirator or accomplice to the financial crime.
I asked you this question: if your fraud risk assessment is vague, non-descriptive, did you turn a blind eye?
Caution: I am not providing legal advice. You should always consult an attorney.
Here are my Thoughts on the Subject of Fraud Risk Assessment: A New Model, New Approach
- Assess your department's knowledge proficiency level in regard to understanding how and where financial crimes can occur in or against your organization.
- Determine who has responsibility for managing financial crime risk.
- Determine who is communicating financial crime risk to the audit committee, and how.
- Communicate which financial crimes you can prevent, detect, or deter.
- Distinguish between your organization's knowledge proficiency in managing "fraud risk" and in investigating financial crimes. I believe they are two very different skill sets.
- Invest in human fraud intelligence for auditors and fraud risk managers.
- Adopt a model for how to describe a statement of fraud risk.
- Incorporate the sophistication of concealment into your assessment.
- Do a deep dive on one business model to understand how to perform a fraud risk assessment in your organization.
- Perform a self-assessment to determine whether your fraud risk assessment or financial crime assessment could be construed as having a "blind eye."
- Provide the CAE with a golden parachute for doing their job.
Fraud Trivia
Answers to last month
The "Holy Three" (or Holy Trinity) of criminology refers to the founders of the Italian School of Positivist Criminology in the late 19th century
1. What are their names? Cesare Lombroso, Enrico Ferri and Raffaele Garofalo.
2. Who is often referred to as the father of criminology? Cesare Lombroso
3. What theory did Lombroso present? Father of Modern Criminology, he was an Italian physician who pioneered the scientific study of crime. He famously proposed the now-discredited theory of the "born criminal", arguing that criminality is inherited and that criminals can be identified by distinct physical, biological traits.
4. How did Ferri expand Lombroso's theory? Ferri introduced the idea that criminal behavior is a combination of physiological, physical (natural), and social/economic factors (such as poverty). He heavily advocated crime prevention and social reforms.
5. The term criminology was most likely coined in 1885 by Italian Law Professor Raffaele Garofalo
This month's questions
1) What is corporate crime sociology?
2) Who are sociologists Clinard and Yeager?
3) Much like the ACFE fraud tree, what are Clinard and Yeager's categories of corporate crime?
4) Can you provide some real-life examples of corporate crimes?
5) Does your corporate fraud risk assessment identify and assess these risks?
