This year, we are focused on the fraud risk assessment process as both a management tool and an audit tool. The common theme of my blogs is, “Do you understand fraud risk?” I have raised a number of issues that I hope were helpful within your career as an auditor, investigator, risk manager, or senior leader.
This year, I have focused on the fraud risk assessment process as both a management tool and an audit tool. The common theme of my blogs is, “Do you understand fraud risk?” I have raised a number of issues that I hope were helpful within your career as an auditor, investigator, risk manager, or senior leader. In this blog, we’re diving into what having a deeper understanding looks like.
If that phrase doesn’t instantly resonate, take a look at this video. This was an iconic video from the 80s, and people are still asking the question today. (I hope you get my sense of humor.)
In the beginning of my career, someone once told me, "People commit fraud, not internal controls." So, if we are to perform a proper analysis of fraud risk, then we need first to assess people. No, I do not mean a psychological profile. To me, it means the opportunity the person has by virtue of the position in the business cycle. Or by their sophistication to conceal the fraud scheme. Or, by understanding the natural vulnerabilities that exist within their business system.
This will be the summer of challenging our profession’s guidance on fraud risk assessment. As you know, last month we raised the question of whether fraud risk assessment is simply an academic process to meet a standard.
Fraud risk assessment is alleged to be an essential part of protecting a company, but is it just an academic exercise?
Please be advised, I will not be providing a job description of a Fraud Auditor. Rather, the thought process that is necessary to find the right person, with the right skill set.
I know this is a good technical question, but I do not know if there is a good technical answer. With that said, my suggestion to the CAE’s of the world would be to look for someone with the “Passion for the subject knowledge of fraud risk.” The passion would be for both the science of fraud risk and the passion for the practical application of fraud auditing. I say this because, with any new profession, the person must have the passion to create, build, and polish the fraud audit approach. I am sure that this person will get pushback from the traditional auditor. I know I have.
Before I start, let me explain that in this blog I will not provide any answers to the phrase “Deeper Understanding of Fraud Schemes.” Rather, I will only raise questions regarding the phrase. To be honest, If I was a CAE, I am not sure what the profession wants me to do.
With that said, I praise the profession in recognizing the importance of gaining a deeper understanding of fraud schemes facing our companies. Maybe, I am talking out of both sides of my mouth. Remember, my blogs are designed to make you think.
So, think about this: Fraud is not predictable as to when it will occur but is fairly straight forward as to how it will occur.
Many years ago, the IT auditor was created. In fact, I was an IT auditor in 1979. For the last 40 years, however, I have been a fraud auditor. Unfortunately, unlike IT, the profession does not recognize the title of fraud auditor.
In my opinion, it is time for the title of Fraud Auditor to be created and recognized by the profession. Auditors are not born with fraud risk or fraud audit knowledge or fraud skills. I suspect that college courses are not designed to provide this knowledge. If the profession is serious about a “more proactive approach to fraud detection” it is time to recognize that this will require auditors to develop and gain a new set of skills. I recommend that every audit department invests in human fraud risk intelligence.
Current audit standards call for us to use a mitigation standard when it comes to audits This means that unless you want to be an outlaw, your assessment will end with mitigate. However, the question I want you to ask yourself is, right now do we have enough information to properly assess the mitigate question?
