Corporate Governance, Fraud and Internal Audit

Introduction and context

Corporate governance is the system by which organisations are directed, controlled and held accountable. It concerns the allocation of authority between shareholders, the board, management, assurance providers and other stakeholders. Audit and assurance cannot be understood independently of governance: the quality of financial reporting, the prevention of fraud and the reliability of internal controls depend substantially on how responsibilities are designed and exercised.

Modern organisations operate through complex structures, delegated decision-making, digital systems and global supply chains. These conditions create opportunities for innovation but also increase exposure to conflicts of interest, management override, cyber-enabled fraud, regulatory breaches and misleading reporting. A professional accountant therefore needs more than technical knowledge of audit procedures. The accountant must understand the behavioural, ethical and institutional conditions that make reliable governance possible.

This chapter uses a principles-based approach. Exact legal duties, corporate reporting requirements and whistleblowing protections differ by jurisdiction, entity type and listing status. Practitioners must therefore supplement the principles here with applicable company law, securities regulation, auditing standards, professional codes and sector-specific requirements.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Explain the purpose, structure and limitations of corporate governance.
2. Evaluate the roles of shareholders, directors, management, audit committees and auditors.
3. Distinguish internal audit from external audit and explain the three-lines model.
4. Assess fraud risk, misconduct risk and the conditions described by the fraud triangle and fraud diamond.
5. Explain whistleblowing arrangements and the auditor’s responsibilities regarding fraud and laws and regulations.
6. Recommend improvements to governance, internal control and assurance arrangements.
7. Critically evaluate the effects of technology, data analytics and artificial intelligence on fraud and assurance.

1. The purpose and theory of corporate governance

Governance addresses a fundamental problem: those who own an organisation may not be the people who manage it. The separation of ownership and control creates an agency relationship. Managers normally possess more information about operations than shareholders and may pursue personal objectives, such as remuneration, status, job security or empire-building. Governance mechanisms attempt to align interests, constrain abuse and provide credible information for decision-making.

Agency theory highlights monitoring, incentives and accountability. Stewardship theory offers a contrasting view: managers may be intrinsically motivated to act as responsible stewards, especially where organisational purpose, trust and professional identity are strong. Stakeholder theory broadens the governance objective beyond shareholders to employees, customers, lenders, communities, regulators and the environment. These theories are not mutually exclusive. A well-designed governance system recognises economic incentives while cultivating ethical commitment and considering legitimate stakeholder interests.

A useful governance framework has four connected elements:

• Direction: establishing purpose, strategy, risk appetite and organisational values.
• Control: establishing policies, authority limits, segregation of duties and monitoring.
• Accountability: requiring decision-makers to explain actions and accept consequences.
• Transparency: communicating reliable, balanced and timely information to stakeholders.

Governance is not identical to compliance. Compliance is necessary, but an organisation may obey formal rules while tolerating aggressive reporting, conflicts of interest or unethical treatment of customers. Effective governance asks whether decisions are lawful, ethical, sustainable and consistent with the organisation’s stated purpose.

Governance structures

The board is collectively responsible for oversight. Its responsibilities commonly include approving strategy, monitoring risk, appointing and evaluating senior management, overseeing financial reporting, safeguarding resources and establishing the organisation’s ethical culture. Directors should exercise independent judgement, care, competence and loyalty. They must also identify and manage conflicts of interest.

The chair leads the board and promotes effective challenge. The chief executive officer manages the organisation and implements approved strategy. Combining the chair and chief executive roles may be permitted, but it can concentrate power and make independent challenge more difficult. Where the roles are combined, stronger counterbalances—such as a senior independent director and robust committee structures—become especially important.

Board effectiveness depends on more than formal independence. Relevant expertise, diversity of thought, adequate time, constructive challenge, accurate information and periodic evaluation are essential. A board composed entirely of nominally independent directors may still fail if directors lack industry knowledge or defer excessively to management.

2. The audit committee

The audit committee is a committee of the board, not a substitute for the board’s responsibility. Its detailed remit varies, but it generally oversees:

• the integrity of financial statements and significant accounting judgements;
• the effectiveness of internal financial controls and risk management;
• the independence, appointment and performance of the external auditor;
• the internal audit function and its relationship with external assurance;
• arrangements for reporting concerns, fraud and misconduct;
• compliance with relevant legal and regulatory requirements.

An effective audit committee should have sufficient independence, financial literacy and access to information. At least one member should normally possess recent and relevant financial expertise, subject to local governance requirements. Meetings should be private when appropriate, including regular sessions with the external auditor, internal auditor and compliance officer without executive management present.

The committee’s role is one of informed oversight and challenge. It should not prepare the accounts, perform management’s control activities or guarantee that fraud will not occur. Warning signs of an ineffective committee include late circulation of papers, excessive reliance on management explanations, reluctance to investigate unusual transactions and a narrow focus on technical compliance.

A committee should examine not only whether controls exist but whether they operate in practice. It should ask: What could go wrong? Who could benefit? What information would reveal the problem? How quickly would management and the board know? What consequences follow when controls are bypassed?

3. Management responsibilities and the control environment

Management is responsible for establishing and maintaining internal control, preparing financial statements, complying with laws and regulations, preventing and detecting fraud, and providing auditors with complete information. The auditor’s involvement does not transfer these responsibilities.

The control environment is the foundation of internal control. It includes the board’s oversight, management’s integrity, organisational structure, assignment of authority, competence, accountability and human-resource practices. A formal code of conduct has little value if senior executives reward results obtained through deception.

Internal control is often analysed through five connected components:

1. Control environment: values, leadership, structure and accountability.
2. Risk assessment: identifying and analysing threats to objectives.
3. Control activities: approvals, reconciliations, segregation, access controls and verification.
4. Information and communication: obtaining and communicating relevant information.
5. Monitoring: evaluating whether controls continue to operate effectively.

Controls may be preventive, detective or corrective. A system access restriction is preventive; a bank reconciliation is detective; restoration from a tested backup is corrective. Controls may also be manual, automated or dependent on information technology. Automated controls can be consistent and scalable, but they remain vulnerable to poor configuration, inappropriate access, corrupted data and management override.

No control system provides absolute assurance. Limitations include human error, collusion, cost constraints, changing conditions, poor judgement and the possibility that senior management can override controls. The objective is reasonable assurance: a high, but not absolute, level of confidence that objectives will be achieved.

4. Internal audit and the three-lines model

Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation’s operations. It evaluates governance, risk management and control processes and recommends improvements. Its independence is strengthened when the chief audit executive reports functionally to the audit committee and administratively to an appropriately senior executive.

Internal audit differs from external audit in purpose, accountability and scope. External audit ordinarily provides an independent opinion on specified financial statements for shareholders and other users. Internal audit serves the organisation through a risk-based programme covering financial, operational, strategic, technology, compliance and sustainability matters. Internal audit does not own the controls it reviews; otherwise it would be reviewing its own work.

The three-lines model clarifies responsibilities:

Figure: Responsibilities and assurance relationships in the three-lines model.

The first line owns and manages risks through day-to-day operations. The second line supplies expertise, frameworks, monitoring and challenge in areas such as risk, compliance, information security and quality. The third line—internal audit—provides independent and objective assurance to the governing body. The governing body remains accountable for oversight. External assurance is outside the three internal lines but interacts with them.

The model is a coordination framework, not a rigid organisational chart. Smaller organisations may combine roles, provided conflicts are identified and compensating safeguards are used. Internal audit should use the work of other assurance providers only after evaluating their competence, objectivity, scope, methods and evidence.

5. Fraud, misconduct and risk assessment

Fraud is an intentional act involving deception to obtain an unjust or illegal advantage. It may involve fraudulent financial reporting, misappropriation of assets, corruption, procurement manipulation, bribery, money laundering, cyber fraud or deliberate regulatory evasion. An error is unintentional, although repeated disregard of obvious information may raise ethical and legal concerns.

The fraud triangle identifies three common conditions:

• Pressure or incentive: financial difficulty, unrealistic targets, debt, status expectations or compensation schemes.
• Opportunity: weak controls, excessive access, poor supervision or management override.
• Rationalisation: the perpetrator’s justification, such as “I am only borrowing it” or “the organisation owes me.”

The fraud diamond adds capability: knowledge, authority, confidence and technical ability to exploit the opportunity. Contemporary risk assessments should also consider organisational culture, digital access, third-party relationships and the speed with which fraudulent activity can scale.

Fraud risk assessment should be systematic. Management can identify schemes, affected processes, possible perpetrators, existing controls, warning indicators and response owners. Risks should be assessed for likelihood and impact, but numerical scoring does not remove judgement. A low-frequency event with catastrophic consequences may deserve priority even when its probability is difficult to estimate.

Red flags include unexplained journal entries, unusual transactions near period end, persistent override of approval limits, excessive secrecy, lifestyle changes, related-party transactions lacking transparency, high employee turnover in sensitive functions, complaints that are dismissed, and results that consistently exceed expectations without a credible operational explanation. A red flag is not proof of fraud; it is a reason for proportionate investigation.

Anti-fraud controls include ethical leadership, segregation of duties, independent reconciliations, supplier due diligence, rotation of sensitive responsibilities, protected reporting channels, conflict declarations, data analytics and credible sanctions. Controls should address both internal and external perpetrators and should be tested after implementation.

6. Whistleblowing and ethical culture

Whistleblowing is the reporting of suspected wrongdoing to an appropriate internal or external recipient. Effective arrangements provide confidential or anonymous channels where legally permitted, protect good-faith reporters from retaliation, establish triage and investigation procedures, preserve evidence and communicate outcomes appropriately.

A reporting channel cannot compensate for a culture that punishes dissent. Employees must believe that concerns will be taken seriously, investigated fairly and escalated when management is implicated. The organisation should distinguish malicious allegations from honest mistakes; a report made in good faith should not attract retaliation merely because it is unsubstantiated.

Governance of whistleblowing requires clear ownership. The board or audit committee should receive periodic information about the volume, nature, age and resolution of cases, while protecting personal data and investigation confidentiality. Investigators must be competent and independent. Where the concern involves senior executives, normal reporting routes should be bypassed in favour of the audit committee, board chair, regulator or other legally recognised channel.

Professional accountants must apply integrity, objectivity, professional competence, confidentiality and professional behaviour. Confidentiality does not mean concealing illegal conduct. Disclosure may be required or permitted by law, regulation or professional obligations, and the practitioner should obtain appropriate legal or professional advice where necessary.

7. Auditor responsibilities for fraud

The auditor’s objective is not to guarantee that fraud is absent. Under generally accepted auditing principles, the auditor plans and performs procedures to obtain reasonable assurance that the financial statements as a whole are free from material misstatement, whether caused by fraud or error.

Fraud is especially challenging because it may involve concealment, collusion, forged evidence, intentional misrepresentation or management override. Auditors should maintain professional scepticism: a questioning mind and critical assessment of audit evidence, without assuming either honesty or dishonesty in every interaction.

Key responsibilities commonly include:

1. Discussing fraud risks among the engagement team, including how fraud could occur.
2. Making enquiries of management, those charged with governance and relevant personnel.
3. Assessing incentives, opportunities and attitudes that could lead to fraud.
4. Testing journal entries and other adjustments, particularly unusual or late entries.
5. Evaluating accounting estimates for management bias.
6. Considering significant unusual transactions and the business rationale for them.
7. Designing responses to assessed risks and obtaining sufficient appropriate evidence.
8. Communicating identified or suspected fraud at the appropriate level.
9. Evaluating the effect on the financial statements, audit opinion and ongoing relationship.

Management override is a presumed or high-priority fraud risk in many audit frameworks. The auditor should not treat management representations as a substitute for corroborating evidence. If evidence is inconsistent, the auditor must investigate rather than simply select the explanation most favourable to management.

The auditor should distinguish fraud risk from audit risk. Audit risk is the risk of expressing an inappropriate opinion when financial statements are materially misstated. A common audit-risk model is:

where AR is audit risk, IR is inherent risk, CR is control risk and DR is detection risk. The model is a planning framework rather than a precise probability calculator. It assumes the components are conceptually separable and is useful for showing that higher assessed inherent or control risk generally requires lower acceptable detection risk, achieved through stronger or more extensive audit procedures.

Materiality, evidence and reporting are matters of professional judgement. A fraud involving a small amount may nevertheless be material because of its nature—for example, a breach of law, executive misconduct or a transaction affecting a key performance measure.

8. Laws and regulations

Non-compliance with laws and regulations (often abbreviated NOCLAR) includes acts or omissions contrary to applicable law, such as bribery, money laundering, sanctions breaches, tax offences, data-protection violations, employment abuses or environmental breaches. Some non-compliance directly affects financial statement amounts and disclosures; other matters may affect the entity’s reputation, licence to operate or ability to continue as a going concern.

Management is responsible for compliance. The auditor must obtain sufficient understanding of the legal and regulatory framework relevant to the entity and perform procedures to identify material misstatement arising from non-compliance. The auditor normally distinguishes:

• laws and regulations with a direct effect on financial statement amounts and disclosures; and
• other laws and regulations where non-compliance may have an indirect but significant effect.

When suspected non-compliance arises, the auditor should understand the matter, discuss it with the appropriate level of management and those charged with governance, evaluate its implications, obtain legal advice where needed, and determine whether reporting to an authority is required or permitted. The auditor must also consider whether management’s response is adequate, whether the matter affects the audit opinion, and whether withdrawal or resignation is appropriate where legally possible.

The auditor must not become the investigator, regulator or legal adviser merely by identifying a concern. However, neither may the auditor ignore credible evidence. Documentation should record the facts, discussions, judgements, advice and conclusions.

9. Applied case: Northbridge Components Ltd

This is an illustrative fictional case. Northbridge Components Ltd, a listed manufacturer, reported rapidly increasing revenue despite flat production volumes. The chief executive received a bonus based on revenue growth. The finance director approved several end-of-year sales to a newly established distributor controlled by a former employee. Goods remained in Northbridge warehouses, and payment terms were unusually long. The internal audit function had recently been reduced and now reported administratively and functionally to the finance director.

Problem

The audit committee initially accepted management’s explanation that the transactions were normal channel expansion. A junior accountant later used the confidential reporting channel to allege that sales invoices had been raised before customer acceptance and that credit notes were being delayed. The external auditor also identified unusual manual journal entries posted on the final day of the year.

Analysis

The case presents several connected risks: management incentive, related-party dealings, weak segregation of duties, possible premature revenue recognition, management override, compromised internal-audit independence and possible retaliation against the accountant. The transactions may be fraudulent financial reporting even if cash has not yet been lost.

The audit committee should meet privately with internal audit, the external auditor and the reporting employee’s designated investigator. It should preserve electronic records, suspend destruction procedures relevant to the investigation and ensure that the finance director cannot control the investigation. The external auditor should expand testing of sales cut-off, customer acceptance, collectability, related parties, post-year-end credit notes and journal entries. Confirmation evidence should be evaluated critically because a related distributor may not provide independent evidence.

Approach and solution

The board appoints an independent investigation team reporting to the audit committee. Internal audit’s functional reporting is transferred to the committee, and its access rights are reviewed. Management corrects revenue that does not meet the applicable recognition criteria and discloses the related-party relationship. The audit committee revises bonus metrics to include cash collection, control quality and ethical conduct rather than revenue alone.

The whistleblower is protected from retaliation, and the allegation process is documented. The external auditor communicates the fraud risk and control deficiencies to those charged with governance and considers the effect of the corrected misstatements and any limitation on evidence. The regulator is notified where required by law.

Outcome and learning points

The case demonstrates that governance failures rarely arise from one missing control. Incentives, related-party risk, weak challenge, compromised assurance and poor reporting culture interacted. A strong audit committee would have questioned revenue quality, distributor independence, warehouse retention and the effect of bonus arrangements before the allegation arose. Internal audit independence is a governance issue, not merely an organisational-design preference.

10. Technology, data analytics and emerging issues

Technology changes both the opportunity for fraud and the means of detecting it. Enterprise systems create audit trails and permit continuous analysis, but privileged users can manipulate master data, automated rules or interfaces. Generative artificial intelligence can produce convincing invoices, emails, identities and forged documents. Conversely, machine-learning tools can identify unusual payment patterns, duplicate vendors, rapid changes in bank details and anomalous journal entries.

Analytics should support—not replace—professional judgement. A model may produce false positives because unusual transactions can be legitimate, or false negatives because fraudsters adapt their behaviour. Data quality, access rights, model bias, explainability and privacy must be addressed. Organisations should document the purpose of an analytical procedure, data sources, validation, thresholds, investigation outcomes and human review.

Contemporary governance also addresses cyber resilience, third-party concentration, climate and sustainability reporting, privacy, algorithmic accountability and supply-chain ethics. Boards should understand how non-financial risks can become financial reporting risks. For example, a regulatory ban on a supplier may impair inventory, while a cyberattack may compromise the completeness of accounting records.

11. Critical evaluation and best practice

No governance structure is universally optimal. Independent directors can challenge management but may lack operational knowledge. Internal audit can provide valuable insight but may lose objectivity if it performs consulting work that it later audits. Data analytics can increase coverage but may create unjustified confidence in imperfect models. Whistleblowing systems can expose misconduct but can also be misused. The appropriate response is not to eliminate judgement but to make responsibilities, safeguards and escalation routes explicit.

Strong practice generally includes:

• a board that combines independence, competence, diversity and active challenge;
• an audit committee with authority, financial literacy and private access to assurance providers;
• clear management ownership of risk and controls;
• an internal audit function with functional independence and risk-based planning;
• integrated but non-duplicative assurance mapping;
• fraud-risk assessments linked to incentives, access and culture;
• protected, trusted and independently overseen reporting channels;
• proportionate investigation, remediation and disciplinary processes;
• auditor scepticism regarding estimates, unusual transactions and management override;
• documented consideration of laws, regulations and reporting obligations;
• periodic evaluation of board, committee, control and assurance effectiveness.

The central test is whether governance arrangements produce reliable challenge and timely escalation when information is inconvenient. A policy that is not understood, monitored and enforced is not an effective control.

Chapter Summary

Corporate governance allocates authority, establishes accountability and supports transparent, ethical decision-making. Agency, stewardship and stakeholder perspectives explain why governance must address both incentives and values. The board oversees strategy, risk, reporting and management, while the audit committee provides focused oversight without assuming management’s responsibilities.

Management owns internal control, fraud prevention and legal compliance. Internal audit provides independent, objective assurance over governance, risk management and controls. The three-lines model distinguishes operational ownership, risk and compliance support, and independent internal assurance. External auditors provide a separate statutory or engagement-based perspective.

Fraud risk arises through pressure, opportunity, rationalisation and capability. Effective responses combine ethical culture, preventive and detective controls, protected whistleblowing, data analysis and credible investigation. Auditors obtain reasonable—not absolute—assurance, maintain professional scepticism, address management override and consider fraud and non-compliance in accordance with applicable standards and law. Technology strengthens detection but introduces new risks involving access, data quality, cyber threats and artificial intelligence.

Key Terms

Corporate governance: The system by which an organisation is directed, controlled and held accountable.

Agency theory: A perspective focusing on conflicts between owners and managers arising from separation of ownership and control.

Stakeholder theory: The view that governance should consider the interests of affected parties beyond shareholders.

Audit committee: A board committee overseeing financial reporting, assurance, controls, risk and related matters.

Control environment: The values, leadership, structure and accountability forming the foundation of internal control.

Internal control: Processes designed to provide reasonable assurance over operations, reporting and compliance objectives.

Internal audit: An independent, objective assurance and consulting activity that improves governance, risk management and control.

Three-lines model: A framework distinguishing operational ownership, risk and compliance support, and independent internal assurance.

Fraud: An intentional act involving deception to obtain an unjust or illegal advantage.

Fraud triangle: Pressure or incentive, opportunity and rationalisation as conditions associated with fraud.

Fraud diamond: The fraud triangle plus capability.

Management override: Deliberate circumvention of established controls by senior management.

Professional scepticism: A questioning mind and critical evaluation of audit evidence.

Whistleblowing: Reporting suspected wrongdoing through an appropriate internal or external channel.

NOCLAR: Non-compliance with laws and regulations.

Reasonable assurance: A high but not absolute level of assurance.

Audit risk: The risk of an inappropriate audit opinion on materially misstated financial statements.

Related party: A person or entity with a relationship capable of influencing transactions or decisions.

Audit trail: Records that document the initiation, processing and authorisation of transactions.

Review Questions

Short Answer Questions

1. What are the four broad purposes of corporate governance?
2. State the principal responsibilities of an audit committee.
3. How does internal audit differ from external audit?
4. What are the three elements of the fraud triangle?
5. Why does management override create a significant audit risk?

Long Answer Questions

1. Critically compare agency theory, stewardship theory and stakeholder theory as explanations of governance.
2. Explain the three-lines model and evaluate its usefulness in a multinational organisation.
3. Discuss how an audit committee can assess the effectiveness of internal audit without taking over management responsibilities.
4. Explain the auditor’s responsibilities when suspected fraud and non-compliance with laws and regulations are identified.
5. Evaluate the strengths and limitations of whistleblowing systems as a control against misconduct.

Analytical / Application Questions

1. A retailer’s finance director receives a bonus for quarterly profit, approves manual revenue adjustments and refuses internal audit access to the sales system. Identify the governance and fraud risks, and recommend an assurance response.
2. An organisation’s analytics tool flags a cluster of payments to new suppliers, all authorised by one manager. Design a proportionate investigation and explain how false positives should be managed.
3. A listed company has an audit committee of technically qualified directors, but all meetings are controlled by the chief executive and no private sessions occur. Evaluate the committee’s practical independence and propose reforms.

Multiple Choice Questions with Answers

Question 1

Which body is primarily responsible for overseeing the integrity of financial reporting and the independence of the external auditor?

A. The audit committee

B. The procurement department

C. The external auditor alone

D. The internal audit team alone

Correct Answer: A. The audit committee

Question 2

In the three-lines model, who owns and manages operational risks and controls?

A. The governing body only

B. First-line operational management

C. The external auditor

D. The regulator

Correct Answer: B. First-line operational management

Question 3

Which item is an element of the fraud triangle?

A. Capability

B. Rationalisation

C. Materiality

D. Independence

Correct Answer: B. Rationalisation

Question 4

What is the principal purpose of internal audit?

A. To prepare the organisation’s financial statements

B. To replace the audit committee

C. To provide independent, objective assurance and consulting that improves operations

D. To guarantee that fraud cannot occur

Correct Answer: C. To provide independent, objective assurance and consulting that improves operations

Question 5

Which action best demonstrates professional scepticism?

A. Accepting management’s explanation without corroboration

B. Assuming every employee is dishonest

C. Critically evaluating inconsistent evidence and investigating it

D. Ignoring unusual transactions below a predetermined amount

Correct Answer: C. Critically evaluating inconsistent evidence and investigating it

Question 6

Under the audit-risk model, which factor is generally reduced by performing stronger substantive procedures?

A. Inherent risk

B. Control risk

C. Detection risk

D. Business risk

Correct Answer: C. Detection risk

Question 7

Which statement about whistleblowing is most appropriate?

A. A report is valid only if it is eventually proven true

B. Good-faith reporters should be protected from retaliation

C. Only external reports are legitimate

D. Management should investigate allegations involving itself without oversight

Correct Answer: B. Good-faith reporters should be protected from retaliation

Question 8

Which is a typical example of management override?

A. A system automatically rejects an unauthorised payment

B. A manager bypasses approval controls to post a year-end journal entry

C. An auditor confirms a bank balance

D. An employee completes mandatory training

Correct Answer: B. A manager bypasses approval controls to post a year-end journal entry

Question 9

Who is primarily responsible for establishing and maintaining internal control?

A. Management

B. The external auditor

C. The shareholders individually

D. The regulator

Correct Answer: A. Management

Question 10

Why must auditors consider laws and regulations beyond those directly affecting financial statement amounts?

A. Non-compliance may create material financial, reporting, legal or going-concern consequences

B. Auditors automatically become legal advisers

C. All legal breaches are necessarily fraud

D. It eliminates the need for audit evidence

Correct Answer: A. Non-compliance may create material financial, reporting, legal or going-concern consequences