Fraud Risk Assessment, Governance and Internal Control

Introduction

Fraud is an intentional act involving deception, concealment or violation of trust for personal or organizational advantage. Unlike accidental error, fraud is purposeful. It may involve employees, managers, directors, suppliers, customers or external criminals, and it may be perpetrated alone or through collusion. Fraud can produce financial losses, regulatory sanctions, unreliable financial statements, reputational damage and weakened stakeholder confidence.

Fraud examination therefore begins before an allegation is received. An effective organization identifies where fraud could occur, evaluates the strength of its governance and controls, establishes reporting mechanisms and monitors indicators of misconduct. This chapter explains how fraud risk is assessed and managed, with particular emphasis on inherent and residual risk, governance, internal control, segregation of duties, whistleblowing and management override.

Fraud risk assessment is not a one-time compliance exercise. It is a continuing process that should respond to changes in technology, personnel, markets, regulation, business models and organizational structure.

Learning Objectives

By the end of this chapter, students should be able to:

1. Explain the nature and significance of fraud risk.
2. Distinguish inherent fraud risk from residual fraud risk.
3. Apply recognized risk-management and internal-control frameworks.
4. Evaluate governance structures and ethical culture.
5. Analyze segregation of duties and identify incompatible responsibilities.
6. Assess whistleblowing systems and retaliation risks.
7. Explain management override and design appropriate mitigating procedures.
8. Recommend practical improvements to fraud prevention, detection and response.

1. The Nature of Fraud Risk

Fraud risk is the possibility that an intentional act of deception will result in financial, operational, legal or reputational harm. Risk has two central dimensions:

• Likelihood: the probability that a fraud event will occur.
• Impact: the magnitude of its consequences if it occurs.

Fraud risk differs from ordinary business risk because it involves intent and concealment. A control may be effective against accidental error but ineffective against collusion or deliberate circumvention. For example, a supervisor’s approval may prevent an employee from making an accidental payment error, but it may not prevent the supervisor and employee from cooperating to approve a fictitious supplier.

Common categories include:

The fraud triangle provides a useful behavioral model. It proposes that fraud commonly arises when three conditions coexist:

1. Pressure or incentive, such as debt, performance targets or personal financial difficulty.
2. Opportunity, such as weak controls, poor supervision or unrestricted system access.
3. Rationalization, such as “the organization owes me” or “everyone does it.”

The fraud diamond adds capability: the perpetrator must possess the authority, technical skill, confidence or access needed to execute and conceal the scheme. These models are not predictive equations. They are analytical tools that help investigators and managers identify conditions requiring attention.

2. Fraud Risk Assessment

A fraud risk assessment is a structured process for identifying, analyzing, prioritizing and responding to fraud threats. It should cover the organization’s objectives, processes, locations, systems, third parties and reporting obligations.

A sound assessment normally follows these stages:

1. Establish scope and objectives.
2. Identify fraud schemes and scenarios.
3. Identify vulnerabilities and existing controls.
4. Assess inherent risk.
5. Evaluate control design and operating effectiveness.
6. Assess residual risk.
7. Assign risk owners and responses.
8. Monitor, report and update the assessment.

2.1 Identifying Fraud Scenarios

Risk assessment should ask specific questions rather than merely stating that “fraud may occur.” Examples include:

• Could an employee create a fictitious vendor and approve payment?
• Could revenue be recognized before the performance obligation is satisfied?
• Could a manager alter journal entries at period end without independent review?
• Could a supplier influence an employee through gifts or undisclosed relationships?
• Could compromised credentials redirect payments to an unauthorized account?

Scenario analysis should consider the perpetrator, method, affected process, concealment technique, possible collusion and resulting harm.

2.2 Inherent and Residual Risk

Inherent fraud risk is the level of risk that exists before considering controls. It reflects the natural exposure created by the organization’s activities, complexity, incentives and environment.

Residual fraud risk is the risk remaining after considering the design and operation of controls. It is the risk management must accept, reduce, transfer or avoid.

A conceptual relationship is:

This is not a precise accounting identity. It expresses a management concept: controls reduce, but rarely eliminate, risk. The relationship assumes that the control assessment is sufficiently reliable and that risks are measured on a comparable basis. In practice, risk is multidimensional and cannot always be reduced by simple arithmetic.

Organizations frequently use a likelihood-impact matrix. For example, if likelihood and impact are each scored from 1 to 5, a simple prioritization score may be calculated as:

Here, both scores are ordinal ratings rather than objective probabilities, so the resulting score is a prioritization aid, not a statistical probability. A score of 20 does not mean a 20 percent probability of loss. The organization should define rating criteria consistently and avoid false precision.

A risk register should record the scheme, causes, consequences, inherent rating, controls, residual rating, owner, action plan and review date.

Figure: The fraud risk assessment cycle is iterative rather than a one-time event.

3. Recognized Frameworks

3.1 COSO Internal Control—Integrated Framework

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) identifies five mutually related components of internal control:

1. Control environment: integrity, ethical values, board oversight, accountability and competence.
2. Risk assessment: identification and analysis of risks to objectives, including fraud risk.
3. Control activities: approvals, authorizations, reconciliations, segregation of duties and other actions.
4. Information and communication: timely, relevant information flowing internally and externally.
5. Monitoring activities: ongoing and separate evaluations of whether controls function effectively.

COSO also emphasizes principles within these components. Fraud risk is not confined to the control-activities component; it is influenced by culture, information quality and monitoring as well.

3.2 Enterprise Risk Management

COSO’s Enterprise Risk Management framework links risk with strategy and performance. It encourages organizations to consider how risk appetite, objectives, performance and review interact. Fraud risk should therefore be connected to strategic decisions, incentive systems, acquisitions, outsourcing and digital transformation—not treated solely as an accounting department concern.

3.3 ISO 31000

ISO 31000 presents risk management as a process involving communication and consultation, scope and context, risk assessment, risk treatment, monitoring and recording. Its broad applicability is useful, but it does not replace professional judgment or prescribe a single fraud-control design.

3.4 Three Lines Model

The Three Lines Model clarifies responsibilities:

• First line: operational management owns risks and operates controls.
• Second line: risk, compliance and control functions support, monitor and challenge the first line.
• Third line: internal audit provides independent and objective assurance.

The board and senior management remain accountable for governance. External audit has a separate statutory or assurance role and should not be confused with management’s responsibility to prevent and detect fraud.

4. Governance and Ethical Culture

Governance is the system by which an organization is directed, controlled and held accountable. Fraud prevention begins with the tone at the top, but it also depends on the “mood in the middle” and conduct throughout the organization.

Important governance mechanisms include:

• An independent and competent board.
• An audit committee with financial literacy and access to internal and external auditors.
• Clear authority and accountability structures.
• A code of ethics supported by training and enforcement.
• Transparent remuneration and performance targets.
• Conflict-of-interest declarations.
• Independent investigation and disciplinary processes.
• Regular reporting of fraud risks and control deficiencies.

A written code of conduct is ineffective if senior executives violate it without consequence. Similarly, aggressive targets can create pressure that undermines otherwise well-designed controls. Governance assessment should therefore examine actual behavior, not only policies.

The board should ask whether management has identified significant fraud risks, whether controls address them, whether reports are escalated promptly and whether management has overridden controls. It should also ensure that investigations are independent and that whistleblowers are protected.

5. Internal Control Design and Operation

A control is a policy, procedure, system configuration or management action intended to prevent, detect or correct an undesirable event.

Preventive, Detective and Corrective Controls

• Preventive controls act before an event: access restrictions, approval limits and background checks.
• Detective controls identify events after they occur: reconciliations, exception reports and audits.
• Corrective controls address consequences: recovery procedures, disciplinary action and system changes.

Controls may also be manual, automated or hybrid. Automated controls can apply rules consistently, but they depend on accurate configuration, reliable data and appropriate access management.

Design Effectiveness and Operating Effectiveness

A control is design effective if, when performed as intended by a competent person, it could prevent or detect the relevant fraud. A control is operating effective if it actually operated consistently during the relevant period and evidence demonstrates that operation.

For example, a monthly bank reconciliation may be well designed. If reconciliations are prepared late, contain unexplained items or are not reviewed, operating effectiveness is weak.

Control evaluation should consider:

1. The risk addressed.
2. The control owner.
3. Frequency and timing.
4. Required evidence.
5. Independence of performance and review.
6. Exceptions and escalation.
7. Dependence on information technology.
8. Possibility of collusion or override.

6. Segregation of Duties

Segregation of duties (SoD) divides incompatible responsibilities among different people so that one individual cannot initiate, authorize, record and conceal a transaction without detection.

The classic incompatible functions are:

• Custody of assets.
• Authorization of transactions.
• Recording transactions.
• Reconciliation or independent review.

For purchases, one person should not control vendor creation, purchase approval, receipt confirmation, invoice processing and payment release. In a small organization, complete separation may be impractical. Compensating controls may include owner review, independent bank-statement review, payment alerts, dual authorization and periodic external review.

SoD analysis should be performed using an access matrix. A conflict exists when a user has combinations of privileges that create an unacceptable ability to commit and conceal fraud. However, a theoretical conflict is not automatically a fraud occurrence. It should be evaluated alongside transaction volume, monitoring, system logs and the person’s actual duties.

Common weaknesses include shared passwords, excessive administrator access, dormant accounts, emergency access without review and failure to remove access after transfer or termination.

7. Whistleblowing and Speak-Up Systems

Whistleblowing systems provide channels through which employees and other stakeholders can report suspected misconduct. They are important because individuals close to operations may detect fraud before formal controls do.

An effective system should provide:

• Multiple reporting channels, such as telephone, web, email and in-person reporting.
• Confidentiality and, where legally permitted, anonymity.
• Accessibility to employees, contractors, suppliers and other stakeholders.
• Clear triage and investigation procedures.
• Protection against retaliation.
• Defined escalation to legal counsel, compliance, internal audit or the audit committee.
• Documented case management and evidence preservation.
• Periodic reporting of trends without exposing identities.

A hotline is not effective merely because it exists. Management must demonstrate that reports are taken seriously, investigated impartially and resolved consistently. Retaliation may include dismissal, demotion, exclusion, threats or unfavorable scheduling. Fear of retaliation is a major reason employees remain silent.

False reports should be handled fairly. Good-faith reporting must be protected even when allegations are unsubstantiated, while deliberately malicious reports may warrant disciplinary action after due process.

8. Management Override

Management override occurs when an authorized manager circumvents established controls for an improper purpose. It is a significant fraud risk because management often has privileged access, influence over subordinates and authority to approve unusual transactions.

Examples include:

• Manual journal entries posted late at night or near period end.
• Unsupported changes to accounting estimates.
• Side agreements that alter contractual terms.
• Unusual related-party transactions.
• Bypassing procurement requirements.
• Direct changes to master data.
• Suppression of exception reports.

No control system can assume that senior personnel will always comply. Controls addressing override include:

1. Independent review of significant or unusual journal entries.
2. Audit-committee review of estimates, related parties and non-routine transactions.
3. Restricted system privileges and immutable audit logs.
4. Analytical review of period-end activity.
5. Mandatory documentation for overrides.
6. Rotation of sensitive duties and vacations where appropriate.
7. Independent investigation of allegations involving senior personnel.

The aim is not to prevent every legitimate exception. Rather, legitimate exceptions should be transparent, documented, authorized and subject to later review.

9. Technology, Data Analytics and Artificial Intelligence

Technology can strengthen fraud risk management through continuous monitoring, duplicate-payment detection, access analytics, network analysis and anomaly detection. Useful tests include:

• Duplicate invoice numbers, amounts or bank accounts.
• Payments just below approval thresholds.
• Vendors sharing addresses or bank details with employees.
• Unusual entries posted outside normal working hours.
• Rapid changes to supplier master data followed by payments.
• User access inconsistent with job responsibilities.

Artificial intelligence can identify patterns across large datasets, but it does not establish that fraud occurred. False positives, biased training data, poor data quality and explainability problems may lead to unfair investigations. AI outputs should be treated as risk indicators requiring human review. Organizations should document data sources, model governance, access controls, validation procedures and escalation rules.

Technology also creates new risks. Automated workflows may spread a configuration error rapidly; deepfakes and social engineering may facilitate payment diversion; and cloud systems may create complex access and third-party dependencies.

10. Illustrative Case: The Fictitious Vendor Scheme

This is a fictional instructional case.

Background

Meridian Components, a medium-sized manufacturer, experienced rapid growth. Its procurement manager, Daniel, could create vendors, approve purchase orders up to $25,000 and review invoices. The accounts-payable clerk processed invoices and released payments after receiving Daniel’s approval. The company had a whistleblowing email address, but it was monitored only by the chief financial officer.

Problem

Over eighteen months, Meridian paid approximately $420,000 to three vendors. The vendors had similar addresses, bank accounts opened recently and no evidence of meaningful business activity. Many invoices were just below Daniel’s approval limit. A junior employee later reported that the vendors were connected to Daniel’s relative.

Analysis

The inherent risk was high because procurement involved substantial transaction volume, the organization was growing rapidly and one manager had extensive authority. The control design was weak: vendor creation, purchase approval and invoice review were not adequately separated. Operating effectiveness was also weak because no independent review examined vendor master data, related-party declarations or threshold-splitting patterns.

The scheme exploited all three sides of the fraud triangle:

• Pressure: Daniel sought funds for personal financial problems.
• Opportunity: excessive access and weak review.
• Rationalization: he viewed the payments as temporary borrowing.

His position and system knowledge also supplied the capability described by the fraud diamond.

Approach and Solution

The company preserved email, system logs, vendor records, invoices and bank information. Access to relevant systems was restricted, and an independent investigation team interviewed witnesses. Payments were compared with approval thresholds and vendor attributes. Legal counsel advised on reporting and recovery options.

Remediation included:

• Separating vendor creation from purchase approval.
• Requiring independent confirmation of new vendor bank details.
• Introducing dual authorization for payments.
• Reviewing related-party declarations annually and on appointment.
• Monitoring transactions just below approval limits.
• Establishing an independently administered reporting channel.
• Conducting periodic access reviews and data analytics.

Outcome

The investigation confirmed the scheme, enabled partial recovery and led to disciplinary and legal action. More importantly, the organization revised its governance and control structure rather than treating the event as an isolated employee problem.

Learning Points

1. A control can fail through excessive access even when approvals appear to exist.
2. Threshold-based approval systems require monitoring for transaction splitting.
3. Vendor master data deserves the same attention as payment transactions.
4. Whistleblowing systems must be trusted and independently monitored.
5. Fraud risk assessment should consider collusion and management influence.

11. Challenges and Limitations

Fraud risk assessment involves unavoidable judgment. Ratings may be influenced by optimism, fear of reputational damage or pressure from senior management. Other limitations include:

• Collusion can defeat apparently strong SoD.
• Controls may be bypassed during emergencies.
• Data may be incomplete or inaccurate.
• Quantitative risk scores can create false confidence.
• Fraud schemes evolve faster than policies.
• Small entities may lack resources for extensive separation.
• Investigations can threaten privacy, due process and employment rights.
• Cross-border operations create differing legal requirements.

Consequently, organizations should combine preventive controls, detective analytics, independent assurance, ethical culture and effective response. No single framework or control guarantees the absence of fraud.

12. Professional, Ethical and Regulatory Implications

Accounting and finance professionals have responsibilities that extend beyond accurate calculation. They must exercise professional skepticism, protect confidential information, document judgments and escalate concerns through appropriate channels. They should not investigate beyond their competence or compromise evidence by conducting informal confrontations.

Regulatory requirements vary by jurisdiction, but commonly address financial reporting, anti-bribery, money laundering, data protection, employee protection and corporate governance. Professionals must understand applicable law and obtain specialist advice where necessary. Confidentiality does not authorize concealment of illegal conduct, and reporting obligations may apply to auditors, regulated entities or public officials.

A strong response process normally includes allegation intake, preliminary assessment, preservation of evidence, investigation planning, interviews, analysis, findings, reporting, remediation and follow-up. Investigations should be proportionate, impartial and documented.

Best-Practice Checklist

An organization with mature fraud risk management should be able to demonstrate that it:

• Performs documented, periodic fraud risk assessments.
• Connects fraud risks to objectives and risk appetite.
• Maintains board and audit-committee oversight.
• Tests both control design and operating effectiveness.
• Reviews privileged access and incompatible duties.
• Monitors journal entries, master data and unusual transactions.
• Operates trusted reporting channels with anti-retaliation safeguards.
• Investigates allegations promptly and independently.
• Reviews management override risks.
• Uses technology with appropriate human oversight.
• Tracks remediation to completion.
• Learns from incidents and updates controls.

Chapter Summary

Fraud risk is the possibility that intentional deception will cause financial, operational, legal or reputational harm. Effective assessment identifies specific fraud scenarios, evaluates inherent risk, examines control design and operation, and determines residual risk. Likelihood-impact matrices can prioritize attention, but their scores are judgmental indicators rather than objective probabilities.

COSO, ISO 31000 and the Three Lines Model provide complementary perspectives on risk, control and assurance. Governance establishes accountability, ethical expectations and independent oversight. Internal controls must be designed for relevant risks and tested for actual operation. Segregation of duties reduces the ability of one person to initiate, authorize, record and conceal a transaction, although compensating controls may be necessary in smaller entities.

Whistleblowing systems are valuable only when they are accessible, confidential, independently administered and protected from retaliation. Management override requires particular attention because senior personnel can circumvent ordinary controls. Data analytics and AI can identify indicators, but human judgment, due process and professional skepticism remain essential. Ultimately, fraud risk management is a continuous organizational responsibility rather than a one-time compliance exercise.

Key Terms

Fraud risk: The possibility that intentional deception will cause harm.

Inherent risk: Risk assessed before considering controls.

Residual risk: Risk remaining after controls are considered.

Fraud triangle: Pressure, opportunity and rationalization as conditions associated with fraud.

Fraud diamond: The fraud triangle with capability added.

Governance: The system by which an organization is directed, controlled and held accountable.

Control environment: The cultural and structural foundation of internal control.

Preventive control: A control intended to stop an undesirable event before it occurs.

Detective control: A control intended to identify an event after it occurs.

Corrective control: A control intended to remedy consequences or prevent recurrence.

Design effectiveness: The extent to which a control could address a relevant risk if properly performed.

Operating effectiveness: The extent to which a control actually operates consistently and appropriately.

Segregation of duties: Division of incompatible responsibilities among different individuals.

Management override: Circumvention of controls by authorized management personnel.

Whistleblowing: Reporting suspected wrongdoing through an internal or external channel.

Retaliation: Adverse treatment imposed because someone reported or supported a concern.

Risk register: A documented record of risks, controls, owners, ratings and responses.

Three Lines Model: A model distinguishing operational ownership, oversight functions and independent assurance.

Professional skepticism: An questioning, alert attitude toward evidence and possible misstatement or misconduct.

Compensating control: An alternative control that reduces risk when a preferred control is impractical.

Review Questions

Short Answer Questions

1. Distinguish inherent fraud risk from residual fraud risk.
2. Identify the three elements of the fraud triangle.
3. What are the four classic incompatible duties in segregation of duties?
4. State two characteristics of an effective whistleblowing system.
5. Why is management override a significant fraud risk?

Long Answer Questions

1. Explain how COSO’s five components support fraud risk management.
2. Discuss the role of governance and ethical culture in preventing fraud.
3. Explain how an organization should evaluate the design and operating effectiveness of a control.
4. Compare preventive, detective and corrective controls, using examples.
5. Discuss the benefits and limitations of using data analytics and AI in fraud examination.

Analytical / Application Questions

1. A purchasing officer can create vendors, approve purchase orders and review invoices, while the finance manager releases payments. Identify the principal risks and recommend a redesigned control structure.
2. A company has a hotline, but reports go directly to the chief executive, who is frequently named in complaints. Analyze the governance weaknesses and propose an alternative reporting and escalation process.
3. A manager posts numerous manual journal entries immediately before year-end, each supported by brief descriptions but lacking source documentation. Design an investigation and control-response plan, explaining how management override should be assessed.

Multiple Choice Questions with Answers

Question 1

Which statement best describes residual fraud risk?

A. The risk that exists before any controls are considered

B. The risk remaining after the effects of controls are considered

C. The risk that has already resulted in a confirmed fraud

D. The risk reported only to external auditors

Correct Answer: B. The risk remaining after the effects of controls are considered

Question 2

Which of the following is part of the fraud triangle?

A. Capability

B. Collusion

C. Rationalization

D. Confidentiality

Correct Answer: C. Rationalization

Question 3

Which responsibility is generally incompatible with creating a vendor master record?

A. Maintaining an approved supplier list

B. Approving the same vendor’s payments

C. Reviewing procurement policy

D. Reporting vendor changes

Correct Answer: B. Approving the same vendor’s payments

Question 4

Which COSO component includes ethical values, board oversight and accountability?

A. Control environment

B. Control activities

C. Information and communication

D. Monitoring activities

Correct Answer: A. Control environment

Question 5

A risk has a likelihood score of 4 and an impact score of 5. Using the chapter’s illustrative prioritization method, what is its risk score?

A. 9

B. 20

C. 25

D. 45

Correct Answer: B. 20

Question 6

Which feature most strengthens a whistleblowing system?

A. Routing every complaint to the person accused

B. Allowing reports only during working hours

C. Providing confidentiality and protection against retaliation

D. Rejecting reports that cannot immediately be proven

Correct Answer: C. Providing confidentiality and protection against retaliation

Question 7

Which is an example of management override?

A. An automated three-way match rejects an invoice

B. An employee completes required ethics training

C. A manager bypasses procurement approval for an improper payment

D. An auditor performs an independent confirmation

Correct Answer: C. A manager bypasses procurement approval for an improper payment

Question 8

Under the Three Lines Model, internal audit primarily provides which function?

A. Independent and objective assurance

B. Day-to-day operation of all controls

C. Direct ownership of business risks

D. Approval of every employee transaction

Correct Answer: A. Independent and objective assurance

Question 9

Which analytical indicator may suggest transaction splitting?

A. Many purchases consistently just below an approval threshold

B. A decline in the number of suppliers

C. A complete annual inventory count

D. A properly documented bank reconciliation

Correct Answer: A. Many purchases consistently just below an approval threshold

Question 10

Why should AI-generated fraud alerts normally receive human review?

A. AI cannot process any financial data

B. AI alerts prove fraud without further evidence

C. AI may produce false positives, biased results or unexplained conclusions

D. Human review eliminates the need for controls

Correct Answer: C. AI may produce false positives, biased results or unexplained conclusions