CIA Part 1 - Fraud Risks

Fraud

Any intentional act characterized by deceit, concealment, dishonesty, misappropriation of assets or information, forgery, or violation of trust perpetrated by individuals or organizations to secure an unjust or illegal personal or business advantage.

Phishing

Electronically obtaining confidential information through deceit. May use different means - email, sms, calls, etc.

Social Engineering

Practice of obtaining sensitive information by manipulating legitimate offers, often through telephone/internet.

Attempts to deceive target into sending payment and/or collect pertinent and potentially damaging information.

Pressure

[Triangle] Need a person tries to satisfy by committing fraud. Motive.

Rationalization

[Triangle] Ability for justification of fraud. Attributing their actions to rational and credible motives without self-awareness.

i.e. feeling underpaid.

Fraud awareness training can deter this.

Opportunity

[Triangle] Ability to commit fraud. Absence of controls, ineffective controls, lack of SOD, and ability for management override.

Factor in low-level employee fraud.

Only aspect directly controllable by the organization.

Asset Misappropriation

Stealing cash or other assets (supplies, inventory, equipment, information).

Can be concealed by adjusting records.

Defalcation

Misappropriation by a person in control of the funds; by a trustee, fiduciary, etc.

Embezzlement

Employee diversion of funds/assets for personal use.

Skimming

Theft of cash before recording of the asset.

Ex. accepting payment by customer but not recording sale.

Payment Fraud

Payment for fictious goods/services, overstatements of invoices, or personal use of invoices.

Expense Reimbursement Fraud

Payment for fictitious fraud or inflated expenses. I.e. report for personal travel, nonexistent meals, etc.

Payroll Fraud

False claim for compensation - i.e. exaggerated overtime or ghost employees.

• Catch ghost employees by comparing names on payroll to those observed working.

Financial Statement Misrepresentation

Overstating assets and revenue; understating liabilities and expenses.

Mgmt may use aggressive accounting methods to meet expectations.

• Channel Surfing

• Recording false sales with fake invoices

• Manipulating timing of revenue & expenses

• Not recording asset impairments when required by accounting standards

Channel surfing

Shipping products to distributors that do not need it and recording a sale

[Financial Statement Misrepresentation]

Information Misrepresentation

Providing false information, usually to outsiders, in the form of fraudulent financial statements, etc.

Corruption

Improper use of power.

Often leaves little accounting evidence - usually reported through tips / 3rd party complaints.

Lapping Receivables

Theft of a customer’s payment by a person(s) with access to customer payments and accounts receivables.

Shortage in the customers account is covered by a subsequent payment. The process continues until:

• Customer complains about non-timely posting of payment

• Absence by the perpetrator lets another employee discover it

• perpetrator covers the stolen amount

Check Kiting

Fraud occurring when a person writes an insufficient funds check ton an account in one bank account and then deposits the check into another bank account

• attempts to take advantage of the time difference (float) between depositing and the check bouncing

Document Symptom of fraud

Tampering with the accounting records to conceal a fraud.

Ex. Keeping two sets of books; forcing books to reconcile.

Lifestyle Symptom of fraud

Unexplained rise in an employee’s social status or level of material consumption

Behavioral Symptom of fraud

Drastic change in employee’s behavior - depression, temper, etc. - as guilt and stress associated with perpetrating and concealing the fraud increase.

Discovery Sampling

Sampling where there is a specified probability of including at least one item that occurs very rarely in the population.

Used when finding fraud and avoidance of internal controls is possible.

If sample does not include an item with the characteristic, auditors can conclude that rate of occurrence is < that specified.

Ground Truth Testing

Testing to verify that fraud exists after considering a fraud-related policy and whether compliance or violation occurred in actual practice.

Gaps between policy and practice are observed and learned.