5. Monitoring controls and detecting fraud

What is fraud?

Fraud is a crime involving intentional deception to obtain a gain or cause another person or organisation a loss, often through misappropriation of assets or financial misstatement.

What are the three types of fraud under the Fraud Act 2006?

Fraud by false representation, fraud by failing to disclose information when legally required, and fraud by abuse of position.

What are the two main categories of accounting fraud?

Misappropriation of assets: theft or misuse of company resources. Financial statement misstatement: deliberately recording misleading figures to distort financial performance or position.

What is misappropriation of assets?

Theft or unauthorised use of company assets, including cash theft, teeming and lading, fictitious suppliers or employees, and paying for goods or services not received.

What is fraudulent misstatement of financial statements?

Deliberately overstating assets or profits, understating liabilities or expenses, or otherwise manipulating accounting figures to mislead users.

What are common examples of business fraud?

Falsified invoices, false accounting, payment fraud, tax evasion, money laundering, insider trading, embezzlement, fictitious employees and supplier fraud.

What is teeming and lading?

Stealing a customer's payment and concealing the theft by using a later customer's receipt to settle the earlier customer's account, continuing the process to hide the shortage.

What is embezzlement?

Dishonestly taking money or assets entrusted to an employee or someone holding a position of responsibility or trust.

What are systemic weaknesses and why are they dangerous?

Weaknesses within accounting systems or procedures, such as inadequate authorisation, poor segregation, missing reconciliations or weak supervision, which increase opportunities for fraud and errors.

What are the three main impacts of fraud on an organisation?

Financial loss: stolen assets, fines and reduced profits. Reputational damage: loss of stakeholder trust and business. Employee morale: reduced confidence, recruitment and retention difficulties.

What additional consequences can serious fraud cause?

Regulatory investigations, prosecution, compensation payments, legal costs, falling share prices, business disruption and potentially business failure.

Why must internal controls be monitored regularly?

To check they operate as intended, identify new weaknesses, respond to internal and external changes, prevent fraud and errors, and ensure continued compliance.

What is the difference between internal and external audit?

Internal audit reviews controls, risks and processes for management and is generally employed by the organisation. External audit independently examines financial statements and reports an audit opinion to shareholders.

Who monitors internal controls in small and large organisations?

Small organisations may use managers and department heads through formal or informal checks. Larger organisations often have independent internal audit teams reporting findings to management.

What are the four main categories of fraud prevention controls?

Staff controls: segregation of duties. Management controls: supervision and review. Physical controls: locks and security. IT controls: passwords, access restrictions and computer checks.

Why is segregation of duties important for fraud prevention?

Different people should authorise, record, handle assets and reconcile transactions. This prevents one employee controlling the entire process and makes fraud harder to conceal.

What are authorisation controls and why are they important?

Requiring transactions such as purchases, payments, credit notes and debt write-offs to be approved by an authorised person, reducing fraudulent or inappropriate activity.

What are the main fraud risks in the sales system?

Stealing cash receipts, overcharging customers, inflating orders, issuing false credit notes, writing off genuine debts, fictitious customers and teeming and lading.

What controls help prevent sales and receivables fraud?

Independent credit checks, approved credit limits, sequentially numbered invoices, authorised credit notes and write-offs, daily banking, till reconciliations, aged receivables reviews and segregation of duties.

Why should aged receivables reports be reviewed regularly?

To identify overdue balances, unallocated receipts, unusual debt write-offs, possible fictitious sales, poor credit control and potential theft of customer payments.

What are the main fraud risks in the purchases system?

Ordering goods for personal use, fictitious suppliers, duplicate or inflated invoices, collusion with suppliers, diverting payments to personal bank accounts and paying for goods not received.

What controls help prevent purchases fraud?

Approved purchase orders, authorised supplier creation and bank detail changes, segregation of ordering and payment, three-way matching, supplier statement reconciliations and independent payment approval.

What is a three-way match in purchasing?

Comparing the purchase order, goods received note and supplier invoice to confirm that goods were authorised, received and correctly invoiced before payment.

Why should one employee not control the entire purchases process?

They could order unauthorised goods, falsely confirm receipt, approve invoices and make payments without independent detection.

What are the main fraud risks in the payroll system?

Ghost employees, employees remaining on payroll after leaving, inflated overtime or commission, unauthorised pay rises, false expense claims and diversion of wages.

What controls help prevent payroll fraud?

Authorised starters and leavers, approved timesheets and overtime, independent payroll review, reconciliations, restricted access, verified bank details and secure payslip distribution.

What is a ghost employee?

A fictitious or ineligible employee included on payroll so that wages are fraudulently paid, often into an account controlled by the fraudster.

What is the purpose of the risk assessment process?

To identify internal and external risks, assess their likelihood and potential impact, evaluate existing controls and prioritise action to reduce exposure.

What internal and external changes should trigger a control review?

Internal changes include new software, restructuring and staff changes. External changes include new regulations, increased competition, supplier problems and changing market conditions.

What five broad risks should management consider when assessing controls?

Failure to meet objectives, losses or fraud, financial statement errors, unethical behaviour and non-compliance with legal or regulatory requirements.

How is the risk of fraud assessed?

By considering the likelihood that fraud will occur and the financial, operational, legal or reputational impact if it does occur.

What is a fraud matrix and why is it used?

A structured record mapping potential frauds, their risks, existing controls and risk grades. It helps management identify weaknesses and prioritise improvements.

How should management use the results of a fraud matrix?

Investigate high-risk areas first, strengthen weak controls, consider the cost and benefit of improvements, assign responsibility and monitor whether changes are effective.

What are the main detective controls for fraud and errors?

Spot checks, performance reviews, budget comparisons, ratio analysis, reconciliations with external records and control account reconciliations.

What is a budgetary control report?

A report comparing budgeted or standard revenues and costs with actual results, identifying variances that management should investigate.

How can management accounts help detect fraud?

Regular income and expenditure reports, variance analysis, aged receivables and capital expenditure reviews can reveal unusual transactions, declining margins, missing cash or inventory losses.

What is ratio analysis and how can it reveal fraud?

Comparing relationships between financial statement figures across periods or against benchmarks. Unusual changes in profit margins, receivables or inventory may indicate errors, inefficiency or fraud.

What are the limitations of ratio analysis for detecting fraud?

Ratios can be affected by accounting policies, seasonal changes, inflation, one-off events and unreliable data. Unusual results indicate areas for investigation but do not prove fraud.

What is a balanced scorecard and what are its four perspectives?

A performance management tool combining financial and non-financial measures. Perspectives: customer satisfaction, internal process efficiency, learning and growth, and financial success.

What are the advantages of using a balanced scorecard?

It links performance measures to strategy, considers internal and external factors, combines financial and non-financial indicators, and recognises that customer satisfaction and efficiency drive financial success.

How is fraud risk graded on a 1–5 scale?

1 = low risk; 3 = medium risk; 5 = high risk. Assess both likelihood and potential impact. For example, likelihood 5 and impact 3 may produce an overall judgement of 4 (medium/high). Prioritise improvements for high- and medium-risk areas.

What should a complete fraud matrix include?

The potential fraud, existing control weaknesses, likelihood of occurrence, potential financial and non-financial impact, relevant legal or regulatory breaches, overall risk grade and recommended improvements to controls.

What are common ways financial statements can be fraudulently misstated?

Overvaluing or undervaluing inventory, failing to write off irrecoverable debts, manipulating accounting estimates, recording fictitious sales and understating expenses or liabilities to distort profit.

What additional examples of fraud should be recognised in sales, purchases and payroll?

Sales: overcharging, inflating customer orders and unauthorised credit notes. Purchases: supplier collusion, diverting payments to personal accounts and fictitious suppliers. Payroll: overstated overtime, false expense claims, unauthorised pay rises and retaining leavers on payroll.

How should you answer an exam question recommending fraud control improvements?

Identify the specific weakness and potential fraud, explain its likelihood and financial or non-financial impact, identify any relevant compliance risk, recommend a practical control such as independent authorisation or reconciliation, and explain how it reduces the risk.