Dan's Internal Audit Corner
Is Your Organization Serious About Tackling Fraud?
By Dan Swanson
Each month Dan Swanson, a senior security and internal audit professional will provide his list of recommended resources for AuditNet readers. If you have questions about this page or the links, you can reach Dan at www.securitybenchmark.com and dswanson_2008@yahoo.com.
For more IT and Information Security resources check out the latest Taylor and Francis publications.
Some companies have far lower levels of misappropriation of assets and fraudulent financial reporting than others. Why? Because they aggressively take steps to prevent and detect fraud, end of story.
At these exemplary companies, management takes seriously its
ethical responsibilities for designing and implementing systems,
procedures and controls to catch fraud—and, along with the board of
directors, for promoting a culture and corporate environment that
demands honesty and ethical behavior.
There are three important questions regarding fraud:
• What are the board’s and management’s roles regarding fraud?
• What should the internal audit team’s role be regarding fraud?
• How can the organization best assist the external auditor meet its
responsibilities regarding its evaluation of the risks of fraud
(particularly under Sarbanes-Oxley section 404 and PCAOB Auditing
Standard 5)?
Read on …
The board is accountable for ensuring an effective system of internal control is established to fight fraud; management is responsible for how that system is designed and enforced to fight fraud. Once you have that clear—and actually done—the internal audit department can also contribute to those anti-fraud efforts.
An effective internal audit function improves the company’s ethical culture and control environment, both overtly through its audit work and in a more general sense by promoting good practices. Internal audits of anti-fraud activities provide valuable feedback to management and the board on where they can improve overall performance, which contributes in the long term to more effective fraud risk management efforts. It can also be a deterrent when employees know that the internal audit department possesses persons with fraud detection knowledge, skills, and tools.
There will always be limits to an organization’s anti-fraud capabilities. Your sample sizes can only be so large. Your budget is only so big.
Assigning accountabilities and responsibilities is critical
Setting clear expectations and defining everyone’s responsibilities regarding your antifraud efforts is half the battle. Being diligent in your efforts is the other half. To fight fraud, we need a firm policy, it must be enforced, and violators must be investigated and appropriate actions taken. Management must understand that it has the responsibility to design and implement anti-fraud activities, including the monitoring of the results. Internal auditors should also search for fraudulent activities and contribute to the organization’s “no tolerance” attitude toward fraud.
The resources I’ve cited this month will significantly increase your understanding and are written by experts in the field. Spend some quality time reviewing their insights.
Key Resources
Managing the Business Risk of Fraud: A Practical Guide
Management Antifraud Programs and Controls: Guidance to Help Prevent
and Deter Fraud
Management Override of Internal Control: The Achilles’ Heel of Fraud Prevention
Ten Things About Fraud Control: How Executives View the “Fraud Control Gap”
Fraud Risk Management: Developing a Strategy for Prevention, Detection, and Response
Fraud Auditing and Forensic Accounting
Additional Leading Resources
Antifraud & Corporate Responsibility Center (AICPA)
Auditing to Spot Fraud, From Start to End
The Association of Certified Fraud Examiners fraud resource repository
“Report to the Nation" – A comprehensive report that sheds light on occupational fraud and abuse, offering stark lessons and useful insight.
The opinions, beliefs and viewpoints expressed by the various authors and forum participants on this web site do not necessarily reflect the opinions, beliefs and viewpoints of AuditNet®

