Risky Business: Conducting the internal fraud risk assessment

Devising and conducting an internal fraud risk assessment may be a daunting task, but every fraud examiner should have the essentials to get the job done. Here are some steps you can take to prevent and detect fraud. 

The company's CEO was nervous. In 2002, I was presenting him with the results of an investigation I had conducted on suspected fraudulent acts by four managers at a subsidiary of the publicly traded firm and he was quite concerned about his liabilities under the U.S. Sarbanes-Oxley Act.

Given the findings of my investigation, he said he didn't have faith in the abilities of his internal audit staff, chief financial officer, or external auditors to assess the company's fraud controls. He asked that I assess the company's vulnerabilities to fraud and recommend actions to address any shortcomings. This was the first time any client had asked me for a complete assessment of a company's internal fraud controls.

An internal fraud assessment is a daunting task for any fraud examiner regardless of the organization's size. I first had to find a suitable methodology to create a comprehensive assessment guideline. The methodology would have to allow me to complete the project in a reasonable timeframe while still conducting a thorough assessment of the risks to the organization's assets.