Page 32 - IIA MAGAZINE_March 2017_English

Fraud Risk
B. Detection of Fraud
Detection of fraud is represented in the
internal control methods designed to detect
fraud and misconduct when they occur.
The existence of sufficient and appropriate
detective control methods is one of the
strongest deterrent of fraudulent conduct.
They are used along with preventive control
methods to enhance the effectiveness
of the fraud risk management program
through the provision of evidence that the
preventive control methods are working as
planned in the detection of fraud that may
occur. Although the detective controls may
provide evidence that fraud is occurring, or
has already occurred, they are not designed
to prevent fraud.
Internal control methods are designed
to provide evidence and warnings that
fraud is occurring or has already occurred.
Effective internal control methods are one
of the strongest ways to reduce or prevent
fraudulent conduct or procedures. The si-
multaneous use of detective and preventive
internal control methods support the fraud
risk management program. Although de-
tective controls may provide evidence for
the occurrence of fraud, they do not aim,
or are unable, to prevent fraud.
The auditors auditing cases of fraud must
be aware of the basic requirements of the
detection of fraud. These basic require-
ments are:
1. Specification of the fraud risk in the
organization through the examination
of the control and operational envi-
ronment to determine the categories
and methods of fraud;
2. Evaluation of fraud risk;
3. Examination of risks and their occur-
rence from the perspective of the per-
petrator of fraud in order to determine
what the control methods are and the
manipulation methods that cause the
occurrence of fraud;
4. Full understanding of fraud indicators
and the data that may include these
indicators; and
5. Readiness for the occurrence of any
fraud cases as a result of the indicators, One of the most important outputs of
as well knowledge of how to search for
these indicators in the data.
When these requirements are fulfilled,
it is easy to deter perpetrators, to inves-
tigate and report the detected cases, and
to develop control methods to detect the
repetition of such cases.
The role of internal audit in the detection
of fraud through the stages of the fraud
risk management is as follows:
MARCH 2017
1. Taking into consideration the fraud
risk when evaluating the control
methods and the determination of the
necessary audit procedures. Whereas
internal auditors are not expected to
detect fraud and violations, they are
expected to give reasonable confirma-
tion that the objectives of the business must take the following into consideration:
environment of the operations have
been achieved.
2. Providing adequate knowledge
about fraud cases to determine fraud
indicators. This knowledge includes
awareness of fraud properties and
factors and the techniques used in the
commission of fraud.
3. Being ready to any opportunity that
may allow the commission of fraud
such as any weakness in the control
methods. If a major deficiency in the
control methods has been detected,
additional tests must be conducted
by internal auditors to specify fraud
indicators.
4. Evaluating fraud indicators and taking
any other necessary procedures or
conducting investigations if needed.
5. Whistle-blowing and reporting to
the competent authorities inside the
organization if a fraud case is detected
to recommend the conduct of an
investigation.
C. Response and
Investigation:
Response and investigation are represented
in the internal control designed to take
a remedial and corrective action for the
damages resulting from the occurrence of
fraud and misconduct.
The role of internal audit must be
determined in the investigation process in
the internal audit regulations as well as in
the fraud-related policies and procedures.
This includes collecting sufficient
information on specific details and
carrying out these necessary procedures
to determine whether fraud is committed,
who was involved and how it happened.
the investigations is the exclusion of
innocent people from the circle of doubt
or suspicion. Investigation starts with
planning and ends with the issuance of a
report on the findings of the investigation.
1. Investigation Planning
A plan for each investigation process
is set according to the procedures
of the organization. The team
leader in charge in the internal
audit department determines the
skills, competencies and knowledge
required for conducting the
investigation procedures through the
identification of suitable individuals
for carrying out the investigation.
Moreover, an assertion must be
obtained that there is no potential
conflict of interests with those who
will be investigated or any employee
in the organization.
When preparing the plan of the
investigation activities, the team leader
• Collect evidence through surveillance,
interviews and any documents;
• Document and preserve evidence
without violation to any legal rules in
obtaining such evidence;
• Determine the scope and extent to
which the organization’s operations are
affected by the fraud;
• Specify the methods used in the fraud;
• Evaluate the reasons of the fraud; and
• Identify the perpetrators of fraud.
2. Reporting on Investigations
The form of the report, whether oral
or written, whether provisional or
final, and whether submitted to the
Senior Management or to the Board
of Directors, differs according to the
investigation findings. A formal written
report may be issued at the end of
the investigation stages, including the
reasons for conducting the investigation,
the time frame for the investigation,
and the notes, conclusions and
recommendations necessary to correct
and enhance the control methods. The
reporting may be required to be written
in a way that secures confidentiality
of individuals. The requirements of
the Board of Directors and executive
management must also be taken into
account, with compliance with the
legal requirements and the policies and
procedures of the organization.
Internal auditors may participate in
the following processes as consultants
through this stage as long as the effect
of these activities on the independence
of the internal audit is identified and
appropriately dealt with, which may
include all or some of the following:
• Providing a document indicating the end
of investigation for the suspected who
were acquitted;
• Punishing employees according to
the company standards, labor laws or
employment contracts;
• Requesting voluntary financial
compensations from the employee,
client or supplier;
• Terminating the contracts of the
suppliers involved in the fraud; and
• Reporting the fraud cases to the
legal and regulatory authorities and
cooperating in the investigations
that would be conducted by those
authorities.
INTERNAL AUDITOR - MIDDLE EAST 32