FRAUD RISKMANAGEMENT
GUIDE
SecondEditionE X E C U T I V E

Committee of Sponsoring
Organizations of theTreadway Coåmmission

S U M M A R YPrincipal Authors of the Fraud Risk Management Guide
David L. Cotton, CPA, CFE, CGFM
Chairman Emeritus, Cotton, A Sikich Company
Sandra Johnigan, CPA/CFF, CFE
Owner, Johnigan, P.C.
Leslye Givarz
Technical Editor, Public Company Accounting Oversight Board (Retired)

Acknowledgements
COSO and ACFE thank each of the Fraud Risk Management Update Task Force members,
the other anti-fraud professionals who provided recommendations for this Fraud Risk
Management Guide Update, and the original Task Force and Advisory Panel members fortheir generous contributions of time, resources, and knowledge (see pages 5 to 7).
In particular, COSO and ACFE gratefully acknowledge David L. Cotton and
Sandra K. Johnigan, co-chairs of the Fraud Risk Management Update Task Force,for their outstanding leadership and efforts toward the completion of this Guide.
COSO and ACFE also thank Sergio Analco and Laura Hymes for their outstanding
design and editorial expertise.

COSO Board Members
Paul J. Sobel
Outgoing COSO Chair

Lucia Wind
Incoming COSO Chair

Douglas F. Prawitt
American Accounting Association

Jeffrey C. Thomson
Institute of Management Accountants (Outgoing Board Member)

Jennifer Burns
American Institute of CPAs

Larry R. White
Institute of Management Accountants (Incoming Board Member)

Daniel C. Murdock
Financial Executives International

Patty K. Miller
The Institute of Internal Auditors

PrefaceThis project was commissioned by the Committee of Sponsoring Organizations of theTreadway Commission (COSO), which is dedicated to helping organizations improve
performance by developing thought leadership that enhances internal control,risk management, governance, and fraud deterrence.
COSO is a private-sector initiative jointly sponsored and funded by the following organizations:			

American Accounting Association (AAA)			

American Institute of CPAs (AICPA)			Financial Executives International (FEI)			The Institute of Management Accountants (IMA)			The Institute of Internal Auditors (IIA)

Committee of Sponsoring Organizationsof the Treadway Commission

coso.orgFRAUD RISKMANAGEMENT
GUIDE
SecondEditionE X E C U T I V E

S U M M A R Y

March 202 3 | Research Commissioned by

Co-published byCommittee of Sponsoring
Organizations of theTreadway Coåmmission

2 | Executive Summary | Fraud Risk Management Guide | COSO/ACFE

coso.orgCOSO/ACFE | Executive Summary | Fraud Risk Management Guide |3

FOREWORD
In 1992 the Committee of Sponsoring Organizations of
the Treadway Commission (COSO) released its Internal
Control — Integrated Framework (the original framework).
The original framework gained broad acceptance and was
widely recognized as a leading framework for designing,
implementing, and conducting internal control andassessing the effectiveness of internal control.

For organizations desiring a more comprehensive approachto managing fraud risk, the Fraud Risk Management Guide
includes the information needed to perform a fraud risk
assessment, as well as guidance on establishing an overall
Fraud Risk Management Program including:

COSO revised the original framework in 2013 (COSO 2013 IC
Framework). The COSO 2013 IC Framework incorporated 17
principles. These 17 principles are associated with the fiveinternal control components, and provide clarity for the user
in designing and implementing systems of internal control
and for understanding requirements for effective internal
control. COSO makes clear that for a system of internal
control to be effective, each of the 17 principles is present,
functioning, and operating together in an integrated manner.
One important principle focused on fraud risk.

• Performing a fraud risk assessment

Principle 8, one of the risk assessment
component principles, states:
The organization considers the potential
for fraud in assessing risks to theachievement of objectives.

The Fraud Risk Management Guide, originally published in2016, was intended to be supportive of and consistent with
the COSO 2013 IC Framework and to serve as guidance fororganizations to follow in addressing this specific fraud risk
assessment principle.
However, fraud is not static. Accordingly, COSO and ACFE
initiated an update process that included reaching out to abroad range of users for recommendations on where theFraud Risk Management Guide could be improved, andassembled a team to take a refreshed look at the Guide andassess how and where it should be updated.

• Establishing fraud risk governance policies• Designing and deploying fraud preventive and detective
control activities• Conducting investigations, and• Monitoring and evaluating the total Fraud Risk
Management ProgramThis Guide is designed to be familiar to COSO Frameworkusers. It contains principles and points of focus. This Guide’s
five principles are consistent with the five COSO Internal
Control Components and the 17 COSO principles.
This Guide updates the first edition of the Fraud Risk
Management Guide published in 2016. It also draws from a2008 publication published and sponsored by the American
Institute of CPAs (AICPA), Institute of Internal Auditors (IIA),
and Association of Certified Fraud Examiners (ACFE). Thisprior publication, Managing the Business Risk of Fraud: A
Practical Guide, contained similar guidance for establishinga comprehensive Fraud Risk Management Program and has
been used by many organizations to manage fraud risk. The
COSO sponsors and ACFE are appreciative of the work doneby the task forces that produced these prior publications.
This updated Guide builds on them by addressing more
recent anti-fraud developments, revising terminology to
be consistent with newer COSO terminology, and adding
important information related to technology developments— specifically data analytics.

Performing periodic fraud risk assessments is an importantelement of good governance. Additionally, it is also a COSO
2013 IC Framework requirement.

coso.org

4 | Executive Summary | Fraud Risk Management Guide | COSO/ACFEThe Guide’s executive summary provides a high-level
overview intended for the board of directors, senior
management, and chief audit executives. It is designed to
explain the benefits of establishing strong anti-fraud policies
and controls. The updated Guide’s appendices containvaluable information:
A. Glossary
B. Fraud Risk Management Roles and Responsibilities
C. Fraud Risk Management Considerations for
Smaller Entities
D. Data Analytics and FRM
E. Fraud Risk Assessment Example
F. Fraud Risk Management Tools
G. Managing the Risk of Fraud, Waste,
and Abuse in the Government Environment
The updated Guide also contains links to several
valuable tools and templates that can be used to make
implementation and documentation of a comprehensive
Fraud Risk Management Program more effective.

COSO has also published Enterprise Risk Management— Integrating with Strategy and Performance (COSO 2017
ERM Framework). This Guide, the COSO 2013 IC Framework,and the COSO 2017 ERM Framework, are intended tobe complementary. Depending on how an organization
implements the Internal Control Framework, the ERM
Framework, and this Guide, there may be overlapping andinterconnecting areas. Fraud risk can affect areas beyond
accounting and financial management activities.
Indeed, an organization seeking to minimize the adverse
impacts of fraud needs to consider fraud risk in all areas ofthe enterprise and its operations.
The COSO Board would like to thank members of the
Task Force that updated this Guide, the other anti-fraud
professionals who provided recommendations for thisUpdate, the original Task Force and Advisory Panelmembers, and the COSO member organizations for theircontributions in reviewing the Guide (see pages 5, 6, and 7).
Finally, the COSO Board gratefully acknowledges David
L. Cotton and Sandra K. Johnigan, co-chairs of the Update
Task Force, for their outstanding leadership and efforts
toward the completion of this update.

Paul J. Sobel
COSO Chair

Bruce Dorris
ACFE President and CEO

coso.orgCOSO/ACFE | Executive Summary | Fraud Risk Management Guide |5

Fraud Risk Management Guide Update Task ForceTom Caulfield
Procurement Integrity Consulting Services

Sandra K. Johnigan, Co-Chair
Johnigan, PC

Jeffrey Steinhoff
Formerly KPMG and GAODavid Coderre
CAATS

Andi McNeal
ACFE

Pamela VerickProtiviti

David L. Cotton, Co-Chair
Cotton, A Sikich Company

Linda Miller
Audient Group, LLC

Vincent Walden
KonaAI

John D. Gill
ACFE

Lynda Schwartz
University of Massachusetts Amherst

Anti-Fraud Professionals Who Provided Recommendations
for this Fraud Risk Management Guide Update
Tim Berichon
Institute of Internal Auditors

Anne Mercer
Institute of Internal Auditors

Sonia Boguslavsky
Bank of Israel

Rhod Newcombe
Brit Insurance

Dr. El-fred Boo
Nanyang Technological University

Joseph Palmar
Palmar Forensics

Mike Carter
Bittrex, Inc.

Brad Preber
Grant Thornton

Margot Cella
Center for Audit Quality

Katherine Robinson
Sterling Bank & Trust, FSB

Dr. Todd DeZoort
The University of Alabama

Valerie Scarantino
UGI Corporation

Scott Hilsen
Cox Automotive, Inc.

Paul Sobel
COSO Chairman

Robert HirthProtiviti

Dr. Robert Tennant
Institute of Management Accountants

Robert Hogan
Hogan Forensics

Lucy Wang
Center for Audit Quality

Ryan Hubbs
Schlumberger

Elizabeth Zachem Woodward
Dean Dorton

Jonathan T. Marks
Baker Tilly US, LLP

coso.org

6 | Executive Summary | Fraud Risk Management Guide | COSO/ACFEIn addition to the Task Force and Anti-Fraud Professionals listed above who contributed to the development of this 2023
Update, COSO and ACFE gratefully acknowledge those listed below, who previously contributed to the 2016 Guide.

Fraud Risk Management Task Force
Barbara Andrews
AICPA

Dan George
USAC

Kelly Richmond Pope
DePaul University

Michael Birdsall
Comcast Corporation

John D. Gill
ACFE

Carolyn Devine Saint
University of Virginia

Toby Bishop
Formerly ACFE, Deloitte

Leslye Givarz
Formerly AICPA, PCAOB

Jeffrey Steinhoff
Formerly KPMG and GAO

Margot Cella
Center for Audit Quality

Cindi Hook
Comcast Corporation

William Titera
Formerly EYDavid Coderre
CAATS

Sandra K. Johnigan, Co-Chair
Johnigan, PC

Michael Ueltzen
Ueltzen & Company

David L. Cotton, Chair
Cotton, A Sikich Company

Bill Leone
Norton Rose FulbrightPamela VerickProtiviti

James Dalkin
GAO

Andi McNeal
ACFE

Vincent Walden
KonaAI

Ron Durkin
Durkin Forensic, Inc.

Linda Miller
Audient Group, LLC

Bill Warren
PwC

Bert Edwards
Formerly State Department

Kemi Olateju
General ElectricRichard Woodford
U.S. Coast Guard Investigative Service

Frank Faist
Charter Communications

Chris Pembroke
Crawford & Associates, PC

Eric Feldman
Affiliated Monitors, Inc.

J. Michael Peppers
University of Texas

coso.orgCOSO/ACFE | Executive Summary | Fraud Risk Management Guide |7

Fraud Risk Management Advisory Panel
Dan Amiram
Columbia University Business School

Michael Justus
University of Nebraska

Zahn Bozanic
The Ohio State University

Theresa Nellis-Matson
New York Office of the State Comptroller

Greg Brush
Tennessee Comptroller of Treasury

Jennifer Paperman
New York Office of the State Comptroller

Tamia Buckingham
Massachusetts School Building Authority

Daniel Rossi
New York Office of the State Comptroller

Ashley L. Comer
James Madison University

Lynda Schwartz
University of Massachusetts Amherst

Molly Dawson
Cotton & Company LLP

Rosie Tomforde
Regional Government

Eric Eisenstein
Cotton & Company LLP

The COSO Board gratefully acknowledges everyone who contributed their time, experience, thoughts, and expertise to boththe original Guide and this updated Guide.

coso.org

8 | Executive Summary | Fraud Risk Management Guide | COSO/ACFEEXECUTIVE SUMMARY | FRAUD RISK MANAGEMENTThe Ever-Present Risk of Fraud and its Costs
All organizations are subject to fraud risks. Some
organizational leaders may question whether the benefits
derived from implementing and maintaining a Fraud Risk
Management Program outweigh the costs. This Guide
demonstrates why the answer to that question is Yes, andprovides help in implementing such a program.
Publicized fraudulent behavior by key executives, other
employees, and outsiders repeatedly demonstrate thereality of this ever-present risk and how it negatively impacts
reputations, brands, and images of many organizations
around the globe. Large frauds have led to the collapseof entire organizations, massive asset losses, significant
legal costs, incarceration of key individuals, and erosion ofconfidence in capital markets, government, and not-for-profit
entities. Even relatively small frauds can be devastating to anorganization, resulting in:• Loss of trust in management and the breakdown of
teamwork and organizational cohesion• Increased scrutiny from law enforcement andregulatory bodies• Loss of trust by stakeholders (shareholders, donors,
customers, taxpayers, and the public)• Increased employee and management turnover• Reputational damage• Loss of competitive advantage
It is impossible and impractical to eliminate all fraud in allorganizations. However, effective leaders address fraud
risk as they do any risk — they manage it. The Fraud Risk
Management Guide provides a blueprint to do just that. It isbased on the proven principles of enterprise risk management
as published by COSO, most recently in 2017. This Guide gives
organizations, whether large or small, government or private,
profit or non-profit, the information necessary to design aplan specific to the risks for that entity. There is no “onesize-fits-all approach” to managing fraud risk. But with theright approach, an organization can create a custom-fitted
program tailored to its specific needs.

1

A Growing Area of Fraud Risk
Organizations committed to fraud prevention, detection, anddeterrence will address not just internal fraud risks — frauds
perpetrated by parties within the organization, but also
external fraud risks — fraud perpetrated on the organization
by outside parties such as ransomware, data breaches,
identity theft, and a wide range of corruption schemes that
continue to evolve.
Fraud Deterrence Now and in the Future
Implementation of the principles in this Guide will maximize thelikelihood that fraud will be prevented or detected in a timely
manner and can create a strong fraud deterrence effect.
COSO’s mission is to help organizations improve performanceby developing thought leadership that enhances internal
control, risk management, governance and fraud deterrence.
The Fraud Risk Management Guide is a key tool for furthering
this mission, particularly with respect to fraud deterrence.
As a first step in discussing fraud deterrence, the following
practical definition of fraud1 is used in this Guide:
Fraud is any intentional act or omission
designed to deceive others, resulting in thevictim suffering a loss and/or the perpetrator
achieving a gain.

Therefore, to successfully achieve fraud deterrence,organizations will implement policies and procedures thattarget the prevention and detection of fraud. Organizations
that implement a rigorous Fraud Risk Management Program
will further strengthen fraud deterrence by making it known
that potential fraud perpetrators face a significant likelihoodof getting caught and being punished.
Deterrence is also supported and enhanced by theknowledge throughout the organization that:• Those charged with governance have made acommitment to comprehensive fraud risk management

The authors recognize that many other definitions of fraud exist, including those developed by the Auditing Standards Board of the American
Institute of Certified Public Accountants, the Public Company Accounting Oversight Board, and the Government Accountability Office. Somelegal definitions of fraud do not include scienter, or intent.

coso.orgCOSO/ACFE | Executive Summary | Fraud Risk Management Guide |• Periodic fraud risk assessments are being conducted
and updated as risks change or new information
becomes known• Fraud preventive and detective control activities,
including data analytics — overt and covert — are being
conducted• Suspected frauds are investigated quickly• Fraud reporting mechanisms are in place• Discovered frauds are remediated thoroughly• Wrongdoing has been appropriately disciplined• The entire Fraud Risk Management Program is being
constantly monitored
Roles and Responsibilities
The board of directors2 and top management have
responsibility for managing fraud risk. In particular, they
are expected to understand how the organization is
responding to heightened risks and emerging exposures,
as well as public and stakeholder scrutiny; what form ofFraud Risk Management Program the organization has
in place; how it identifies fraud risks; what it is doing tobetter prevent fraud, or at least detect it sooner; andwhat processes are in place to investigate fraud and takecorrective action. Further, personnel at all levels of theorganization have a responsibility to understand the effects
of fraud and the importance of preventing fraud. This Guideis designed to help address these complex issues.
How it Works
This Guide provides implementation guidance for a Fraud
Risk Management Program that defines principles andpoints of focus for fraud risk management and describes
how organizations of various sizes and types can establish
their own Fraud Risk Management Programs. The Guide
includes examples of key program components andresources that organizations can use as a starting place
to develop a Fraud Risk Management Program effectively
and efficiently. In addition, and recognizing that no twoorganizations are the same, the Guide contains references
to other sources of guidance to allow for tailoring a
Fraud Risk Management Program to a particular industry
or to government or not-for-profit organizations. Eachorganization will assess the degree of emphasis toplace on fraud risk management based on its size andcircumstances.
2

9

The Guide also contains valuable information for users
who are implementing a Fraud Risk Management Program.
This includes addressing fraud risk management roles andresponsibilities, fraud risk management considerations forsmaller organizations, data analytics, and managing fraud
risk in the government environment.
What’s New in the 2023 Fraud Risk
Management Guide?
Following publication of the Fraud Risk Management
Guide in 2016, it became recognized as containing awidely accepted set of leading practices for anti-fraud
professionals and organizations intent on deterring fraud.
But, fraud is not static. Accordingly, COSO and ACFE
initiated an update process that included reaching out toa broad range of users for recommendations on where the
Guide can be improved, and assembled a team to take arefreshed look at the Guide and assess how and where it
should be updated. Following are the key changes to this2023 edition:• Fraud risk management and deterrence. This edition
explains how fraud risk management relates to andsupports fraud deterrence — a key theme in COSO’s
missions.
• Relationships among COSO’s two frameworks andfraud risk management. This edition explains how the
COSO 2013 Internal Control — Integrated Framework,
the COSO 2017 Enterprise Risk Management —Integrating with Strategy and Performance Frameworkand the Fraud Risk Management Guide are related andsupport each other.
• Expanded information on data analytics. Data analytics
continues to grow in importance as a key tool for theprevention and early detection of fraud. Advanced
applications of data analytics may be less familiar tosome users than standard tools, such as interviewing
and whistleblower systems. Accordingly, this edition
includes expanded and updated information on data
analytics, while continuing to emphasize the importanceof interviewing and whistleblower systems. A data
analytics Point of Focus has been added to each of thefive fraud risk management principles to demonstrate
how the use of data analytics is an integral part of eachprinciple. Further, the data analytics appendix has been
updated and expanded. This approach is not meant
to downplay the importance of other tools, but rather,to highlight the increasing power of data analytics inmanaging fraud risk.

Throughout this Guide the terms board and board of directors refer to the governing or oversight body or those charged with governance ofthe organization. The terms chief executive officer (CEO) and chief financial officer (CFO) refer to the senior-level management individuals
responsible for overall organization performance and financial reporting.

coso.org

10 | Executive Summary | Fraud Risk Management Guide | COSO/ACFE• Internal control and fraud risk management. This
edition explains how internal control and fraud risk
management are related and support each other, but
are different in some important respects. Examples areprovided to show that many “go-to” internal control
processes and procedures may be adequate for
ensuring accuracy in accounting and financial reportingbut may not provide sufficient fraud protection.
• Assessing the effectiveness of existing control
procedures as related to fraud risk. Chapter 2 (Fraud
Risk Assessment) provides additional informationon this important step in the fraud risk assessment
process. It clarifies and emphasizes that assessing
control effectiveness involves (a) identifying existing
control procedures related to each identified inherent
fraud risk, (b) assuring that the controls have been
implemented and are working as designed, and (c)assessing whether the controls are adequate toaddress the fraud risks that have been identified. That
last step is in addition to an assessment of the designand operating effectiveness of controls from an internal
control over financial reporting perspective. Further,
it is the key to identifying residual fraud risk so that
additional fraud control activities such as additional
data analytics can be applied.
• Changes in the legal and regulatory environment.
This edition includes updated information with respect
to recent legal and regulatory developments in the
U.S. pertaining to fraud and fraud risk management,
including:- The Department of Justice’s Evaluation of Corporate
Compliance Programs- The Government Accountability Office’s A Frameworkfor Managing Fraud Risks in Federal Programs- U.S. Securities and Exchange Commission’s Climate
and Environmental, Social, and Governance (ESG)
Task Force Reports• Fraud reporting systems or hotlines. ACFE research
consistently shows that the majority of frauds are
discovered through tips, often from employees inan organization. This edition includes updated andexpanded information related to the importance offraud reporting systems in detecting, preventing, anddeterring fraud.
• Changes in the external environment and fraud
landscape. The fraud landscape is changing rapidly.
This edition includes information on this changing
environment, including:coso.org- Environmental, Social, and Governance (ESG)
initiatives and reporting- Cyber fraud- Blockchain, cryptocurrency, and digital assets- Ransomware- COVID-19 response efforts, the CARES Act (Public
Law 116-136) and other related programs- Remote working and hybrid working environments- Innovative and virtual management tools andaccounting procedures• Appendices changes. The 2016 Guide had 19 appendices.
This 2023 edition has 7. Several of the 2016 appendiceshave been moved to ACFE’s Fraud Risk Management
Tools web site so that they can be updated as needed.
The appendices moved are:
- Sample Fraud Control Policy Framework(2016 Appendix F-1)
- Fraud Risk Management High-Level Assessment(2016 Appendix F-2)
- Sample Fraud Policy Responsibility Matrix(2016 Appendix F-3)
- Sample Fraud Risk Management Policy(2016 Appendix F-4)
- Sample Fraud Risk Management Survey(2016 Appendix F-5)
- Fraud Risk Exposures (2016 Appendix G)- The five Fraud Risk Management Scorecards(2016 Appendices I-1 through I-5)
The Appendix, Managing the Risk of Fraud, Waste, andAbuse in the Government Environment, has been updated
and expanded, and remains in the Guide as a valuable
resource.
Finally, and significantly, the ACFE tools site includes agreatly-expanded list of fraud risk exposures and fraud
schemes. Each scheme in the expanded list is hyperlinked
to an underlying description of the scheme and how it
is carried out. This list contains generic schemes —schemes that can victimize any organization — but also
industry-specific schemes (healthcare, financial services,manufacturing, and so forth). Again, through input fromusers, this resource will continue to expand. These dynamic
resources are readily accessible to anti-fraud professionals
implementing Fraud Risk Management Programs.
COSO and ACFE are confident that this updated Fraud Risk
Management Guide will continue to grow in importance as
the set of leading practices for preventing, detecting, anddeterring fraud.

COSO/ACFE | Executive Summary | Fraud Risk Management Guide |11

Fraud Risk Management and the COSO Internal Control Framework
COSO revised its Internal Control — Integrated Framework
in 2013 to incorporate 17 principles. These 17 principles areassociated with the five internal control components COSO
established in 1992. The principles provide clarity for the user
in designing and implementing systems of internal control
and for understanding requirements for effective internal
control. COSO clarifies that for a system of internal control tobe effective, each of the 17 principles is present, functioning,and operating in an integrated manner. Throughout this Guide
the COSO 2013 IC Framework has been used as a source fordescribing aspects of internal control.
Principle 8, one of the risk assessment
component principles, states:
The organization considers the potential
for fraud in assessing risks to theachievement of objectives.

This Guide is intended to be supportive of and consistent
with the COSO 2013 IC Framework and can serve as
guidance for organizations to follow in performing a fraud
risk assessment.
For organizations desiring to establish a morecomprehensive approach to managing fraud risk, however,this Guide includes more than just the information needed
to perform a fraud risk assessment. It also provides
guidance on establishing the other components of an
overall Fraud Risk Management Program, including:• Establishing fraud risk governance policies• Designing and deploying fraud preventive and detective
control activities• Conducting investigations and taking corrective actions

The Guide also defines important terminology (seeAppendix A), explains key roles and responsibilities (seeAppendix B), and describes how it can be applied tosmaller organizations (see Appendix C).
Consequently, organizations applying the COSO 2013 IC
Framework can choose from the following two approaches
in addressing this important fraud risk assessment
principle:• First Approach: They can use this Guide’s second
fraud risk management principle (The organization
performs comprehensive fraud risk assessments to
identify specific fraud schemes and risks, assess theirlikelihood and significance, evaluate existing fraud
control activities, and implement actions to mitigate
residual fraud risks) on a stand-alone basis to conduct
a fraud risk assessment that is compliant with COSO
2013 IC Framework Principle 8. Under this approach, anorganization would overlay this fraud risk assessment
process on its existing internal control structure by
revisiting each component of internal control andassessing vulnerabilities to fraud.
• Second Approach: They can implement this Guide as aseparate, compatible, and more comprehensive process
to not only periodically assess, but to also manage theorganization’s fraud risks as part of a broader Fraud
Risk Management Program. That approach includes a
fraud risk assessment and also encompasses fraud risk
governance, designing and implementing fraud control
activities, fraud investigation and corrective action, andfraud risk management evaluation and monitoring. Once
the Guide is implemented, its results will support and will
be consistent with the overall COSO 2013 IC Framework.
The second approach results in an ongoing, comprehensive
Fraud Risk Management Program as follows in Figure 1.

• Monitoring and evaluating the total Fraud Risk
Management Program

coso.org

12 | Executive Summary | Fraud Risk Management Guide | COSO/ACFE

Figure 1. Ongoing, Comprehensive Fraud Risk Management Process
Establish a fraud
risk management
policy as part oforganizational
governanceMonitor the fraud risk
management process,report results, andimprove the process

Establish a fraud
reporting process andcoordinated approach
to investigation andcorrective action,
including analyzing andremediating root causesThis comprehensive approach recognizes and emphasizes
the fundamental difference between internal control
weaknesses resulting in errors and weaknesses resulting in
fraud. This fundamental difference is intent. An organizationthat simply adds the fraud risk assessment to the existingrisk assessment may not thoroughly examine and identify
possibilities for improper acts designed to:• Misstate financial information• Misstate non-financial information• Misappropriate assets• Perpetrate illegal acts or corruptioncoso.org

Perform
comprehensive
fraud risk
assessments

Select, develop, anddeploy preventive
and detective fraud
control activities

Implementing a specific and more focused fraud risk
assessment as a separate Fraud Risk Management Program
enhances the likelihood that the assessment’s focus
remains on intentional acts.
The recommended approach is also likely to result in a morerobust and comprehensive assessment of fraud risk. It also
provides the additional structure needed for comprehensive
fraud risk management. If organizations use the more
simplified approach (just performing the fraud risk
assessment), they can combine those results with the COSO
2013 IC Framework’s results to yield more robust prevention
and detection mechanisms.

COSO/ACFE | Executive Summary | Fraud Risk Management Guide |13

Relationships Among COSO’s Two Frameworks and this Fraud Risk Management Guide
COSO published Internal Control — Integrated Framework
in 2013 (COSO 2013 IC Framework) and publishedEnterprise Risk Management — Integrating with Strategy
and Performance in 2017 (COSO 2017 ERM Framework).
This Fraud Risk Management Guide, the COSO 2013 IC
Framework, and the COSO 2017 ERM Framework, areintended to be complementary.

Enterprise risk management is broader than internal control
in that it focuses on a variety of risk responses to manage
risk in all aspects of business. Internal control is a subset
and integral part of enterprise risk management, while
enterprise risk management is a subset of organizational
governance. Of course, fraud risk can impact all aspects ofboth enterprise risk and internal control.

Depending on how an organization implements the Internal
Control Framework, the ERM Framework, and this Guide,
there may be overlapping and interconnecting areas. Fraud
risk can affect all areas of accounting functions, financial
management and reporting activities, and non-financial
management and reporting activities. Indeed, an organization
seeking to minimize the adverse impacts of fraud will consider
fraud risk in all areas of the enterprise and its operations.

This Fraud Risk Management Guide is intended to be an
important component of a holistic risk response that isboth effective and efficient in addressing wide-ranging
fraud risks, including those originating from internal sources(e.g., management, employees, consultants), externalsources (e.g., cyber/hacking risk), or both (e.g., conspiracy,
corruption, money laundering, drug trafficking/terrorism
financing).

Summary of Fraud Risk Management Components and Principles
Fraud Risk Governance
Fraud risk governance is an integral component of corporate
governance and the internal control environment. Corporate
governance addresses the manner in which the board of
directors and management meet their respective obligations
to achieve the organization’s goals, including its fiduciary,1

Principle
Control
Environment

The organization establishes and communicates a Fraud Risk
Management Program that demonstrates the expectations of theboard of directors and senior management and their commitment tohigh integrity and ethical values regarding managing fraud risk.

Fraud Risk Assessments
A fraud risk assessment is a dynamic and iterative process
for identifying and assessing fraud risks relevant to theorganization. Fraud risk assessment addresses the riskof fraudulent financial reporting, fraudulent non-financial
reporting, asset misappropriation, and corruption (including
illegal acts and noncompliance with laws and regulations).

Principle
Risk
Assessment

2

reporting, and legal responsibilities to stakeholders.
The internal control environment creates the disciplinethat supports the assessment of risks to the achievementof the organization’s goals.

Organizations can tailor this approach to meet theirindividual needs, complexities, and goals. Fraud risk
assessment is not only an integral component of risk
assessment and internal control, it also is specificallylinked to COSO 2013 IC Framework Principle 8.

The organization performs comprehensive fraud risk assessments
to identify specific fraud schemes and risks, assess their likelihoodand significance, evaluate existing fraud control activities, andimplement actions to mitigate residual fraud risks.

coso.org

14 | Executive Summary | Fraud Risk Management Guide | COSO/ACFE

Fraud Control Activity
A fraud control activity is an action establishedthrough policies and procedures that helps ensure thatmanagement’s directives to mitigate fraud risks are carriedout. A fraud control activity is a specific procedure orprocess intended either to prevent fraud from occurring or
to detect fraud quickly in the event that it occurs.
Fraud control activities are generally classified as either
preventive (designed to avoid a fraudulent event ortransaction at the time of initial occurrence) or detective(designed to discover a fraudulent event or transaction

Principle

3

Control
Activities

The organization selects, develops, and deploys
preventive and detective fraud control activities tomitigate the risk of fraud events occurring or not being
detected in a timely manner.

Fraud Investigation and Corrective Action
Control activities cannot provide absolute assurance against
fraud. As a result, the organization’s governing board
ensures that the organization develops and implementsa system for prompt, competent, and confidential review,
investigation, and resolution of instances ofPrinciple

Information &Communication

4

Organizations use ongoing and separate (periodic)
evaluations, or some combination of the two, to perform

Monitoring
Activities

coso.org

5

allegations involving potential fraud and misconduct. An
organization can improve its chances of loss recovery, while
minimizing exposure to litigation and damage to reputation,by establishing and carefully preplanning investigation andcorrective action processes.

The organization establishes a communication process to obtain
information about potential fraud and deploys a coordinatedapproach to investigation and corrective action to address fraud
appropriately and in a timely manner.

Fraud Risk Management Monitoring Activities
The fifth fraud risk management principle relates tomonitoring the overall Fraud Risk Management Program.
Organizations use fraud risk management monitoring
activities to ensure that each of the five principles of fraud risk
management is present and functioning as designed and thatthe organization identifies needed changes in a timely manner.

Principle

after the initial processing has occurred). The selection,
development, implementation, and monitoring of fraud
preventive and fraud detective control activities are crucial
elements of managing fraud risk. Fraud control activities
are documented with descriptions of the identified fraud
risk and scheme, the fraud control activity that is designed
to mitigate the fraud risk, and the identification of those
responsible for the fraud control activity. Fraud control
activities are integral to the ongoing fraud risk assessment
component of internal control.

the fraud monitoring activities. Similar to the COSO 2013 IC
Framework, ongoing evaluations in a Fraud Risk
Management Program that are built into the organization’s
business processes at varying levels provide timely
information. In contrast, organizations conduct separate
evaluations periodically that vary in scope and timing basedon numerous factors, including the results of ongoingevaluations.

The organization selects, develops, and performs ongoing evaluations toascertain whether each of the five principles of fraud risk management ispresent and functioning and communicates Fraud Risk Management Program
deficiencies in a timely manner to parties responsible for taking corrective
action, including senior management and the board of directors.

COSO/ACFE | Executive Summary | Fraud Risk Management Guide |15

Use by Interested Parties
Board of Directors and Audit Committee
A well-performing and engaged board discusses withsenior management the state of the entity’s Fraud Risk
Management Program and provides oversight as needed.
Senior management has overall responsibility for thedesign and implementation of a Fraud Risk Management
Program, including setting the tone at the top that createsthe culture for the entire organization. The board establishes
policies and procedures explaining how the board provides
oversight, including defining expectations about integrityand ethical values, transparency, and accountability
for the implementation and operation of the Fraud Risk
Management Program. Senior management informs theboard of the residual risks of fraud from its fraud risk
assessments, as well as incidents of fraud or suspectedfraud. The board challenges management and asks thetough questions, as necessary. It seeks input from internal
auditors, external independent auditors, specialists, andlegal counsel and utilizes these resources as needed toinvestigate any issues.
The board is an important check on the risk of management
wrongdoing, including management override of anti-fraud
and other internal controls. The board assesses the risk ofmanagement override and also considers and addresses
fraud allegations related to senior management if they arise.
Senior Management
Senior management assesses the entity’s Fraud Risk
Management Program in relation to this Fraud Risk
Management Guide, focusing on how the organization
applies the five principles in support of its Fraud Risk
Management Program. Further, they assess the entity’s
fraud risk in compliance with Principle 8 of the COSO 2013 IC
Framework.
Other Management and Personnel
Managers and other personnel consider how they are
conducting their responsibilities in light of this Guide anddiscuss with more senior personnel ideas for strengthening
fraud risk controls. More specifically, they consider how
existing controls affect the relevant principles within the fivecomponents of fraud risk management, as well as Principle
8 of the COSO 2013 IC Framework.

Internal Audit
Internal auditors review their internal audit plans and how
the plans are applied to the entity’s Fraud Risk Management
Program in connection with implementation of thisguidance. Internal auditors will use this Guide to 1) assess
how effective their risk assessments are in evaluating fraud
risk and improve them, and 2) help assess fraud risk ineach internal audit project, and 3) identify potential control
enhancements to minimize ongoing fraud risk.
External Independent Auditors
In many situations, an external independent auditor is
engaged to audit or examine the effectiveness of theclient’s internal control over financial reporting in addition
to auditing the entity’s financial statements. The COSO
2013 IC Framework introduced Principle 8: the organizationconsiders the potential for fraud in assessing risks to theachievement of objectives. Auditors can assess the entity’s
implementation of that Principle using this Guide.
Specialists
In addition to the audit committee, internal audit, andmanagement, the organization also may include internal andexternal professionals with specific domain expertise, suchas legal, compliance, investigations, emerging markets,human resources, security, and data analytics.
Other Professional Organizations
Other professional organizations providing guidance on
fraud risk as it relates to operations, reporting, andcompliance may consider their standards and guidance incomparison to the Guide. To the extent diversity in concepts
and terminology is eliminated, all parties benefit.
Educators
The concepts of fraud risk management are important toprofessional education. Because fraud risks are pervasive
and perennial, every professional benefits from a solid
grounding in the Guide’s concepts and approaches.
Educators can leverage the Guide as a teaching text or as
source material for lessons in leadership, business decisionmaking, management and organizational behavior, ethics,
advanced audit, information management, data analytics,
and forensic accounting.

coso.org

16 | Executive Summary | Fraud Risk Management Guide | COSO/ACFE

Relationship Between the COSO 2013 IC Framework’s Five Components and 17 Internal
Control Principles and this Guide’s Five Fraud Risk Management Principles
COSO revised its Internal Control — Integrated Framework in 2013 to incorporate 17 principles. These 17 principles areassociated with the five internal control components COSO established in 1992. This Guide’s five fraud risk management
principles fully support, are entirely consistent with, and parallel the COSO 2013 IC Framework’s 17 internal control principles.
The correlation between the fraud risk management principles and the COSO 2013 IC Framework’s internal control
components and principles is as follows:
COSO Framework Components and Principles

Fraud Risk Management Principles

Control
Environment

1. The organization demonstrates a commitment to integrity and ethical values.
2. The board of directors demonstrates independence from management andexercises oversight of the development and performance of internal control.
3. Management establishes, with board oversight, structures, reporting lines,
and appropriate authorities and responsibilities in the pursuit of objectives.
4. The organization demonstrates a commitment to attract, develop, and retain
competent individuals in alignment with objectives.

1. The organization establishes and communicates a
Fraud Risk Management Program that demonstrates
the expectations of the board of directors and senior
management and their commitment to high integrityand ethical values regarding managing fraud risk.

5. The organization holds individuals accountable for their internal control
responsibilities in the pursuit of objectives.

Risk
Assessment

6. The organization specifies objectives with sufficient clarity to enable theidentification and assessment of risks relating to objectives.
7. The organization identifies risks to the achievement of its objectives
across the entity and analyzes risks as a basis for determining how therisks should be managed.
8. The organization considers the potential for fraud in assessing risks to theachievement of objectives.

2. The organization performs comprehensive fraud
risk assessments to identify specific fraud schemes
and risks, assess their likelihood and significance,
evaluate existing fraud control activities, andimplement actions to mitigate residual fraud risks.

9. The organization identifies and assesses changes that could significantly
impact the system of internal control.

Control
Activities

10. The organization selects and develops control activities that contribute to themitigation of risks to the achievement of objectives to acceptable levels.
11. The organization selects and develops general control activities overtechnology to support the achievement of objectives.

Monitoring
Activities

Information &Communication

12. The organization deploys control activities through policies that establish
what is expected and procedures that put policies into action.
13. The organization obtains or generates and uses relevant, quality information
to support the functioning of other components of internal control.
14. The organization internally communicates information, including
objectives and responsibilities for internal control, necessary to support
the functioning of internal control.

3. The organization selects, develops, and deploys
preventive and detective fraud control activities tomitigate the risk of fraud events occurring or not
being detected in a timely manner.

4. The organization establishes a communication
process to obtain information about potential fraud
and deploys a coordinated approach to investigationand corrective action to address fraud appropriately
and in a timely manner.

15. The organization communicates with external parties regarding mattersaffecting the functioning of other components of internal control.
16. The organization selects, develops, and performs ongoing and/or
separate evaluations to ascertain whether the components of internal
control are present and functioning.
17. The organization evaluates and communicates internal control
deficiencies in a timely manner to those parties responsible for taking
corrective action, including senior management and the board of
directors, as appropriate.

5. The organization selects, develops, and performs
ongoing evaluations to ascertain whether eachof the five principles of fraud risk management ispresent and functioning and communicates Fraud
Risk Management Program deficiencies in a timely
manner to parties responsible for taking corrective
action, including senior management and the boardof directors.

The most obvious correlation between these two sets of principles is COSO 2013 IC Framework Principle 8 and Fraud Risk
Management Principle 2. In addition, as the above exhibit displays, all of the COSO 2013 IC Framework and Fraud Risk
Management Principles correlate with and support each other.

coso.org

Testimonials“The Guide is a great resource for professionals who appreciate
the need to take a holistic approach to fraud risk management.”
Todd DeZoort, Ph.D., CFE, NACD.DC

Durr-Fillauer Chair in Business Ethics and Professor of Accounting
Culverhouse School of Accountancy, The University of Alabama“As much as we don’t like to think about it, fraud is just part of thebusiness landscape and human condition. Pressure, greed, insecurity, andmany other emotions are involved which unfortunately fuel intentional
bad behavior and decision-making. This guide expands upon Principle 8
in the 2013 COSO Internal Control — Integrated Framework in an effective
way to help all organizations regardless of size, industry, form, or ownershipmore effectively address the unwelcome subject of fraud. Boards,
management, accountants, internal auditors, and others will benefit
from its advice, structure, and guidance.”
Robert B. Hirth, Jr.

Senior Managing Director, Protiviti
COSO Chair Emeritus (2013–2018)“Being a CPA as well as a CFE, I was already familiar with COSO guidance.
Coupling that with a fraud risk management perspective is ideal for anyone
in a corporate role. The FRMG provides clear direction for identifying andaddressing risks, and makes it easy to integrate with overall corporate risk
management efforts.”
Valerie Scarantino
UGI Corporation“I found the Guide to be a cost effective and valuable resource for fighting
fraud as it approaches fraud prevention and detection on a comprehensive
basis as opposed to piecemeal, which as is often the approach used by mostorganizations. Proactiveness vs. reactiveness is both more cost effective as
well as protecting from something you can never recover from, reputation
damage…the true cost of fraud. Unfortunately, many organizations fall into the“comfortable in action mode,” in other words “it can’t happen here,” or simply
don’t know where or how to start a comprehensive, all-encompassing approach
to fraud protection and detection. You now have a tool andresource to guide you through this process!”
Joseph M. Palmar, CPA, CFE, CFF
Chief Executive Officer
Palmar Forensics

FRAUD RISKMANAGEMENT
GUIDE
SecondEditionCommittee of Sponsoring
Organizations of theTreadway Coåmmission

FRAUD RISKMANAGEMENT
GUIDE
SecondEditionCommittee of Sponsoring
Organizations of theTreadway Coåmmission