Spreadsheet: 69aeaec2-64af-4ab3-b90f-94c95033519b
Sheet: Doug, Ken, Peter

Question | Doug's Response | [NAME]'s Response | [NAME]'s Response
Who all has responsibilities related to the Fraud Management Program and what is their role? | Management has responsibility for  the fraud management program. The program could be coordinated/facilitated by the office/position that has responsibility for enterprise risk management, but other parties could also handle this.  The "correct" answer will most likely be organizational dependent. I think management from the various business units, divisions, or departments within the organization should also be assigned responsibility to help address fraud risks. The Board should provide an oversight role to ensure critical fraud risks are addressed by the organization. IA can provide assurance and consulting services on the fraud program. | Management has responsibility for  the fraud management program. The program is best coordinated/facilitated by the office/position that has responsibility for enterprise risk management. I think management from the various business units, divisions, or departments within the organization should also be assigned responsibility to help address fraud risks. The Board should provide an oversight role to ensure critical fraud risks are addressed by the organization. IA can provide assurance and consulting services on the fraud program. | I think [NAME] or [NAME] are better qualified to answer this question.  My OPINION is that management has the responsibility for the program, IA has a role to play in providing assurance around that program.
How can a fraud management program be integrated with the ERM process? | See [NAME]'s response | Fraud management was a component of our ERM process. We did the fraud risk assessment separate from our business, legal, and IT risk assessments in order to  facilitate completion, but it was part of the ERM process. | Fraud is just another type of risk and could be treated that way as part of the ERM program
How can I measure and assess the effectiveness of our organization's fraud program? | A good starting point would be to review the organization's documented fraud program to ensure that the program is in place and working as intended. In addition, review guidance from the IIA, [NAME], ACFE and other professional organizations to capture what key elements, procedures, practices and controls should be considered for an effective fraud program. | A good starting point would be to review the organization's documented fraud program to ensure that the program is in place and working as intended. In addition, review guidance from the IIA, [NAME], ACFE and other professional organizations to capture what key elements, procedures, practices and controls should be considered for an effective fraud program.
What are some examples of fraud risk factors or indicators and how can these be quantified and categorized for likelihood and impact? | There are many resources available to help identify fraud risk factors including the IIA's recent publications on fraud ("Internal Auditing and Fraud," on Page 16 for Fraud risk assessment, and in the GTAG on Fraud in section 2 for IT Fraud risks). The AICPA and ACFE and the  also provide good examples of fraud risks. Using a risk assessment tool demonstrated on the webinar can help quantify and categorize the likelihood and impact. Using the results of the risk management tool can lead to meaningful and productive discussions with management on how effective fraud risks are addressed. | There are many resources available to help identify fraud risk factors including the IIA's recent publications on fraud. The AICPA, ACFE, and the Audit Director's Roundtable of the Corporate Executive Board also provide good examples of fraud risks. Using a risk assessment tool demonstrated on the webinar can help quantify and categorize the likelihood and impact. Using the results of the risk management tool can lead to meaningful and productive discussions with management on how effective fraud risks are addressed. | I suggest reading the PG, "Internal Auditing and Fraud," on Page 16 for Fraud risk assessment, and in the GTAG on Fraud in section 2 for IT Fraud risks.  Using a fraud risk assessment tool like [NAME] demonstrated in the webinar is a great way to engage management and audit alike in working together to identify risk and likelihood/impact.
How can a small audit shop with limited resources design, implement, and promote a fraud management program? | I would not recommend IA build a fraud management program for the organization. However, with IA understanding of enterprise risks and controls and access to management, I would suggest working with management so they see the advantages of addressing fraud risks within the organization and to take ownership of building a strong fraud program. IA could provide consulting services to help management address this risk. | I would not recommend IA build a fraud management program for the organization. However, with IA understanding of enterprise risks and controls and access to management, I would suggest working with management so they see the advantages of addressing fraud risks within the organization and to take ownership of building a strong fraud program. IA could provide consulting services to help management address this risk. | My suggestion would be to identify the areas that pose the greatest risk of fraud to the organization, build fraud detection techniques into the audit plan and then leverage technology to provide increases in capacity and efficiency for all audit testing.
How do I approach senior management to convince them on the value of a fraud management program if they are reluctant or do not believe fraud occurs at our organization? | I would suggest reading the, "Managing the Business Risk of Fraud: A Practical Guide," which was referenced at the end of the webinar, for some very good reasons why senior management needs to take fraud management seriously. I would suggest you share specific examples of fraud that has taken place in your industry and/or  with your competitors, in order to make fraud more real to your executives. These fraud examples can often be found through searches on the Internet such as the US Department of Justice website for computer crimes or professional organizations such as the ACFE. | I would suggest you share specific examples of fraud that has taken place in your industry and/or  with your competitors, in order to make fraud more real to your executives. These fraud examples can often be found through searches on the Internet such as the US Department of Justice website for computer crimes or professional organizations such as the ACFE. The deal closer would be if your audit team could identify fraud through one of your audits. You may want to have a discussion with your Board or Audit Committee, if applicable. | I would suggest reading the, "Managing the Business Risk of Fraud: A Practical Guide," which was referenced at the end of the webinar, for some very good reasons why senior management needs to take fraud management seriously.  Also the ACFE Report to the Nation on Fraud is an excellent resource for highlighting the prevalence of fraud and statistics around organization loss from fraudulent activity.
What are examples of fraud risk indicators and data analytics to detect kickbacks? | [NAME] to [NAME]'s remarks. | [NAME] to [NAME]'s remarks. | A kickback is secret payment made in return for a favour.  More practically speaking, it can be when a buyer “kicks back” a payment to the vendor for being selected for a contract or vice versa.  In this case, we’ll be looking at it from the perspective of an Internal Auditor in the vendor’s organization. An employee of the vendor sells goods or services at an inflated price to a knowing party in the buyer’s organization. The buyer then secretly passes back a percentage of the overpayment to the vendor in return for being selected for the contract.  So your question is how would one find this by looking at data?  Where are the “indicators?”  Indicators could be found in the Order-to-Cash (O2C) data by simply doing basic statistical analysis (seeking minimum and maximum prices of goods sold) and looking for unit prices with a large standard deviation.  Alternatively, one could seek cases where goods are being sold at a price in excess of the established list price: Compare sales order values to price list. Even more blatantly, shipments could be made to a buyer without a sales order having been raised: Seek shipments to buyers with no corresponding [NAME]. While this may seem highly improbable because the fraudster isn’t working very hard at covering their tracks, stranger things have been known to happen.  Many fraudsters aren’t all that clever.
Where in the organization is the most appropriate place for continuous monitoring, what are typical types of activities, and how can effectiveness be assessed? | See [NAME]'s response | In addition to [NAME]'s comment, since continuous monitoring can be an overwhelming task, I would engage IT to help automate the continuous monitoring activities to make it as efficient and effective as possible. | The most appropriate place for [NAME] (as opposed to [NAME]) is with management.  The areas that this should be done need to be part of an overall assessment of the organizations Governance, Risk and Compliance (GRC) strategy.  One would expect [NAME] to be applied in high risk areas where the likelihood of controls failures is high and the impact to the organization is significant from either a loss and/or a compliance perspective.  The effectiveness of a [NAME] initiative can be measured by trending statistics on the number of identified control failures/exceptions identified.  With an effective Continuous Monitoring program in place, one would expect to see an improvement in the overall controls environment and fewer exceptions being identified.
How do you approach fraud risk when it relates to senior management and how much emphasis/resources should be placed here compared with the risk assessment of other areas? | In addition to [NAME]'s response: You should recognize that fraud perpetrated by senior management typically has higher impact than other frauds and is more likely to override normal controls (making it hard to prevent).  This higher risk profile of senior management fraud should be considered by IA. | The organization should have a documented policy on how to investigate fraud that includes fraud by senior management. By first identifying and documenting the following components of a fraud risk assessment: significant fraud risks,  controls in place to mitigate those risks, gaps in fraud controls, likelihood of a significant fraud or control failure, and the business impact of the fraud, it provides a great roadmap on where your audit focus on fraud should be. As part of this process, you should assess the ability of anyone including senior management that could bypass controls or exceed their authorities to commit fraud.
Should an Internal Audit Dept develop separate audit programs that focus on fraud or should the audit program combine tests for fraud as a part of their normal tests? | See [NAME]'s response | Identify potential fraud risks for each audit and build audit steps in the program to help determine if indicators of fraud exist. | My approach would be to incorporate fraud tests in each audit plan. The areas and degree to which this could be done would have to be consistent with your audit planning and overall risk assessment done during the planning phase.
How would you integrate specific state or country "personal information" privacy laws into IT fraud assessment/ awareness programs | I would work with your legal team to identify applicable privacy laws and regulations that apply to jurisdictions'  where the organization does significant business.  I would incorporate these "key" requirements into the enterprise risk assessment, legal risk assessment or IT fraud assessment as appropriate. I would also suggest reading GTAG #5 Managing and Auditing Privacy Risks for guidance on how to handle these issues. | I would work with your legal team to identify applicable privacy laws and regulations that apply to jurisdictions'  where the organization does significant business.  I would incorporate these "key" requirements into the enterprise risk assessment, legal risk assessment or IT fraud assessment as appropriate. | I would suggest reading GTAG #5 Managing and Auditing Privacy Risks for guidance on how to handle these issues.  There's lots of great information there.
Are there documented Fraud Questionnaires available out in the audit environment? If not, what is the best way to come up with a Fraud Questionnaire? | See [NAME]'s response | The IIA's recent publications on fraud provide material that can help you in this area -"Internal Auditing and Fraud" and "GTAG Fraud Prevention and Detection in an Automated World".  The joint document published by the IIA, [NAME] and ACFE may also help - "Managing the Business Risk of Fraud: A Practical Guide".
How do you ensure a comprehensive fraud risk assessment; specifically, how do you go about identifying all the potential fraud risks in your organization? | Identify key participants for the fraud risk assessment that have knowledge of the procedures, practices, and controls surrounding the business process.  For large organizations, this may include numerous participants to represent their particular business unit, division, and/or department. In some cases you may want to consider outside consultants if you do not have the knowledge resources internally. Consider benchmarking your list of identified fraud risks with other professional guidance from the IIA, [NAME], ACFE, and other industry resources. | Identify key participants for the fraud risk assessment that have knowledge of the procedures, practices, and controls surrounding the business process.  For large organizations, this may include numerous participants to represent their particular business unit, division, and/or department. In some cases you may want to consider outside consultants if you do not have the knowledge resources internally. Consider benchmarking your list of identified fraud risks with other professional guidance from the IIA, [NAME], ACFE, Audit Director's Roundtable and other industry resources.