Spreadsheet: 69aeaec2-64af-4ab3-b90f-94c95033519b
Sheet: Revised

Who all has responsibilities related to the Fraud Management Program and what is their role? | How can a fraud management program be integrated with the ERM process? | How can I measure and assess the effectiveness of our organization's fraud program? | What are some examples of fraud risk factors or indicators and how can these be quantified and categorized for likelihood and impact? | How can a small audit shop with limited resources design, implement, and promote a fraud management program? | How do I approach senior management to convince them on the value of a fraud management program if they are reluctant or do not believe fraud occurs at our organization? | What are examples of fraud risk indicators and data analytics to detect kickbacks? | Where in the organization is the most appropriate place for continuous monitoring, what are typical types of activities, and how can effectiveness be assessed? | How do you approach fraud risk when it relates to senior management and how much emphasis/resources should be placed here compared with the risk assessment of other areas? | Should an Internal Audit Dept develop separate audit programs that focus on fraud or should the audit program combine tests for fraud as a part of their normal tests?
 | ERM | Measure Effectiveness | Risk Factors/Indicators | Small Audit Shop | Educate Mgmt on need for Fraud Program | [NAME] | [NAME] | When it is Senior Management . . . | The Audit Program | Other
Is fraud the responsibility of internal audit or is it management's responsibility? | The Fraud Risk Assessment should be conducted by Internal Audit or should be part of the ERM program? | How is the effectiveness of a fraud program measured? | Can you please give some examples of Risk Factors? Thank you. | How can a small Internal Audit Department comply with the new IIA mandatory requirements for detecting and preventing fraud? | How would you approach upper managment that they need to address a fraud program when they are not interested or don't see the value of such a program? | In my organization, I am a business auditor i.e. non-IT. In terms of fraudulent activities with independent contractors, should fraud have happened, activities would likely be conducted 'under the table' e.g. kickbacks. What would be some good fraud risk indicators to look into to be able to detect fraudulent activities between the manager of a department and an independent contractor e.g. business referred by mortgage brokers to our organization and whether kickbacks have happened? | When appropriate in the presentation, can you please address what typical types of activities are continuous monitoring used for and specifically HOW is it used in these cases? Thank you. | Can you provide some examples of control activities can a company can put in place to mitigate the risk of managmeent overide of internal controls? | 1) Is it required to systematically test for fraud, i.e. have separate 'fraud' audits? Is it sufficient to include this as part of every audit, and based on the risk analysis during the planning phase decide what (anti-)fraud controls should be tested? | How would you integrate specific state or country "personal information" privacy laws into IT fraud assessment/ awareness programs
Do you have any guidance on persuading audit committees that they have a role in overseeing fraud in a company? | Shouldn't the fraud program be a component of ERM? | How can we make fraud program effective? | What is an example of a risk indicator? | What continuous monitoring tools could you recommend for small audit shops that may not have the budget to purchase a tool such as ACL? | How do you convince management to put resource $ behind actually executing a fraud risk program, as opposed to them just having one on paper? Most companies I have been with still think they don't have fraud so don't want to spend money on pro-active communication, preventing, detecting. They only spend after-the-fact on investigating when they already know they have a fraud loss. | How do you detect kickbacks using data analytics application? | What continuous monitoring tools could you recommend for small audit shops that may not have the budget to purchase a tool such as ACL? | There are times when allegations of fraud at the senior executive management level are referred to the internal audit department for investigation. In the absence of formal investigation and remediation procedures, how would you approach this without jeopardizing the business relationship established between the senior team and the internal audit department? | Should an Internal Audit Dept develop separate audit programs that focus on fraud or should the audit program combine tests for fraud as a part of their normal tests? | Are there documented Fraud Questionnaires available out in the audit environment? If not, what is the best way to come up with a Fraud Questionnaire?
Who is ultimately responsible for developing the fraud management program? | How did you compile an enterprise wide risk assessment? Was it high level or was it organized by specific lines of business/operational area? | how do judge whether your fraud program is effective? what do you define as effective | Would like more information on what is involved in "identifying risk factors" in the Detection and Monitoring phase. Could you speak to why this would not be part of the risk assessment phase? | I'm the Internal Auditor of a goverment agency. How do I do that, with few resources? | Are you aware of Internal Audit Departments who are training management about fraud risk factors since they are on the front line? | What data and criteria would be used to identify kickbacks? | Does the monitoring you perform in the Detection and Monitoring include continuous controls monitoring? | THe emphasis on fraud risk many times seems to be on lower level employees but the largest and most devestating frauds that have occurred (Enron, World Com, etc.) were perpetrated by executives. Do you audit executive transactions and corporate governance to mitigate this risk. |  | How do you ensure a comprehensive fraud risk assessment; specifically, how do you go about identifying all the potential fraud risks in your organization?
How common is it for departments to perform their own fraud risk assessments rather than relying on I/A's assessment for the entire company? Is this a best practice? | We're in the process of developing an ERM program. Do you see a Fraud Risk Management Program a subset of an ERM, to be managed under the ERM umbrella, or a separate program alltogether? Thanks. | How does one go about assessing the "effectiveness" of their fraud management program? | On the IT Fraud Risk Assessment template, how are the different levels (i.e., high, medium, etc.) defined for the "Likelihood" and the "impact" assessments. | Conducting a fraud risk assessment is a large undertaking. Where would you suggest starting or doing a pilot assessment to refine the assessment process? | How can we convince the senior management that fraud risk assessment is necessary if they are reluctant about implementing it? | What data analytics have you used or you know that have been used to help identify kickbacks? | In your opinion, how effective are the available 3rd Party continuous transaction monitoring programs in detecting fraudulent activity and risk for fraudulent activity?
Would the Risk Officer (where there is one) coordinate management's efforts for fraud risk assessment so that IA can assess the process? | How do you combine the fraud management program with ERM? - as my duties are both risk management and internal audit. | How do I know if I have an effective Fraud program, what are the measurements? | How can the likelihood of fraud be quantified in the context of an audit report such that the risk rating can be more effectively justified? | Our internal audit department has limited resources. If you had only limited time to devote to the entire fraud risk management, program, where would you suggest spending that time? | How do you convince management to seriously consider fraud risk when they feel that fraud doesn't happen at our organization? | Please give an example of how you would use data analysis to determine kickbacks? | Where in the organization is the most appropriate place for continuous monitoring?
Who should own the fraud risk management program within a company? |  | What is considered "Effective"? No fraud may be detected in the fraud progarm, but fraud could be occurring. |  |  | What's the most effective way to engage senior management in conversation about fraud management and encourage commitment from them? | For [NAME]: Can you give exaples of how to use the data analytics for uncovering kickbacks and vendor management illegal/fraudulent activities? | Given the drive across the industry for continuous assurance methods (e.g. continuous auditing/monitoring), what happens when the data owners do not have resources or the ability to support the review and dispositioning of the results? (Generally speaking, audit departments are not data owners over the systems and transactions being evaluated). How will automating fraud detection work if the processes and sustainability are not planned for before automation is implemented?
Who owns the overall Fraud Risk Program - who defines it, who documents the strategy, etc.? If it is management, should there be a central point (i.e. Chief Fraud Risk Officer) or is this most likely the accountability of a committee structure? |  | Would someone with a highly effective fraud program be willing to share what they do? |  |  | How do you get management and get employees engaged in thinking about fraud risks and having them own the responsibility for implementing the proper controls to prevent and detect fraud? |  | Have you seen any effective continuous monitoring programs for fraud in place? If so, what makes it successful?
Doug, you talked about the Fraud Risk Management Program and the fact that Internal Audit's assessment should take pllace after top management's assessment. How do you integrate top management's assessment into Internal Audit's assessment in order to avoid duplication of effort? |  | how do you measure the 'creating an ethical environment'? I know people always talk about creating a high ethics organization, but I have yet to work somewhere that leaders say 'This is a low ethics organization'. |  |  | I have the all important question of, how do we as auditors approach the topic of fraud with management to stress the importance of the true issue that they are the first point of contact with fraud and a program will work best in the organization if they are 'in the game'?
Is there any conflict of interest with the Legal Ethics Officer also serving as the Fraud Risk Coordinator who facilitates the fraud program for management? The Ethics Officer currently works with another employee who is the Fraud Risk Coordinator to conduct the fraud investigations. Should this separation of duties be maintained?
[NAME] usually expects IA or a Fraud Investigation Team to be responsible for fraud risk assessment, detection. monitoring. And many IA depts do not have the skill set or methodology/infrastructure to adequately assess fraud risk. Often fraud risk is an afterthought or not thought of at all. Should IA take a more proactive role in fraud risk mgmt? Is that IA's role?
Doug, Do you typicall expect or see management performing their own fraud risk assessment or rely upon Internal Audit (IA) to accomplish this by including management in the IA fraud risk assessment?
Is the preferred approach for this type of data analytics to have IA develop the tools/tests for the analytics then have managmenet perform the tests as part of operationg procedures?
Doug; From your experience, who is the "owner" of the management fraud risk assessment process? Does this analysis get elevated to the BoD or Audit Committee? What do you feel is appropriate action for IA if the organization is not performing a management fraud risk assessment? Thank you.
Who should "own" the organization's fraud management program? To what extent should Internal Audit be involved?
When we say we (internal auditors) shouldn't take ownership of a fraud risk management program, etc., who in management typically DOES have broad ownership of the fraud management program? It is not practically, the CFO.
Would you consider the Operational Risk Committee to implement a Fraud Program or is it the responsibility of Line Management or a joint venture between the two lines of management?