Spreadsheet: 69aeaec2-64af-4ab3-b90f-94c95033519b
Sheet: All

Question Timestamp | First Name | Last Name | Question | Doug's Response | [NAME]'s Response | [NAME]'s Response | [NAME]
03/24/2010 01:05 PM EDT | [NAME] | [NAME] | As rapidly as IT technology keeps changing, do we know how the ACFE is keeping up with current/relevant IT fraud detection techniques as part of its common body of knowledge (CBOK) for the CFE certification?
03/24/2010 01:08 PM EDT | [NAME] | Fuller | While I may be jumping ahead, do you believe that it is Internal Audit's responsibility to find fraud? ( as opposed to assessing an organiztions fraud risk)
03/24/2010 01:10 PM EDT | [NAME] | Morse | hopefully we'll learn what a basic Fraud Program consist of?
03/24/2010 01:10 PM EDT | [NAME] | [NAME] | How is the effectiveness of a fraud program measured?
03/24/2010 01:11 PM EDT | Brooke | Barbee | How can we make fraud program effective?
03/24/2010 01:11 PM EDT | Olivier | Brasseur | What are the best and most cost-effective fraud detection software available today?
03/24/2010 01:11 PM EDT | [NAME] | Caravella | Is there any experience that would suggest that a Fraud Policy can help deter fraud activity?
03/24/2010 01:11 PM EDT | [NAME] | Lewis | Is fraud the responsibility of internal audit or is it management's responsibility?
03/24/2010 01:11 PM EDT | [NAME] | Birchall | how do judge whether your fraud program is effective? what do you define as effective
03/24/2010 01:11 PM EDT | [NAME] | Lim | How does one go about assessing the "effectiveness" of their fraud management program?
03/24/2010 01:11 PM EDT | [NAME] | Smyser | How do I know if I have an effective Fraud program, what are the measurements?
03/24/2010 01:11 PM EDT | Dustin | Clevenger | How practical is the Certified Fraud Examiner certification in relation to implementing a Fraud Analysis program within the department?
03/24/2010 01:11 PM EDT | [NAME] | [NAME] | Could you please share with us a kind of template that could be used for doing a company wide fraud risk assessment?
03/24/2010 01:11 PM EDT | [NAME] | Murphy | Do you have any guidance on persuading audit committees that they have a role in overseeing fraud in a company?
03/24/2010 01:11 PM EDT | Stacy | Yakimowich | How would you approach upper managment that they need to address a fraud program when they are not interested or don't see the value of such a program?
03/24/2010 01:11 PM EDT | Kurt | Jacobs | What is considered "Effective"? No fraud may be detected in the fraud progarm, but fraud could be occurring.
03/24/2010 01:12 PM EDT | Gregory | Hill | When appropriate in the presentation, can you please address what typical types of activities are continuous monitoring used for and specifically HOW is it used in these cases? Thank you.
03/24/2010 01:12 PM EDT | [NAME] | Eferighe | What could be the most effective way to enforce Fraud Program in an organization? [NAME], Ms. [NAME], CFE. Fort Valley State University. Georgia
03/24/2010 01:12 PM EDT | Darcy | Mitchell | In the audit plans, are you recommending internal audit do the data mining for fraud or assess the data mining efforts of a fraud management program?
03/24/2010 01:12 PM EDT | [NAME] | Darinzo | What percentage of Internal Audit departments provide formal fraud training to their businesses?
03/24/2010 01:12 PM EDT | [NAME] | Ngando | Is the internal control system considered part of a fraud prevention program?
03/24/2010 01:12 PM EDT | [NAME] | Incaprera | Do you support having a Fraud Defalcation Policy so that , for ex, if the policy states any case involving ex $1,000 & above will be referred for prosecution. This way there is at a minimum fear of prosecution
03/24/2010 01:13 PM EDT | Tomi | Leeper | How are other internal auditor dealing with the discussion of fraud with managment during the planning stage (ie. questionnaire, documenting in the workpapers)?
03/24/2010 01:13 PM EDT | Nedra | Harrington | Would someone with a highly effective fraud program be willing to share what they do?
03/24/2010 01:13 PM EDT | [NAME] | [NAME] | would you expect the current economic environment to spawn more fraud incidents in the near term
03/24/2010 01:13 PM EDT | Rajendra | Shah | If available with the help of IT is it wise to do 100% audit? or should we continue with sampling method with the help of IT resources?
03/24/2010 01:14 PM EDT | Maxwell | Smith | What are some of the root caues for the disconnect between Internal Audit and Management views of the liklihood and severity of fraud? - IIA members note that their organizations have sub-par fraud aawareness. - But if you polled Management, I would think that they might have a different response
03/24/2010 01:15 PM EDT | [NAME] | [NAME] | Would you consider annual acknowledgment of the corporate Code of Conduct by all employees a best practice?
03/24/2010 01:15 PM EDT | [NAME] | Eye | At the end of the session, can someone describe distinctions for the terms -"fraud", "waste" and "abuse".
03/24/2010 01:16 PM EDT | [NAME] | Bouyea | What continuous monitoring tools could you recommend for small audit shops that may not have the budget to purchase a tool such as ACL?
03/24/2010 01:16 PM EDT | Galen | Thies | How can the likelihood of fraud be quantified in the context of an audit report such that the risk rating can be more effectively justified?
03/24/2010 01:17 PM EDT | Colleen | [NAME] | How would you define/ criteria in a "high integriy culture?" Thank you.
03/24/2010 01:17 PM EDT | [NAME] | [NAME] | would you recommend that IA's align themselves with their company's legal counsel when a fraud is uncovered so as to make any evidence uncovered more confidential to inside and outside interested parties?
03/24/2010 01:17 PM EDT | [NAME] | Ouellette | What types of controls should you assess on third party relationships? If authority to impose controls on 3rd parties does not exist in the Agreement, do we have right to impose SOX standards on them by law, fed or state?
03/24/2010 01:17 PM EDT | [NAME] | [NAME] | Who is ultimately responsible for developing the fraud management program?
03/24/2010 01:17 PM EDT | Teresa | Ackerman | What is meant by "Hiring and Promotion Procedures" as it relates to the fraud control structure?
03/24/2010 01:18 PM EDT | Vanesa | Roncolato | The Fraud Risk Assessment should be conducted by Internal Audit or should be part of the ERM program?
03/24/2010 01:18 PM EDT | [NAME] | Griffin | Do you see Fraud Risk Management Programs typically being managed by a specifically designated Fraud Group or by the organiztions's Security Officer?
03/24/2010 01:18 PM EDT | [NAME] | Kern | How would you define "fraud control" given that most controls are somehow related to fraud? Does a control need to be directly related to fraud or tied to the fraud risk assessment to be classified as a fraud control?
03/24/2010 01:18 PM EDT | [NAME] | Abata | Although fraud can occur in any industry, is there a particular industry and/or activity that is more susceptible to fraud? e.g., Financial Services Industry, Construction, Retail, Healthcare?
03/24/2010 01:19 PM EDT | [NAME] | [NAME] | How common is it for departments to perform their own fraud risk assessments rather than relying on I/A's assessment for the entire company? Is this a best practice?
03/24/2010 01:19 PM EDT | [NAME] | Riddle | Shouldn't the fraud program be a component of ERM?
03/24/2010 01:19 PM EDT | [NAME] | Paluszewski | Understanding that a risk officer of a company may be an appropriate person responsible to provide assurance that Fraud is covered in an Enterprise Risk Management process, how does (would) a risk officer provide assurance that the controls in place at a company are adequate to deter fraud? Thanks, [NAME] in Dearborn
03/24/2010 01:19 PM EDT | [NAME] | Forget | At Dow, do you have an annual fraud detection plan?
03/24/2010 01:19 PM EDT | Khushvinder | Mangat | Can you please give some examples of Risk Factors? Thank you.
03/24/2010 01:19 PM EDT | Parveen | [NAME] | Can you provide some examples of control activities can a company can put in place to mitigate the risk of managmeent overide of internal controls?
03/24/2010 01:19 PM EDT | [NAME] | [NAME] | What is an example of a risk indicator?
03/24/2010 01:19 PM EDT | [NAME] | Barrett | Benchmarking question: For companies that have implemented a Whistleblower hotline (administered by a third party in our case), what is the general expectation for the ratio of valid reports worth investigating vs. 'general complaints'?
03/24/2010 01:19 PM EDT | [NAME] | Spolarich | Does the monitoring you perform in the Detection and Monitoring include continuous controls monitoring?
03/24/2010 01:20 PM EDT | [NAME] | Linker | Would the Risk Officer (where there is one) coordinate management's efforts for fraud risk assessment so that IA can assess the process?
03/24/2010 01:20 PM EDT | [NAME] | [NAME] | How do you balance teaching folks how to prevent fraud with possibly teaching them how to commit fraud?
03/24/2010 01:20 PM EDT | [NAME] | Upchurch | Would like more information on what is involved in "identifying risk factors" in the Detection and Monitoring phase. Could you speak to why this would not be part of the risk assessment phase?
03/24/2010 01:20 PM EDT | [NAME] | Morrell | How do you convince management to put resource $ behind actually executing a fraud risk program, as opposed to them just having one on paper? Most companies I have been with still think they don't have fraud so don't want to spend money on pro-active communication, preventing, detecting. They only spend after-the-fact on investigating when they already know they have a fraud loss.
03/24/2010 01:20 PM EDT | [NAME] | Martinez | how do you measure the 'creating an ethical environment'? I know people always talk about creating a high ethics organization, but I have yet to work somewhere that leaders say 'This is a low ethics organization'.
03/24/2010 01:20 PM EDT | [NAME] | Borish | Conducting a fraud risk assessment is a large undertaking. Where would you suggest starting or doing a pilot assessment to refine the assessment process?
03/24/2010 01:21 PM EDT | [NAME] | Masters | Would it be suggested that management from all departments meet on a frequent basis to identify and appropriately address the potential risk for fraud in their various departments? Or, would an annual walk thru review of departmental controls be a positive?
03/24/2010 01:21 PM EDT | Kristy D. | Pritchett | Who should own the fraud risk management program within a company?
03/24/2010 01:21 PM EDT | [NAME] | [NAME] | Who owns the overall Fraud Risk Program - who defines it, who documents the strategy, etc.? If it is management, should there be a central point (i.e. Chief Fraud Risk Officer) or is this most likely the accountability of a committee structure?
03/24/2010 01:22 PM EDT | Doug | Ringler | Doug, what mechanisms does your office use to document the consideration of fraud during performance-related engagements? Narrative, checklists, questionnaire, brainstorming, or other actions?
03/24/2010 01:23 PM EDT | Eulonda | Whitmore | Are you aware of Internal Audit Departments who are training management about fraud risk factors since they are on the front line?
03/24/2010 01:23 PM EDT | Percival J. | Veloro | In conjunction with this webinar, do we also have some sort of forensic accounting training class?
03/24/2010 01:24 PM EDT | Juman | Doleh-Alomary | How long did it take you to conduct the Fraud risk assessment for your organization? And how were the results reported?
03/24/2010 01:24 PM EDT | [NAME] | Farrington | Please repeat the regulation number that requires the CAE to report on Fraud Risk to the Board of Directors.
03/24/2010 01:24 PM EDT | [NAME] | [NAME] | How can a small Internal Audit Department comply with the new IIA mandatory requirements for detecting and preventing fraud?
03/24/2010 01:24 PM EDT | [NAME] | Pickett | Doug, you talked about the Fraud Risk Management Program and the fact that Internal Audit's assessment should take pllace after top management's assessment. How do you integrate top management's assessment into Internal Audit's assessment in order to avoid duplication of effort?
03/24/2010 01:25 PM EDT | [NAME] | [NAME] | There are times when allegations of fraud at the senior executive management level are referred to the internal audit department for investigation. In the absence of formal investigation and remediation procedures, how would you approach this without jeopardizing the business relationship established between the senior team and the internal audit department?
03/24/2010 01:25 PM EDT | Russell | Frey | How much comfort does a robust code of conduct policy/program provide in your fraud risk assessment?
03/24/2010 01:26 PM EDT | Wendi | [NAME] | How did you compile an enterprise wide risk assessment? Was it high level or was it organized by specific lines of business/operational area?
03/24/2010 01:26 PM EDT | [NAME] | Ostrowski | We're in the process of developing an ERM program. Do you see a Fraud Risk Management Program a subset of an ERM, to be managed under the ERM umbrella, or a separate program alltogether? Thanks.
03/24/2010 01:26 PM EDT | Efren | Aranzamendez | Can we access the cybercrime.gov website and use it for our data mining collection purposes?
03/24/2010 01:27 PM EDT | [NAME] | Lim | How could someone "exceed" his/her authorized computer access?
03/24/2010 01:27 PM EDT | [NAME] | [NAME] | What was the name of the DOJ website refered to by Mr. [NAME]?
03/24/2010 01:27 PM EDT | [NAME] | Katzman | As I consider [NAME], is there a repository that shows the Frauds that have occurred, an overview of how, the controls that could have prevented the event, etc? One of my concernd is that Audit is Sample Oriented and Fraud determination are Transaction based; therefore, for the most part Sampling will uncover fraud by accident only. If a framework of perpetrated frauds is available, then we can look at the controls to determine if they could be effective.
03/24/2010 01:28 PM EDT | [NAME] | [NAME] | How would you integrate state "personal information" privacy laws into IT fraud assessment/ awareness programs
03/24/2010 01:28 PM EDT | [NAME] | Pouliot | Isn't it uncommon for White Colar crimes to get assessed penaly and jail time for first offence?
03/24/2010 01:28 PM EDT | [NAME] | Smith | Is there any conflict of interest with the Legal Ethics Officer also serving as the Fraud Risk Coordinator who facilitates the fraud program for management? The Ethics Officer currently works with another employee who is the Fraud Risk Coordinator to conduct the fraud investigations. Should this separation of duties be maintained?
03/24/2010 01:28 PM EDT | [NAME] | [NAME] | How were the illustrated frauds detected? Were they detected by internal audit or through a hotline or other non-audit result?
03/24/2010 01:29 PM EDT | [NAME] | Hui | [NAME] usually expects IA or a Fraud Investigation Team to be responsible for fraud risk assessment, detection. monitoring. And many IA depts do not have the skill set or methodology/infrastructure to adequately assess fraud risk. Often fraud risk is an afterthought or not thought of at all. Should IA take a more proactive role in fraud risk mgmt? Is that IA's role?
03/24/2010 01:30 PM EDT | [NAME] | [NAME] | sdlc = system development life cycle
03/24/2010 01:30 PM EDT | [NAME] | Woo | is this really fraud? or examples of malicious intent?
03/24/2010 01:30 PM EDT | [NAME] | Kleppel | Is it possible to elaborate on how the fraud examples presented by [NAME] were identified?
03/24/2010 01:31 PM EDT | [NAME] | Myers | Can we use ACL to uncover the frauds listed? If so can you give examples.
03/24/2010 01:32 PM EDT | [NAME] | Reinhard | What is the percentage of fraud committed through IT versus total fraud? Also, we hear mostly about nromal fraud and not about IT so really how prevalent is it?
03/24/2010 01:33 PM EDT | [NAME] | [NAME] | In my organization, I am a business auditor i.e. non-IT. In terms of fraudulent activities with independent contractors, should fraud have happened, activities would likely be conducted 'under the table' e.g. kickbacks. What would be some good fraud risk indicators to look into to be able to detect fraudulent activities between the manager of a department and an independent contractor e.g. business referred by mortgage brokers to our organization and whether kickbacks have happened?
03/24/2010 01:33 PM EDT | [NAME] | Beyer | Can the IIA provide or point attendees to a generic IT Fraud risk assessment that can then be customized?
03/24/2010 01:33 PM EDT | [NAME] | Mincey | Can this be used as a generic IT fraud risk assessment template and then add to it if a person sees fit?
03/24/2010 01:33 PM EDT | Tonya | McCrory | What is the best way to mitigate the risk when your IT Director's mother works in Accounts Payable, other than CONSTANT monitoring?
03/24/2010 01:34 PM EDT | [NAME] | Bilot | will you make available for distribution the entire IT Fraud Risk template that you presented? (not just presentation slides)
03/24/2010 01:34 PM EDT | [NAME] | [NAME] | What is the most common type of fraud? Does it vary from Private to Public sector?
03/24/2010 01:34 PM EDT | [NAME] | [NAME] | Why did you use 2, 5, and 8 as the scoring in lieu of 1,2,3?
03/24/2010 01:35 PM EDT | [NAME] | Volpi | Are the IT risk assessmnet rankings after considering implementation of the controls or before implementation?
03/24/2010 01:35 PM EDT | [NAME] | Forget | Which tools do you use in order to detect fraud (ACL, or other)?
03/24/2010 01:35 PM EDT | [NAME] | Tocash | On the IT Fraud Risk Assessment template, how are the different levels (i.e., high, medium, etc.) defined for the "Likelihood" and the "impact" assessments.
03/24/2010 01:36 PM EDT | Latoya | [NAME] | I don't understand the scenario where the foreign exchange trader was able to cover up losses by changing the source code? What source sode is being spoken of. that for the application on which the trade was processed? How would someone monitor changes to source code?
03/24/2010 01:36 PM EDT | Damian | Dyer | Do you have any idea the % of IT related frauds detected resulting in prosecution?
03/24/2010 01:36 PM EDT | Feiling | [NAME] | When assessing the likelihood of a control failure, was it inherent risk, control risk, or the combination of the two?
03/24/2010 01:36 PM EDT | [NAME] | [NAME] | Were these fraud risk surveys utilize any level of anonymity for the responder?
03/24/2010 01:37 PM EDT | [NAME] | Beyer | interesting, IT governance is now required audit area, but showing as low risk.... hummmm
03/24/2010 01:37 PM EDT | [NAME] | [NAME] | for the IT Fraud Risk Assessment, it states that IT auditors participated and IT Managers participated. Were the IT Managers from the IT area itself or from the IT Auditing department?
03/24/2010 01:37 PM EDT | [NAME] | Mishra | Is the, IT risk assessment tool, tool available for audiance to try at their work?
03/24/2010 01:37 PM EDT | [NAME] | [NAME] | Who comes up with the risk score rating? Since it seems subjective, we can never get agreement on whether something should be a 2 versus a 5 or a 8.
03/24/2010 01:38 PM EDT | Ares B. | Cruz | Slide #27-IT Fraud Risk Assessment. Is the rating "medium" under Likelihood, based on control activities mitigating the fraud risk or is it based on not taking into account any contriol activities?
03/24/2010 01:39 PM EDT | [NAME] | Ollier | [NAME] - did IT/systems related fraud figure in your risk assessment, and what were the challenges faced if in fact this was the case ? In practical terms, how was your assessment utilised in determining the risk apetite, specific to fraud ?
03/24/2010 01:39 PM EDT | [NAME] | Seval Vasudevan | How important is it to hire the employee with right ethical and moral background and conduct after proper screening processes, as one of the primary controls for fraud reduction? Also, apart from identifying and taking to task the fraudsters, would it be a good idea to encourage honest employees and other business counterparties through well defined and visible schemes?
03/24/2010 01:39 PM EDT | [NAME] | Ostrander | Is there a particular software you would recommend?
03/24/2010 01:39 PM EDT | Greg | Rodenbeck | Doug, Do you typicall expect or see management performing their own fraud risk assessment or rely upon Internal Audit (IA) to accomplish this by including management in the IA fraud risk assessment?
03/24/2010 01:40 PM EDT | [NAME] | Incaprera | In any of your organizations, who actually pursues the frauds - ie conduct interviews, obtain statements, testify, etc-- once you detect
03/24/2010 01:40 PM EDT | [NAME] | Mah | Question for [NAME]: In your methodology, you have a column to assess "effort/cost to mitigate". What sort of criteria is used to assess this item?
03/24/2010 01:40 PM EDT | [NAME] | Lim | Whether an organization can examine 100% of transactions would depend on the size of the organization and what the volume of transactions is, would it not?
03/24/2010 01:41 PM EDT | [NAME] | Thompson | Can you please provide a specific example of two applications that you might compare to identify potential fraud?
03/24/2010 01:43 PM EDT | [NAME] | Serano | For [NAME]: How do you handle analytics when the data is often not entered in an identical format (eg dates entered as 2008March24 or March242008, or names entered last name first or first name first, etc.)? Or you have fields left blank?
03/24/2010 01:43 PM EDT | [NAME] | [NAME] | If transactions occur below the acceptable range cause concern as well?
03/24/2010 01:44 PM EDT | [NAME] | [NAME] | At some point, perhaps near end of presentation, can you repeat why sampling is not appropriate for fraud detection?
03/24/2010 01:44 PM EDT | [NAME] | [NAME] | Can you list areas of functions or responsibilities in which fraud activity typically occurs, include tax fraud, off-books entities, round-off clipping, etc.?
03/24/2010 01:45 PM EDT | [NAME] | Woo | Is the preferred approach for this type of data analytics to have IA develop the tools/tests for the analytics then have managmenet perform the tests as part of operationg procedures?
03/24/2010 01:46 PM EDT | [NAME] | Werstiuk | Doug; From your experience, who is the "owner" of the management fraud risk assessment process? Does this analysis get elevated to the BoD or Audit Committee? What do you feel is appropriate action for IA if the organization is not performing a management fraud risk assessment? Thank you.
03/24/2010 01:46 PM EDT | [NAME] | Simmons | For [NAME]: You indicated the IT fraud risk assessment was performed by the IT audit staff. How were the results received by the senior management, and what role, if any, did the CIO play in defining the range of risk tolerance and the level of acceptable residual risk?
03/24/2010 01:46 PM EDT | Anna | [NAME] | Do you feel that using ACL alone is enough to say we are performing our due diligence on Fraud as Internal Auditors? Addtionally, for continous monitoring purposes do you feel that establishing objectives prior to having scripts that dump various data are important?
03/24/2010 01:47 PM EDT | [NAME] | Timleck | Are privacy laws restricting our ability to use data from varying systems? Often I get push back from Human Resources relating to the sonfidentiality of employee information.
03/24/2010 01:48 PM EDT | [NAME] | [NAME] | A less commonly recognized fraud might fall under project management when resource expenditures and budgets are padded throughout the life cycle of the project and delivery of end results. How would you detect and manage fraud in this situation?
03/24/2010 01:48 PM EDT | McCall | [NAME] | How can this type of behind the scenes transaction review act as a deterrent? How can the fact that analysis is being performed be publicized?
03/24/2010 01:48 PM EDT | ivelisse | colon | I'm the Internal Auditor of a goverment agency. How do I do that, with few resources?
03/24/2010 01:48 PM EDT | Tolu | Igbalajobi | Since most companies want current experience, if you have been working in a different field for several years how can you get a company that would give you the opportunity to prove what you can do? Also, which company would hire a volunteer IT audit staff who wants to gain more experience in the field? (Texas)
03/24/2010 01:48 PM EDT | [NAME] | Getrost | [NAME]. You mentioned you could identify bid-rigging through the analytica techniques you listed. How would that work?
03/24/2010 01:48 PM EDT | [NAME] | Corcoran | I am a member of our local school district's governing board audit committee. May I share portions of this presentation with my fellow committee members and our school districts's CFO?
03/24/2010 01:49 PM EDT | Bradley | Filsinger | Question for Doug: Does the Fraud Investigative Service (FIS) group participate in the fraud risk assessment on domestic and international audits. Also, is there a planning survey (tool) used to assess potential fraud indicators, control activities in international businesses.
03/24/2010 01:49 PM EDT | [NAME] | Asinas | Can you give an example of fraud in conflict of interest area?
03/24/2010 01:49 PM EDT | [NAME] | [NAME] | do you have the spreadsheet and graph for the IT fraud, the one with the ratings and balloon graphs?
03/24/2010 01:49 PM EDT | Lorita | Chung | How do you detect kickbacks using data analytics application?
03/24/2010 01:49 PM EDT | Anna | [NAME] | How can we convince the senior management that fraud risk assessment is necessary if they are reluctant about implementing it?
03/24/2010 01:50 PM EDT | Shishir | [NAME] | are there specific data or reference for analysis techniques and examples that can be used in financial institutions for customer transaction data?
03/24/2010 01:50 PM EDT | [NAME] | Drabing | Our company is just starting to institute the foreign corrupt practice's act. I am unfamiliar with the foreign corrupt purchasing act that was refrenced, is it a subset of the foreign corrupt practice's act?
03/24/2010 01:50 PM EDT | [NAME] | Schiro | What data and criteria would be used to identify kickbacks?
03/24/2010 01:50 PM EDT | [NAME] | Whitmore | We're completely intrigued by Benford's Law around here, but haven't used it yet. Can you give a couple more examples of where you've seen it used?
03/24/2010 01:51 PM EDT | [NAME] | Adams-Selinger | What type of technology is available to look for fraud initiated in IT (i.e. changing code)?
03/24/2010 01:51 PM EDT | [NAME] | Grimes | What data analytics have you used or you know that have been used to help identify kickbacks?
03/24/2010 01:52 PM EDT | Clover | [NAME] | Excellent presenations. Have current analyses indicated changing trends in the areas / types of fraud (3-5 yr trend)?
03/24/2010 01:52 PM EDT | [NAME] | IMAFIDON | How do you use data analysis to test for conflict of interest? Do you do that by reviewing and matching address and names? Thanks.
03/24/2010 01:52 PM EDT | [NAME] | Winslow | Could you give an example or examples of a analytic test that would be run through the General Ledger to detect fraudulent entries?
03/24/2010 01:53 PM EDT | [NAME] | [NAME] | Please give an example of how you would use data analysis to determine kickbacks?
03/24/2010 01:53 PM EDT | Somaia | Farag | For [NAME]: Can you give exaples of how to use the data analytics for uncovering kickbacks and vendor management illegal/fraudulent activities?
03/24/2010 01:53 PM EDT | [NAME] | Borish | Our internal audit department has limited resources. If you had only limited time to devote to the entire fraud risk management, program, where would you suggest spending that time?
03/24/2010 01:53 PM EDT | [NAME] | [NAME] | What is the status of building data analytic steps into audit work programs to make it easier for audtors to use tools like ACL?
03/24/2010 01:53 PM EDT | [NAME] | Buckley | Is there a good source or library to get examples of fraud risks?
03/24/2010 01:53 PM EDT | [NAME] | [NAME] | Should an Internal Audit Dept develop separate audit programs that focus on fraud or should the audit program combine tests for fraud as a part of their normal tests?
03/24/2010 01:53 PM EDT | [NAME] | [NAME] | In your opinion, how effective are the available 3rd Party continuous transaction monitoring programs in detecting fraudulent activity and risk for fraudulent activity?
03/24/2010 01:53 PM EDT | [NAME] | Ozenne | Where in the organization is the most appropriate place for continuous monitoring?
03/24/2010 01:54 PM EDT | [NAME] | [NAME] | Given the drive across the industry for continuous assurance methods (e.g. continuous auditing/monitoring), what happens when the data owners do not have resources or the ability to support the review and dispositioning of the results? (Generally speaking, audit departments are not data owners over the systems and transactions being evaluated). How will automating fraud detection work if the processes and sustainability are not planned for before automation is implemented?
03/24/2010 01:54 PM EDT | [NAME] | [NAME] | Is COSO's ERM framework being widely used yet by internal auditors?
03/24/2010 01:54 PM EDT | Mahmoodul | Sufyani | For [NAME] or [NAME]: What are the important IT ethics that would act as fraud prevention or even expose any fraud commited? Your Fraud detection analysis covers the issue but your high -lighting would be appreciated for better understanding and use.
03/24/2010 01:54 PM EDT | [NAME] | Tinsley | Is the auditor required by standards to document consideration of fraud in every audit engagement?
03/24/2010 01:55 PM EDT | Anja | [NAME] | Who should "own" the organization's fraud management program? To what extent should Internal Audit be involved?
03/24/2010 01:55 PM EDT | [NAME] | Helfer | When we say we (internal auditors) shouldn't take ownership of a fraud risk management program, etc., who in management typically DOES have broad ownership of the fraud management program? It is not practically, the CFO.
03/24/2010 01:55 PM EDT | [NAME] | [NAME] | What data mining software do you recommend that the Banking Industry should be using?
03/24/2010 01:56 PM EDT | [NAME] | Springsted | How do you convince management to seriously consider fraud risk when they feel that fraud doesn't happen at our organization?
03/24/2010 01:56 PM EDT | Doug | Horner | what are resources to find software for fraud analytics?
03/24/2010 01:57 PM EDT | Eulonda | Whitmore | How are Internal Audit departments taking fraud investigations into consideration when preparing the annual audit plan? I reviewed an article that showed the established audit plan is not being met due to unplanned fraud investigations.
03/24/2010 01:57 PM EDT | [NAME] | [NAME] | how do you envision Internal Audit working with the external auditors related to fraud?
03/24/2010 01:57 PM EDT | [NAME] | Zissa | Can you give an estimation as to what might be a reasonable allocation of internal audit resources between fraud/risk and the "normal" internal audit activities? [NAME], [NAME]
03/24/2010 01:57 PM EDT | Coleena | [NAME] | Q for [NAME], for the IT Risk Assessment Tool - Example slide, how the scores are calculated?
03/24/2010 01:57 PM EDT | Yusuf | Seedat | What types of analytics tools do you use?
03/24/2010 01:57 PM EDT | JOANNE | CURTIS TAYLOR | If the organization does not have a fraud mangement program, will the Internal Audit dept. have satisfied the IIA Standards through reporting such to governance and building assessement in the various audits?
03/24/2010 01:57 PM EDT | [NAME] | Green | Doug, Since the Investigative function reports into the CAE, who does the evaluation or audit of the Investigative function?
03/24/2010 01:58 PM EDT | [NAME] | Fitts | Is there somewhere we can find the full IT Risk Assesssment from Slide 28?
03/24/2010 01:58 PM EDT | Michelle | Studie | how much time is allocated to the initial setup for IT fraud monitoring? How are the hours spend communicated to the audit committee in regards to the annual audit plan?
03/24/2010 01:58 PM EDT | [NAME] | Majcan | where to find info on how to automate for analysis
03/24/2010 01:58 PM EDT | [NAME] | Povondra | What data analysis product does your organization utilize?
03/24/2010 01:58 PM EDT | Michelle | Bourassa | What's the most effective way to engage senior management in conversation about fraud management and encourage commitment from them?
03/24/2010 01:58 PM EDT | [NAME] | Karcher | Have you seen any effective continuous monitoring programs for fraud in place? If so, what makes it successful?
03/24/2010 01:58 PM EDT | [NAME] | Mokwenye | why is it that organizations are reluctant to expose or prosecute fraud that have ocurred in their organizations?
03/24/2010 01:58 PM EDT | [NAME] | [NAME] | Are there documented Fraud Questionnaires available out in the audit environment? If not, what is the best way to come up with a Fraud Questionnaire?
03/24/2010 01:58 PM EDT | Maydel | Vazquez | Is there a source, which lists specific examples of analytics used for fraud detection?
03/24/2010 01:58 PM EDT | Derik | [NAME] | How are fraud guidesobtained and at what cost?
03/24/2010 01:58 PM EDT | TERRI | RAMOS | How do you combine the fraud management program with ERM? - as my duties are both risk management and internal audit.
03/24/2010 01:58 PM EDT | [NAME] | Haley-Pinnick | What approach should be taken to tailor this type of assessment for casino auditing?
03/24/2010 01:58 PM EDT | Anna | [NAME] | How do you ensure a comprehensive fraud risk assessment; specifically, how do you go about identifying all the potential fraud risks in your organization?
03/24/2010 01:59 PM EDT | Raviprakash | [NAME] | more risk of fraud is related to [NAME], inspite of Internal control procedures. how to tackle that ?
03/24/2010 01:59 PM EDT | [NAME] | [NAME] | If management sees Internal Audit as being responsible for fraud prevention, how far can Internal Audit go without losing independence?
03/24/2010 01:59 PM EDT | Megan | [NAME] | What is the main difference between the IT Fraud Risk Assessment and an IT Risk Assessment?
03/24/2010 01:59 PM EDT | [NAME] | [NAME] | No one has mentioned the importance of performing periodic background checks of the fraud risk group or the fraud investigation group, as well as those individuals whose responsibilities deal with large amounts of money and/or sensitive data. Second, companies should consider re-structuring sensitive processes in a segmented way, with separation of responsibilities and limits on budget/check approvals. Would you agree?
03/24/2010 01:59 PM EDT | [NAME] | Adler | Would you consider the Operational Risk Committee to implement a Fraud Program or is it the responsibility of Line Management or a joint venture between the two lines of management?
03/24/2010 01:59 PM EDT | [NAME] | McDonnell | Does anyone know of a software program that will search and detect backdoor access to assist an auditor without the sufficient I.T. knowledge.
03/24/2010 01:59 PM EDT | [NAME] | Yeats | Should Internal Audit do SOX testing or is this a conflict of interest? OUr organization has moved from testing all SOX controls to testing only key controls. Should our internal audit department revise our audit program to compensate for this change?
03/24/2010 01:59 PM EDT | Gregory | Hill | THe emphasis on fraud risk many times seems to be on lower level employees but the largest and most devestating frauds that have occurred (Enron, World Com, etc.) were perpetrated by executives. Do you audit executive transactions and corporate governance to mitigate this risk.
03/24/2010 01:59 PM EDT | [NAME] | Thompson | How do you get management and get employees engaged in thinking about fraud risks and having them own the responsibility for implementing the proper controls to prevent and detect fraud?
03/24/2010 01:59 PM EDT | Brent | Mussery | Does management's fraud risk program have to be formal or can it be informal? What added risks are present when informal?
03/24/2010 01:59 PM EDT | Theresa | [NAME] | Question for Ken - As a consultant, I often ran into situations where IT management does not agree with IT auditors about the likelihood and impact of risks. This prevented us from going further with our recommendations and remediation process. How would you handle that?
03/24/2010 01:59 PM EDT | Christine | [NAME] | How do organizations integrate their fraud program with SOX 404 process?
03/24/2010 02:00 PM EDT | [NAME] | [NAME] | What risks/liabilty does a consultant face when, after his/her firm has conducted a fraud prevention analysis program for a client, a major fraud occurs subsequent to the consultant's report?
03/24/2010 02:00 PM EDT | Sandra | Scheel | Any recommendations on creating a Fraud Hotline operated by the internal auditors for local governmental entity with limited resources?
03/24/2010 02:00 PM EDT | [NAME] | Corcoran | As an ACL Certified Data Analyst, I understood how [NAME] intended to apply the techniques he described. However, I wonder if those unfamiliar with the ACL program understand or may question how these techniques would be applied during audit. Could Mr. [NAME] please explain how one can access and apply this analytical program?
03/24/2010 02:00 PM EDT | [NAME] | [NAME] | Based on my understanding of what you are saying fraud should be addressed as a audit program, if so, how do you feel about using just a fraud questionnaires?
03/24/2010 02:00 PM EDT | [NAME] | Kleffner | What are some resources that are available for fraud awareness solutions (e.g., company newsletter inserts to raise awareness of fraud and the whistleblower hotline)
03/24/2010 02:00 PM EDT | Delphine | [NAME] | I have the all important question of, how do we as auditors approach the topic of fraud with management to stress the importance of the true issue that they are the first point of contact with fraud and a program will work best in the organization if they are 'in the game'?
03/24/2010 02:01 PM EDT | [NAME] | Mendez-Torres | What should be the recommendation if our Compliance Officer is also the one who manage the Antifraud Program?
03/24/2010 02:02 PM EDT | [NAME] | Galland | 1) Is it required to systematically test for fraud, i.e. have separate 'fraud' audits? Is it sufficient to include this as part of every audit, and based on the risk analysis during the planning phase decide what (anti-)fraud controls should be tested?