Assess fraud risks. Management must be able to thoroughly understand risks faced by the organization, which is possible through the performance of appropriate fraud risk assessment. Without an appropriate risk assessment, fraud risk management initiatives lead to ineffective fraud prevention planning waste of time and resources.
Assess Fraud Risks: Step 2 In Fraud Risk Management
Defining an effective fraud risk management program requires the involvement of experts and senior management, who combine to develop a tailor-made and specific fraud risk assessment strategy for each department and process of the organization.
During the development of fraud risk management strategy, the middle management and junior staff are also consulted to get more in-depth insights into the processes and activities of different departments. Cross-departmental knowledge and understanding gained through such consultations enable the senior management to predict the possible pattern of fraud risks.
In larger organizations with multiple departments and sub-departments, developing a fraud risk management program usually becomes a challenge because of dispersed locations and thousands of employees working in the organization.
In a typical large organization, certain core departments achieve organizational control in terms of financials and strategy setting. Such departments include the finance department, strategy, or business development department. These departments work to consolidate the numbers and plan out the future strategy for the organization and different departments. Budgets are prepared and allocated between different departments and sub-departments.
In these types of organizations, the fraud risk management strategy setting is an ongoing process that requires the involvement and input of various employees from different departments. Without gauging employees from all levels, there is a risk that a fraud risk management program may not be effective and operational.
Fraud Risk Budgets
Fraud risk budgets are prepared and allocated amongst the departments in large organizations. This is because the risk tolerance level for such large organizations is usually set as high because of large numbers of high-value transactions and assets exposures.
In smaller organizations, risk tolerance levels might not be defined or set at a lower level because of the direct involvement of owners in the financial matters and operations of the company. The risk of fraud is lower in smaller organizations, especially those that are run by the family or a small number of business partners. All the processes are kept simple in small organizations, which leaves little room for fraud.
It must be ensured that to develop the relevant fraud risk management framework, the fraud risk assessment is performed, considering the nature and type of the organization. Without understanding the fraud risk landscape, the inherent fraud risks might be overlooked and missed for the application of internal controls. Therefore, a careful understanding of the management’s cross-departmental processes and activities set the fraud risk management strategy.
Employees Self-Risk Assessment
Employees are encouraged to perform the self-risk assessment, whereby employees from different departments assess the fraud risks in their processes and procedures. Self-assessment enables each employee to become aware of inherent and possible fraud risks, which are addressed through the development and application of relevant internal controls. Such internal controls may be preventive or detective or a combination of both. Self-assessments are performed using Risks and Controls Self-Assessment (RCSA) tools. RCAs are filled in by the process owners, which include different fields such as risk fields, controls fields, impact fields, likelihood, category of risk, etc.
Self-assessment results are compiled and shared with the fraud risk management function for further risk assessment. The fraud risk management department analyses the assessment performed by different process owners and based on feedback and available evidence, risk assessments are finalized.
Significant assessed fraud risks are consolidated, and impacts are considered in isolation and combination with other fraud risks. All significant assessed fraud risks are reported to the Board Risk Management Committee (BRMC).
Final Thoughts
A fraud risk assessment is a tool used by management to identify and understand business risks and control weaknesses that pose a fraud risk to the organization. Once a risk has been identified, a plan can be developed to mitigate that risk by implementing controls or procedures and assigning individuals to monitor and implement the mitigation plan.