Responding to Fraud

RISK

Risk Closer Look

Exploring Where Internal Auditing Stands

Farah G. Araj
CIA, CPA, CFE, QIAL

Sponsored by
CBOK
The Global Internal Audit
Common Body of Knowledge
 About CBOK

SURVEY FACTS T he Global Internal Audit Common Body of Knowledge (CBOK) is the world’s
largest ongoing study of the internal audit profession, including studies of inter-
nal audit practitioners and their stakeholders. One of the key components of CBOK
Respondents 14,518*
Countries 166 2015 is the global practitioner survey, which provides a comprehensive look at the
Languages 23 activities and characteristics of internal auditors worldwide. This project builds on two
previous global surveys of internal audit practitioners conducted by The IIA Research
EMPLOYEE LEVELS Foundation in 2006 (9,366 responses) and 2010 (13,582 responses).
Chief audit
Reports will be released on a monthly basis through July 2016 and can be
executive (CAE) 26%
downloaded free of charge thanks to the generous contributions and support from
Director 13% individuals, professional organizations, IIA chapters, and IIA institutes. More than
Manager 17% 25 reports are planned in three formats: 1) core reports, which discuss broad topics,
Staff 44% 2) closer looks, which dive deeper into key issues, and 3) fast facts, which focus on a
specific region or idea. These reports will explore different aspects of eight knowledge
*Response rates vary per
tracks, including technology, risk, talent, and others.
question.
Visit the CBOK Resource Exchange at www.theiia.org/goto/CBOK to download
the latest reports as they become available.

CBOK 2015 Practitioner Survey: Participation from Global Regions

Europe 23%

North
America 19%
Middle East
& North 8%
Africa South
Asia 5%

Latin East
America 14% Asia 25%
& Caribbean & Pacific
Sub-
Saharan 6%
Africa

Note: Global regions are based on World Bank categories. For Europe, fewer than 1% of respondents were from Central Asia.
Survey responses were collected from February 2, 2015, to April 1, 2015. The online survey link was distributed via institute email
lists, IIA websites, newsletters, and social media. Partially completed surveys were included in analysis as long as the demographic
questions were fully completed. In CBOK 2015 reports, specific questions are referenced as Q1, Q2, and so on. A complete list of
survey questions can be downloaded from the CBOK Resource Exchange.

2 ● Responding to Fraud Risk

 Contents
CBOK
Knowledge
Tracks

Future

Executive Summary 4

Introduction 5
Global
Perspective 1 The Global Focus on Fraud Risk 7

2 Internal Audit’s Responsibility for Fraud Prevention

and Detection 12

Governance 3 Internal Audit Capabilities in Responding to

Fraud Risk 18

4 Five Ways to Improve Internal Audit’s Approach

to Fraud Risk 22
Management

Appendix A: Summary of Key Findings 25

Risk

Standards &
Certifications

Talent

Technology

www.theiia.org/goto/CBOK ● 3
 Executive Summary

F raud risk is a reality that every organization faces today. Recent, high-profile cases
of fraud have captured media attention and the scrutiny of regulators worldwide.
When a serious fraud occurs in an organization, the company’s reputation can be badly
damaged, and there is usually a sudden realignment of stakeholder priorities. It is then
when we often hear the question, “Where were the internal auditors?”
Responding to Fraud Risk: Exploring Where Internal Auditing Stands offers a current
global analysis of the importance of fraud risk to internal audit and its stakeholders,
the degree of responsibility internal audit has for fraud prevention and detection, and
perceptions of internal audit capabilities in responding to fraud risk. Findings are
based on the CBOK 2015 Global Internal Audit Practitioner Survey, the largest survey
of internal auditors in the world, as well as extensive interviews with internal audit
leaders in multiple regions.
Internal auditors can use this report to educate stakeholders, define how internal
audit can support the organization’s anti-fraud efforts, and build the capabilities of
the internal audit team. The report concludes with five key ways chief audit executives
(CAEs) can improve their approach to fraud risk in their organizations.

4 ● Responding to Fraud Risk

 Introduction

RESOURCES B efore reviewing the survey findings, it is important to look at the key points of
reference that internal auditors use to define their role related to fraud risk. First,
we will look at The IIA’s materials and then we will review the new principle from
Practice Guide,
Auditing Anti-bribery the updated Internal Control – Integrated Framework from COSO (the Committee of
and Anti-corruption Sponsoring Organizations of the Treadway Commission).
Programs (Altamonte
Springs, FL: The What Does the Standards Say About Fraud Risk?
Institute of Internal
Auditors, 2014). The IIA’s International Standards for the Professional Practice of Internal Auditing
(Standards) defines fraud as:
Practice Guide, Internal
Auditing and Fraud Any illegal act characterized by deceit, concealment, or violation of trust. These
(Altamonte Springs, FL: acts are not dependent upon the threat of violence or physical force. Frauds are
The Institute of Internal
Auditors, 2009).
perpetrated by parties and organizations to obtain money, property, or services;
to avoid payment or loss of services; or to secure personal or business advantage.
Global Technology
Audit Guide (GTAG) This is a broad definition that includes a wide variety of fraud types, including bribery
13: Fraud Prevention and corruption. In addition, this definition does not differentiate between fraud carried
and Detection in an
out by parties inside an organization (employees, management, etc.) or those from out-
Automated World
(Altamonte Springs, FL: side an organization (suppliers, customers, etc.). Correspondingly, if we merge fraud into
The Institute of Internal the definition of risk in the Standards, fraud risk would be defined as “the possibility of
Auditors, 2009). fraud occurring that will have an impact on the achievement of objectives.”
With this definition in mind, let’s look at what the Standards says about internal
audit’s responsibility pertaining to fraud risk. The most relevant standards are as fol-
lows (not a comprehensive list; emphasis added):
●● 1210: Proficiency (1210.A2) – Internal auditors must have sufficient
knowledge to evaluate the risk of fraud and the manner in which it is
managed by the organization, but are not expected to have the expertise of
a person whose primary responsibility is detecting and investigating fraud.
●● 2120: Risk Management (2120.A2) – The internal audit activity must
evaluate the potential for the occurrence of fraud and how the organiza-
tion manages fraud risk.
●● 2210: Engagement Objectives (2210.A2) – Internal auditors must con-
sider the probability of significant errors, fraud, noncompliance, and other
exposures when developing the engagement objectives.

www.theiia.org/goto/CBOK ● 5
 In addition, there are other standards that include fraud, and there are standards
relating to the role of internal audit in evaluating an organization’s ethics and values,
which also impact the effectiveness of how fraud risk is managed.

What Does COSO Say About Fraud Risk?

Another important source of perspective is the new Principle 8 from COSO’s updated
Internal Control – Integrated Framework. The fact that the updated framework includes
a principle dedicated to fraud risk is another sign that awareness about fraud risk is
growing. Exhibit 1 shows the new principle and the four recommended points of
action that can be applied by internal auditors at all levels in an organization.

Exhibit 1 Internal Control ­­– Integrated Framework, Principle 8: Assesses

Fraud Risk

Principle 8 from COSO’s Internal Control – Integrated Framework (2013) states:

The organization considers the potential for fraud in assessing risks to the
achievement of objectives.
This principle is further broken down into four recommended points of focus:

1  onsiders various types of fraud. The assessment of fraud considers

C
fraudulent reporting, possible loss of assets, and corruption resulting from
the various ways that fraud and misconduct can occur.

2  ssesses incentives and pressures. The assessment of fraud risk considers

A
incentives and pressures.

3  ssesses opportunities. The assessment of fraud risk considers

A
opportunities for unauthorized acquisition, use, or disposal of assets, altering
of the entity’s reporting records, or committing other inappropriate acts.

4  ssesses attitudes and rationalizations. The assessment of fraud risk

A
considers how management and other personnel might engage in or justify
inappropriate actions.

Source: Internal Control – Integrated Framework (Committee of Sponsoring Organizations of

the Treadway Commission (COSO), 2013). Used by permission.

How Are Internal Auditors Addressing Fraud Risk Today?

Keeping the role of internal audit in mind, now let’s look at what the survey tells us
about how internal auditors are actually engaged in addressing fraud risk.
Question 1: How important is fraud risk to executive management and CAEs?
Question 2: To what extent are internal auditors responsible for fraud
prevention and detection?
Question 3: Are internal auditors capable of responding to fraud risk?

In response to these findings, section 4 of this report provides five key steps internal
auditors can take to improve their effectiveness in addressing fraud risk.

6 ● Responding to Fraud Risk

1 The Global Focus on Fraud Risk

I nternal auditors are broadly involved

in addressing fraud risk at their orga-
nizations, and this section of the report
4. Recruiting for fraud risk skills

Internal Audit May Prioritize Fraud

Risk More Than Management
explores their answers to survey questions
on the following topics: CAEs who responded to the survey were
asked to rank the top five risks that exec-
1. Fraud risk as a top five organizational
utive management and internal audit are
risk
focusing on. Globally, only 19% believe
2. Fraud as a value-added activity for their executive management focuses on
internal audit fraud as a top five risk, while 31% say that
3. Fraud risk as part of internal audit internal audit focuses on fraud as a top
plans five risk (see exhibit 2). In other words,

Exhibit 2 Fraud Chosen as One of the Top 5 Risk Priorities in 2015 (Region View)

60%

53%
50%

40%
39%
36%
33%
30% 31% 30% 31%
29%
26%
25%
21% 22%
20%
19% 19% 19%
17%
14% 14%
13% 12%
10% 11%
8% 9%
5%
0%
South Latin America Europe Sub-Saharan East Asia Middle East North Global
Asia & Caribbean Africa & Pacific & North Africa America Average

Internal audit Executive management Gap

Note: Q66: Please identify the top five risks on which your internal audit department is focusing the greatest level of attention in
2015. Topic: Fraud, not covered in other audits. CAEs only. n = 2,704. Q65: Please identify the top five risks on which your executive
management is focusing the greatest level of attention in 2015. Topic: Fraud, not covered in other audits. CAEs only. n = 2,705.

www.theiia.org/goto/CBOK ● 7
❝The tone at the internal audit places more emphasis on
fraud risk than they believe executive
executive management is keen on avoid-
ing reputational risk and ensuring that
top is critical to management does. As shown by the gold fraud risk is appropriately addressed and
responding to bars in exhibit 2, the gap between per- responded to.”
ceived priorities was highest in South Asia Regarding the Middle East results,
fraud risk. If a CEO
(17%) and lowest in Sub-Saharan Africa Dr. Khalid Al Faddagh, former CAE of
states in meetings (5%). These gaps may indicate situations Saudi Aramco, said, “I’m surprised and
that fraud will where internal audit is not aligned with concerned that fraud risk didn’t feature as
executive management expectations. one of the top five risks in the Middle East
not be tolerated
region. It could possibly be that the sur-
and that he will South Asia Has Highest Focus on
veyed executives are in denial and believing
Fraud Risk
be ruthless in that fraud only happens in other compa-
Globally, the most focus on fraud risk nies or other countries in the region.”
dealing with the
seems to be in South Asia, where the
perpetrators, this vast majority of survey responses are Focus on Fraud Risk Is Highest in
Privately Held Organizations
tone at the top from India. “India is in transformation
stage, as many companies are being In addition, fraud risk is not cited as
will send a very
listed abroad,” said Umesh Ashar, senior one of the top five risks for any region,
strong and positive general manager – internal audit at Tata industry, organization type, etc. However,
message across the Motors Limited in Mumbai, India. “The internal auditors in privately held orga-
new Companies Act has put huge respon- nizations put more priority on fraud risk
organization. ❞ sibilities on the audit committee, and it than do those from other organization
requires the statutory auditor of publi- types, with 38% choosing it as a top five
—Dr. Khalid Al Faddagh,
cally listed companies to report any fraud risk compared to the global average of
former CAE,
Saudi Aramco to the central government. Therefore, 31% (see exhibit 3).

Exhibit 3 Fraud Chosen as One of the Top 5 Risk Priorities for Internal
Audit in 2015 (Organization View)

Privately held 38%

(excluding financial sector)

Publicly traded
34%
(excluding financial sector)

Not-for-profit organization 33%

Public sector (including agencies 28%

and government-owned operations)

Financial sector 24%

(privately held and publicly traded)

Global average 31%

0% 10% 20% 30% 40% 50%

Note: Q66: Please identify the top five risks on which your internal audit department is
focusing the greatest level of attention in 2015. CAEs only. n = 2,742.

8 ● Responding to Fraud Risk

Fraud Adds Value After Other audit efforts away from important orga-
Activities nizational issues.
In the CBOK 2010 Global Internal
Fraud Risk Is a Small Portion of
Audit Survey, 71% of respondents Audit Plans, But Increases Are
said they carried out “investigations of Expected
fraud and irregularities” as part of their
Only a small number of survey respon-
activities.* The global financial crisis was
dents (4.5%) say they have specialized
cited as one of the reasons for the high
training in fraud and spend a majority of
level of activity. The 2015 survey asked
their time working this field (Q11,
CAEs to select the top five value-adding
n = 12,716). This is relatively consistent
activities for internal audit at their orga-
across ranks/position, and organization
nization from a list that included the
type, number of employees in internal
option “investigating or deterring fraud.”
audit and industry.
When asked the question in this way,
Similarly, looking at internal audit
only about 3 out of 10 chose “investi-
plans, only 3.5% are made up of “fraud
gating or deterring fraud” as a top five
risk that is not covered in other audits”
value-adding activity (see exhibit 4).
(see exhibit 5). This is relatively consis-
This is not unexpected because detecting
tent across organization type, number of
and investigating fraud takes a significant
employees in internal audit and industry.
amount of time and redirects internal
Also, only 25% of CAEs globally believe
that internal audit focus on fraud risk
*  Marco Allegrini et al., What’s Next for
will increase in 2015 compared to the
Internal Auditing? Report IV of the CBOK
2010 Survey (Altamonte Springs, FL: The previous year (see exhibit 6). Regionally,
Institute of Internal Auditors Research however, this percentage increases to
Foundation, 2011), 33.

Exhibit 4 Top Ways Internal Audit Adds Value

Assuring the adequacy and effectiveness of the internal control system 86%

Recommending business improvement 55%

Assuring the organization’s risk management processes 53%

Assuring regulatory compliance 50%

Informing and advising management 40%

Identifying emerging risks 37%

Assuring the organization’s governance processes 37%

Investigating or deterring fraud 29%

Informing and advising the audit committee 28%

Testing management’s assessment of controls 23%

Note: Q89: What are the five internal audit activities that bring the most value to your
organization? (Choose up to five.) CAEs only. n = 2,636.

www.theiia.org/goto/CBOK ● 9
 Exhibit 5 Fraud Risk in the Audit Plan

Operational 24.5%

Compliance/regulatory 14.9%

Risk management assurance/effectiveness 12.1%

Strategic business risks 10.8%

Information technology (IT), not covered in other audits 8.3%

General financial 6.7%

Corporate governance 6.2%

Fraud not covered in other audits 3.5%

Other (in particular, requests, training, etc.) 3.3%

Cost/expense reduction or containment 3.2%

Sarbanes-Oxley testing or support (United States only) 2.8%

Third-party relationships 2.4%

Crisis management 1.2%

Total 100.0%

Note: Q49: What percentage of your 2015 audit plan is made up of the following general
categories of risk? CAEs only. n = 2,677.

Exhibit 6 CAEs Who Expect an Increase in Internal Audit Focus on

Fraud Risk

Sub-Saharan Africa 41%

South Asia 39%

Middle East & North Africa 37%

Latin America & Caribbean 31%

East Asia & Pacific 27%

Europe 23%

North America 12%

Global Average 25%

0% 10% 20% 30% 40% 50%

Note: Q50: Compared to 2014, indicate whether audit focus on each of the following areas
will increase, not change, or decrease in 2015. Topic: Fraud, not covered in other audits. CAEs
only. n = 2,476.

10 ● Responding to Fraud Risk

about 40% in Sub-Saharan Africa and Conclusion
South Asia.
According to Bruce Turner, retired Question 1: How important
CAE, immediate past chairman of is fraud risk to executive
The IIA’s International Public Sector management and CAEs?
Committee, and chairman of the Audit
At face value, fraud does not seem to
Committee of IIA–Australia, “Internal
stand out in terms of the focus of execu-
audit needs to dedicate an adequate
tive management or CAEs. However, it
amount of time in their plans to cover all
should be noted that certain regulations,
of the basics (including fraud risk) and
such as the U.S. Sarbanes-Oxley Act of
then make a provision to cover the more
2002, were enacted as a result of fraud.
interesting, emerging, and strategic risk
There is a good amount of anti-fraud
areas.”
efforts that go into compliance with this
Fraud Risk Skills Are Being regulation. Due to the 2013 COSO
Recruited Moderately Internal Control – Integrated Framework,
The skills being sought for internal audit external auditors have been dedicating
departments are also an indicator of the more time to Principle 8 and the appro-
overall focus on fraud risk. Although priateness of management’s fraud risk
CAEs are looking to hire internal audi- assessment.
tors with skills in fraud auditing or in In developing or emerging markets,
forensics and investigations, these skills CAEs place more emphasis on fraud
are not among the top five for which risk. The same applies to privately held
they are hiring. Only 23% of CAEs organizations. Even though a major
chose “fraud auditing” as one of the top portion of internal audit efforts is not
five skills they are recruiting or building dedicated strictly to fraud risk, internal
into their internal audit departments. A auditors should keep in mind that fraud
similar category, “forensics and investi- risk can have serious consequences for an
gations,” was selected as a top five skill organization or an internal audit depart-
by only 15% of CAEs. The groups with ment. “In Spanish, we have a typical
the most emphasis on fraud auditing phrase: open the umbrella before the rain
are from Latin America (31%) and the comes,” says Jorge Badillo, internal audit
construction industry (30%), while for manager of Sierra Gorda SCM and chair-
forensics and investigations, the most man of the Latin American Federation of
emphasis is in Sub-Saharan Africa (29%) Internal Auditors.
and South Asia (26%) (Q30, n = 3,288).

www.theiia.org/goto/CBOK ● 11
2 Internal Audit’s Responsibility for
Fraud Prevention and Detection

❝The results aren’t

unexpected. There
I nformation found in some textbooks
suggests that management is respon-
sible for establishing and maintaining
The Problem of All Responsibility
or No Responsibility

Exhibit 7 also shows that some respon-

are different internal controls (including anti-fraud dents say their internal audit departments
controls), while internal auditors need have no responsibility for fraud detec-
maturity levels
to evaluate management’s controls and tion (12%) or fraud prevention (17%).
across both entities be aware of fraud red flags. Reality often Many internal audit leaders disagree with
and countries, differs from the textbook ideal. Survey the concept of internal audit having no
results show that there is often a shared responsibility for fraud detection. Lynn
differing societal
responsibility between internal audit and Fountain, author of Raise the Red Flag:
expectations, management when it comes to fraud risk. An Internal Auditor’s Guide to Detect and
as well as many About 3 out of 10 of all survey respon- Prevent Fraud, commented, “Internal
dents say internal audit has “all or most auditors need to brainstorm fraud risks
variables that
of the responsibility” for detecting or as part of every engagement. This is part
come into play in preventing fraud at their organizations, of the Standards, but auditors aren’t really
determining the with about another 6 out of 10 saying doing it effectively.”
they have “some of the responsibility” On the other end of the scale,
role of internal
(see exhibit 7). The exhibit shows that 6% of respondents say their internal
audit across a internal auditors are slightly more likely audit departments assume all of the
fast-changing to be responsible for detecting fraud than responsibility for fraud detection and
preventing fraud. prevention (see exhibit 7). However,
business and
technological
environment. ❞ Exhibit 7 Internal Audit Responsibility for Detecting or Preventing Fraud

—Bruce Turner, retired

CAE, immediate past Detecting Fraud 6% 23% 59% 12%
Chairman of The IIA’s
International Public Sector Preventing Fraud 6% 21% 57% 17%
Committee, and Chairman
of the Audit Committee 0% 20% 40% 60% 80% 100%
of IIA–Australia
All of the responsibility Some of the responsibility
Most of the responsibility None of the responsibility

Note: Q55: What degree of responsibility does internal audit have for detecting fraud in
your organization? n = 11,431. Q56: What degree of responsibility does internal audit have for
preventing fraud in your organization? n = 11,428. Due to rounding, some totals may not equal
100%.

12 ● Responding to Fraud Risk

❝Assigning full responsibility for preventing and
detecting fraud goes against the concept
Where internal auditors have respon-
sibility for certain aspects of fraud
internal audit of internal audit independence and the prevention and detection, these respon-
with all or most Three Lines of Defense Model.* Ashar sibilities include investigating suspected
commented, “I don’t agree with this fraud, facilitating fraud risk assessments,
of the responsi-
[internal audit having all responsibility monitoring the whistleblower hotline,
bility for fraud for fraud prevention]. This is the respon- auditing management’s anti-fraud con-
detection is the sibility of management and the first line trols, and providing fraud awareness
of defense. However, in many cases, training.
old-fashioned way,
internal audit is expected to review the
and it is the most design of internal controls before they Regions Have Large Differences in
Levels of Responsibility
comfortable thing are implemented. This, in a way, is part
of fraud prevention.” In the same way, Exhibit 8 and exhibit 9 show the wide
for a company
the external auditors are required by differences between regions. The highest
to do because it their professional standards to assess the degree of responsibility for fraud preven-
implies that all the risk of material misstatement from both tion and detection is reported in South
fraud and error when auditing financial Asia (mostly comprised of respondents
other areas in the statements. Assigning the internal audit from India), where about 5 out of 10
organization will department with all of the responsibility respondents say they have “all or most
not be challenged for fraud prevention and detection goes of the responsibility (green bars).” Other
against the Standards and good practice. regions with higher levels of responsibil-
to support the
ity are the Middle East & North Africa,
Internal Auditors at Private
fraud detection Latin America & Caribbean, and Sub-
Companies Are More Involved
efforts. ❞ with Fraud Risk Saharan Africa (ranging from 31% to
38%). Ashar explains how regulation and
Fraud responsibility also differs according
—Jorge Badillo, control frameworks are shaping internal
to the type of organization, with privately
Internal Audit Manager, audit’s role regarding fraud in India:
Sierra Gorda SCM,
held organizations reporting the high-
“The Indian Companies Act of 2013 and
and Chairman, est levels of involvement. For detecting
COSO 2013 have put a lot of emphasis
Latin American Federation fraud, 36% of private sector respondents
of Internal Auditors on internal audit and actively addressing
say they have all or most of the respon-
fraud. Companies are investing in the
sibility, compared to the average of 29%
establishment of internal audit depart-
(Q55, n = 11,431). The gap is wider for
ments and in building the capabilities of
preventing fraud, with 35% for the pri-
existing ones.”
vate sector, compared to the average of
In addition, culture and organiza-
26% (Q56, n = 11,428). This could be
tional maturity also have a major effect
attributed to the tendency of privately
on the results, explained Owen Purcell,
held organizations to lack a second line
of defense (i.e., risk management and EY lead partner for the EMEIA Risk
compliance functions). Centre of Excellence, United Kingdom.
“In general, when we look at Europe, we
see maturity in terms of how companies
*  IIA Position Paper, The Three Lines of
Defense in Effective Risk Management and manage fraud risk. Internal audit does
Control, January 2013, 3–5. have a role; however, they are usually not

www.theiia.org/goto/CBOK ● 13
Exhibit 8 Detecting Fraud: Internal Audit Responsibility (Region View)

80% 77%

58% 58% 59%

60% 56%
49% 51%
48%
46%

40% 38%
35%
31%
29% 28% 29%

20% 15%
13% 14% 13% 13% 14%
12%
8%
6%

0%
South Middle East Latin America & Sub-Saharan East Asia Europe North Global
Asia & North Africa Caribbean Africa & Pacific America Average

All or most of the responsibility Some of the responsibility None of the responsibility

Note: Q55: What degree of responsibility does internal audit have for detecting fraud in your organization? Due to rounding, some
totals may not equal 100%. n = 11,281.

Exhibit 9 Preventing Fraud: Internal Audit Responsibility (Region View)

80%

65%

58% 59%
60% 57%
54%
51% 52%

44%
42%
40% 38% 37%
31%
27% 26%
24% 24%
19%
20% 17% 17%
15% 15%
10% 11%
7%

0%
South Middle East Latin America & Sub-Saharan East Asia Europe North Global
Asia & North Africa Caribbean Africa & Pacific America Average

All or most of the responsibility Some of the responsibility None of the responsibility

Note: Q56: What degree of responsibility does internal audit have for preventing fraud in your organization? Due to rounding, some
totals may not equal 100%. n = 11,279.

14 ● Responding to Fraud Risk

leading this. Management and the second increases the perception that internal audit
line of defense (compliance, risk, etc.) are must do more to prevent and detect fraud.
usually responsible for controlling and In addition, management’s expecta-
managing fraud risk.” tions for internal audit functions also
Purcell says cultural attitudes toward play a role. “From my experience, most
fraud and internal audit also affect Indian companies don’t have separate,
internal audit’s role. “In South Asia and stand-alone investigation departments.
Middle East, there is the belief that inter- This includes listed companies. The
nal audit should always be checking for responsibility is placed on internal audit,
fraud. There are several layers of approvals and management’s expectation is that
and signatures, with internal auditors internal audit should take a lead role in
checking the checkers. The established responding to fraud risk,” says Ashar.
internal audit functions in the Middle
A Coordinated Approach to Fraud
East have high profiles within their com-
Risk Is Best
panies, and, as a result, management
would tend to push more of the responsi- Internal audit is not the most prevalent
bility for fraud detection on to them.” means of detecting fraud, according to the
Association of Certified Fraud Examiners
Larger Departments Have More (ACFE) (see exhibit 12). Instead, fraud is
Responsibility
detected more often by internal controls
The largest internal audit departments (tips from hotlines) and the first line of
tend to take on more responsibility to defense (management review).
prevent and detect fraud than do smaller An effective response to fraud risk
departments. In organizations with should include multiple lines of defense,
more than 50 internal auditors, 37% of with the involvement of the audit com-
respondents stated they have “all or most mittee, senior management, compliance,
of the responsibility” for detecting fraud legal, human resources, and internal
compared to the global average of 29% audit. Dr. Al Faddagh shares this view:
(see exhibit 10). For prevention of fraud, “We need to think about fraud risk man-
the results were similar, with 33% of agement as a process. There are shared
organizations with more than 50 internal responsibilities in this process amongst
auditors taking all or most of the respon- internal audit, management, and second
sibility compared to the global average of line functions. When it comes to detec-
26% (see exhibit 11). tion, I believe internal audit bears a
The results may be explained by the higher portion of responsibility than it
existence of dedicated fraud specialists has for the prevention of fraud.” Without
or investigators in larger internal audit a coordinated approach, there is a higher
departments, which usually cannot be risk of failing to detect fraud and fail-
justified in smaller departments due to ing to respond effectively after fraud is
cost constraints. The existence of these detected.
dedicated fraud specialists or investigators

www.theiia.org/goto/CBOK ● 15
 Exhibit 10 Detecting Fraud: Internal Audit Responsibility (Internal Audit
Department Size View)

80%

64%
61% 60%
60% 58%
54%

40% 37%

29%
27% 26% 25%

20%
14% 13% 12% 12%
9%

0%
1 to 3 4 to 9 10 to 49 50 or more Average

All or most of the Some of the None of the

responsibility responsibility responsibility

Note: Q55: What degree of responsibility does internal audit have for detecting fraud in your
organization? Due to rounding, some totals may not equal 100%. n = 10,542.

Exhibit 11 Preventing Fraud: Internal Audit Responsibility (Internal Audit

Department Size View)

80%

58% 60%
60% 58% 57%
52%

40%
33%

26% 26%
23% 23%
19%
20% 16% 17% 17%
15%

0%
1 to 3 4 to 9 10 to 49 50 or more Average

All or most of the Some of the None of the

responsibility responsibility responsibility

Note: Q56: What degree of responsibility does internal audit have for preventing fraud in your
organization? Due to rounding, some totals may not equal 100%. n = 10,540.

16 ● Responding to Fraud Risk

Exhibit 12 Ways That Fraud Is Initially Detected

Percent of
Detection Method
Cases

Tips 42%

Management review 16%

Internal audit 14%

Other methods, such as by accident, external audit, law 28%

enforcement, etc.

Source: The ACFE 2014 Report to the Nations on Occupational Fraud and Abuse
(Association of Certified Fraud Examiners, 2014), figure 11. Used by permission.

investigations can affect internal audit’s

Conclusion
relationships in the organization. “When
Question 2: To what extent are internal auditors are deeply involved
internal auditors responsible for in investigations that may result in dis-
fraud prevention and detection? ciplinary action against executives or
other employees, it can be difficult for
There is no single correct answer. It the internal auditors to be seen later as
largely depends on the organization ‘trusted advisors’ who are ‘there to help’
culture, maturity, and the internal audit when they return in their internal audit
vision/positioning within the organiza- role,” he said.* Regardless, internal audit
tion. For smaller organizations, it may should consider the risk of fraud when
not be feasible to maintain separate preparing its risk assessment, be alert to
internal audit and investigations teams. fraud red flags during engagements, and
However, when internal audit engages respond in line with the organization’s
extensively in fraud investigations, it may policies and applicable laws.
not be able to add the most value to the
organization. *  Richard Chambers, “The Dangers to
According to IIA President and CEO Internal Audit of Donning a ‘Black Hat.’”
Retrieved from: iaonline.theiia.org, July 15,
Richard Chambers, involvement in fraud
2014.

www.theiia.org/goto/CBOK ● 17
3 Internal Audit Capabilities in
Responding to Fraud Risk

A re internal auditors capable of

responding to fraud risk? Do they
have the right skills? This section analyzes
Internal Auditors Appear
Confident in Fraud Risk Skills

Internal auditors appear confident when

the capabilities of internal auditors as it comes to incorporating fraud risk
they relate to the response to fraud risk. into engagements and supporting fraud
It discusses how internal auditors assess risk awareness, even though only a very
their capabilities related to fraud risk, small portion (5%) of respondents have
what percentage of internal auditors have had formal training related to fraud and
fraud-related certifications, and how spend a majority of their time working
much internal auditors use data analytics in that area (Q11, n = 12,716). About
to detect and prevent fraud. 6 out of 10 respondents believe they are

Exhibit 13 Fraud-Related Competency Skill Levels

40%
34%
32%
31%
30% 28% 28%
1-Novice

2-Trained

20% 3-Competent
17%
4-Advanced
13%
5-Expert
10% 8%
7%
4%

0%
Support fraud Incorporate ethics and fraud
risk awareness considerations in audit engagements

Note: Estimate your proficiency for each competency using the following scale: 1-Novice;
2-Trained; 3-Competent; 4-Advanced; 5-Expert. Q81: Topic: Support fraud risk awareness
(n = 11,090) and Q83: Topic: Incorporate ethics and fraud considerations in audit
engagements (n = 11,204).

18 ● Responding to Fraud Risk

❝If your fraud advanced or expert when it comes to
incorporating ethics and fraud consider-
Few Internal Auditors Have Fraud-
Related Certifications
policy or internal ations in audit engagements, and another Only 6% of internal auditors globally
audit charter says 5 out of 10 feel this way about support- (5% in 2010) have a fraud examiner
ing fraud risk awareness (see the gold and certification, such as the ACFE’s certified
you have fraud
purple bars in exhibit 13). fraud examiner (CFE) certification (see
investigation This level of confidence may indicate exhibit 14). The highest region of internal
responsibilities, that internal auditors are unaware of the auditors with fraud examination certifica-
specialized knowledge needed to effec- tion was North America at 15%, followed
you need to have
tively respond to fraud risk. Responding by 8% in the Middle East. The remaining
the ability to hire to fraud risk is not solely about analyzing global regions had an average of about 3%.
help or have the risk and auditing existing controls. There Furthermore, in the CBOK 2010
are investigation techniques, interview Global Internal Audit Survey, 11% of
skills in-house;
techniques, digital forensics, and other respondents indicated that they planned
otherwise, don’t specialized approaches that need to be to obtain a fraud examination certifica-
do it.❞ accessible to an internal audit department tion. It seems very few followed through
to properly respond to fraud. “Internal on these plans over the past five years. This
—Lynn Fountain, auditors can become complacent and is not surprising because internal auditors
Author of Raise the think they understand fraud, but in fact usually pursue internal audit credentials
Red Flag: An Internal
they don’t really understand the unique such as the certified internal auditor
Auditor’s Guide to
Detect and Prevent Fraud aspects of both anti-fraud programs and (CIA) or the qualification in internal
emerging fraud schemes,” says Turner.

Exhibit 14 Respondents with Fraud Certifications

RESOURCE

Lynn Fountain, Raise North America 15%

the Red Flag: An
Internal Auditor’s Guide Middle East & North Africa 8%
to Detect and Prevent
Fraud (Altamonte 4%
Europe
Springs, FL: The
Institute of Internal
Sub-Saharan Africa 4%
Auditors Research
Foundation, 2015).
Latin America & Caribbean 3%

East Asia & Pacific 3%

South Asia 2%

Global Average 6%

0% 5% 10% 15% 20%

Note: Q13: Which professional certifications do you have in areas other than internal auditing?
(Choose all that apply.) Topic: Fraud examination (such as CFE). n = 12,716.

www.theiia.org/goto/CBOK ● 19
 audit leader­ship (QIAL) before obtaining will have an active role in responding to
specialized certifications such as the CFE. fraud risk will need both fraud examina-
The role of internal audit in respond- tion certifications and specialist training
ing to fraud risk and the attitude of the and experience.
CAE toward certifications may explain
Data Analytics Frequently Used to
these results, says Turner. “In Australia,
Identify Fraud
larger well-established entities often
have specialist fraud investigation teams, The use of data analytics is an important
so internal audit does not investigate component of mature anti-fraud
fraud in these instances. Another factor pro­grams. About 5 out of 10 internal
is where internal audit shops don’t have audit departments that have data ana-
professional development plans because lytics activity use it to identify possible
they don’t see the value of boosting certi- frauds, among other things. This rises to
fications at the internal audit department 62% in organizations with more than
level. I think this is a short-sighted view 100,000 employees (see exhibit 15).
that needs to change for internal audit Such results are not surprising given that
departments to be fully effective.” implementing data analytics requires an
Moreover, survey results show that investment in both time and resources.
fraud examination certifications, when According to a report from the ACFE,
available, come later in an internal audi- proactive data monitoring/analysis is one
tor’s career: 75% of internal auditors of the most effective anti-fraud controls in
with a fraud examination certification are terms of reducing median fraud losses and
management level or higher. Likewise, duration.* Data monitoring increases the
66% of internal auditors with a fraud likelihood of detecting fraud schemes (for
examination certification are 40 years old example, fictitious employees or vendors)
or older (Q13, n = 11,106). Logically, and fraud red flags (duplicate payments
internal auditors pursue the CIA creden- or invoices, unusual trends/patterns,
tial before obtaining other certifications. timing of transactions, manual journal
Experts disagree on the topic of fraud entries, etc.). Dr. Al Faddagh agrees with
examination certifications. According to using data analytics to respond to fraud
Fountain, “Not having a fraud examina- risk. “Internal audit departments need to
tion certification does not mean that you create a smart database that includes all
will not be able to assess how the organi- fraud incidents which have happened over
zation responds to fraud risk. Knowledge
the years. This database should be search-
of the organization and its industry is
able, and from there, you can analyze
critical to understanding the types of
trends and gain useful insights into fraud
fraud schemes that could take place.”
hotspots and the circumstances which led
In contrast, Purcell commented,
to committing fraud,” he says.
“Would non-specialist internal auditors
be able to create and preserve an evidence
*  Report to the Nations on Occupational Fraud
trail that would stand up in a court of and Abuse (Association of Certified Fraud
law?” In the end, internal auditors who Examiners, 2014).

20 ● Responding to Fraud Risk

Exhibit 15 Data Analytics Used to Identify Possible Frauds (Organization
Size View)

Less than 500 44%

500 to 1,500 45%

1,501 to 10,000 51%

10,001 to 100,000 56%

More than 100,000 62%

Average 49%

0% 20% 40% 60% 80%

Note: Q96: Does your internal audit department use data mining or data analytics for the
following activities? Exhibit shows respondents who chose “identification of possible frauds.”
n = 11,101.

In addition, data analytics can be when most of them do not own the risk,
even more effective if embedded as part relatively little time is spent on fraud, and
of the first line of defense. Purcell says, the vast majority do not have fraud-related
“Companies may be using data analyt- certifications? A logical answer would be
ics as part of running the internal audit that most internal auditors have a skills
department, but they also need to use gap when it comes to fraud risk. This
it in the course of managing the busi- means that they would need to receive
ness to detect and analyze daily business regular training on fraud to have sufficient
transactions for fraud. New tools and knowledge of fraud red flags and meet the
techniques are emerging and are more ‘in requirements of the Standards.
the moment’ than historical in their anal- From the technology viewpoint, data
ysis.” Embedding data analytics into the analytics (where implemented) is used
business is also likely to result in opera- by internal auditors to identify fraud and
tional efficiencies and not just improved fraud red flags. Some experts suspect that
fraud detection. the activity is mainly centered around the
routine analysis of travel and entertain-
Conclusion
ment expenses, unless there is a mature
Question 3: Are internal auditors anti-fraud program in place (which is
capable of responding to fraud more likely to be true in specific indus-
risk? tries or large organizations). Even though
respondents say they are using data ana-
How can internal auditors feel confident lytics to detect fraud, it may only be at a
in their ability to respond to fraud risk surface level.

www.theiia.org/goto/CBOK ● 21
4 Five Ways to Improve Internal
Audit’s Approach to Fraud Risk

❝Fraud risk is
not adequately
D ealing with fraud, or even talking
about it, can be something man-
agement tends to avoid, regardless of
North America; see exhibit 2). Results
also indicate that internal auditors at
privately held organizations are more
addressed. With materiality. The nature of some fraud focused on fraud risk than other organi-
instances (whether the ambiguity sur- zation types (see exhibit 3). Finally, fraud
the increase in
rounding them or the sensitive positions risk is more likely to be chosen as a top
use of technology, of the perpetrators) can divert attention five risk priority by internal audit than by
internal audit away from core business objectives and management, according to internal audit
risks. Fraud can also take a toll on the perceptions (see exhibit 2).
needs to incor-
organization’s morale, resources, and Even though fraud is not the primary
porate fraud risk reputation. This is what makes fraud risk focus of internal audit, when major fraud
assessments more complex than other business risks. happens in an organization, management
The vast majority of internal auditors and internal auditors often redirect all of
into any process
globally indicate they have at least some their focus and energy to fraud risk. This
audit. ❞ responsibility for detecting and prevent- poses a dilemma for CAEs. How do you
ing fraud in their organizations (88% plan for a situation like this? To be pre-
—Umesh Ashar, and 84%, respectively; see exhibit 7). pared, CAEs should make sure the role
Senior General Manager –
Internal Audit,
However, fraud risk makes up only 4% of of internal audit is very clear to all stake-
Tata Motors Limited most internal audit plans (see exhibit 5), holders. Otherwise, questions may be
and only 25% of CAEs believe that the raised about the effectiveness and value
focus on fraud risk will increase in 2015 of the internal audit department. This
(see exhibit 6). And even though the vast means that CAEs need to be proactive
majority of internal auditors do not have when it comes to addressing fraud risk
fraud examination certifications (94%; and apply a risk-based approach to their
see exhibit 14), about half believe they efforts.
are competent or better at supporting
The Way Forward
fraud awareness and incorporating fraud
considerations in audit engagements (see The messages from the 2015 survey
exhibit 13). and this report need to result in tangi-
When CAEs were asked to choose ble actions for CAEs and internal audit
their top five risk areas, an average of 3 departments. The following five recom-
out of 10 globally chose fraud, but there mendations can help improve internal
are large differences between regions audit’s approach to fraud risk in all kinds
(53% in South Asia compared to 22% in of organizations.

22 ● Responding to Fraud Risk

1. Establish internal audit’s role make sense to put these skills to use.
regarding fraud. Promote the Three Lines of Defense
What is the role of internal audit in the Model. Build awareness across your orga-
organization’s anti-fraud efforts? What nization about fraud risk, the Standards,
activities will the internal audit depart- and the role of internal audit. You may
ment undertake (if any) to prevent and need to address expectation gaps, says
detect fraud? What will be your involve- Fountain. “It is very challenging to
ment in investigations? CAEs need to meet the Standards and keep up with
understand the expectations of stakehold- management expectations. CAEs need
ers and the requirements of the Standards to periodically communicate the role of
to position their departments and docu- internal audit as it relates to fraud to both
ment the role in the internal audit charter the audit committee and management.”
and the organization’s anti-fraud policy.
3. Be proactive in addressing fraud
Given that investigating or deterring risk.
fraud was selected by only 29% of CAEs
as a top way for internal audit to add Do not just sit and wait for fraud to
value, CAEs may want to push as much happen; be proactive! Make use of audit
fraud detection and prevention respon- hotlines, audit management controls
sibility as they can to the first line of over fraud, audit investigation protocols,
defense (operational management) and and audit anti-bribery and corruption
the second line of defense (risk man- programs. In addition, you can facilitate
agement and compliance functions). fraud risk assessments, increase frequency
Purcell says, “Internal auditors should of audits in high fraud risk processes,
work to push the responsibility of fraud champion the need for a digital foren-
and managing fraud risk onto the busi- sics capability, and so on. Make sure
ness. Internal audit can be educators and you agree with your audit committee
make sure that the control framework is on which assignment would add the
operating correctly and that the first or most value to the organization. Turner
second lines of defense are doing their recommends, “Internal auditors need
job; internal audit should not become reasonable focus on facilitating fraud risk
the first or second line of defense.” assessments because this is an area where
However, if you work at a privately held they can add lots of value by driving
organization or in a region with a high strategic solutions to minimize the risk
focus on fraud, you may need to increase of potentially significant frauds.” The
the internal audit department’s involve- Standards requires the internal auditor to
ment in fraud risk and see how best to assess the potential for fraud, and facil-
add value to the organization’s anti-fraud itating fraud risk assessments is a good
program. step toward meeting that requirement.

4. Build a database of lessons

2. Educate management about
learned.
fraud risk.

Internal auditors seem very confident in When fraud occurs, it should (among
supporting fraud awareness, so it would other things) lead to the remediation

www.theiia.org/goto/CBOK ● 23
❝When you inves- of any control deficiencies. Take own-
ership of creating a database of what
5. Create access to the right skills.

tigate fraud, you Make sure your team has the right skills
went wrong, the circumstances that led
to support fraud prevention or detection
should have to to fraud, the scheme, how it was discov-
efforts. Hire, train, or outsource. Your
ered, the location it took place, and the
have the skills to team needs to be able to assess the risk of
outcome. This will serve as an excellent
do it correctly. ❞ tool to educate the internal audit depart-
fraud and be alert to fraud red flags; this
requires experience and maturity. Also,
ment and executive management. It
—Owen Purcell,
do not forget to train the team on how
will also provide historical data on the
EY Lead Partner, technology can be used to commit fraud.
likelihood and impact of certain schemes
EMEIA (Europe, Consider whether you need to hire inter-
Middle East, India, Asia) by location to prioritize audit efforts or
nal auditors with specialization in fraud
Risk Centre of Excellence, have discussions on the acceptance of
United Kingdom
auditing or investigations. Alternatively,
any risks.
negotiate a rate contract with an out-
sourced provider so you can have easy
access to specialists when needed.

24 ● Responding to Fraud Risk

Appendix A:
Summary of Findings
Section 1: The Global Focus on Fraud Risk
●● At face value, fraud risk does not seem to be high on the agenda of
executive management or internal audit departments. However, there is
more focus on fraud risk from the internal audit point of view.
●● Focus on fraud risk by both executive management and internal audit is
higher in privately held organizations compared to other organization types
(publicly listed, government, not-for-profit, etc.).
●● Although most internal auditors believe they have some responsibility for
fraud detection and prevention, CAEs do not consider the investigation or
deterrence of fraud to be a major value-added activity.
●● Fraud risk makes up a very small portion of internal audit plans, and few
CAEs believe that the focus on fraud risk will increase in 2015 compared to
2014.
●● CAEs are looking to hire internal auditors with skills in fraud auditing or
in forensics and investigations. However, these skills are not among the top
five for which they are hiring.

Section 2: Internal Audit’s Responsibility for Fraud Prevention and

Detection
●● Responding to fraud risk involves a coordinated effort across the three lines
of defense, and most internal auditors are involved in this effort.
●● In South Asia, the Middle East & North Africa, and Latin America &
Caribbean, a higher proportion of internal auditors believe they have “all or
most of the responsibility” for preventing and detecting fraud.
●● In privately held organizations and those with internal audit departments
employing more than 50 internal auditors, there is more emphasis on
internal audit to prevent and detect fraud.

Section 3: Internal Audit Capabilities in Responding to Fraud Risk

●● Internal auditors appear confident when it comes to incorporating fraud
risk into engagements and supporting fraud risk awareness, even though
only a very small portion of them spend most of their time working on
fraud.

www.theiia.org/goto/CBOK ● 25
 ●● Fraud examination certifications are not common among internal auditors.
When available, fraud-related certifications seem to come later in an
internal auditor’s career.
●● The most common use of data analytics by internal audit departments is
identifying possible patterns of fraud.

Section 4: Five Ways to Improve Internal Audit’s Approach to Fraud Risk

1. Establish internal audit’s role regarding fraud.

Use expectations of stakeholders and the requirements of the Standards to identify

internal audit’s role regarding fraud in your organization. Document this informa-
tion in the internal audit charter and the organization’s anti-fraud policy.

2. Educate management about fraud risk.

Build awareness across the organization about fraud risk, the Standards, and the role
of internal audit.

3. Be proactive in addressing fraud risk.

Be proactive by auditing anti-corruption measures in use at the organization or by

increasing audits in high fraud risk areas. At the same time, make sure you agree
with your audit committee on which assignment will add the most value.

4. Build a database of lessons learned.

Create a database of circumstances surrounding cases of fraud at your organization

and use it to prioritize future audit efforts.

5. Create access to the right skills.

Make sure your team has the right skills, especially in the area of technology. Hire,
train, or outsource as needed.

26 ● Responding to Fraud Risk

About the Author

F arah G. Araj, CIA, CPA, CFE, QIAL, is an internal audit leader with more than
15 years of professional experience as both a consultant with Big 4 firms and as a
CAE. He has also served as an independent audit committee member. Araj is an active
member of The IIA in the United Arab Emirates (UAE) and has contributed to its
research and publications. In addition, he served as project champion for the CBOK
2015 Global Internal Audit Practitioner Survey in the UAE.

About the Project Team

CBOK Development Team

CBOK Co-Chairs: Primary Data Analyst: Dr. Po-ju Chen

Dick Anderson (United States) Content Developer: Deborah Poulalion
Jean Coroller (France) Project Managers: Selma Kuurstra and
Practitioner Survey Subcommittee Chair: Kayla Manning
Michael Parkinson (Australia) Senior Editor: Lee Ann Campbell
IIARF Vice President: Bonnie Ulmer

Report Review Committee

Sezer Bozkus (Turkey) Michael Parkinson (Australia)

John Brackett (United States) Beatriz Sanz-Redrado (Belgium)
John McLaughlin (United States) Maritza Villanueva (El Salvador)

Acknowledgments

The author would like to thank all the internal audit leaders who took the time to
analyze survey results and participate in the post-survey interviews (including those
who participated anonymously). In particular, he is grateful to Dr. Khalid Al Faddagh,
Umesh Ashar, Jorge Badillo, Lynn Fountain, Owen Purcell, and Bruce Turner for
providing their insightful analysis and comments on the key findings.

www.theiia.org/goto/CBOK ● 27
 About The IIA Research Foundation

Your CBOK is administered through The IIA Research Foundation (IIARF), which has pro-
Donation vided groundbreaking research for the internal audit profession for the past four decades.
Through initiatives that explore current issues, emerging trends, and future needs, The
Dollars at IIARF has been a driving force behind the evolution and advancement of the profession.
Work
CBOK reports are Limit of Liability
available free to
the public thanks The IIARF publishes this document for information and educational purposes only.
to generous IIARF does not provide legal or accounting advice and makes no warranty as to any legal
contributions or accounting results through its publication of this document. When legal or account-
from individuals,
organizations, IIA
ing issues arise, professional assistance should be sought and retained.
chapters, and IIA
institutes around the Contact Us
world.
The Institute of Internal Auditors Global Headquarters
Donate to 247 Maitland Avenue
Altamonte Springs, Florida 32701-4201, USA
CBOK
Copyright © 2015 by The Institute of Internal Auditors Research Foundation (IIARF). All
www.theiia.org/goto/
CBOK rights reserved. For permission to reproduce or quote, please contact [email protected].
ID # 2015-1872