CIA-1 - Fraud Risks (15% of the exam) - Section D.3
Evaluate the potential for fraud and how the organization detects and manages fraud risks, including evaluating fraud risk management processes and detecting red flags at the organizational and process level.
Evaluate the organisation's fraud risk management processes, including how it identifies, assesses, and responds to fraud risk, and assess whether they are adequate for its exposure. Detect and assess red flags at both the organisational and the process level, and recognise the internal auditor's responsibility to report red flags identified during an engagement rather than presuming fraud or ignoring the indicators.
Fraud risk managementRed flagsFraud indicators
Practice question for this objective
lock_openFree sampleFraud Riskshard
An internal auditor is explaining fraud risk management to a newly appointed team member who keeps confusing it with the work done after a fraud is discovered. Which statement best describes what fraud risk management involves?
AIt is the process of gathering legal evidence to establish that a named individual committed a fraud that has already taken place.
BIt is a periodic exercise performed by the external auditors to certify that the financial statements are free from any fraud.
CIt is an ongoing process to identify, assess, and respond to the risk of fraud occurring across the organisation.check_circle Correct
DIt is the internal audit function taking ownership of the operating controls that prevent fraud within the business units.
Fraud risk management is the ongoing identify, assess, and respond process for fraud risk, distinct from investigating a fraud after the fact. Fraud risk management applies the standard risk cycle to the specific risk of fraud, so it is forward-looking and continuous, whereas investigation is a reactive response triggered by a suspected fraud event.
Why A is wrong: This is tempting because it sounds like serious anti-fraud work, but it describes fraud investigation, which responds to a suspected event, rather than the ongoing management of fraud risk.
Why B is wrong: External auditors do consider fraud risk, but this wrongly hands the whole activity to them and treats it as a one-off certification rather than an ongoing organisational process.
Why C is correct: Correct: fraud risk management is the continuous identification, assessment, and response to fraud risk, mirroring the wider risk management cycle applied to the specific threat of fraud.
Why D is wrong: This is tempting because internal audit evaluates fraud controls, but owning and operating those controls is a management responsibility, and taking it on would impair independence.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
The fraud risk management process is adequate, because a documented annual fraud risk assessment and a set of anti-fraud controls are already in place and were completed on schedule this year.
errorWhy it is wrong: The presence of an assessment is reassuring, but adequacy depends on whether it reflects current exposure; an assessment that ignores materially changed fraud risks is not adequate simply because it exists.
As conclusive evidence that a fraud has taken place, which the auditor should report to the authorities before doing any further work.
errorWhy it is wrong: This is tempting because red flags feel alarming, but it confuses an indicator with proof; acting as though fraud is established skips the corroboration the auditor still owes.
Accept management's explanation and close the point, because the engagement objective was payables accuracy rather than fraud, and a small supplier operating below the threshold is not unusual.
errorWhy it is wrong: The explanation is convenient, but a shared bank account and threshold-hugging invoices are recognised fraud indicators; accepting the account without scrutiny abandons the professional scepticism the situation demands.