CIA-1 - Fraud Risks (15% of the exam) - Section D.4
Describe controls to prevent and detect fraud, including tone at the top, segregation of duties, authority levels, and detective controls such as whistleblower hotlines, reconciliations, and supervisory reviews.
Describe how a strong tone at the top reduces the likelihood of fraud by shaping expectations of ethical behaviour, and explain preventive controls such as segregation of duties and appropriate authority and approval levels that remove opportunity. Identify detective controls that surface fraud after the fact, including whistleblower hotlines, reconciliations, and supervisory reviews, and match a control to the fraud risk it addresses.
Segregation of dutiesTone at the topWhistleblower hotlineReconciliation
Practice question for this objective
lock_openFree sampleFraud Risksmedium
At Kesgrave Supplies, a single accounts clerk can add a new vendor to the master file, enter that vendor's invoices, and release the resulting payments with no second person involved. The chief audit executive wants the control that would best PREVENT a fictitious-vendor fraud in this process. Which control should the auditor recommend?
ASegregate the duties so that vendor set-up, invoice entry, and payment release are each performed by a different member of the finance staff.check_circle Correct
BIntroduce a monthly reconciliation of the vendor master file against payments made, so any fictitious vendor and its payments can be identified after each period has closed.
CInstall a confidential whistleblower hotline that lets staff report a colleague they suspect of setting up and paying a fictitious vendor within the accounts team.
DHave a supervisor review a sample of completed payments each week to confirm that the vendors which received them are genuine and properly approved.
Preventive controls such as segregation of duties remove the opportunity for one person to commit fraud, whereas detective controls only surface it afterwards. The fictitious-vendor fraud is possible here because one clerk controls the whole payment cycle. Separating vendor set-up, invoice entry and payment release removes that opportunity, which is prevention; reconciliations, hotlines and supervisory reviews are detective and act only after the payment has gone.
Why A is correct: Splitting these incompatible duties removes the opportunity for one person to create and pay a fictitious vendor, which is a preventive control that stops the fraud before it can occur.
Why B is wrong: A reconciliation is tempting because it would eventually expose a false vendor, but it surfaces the fraud only after money has left, so it detects rather than prevents what the stem asks to stop.
Why C is wrong: A hotline is a detective control that relies on someone noticing and reporting; it does not stop the clerk creating and paying a false vendor, so it cannot prevent the fraud.
Why D is wrong: A supervisory review can catch a fraud already committed, but it operates after the payment is made and does not remove the one-person opportunity the stem asks to prevent.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CIA-1 bank for this domain.
Strengthen segregation of duties among the operational staff who process the underlying transactions each day within the affected departments.
errorWhy it is wrong: Tighter segregation among staff is preventive and generally useful, but a senior manager who can override controls sits above those duties, so this does not detect the override the committee is worried about.
Tighter authorisation limits that reduce the value any single manager may approve before escalation to a superior is required.
errorWhy it is wrong: Tempting because tighter limits do strengthen defences, but authorisation limits are preventive; they constrain what can happen rather than reveal fraud that has already passed the existing controls.
A stronger segregation of duties that separates the physical receiving of cash from the recording of cash within the small finance team.
errorWhy it is wrong: Tighter segregation reduces opportunity and looks like the natural fix, but it is a preventive control, and the stem asks to detect fraud that has already evaded prevention.