Internal Controls and Fraud Risk Assessment

Internal Controls & Fraud Risk Assessment
Core frameworks	COSO Internal Control — Integrated Framework (2013); COSO/ACFE Fraud Risk Management Guide (2016)
Structure	5 components, 17 principles; 5 fraud-risk principles
Related standard	ISO 37001:2025 (anti-bribery management systems)
Benchmark data	ACFE Occupational Fraud 2024 (1,921 cases)
Forensic use	Control testing, segregation-of-duties analysis, scheme-by-scheme risk matrices

Internal control is the set of policies, procedures and structures that give management reasonable assurance an organization will meet its operating, reporting and compliance objectives. A fraud risk assessment applies that lens to deliberate wrongdoing: it identifies who could commit which scheme, which controls would stop or reveal it, and where residual exposure remains. For the forensic accountant, controls matter twice: before a loss, as the thing to be designed and tested; after a loss, as the map of what failed and who was positioned to exploit the gap.^[1]

1 COSO 2013 and the Fraud Risk Management Guide

The Committee of Sponsoring Organizations of the Treadway Commission (COSO) issued its original Internal Control — Integrated Framework in 1992 and an updated version in May 2013. The 2013 framework is the one most U.S. issuers use to evaluate internal control over financial reporting under SOX Section 404 (see Auditing Standards and Fraud). It organizes control into five components—control environment, risk assessment, control activities, information and communication, and monitoring activities—supported by 17 principles.^[2] Principle 8 explicitly requires the organization to "consider the potential for fraud in assessing risks to the achievement of objectives."

COSO and the ACFE jointly published the Fraud Risk Management Guide (first edition 2008; second edition 2016) to expand that single principle into a program. Its five fraud-risk principles map onto the five components:^[3]

Fraud risk principle	Practical content	Artifact an examiner requests
1. Governance	Board/management commitment, fraud risk policy, roles	Code of conduct, board minutes, policy sign-offs
2. Risk assessment	Scheme inventory, likelihood/impact scoring, anti-fraud-control mapping	Risk register, prior assessment workpapers
3. Control activities	Preventive and detective controls tied to each scheme	Control matrix, procedure manuals, access lists
4. Investigation and corrective action	Intake, triage, remediation, discipline	Hotline log, case files, root-cause memos
5. Monitoring	Ongoing evaluation, metrics, reporting of deficiencies	Internal audit reports, KPI dashboards

The framework treats the fraud triangle elements as drivers to be managed: controls reduce opportunity, tone at the top and fair compensation reduce pressure and rationalization. It also cross-references the fraud tree for scheme inventories.

2 Segregation of duties

Segregation of duties (SoD) divides a transaction cycle so that no single person can initiate, authorize, record and keep custody of the asset. The classic four incompatible functions are authorization, custody, recordkeeping and reconciliation. Typical incompatible pairs include:

• Creating vendors in the vendor master file and approving or releasing payments (the root of fictitious-vendor billing schemes).
• Receiving cash and posting receipts to accounts receivable (skimming and lapping).
• Adding employees to payroll and approving timesheets or distributing paychecks (ghost employees).
• Preparing bank reconciliations and having check-signing authority.

Small organizations cannot always staff separate roles; the substitutes are compensating controls such as owner review of bank statements delivered unopened, mandatory vacation or job rotation, and periodic surprise counts. Because a determined insider with two incompatible roles can override a design, SoD should be combined with detective controls.

3 What the ACFE data say about controls

The ACFE's Occupational Fraud 2024 study (see ACFE Report to the Nations) reports that the presence of each of 18 anti-fraud controls was associated with lower median losses (reductions of roughly 23% to 63%) and shorter fraud duration (roughly 14% to 50%). Four controls—surprise audits, external audit of financial statements, hotlines, and proactive data monitoring/analysis—were associated with reductions of at least 50% in both loss and duration. On the cause side, 32% of cases were attributed to a lack of internal controls and 19% to an override of existing controls. On detection, 43% of schemes were found by tips, 14% by internal audit and 13% by management review, while external audit detected about 3%.^[4]

These are correlations from self-selected cases investigated by CFEs, not controlled experiments, and the ACFE itself cautions that the data cannot prove causation. Even so, the pattern is consistent across editions: the most effective controls are those that surface information (tips, analytics, surprise tests) rather than only those that document approval.

4 Fraud risk assessment: steps

1. Scope and team. Include finance, operations, compliance, IT and legal; interview people who actually run the processes.
2. Inventory schemes. Use the fraud tree to list what could happen in each business cycle (procure-to-pay, order-to-cash, payroll, treasury, financial close), including management override and bribery.
3. Rate inherent risk. Score likelihood and impact (for example 1–5 each) before considering controls.
4. Map existing controls to each scheme and judge whether they would prevent or detect it.
5. Test the controls (section 5) to separate controls that exist on paper from those that operate.
6. Rate residual risk, rank, and assign response: add controls, increase monitoring, transfer risk (insurance), or accept.
7. Document and refresh at least annually and on triggers such as acquisitions, system migrations or restructurings.

Illustrative scoring: a fictitious-vendor scheme in a company with unrestricted vendor-master access might score likelihood 4 and impact 4 (inherent 16). If a monthly independent review of new vendors exists and operates, residual might fall to 2 × 4 = 8; if the review is only on paper, residual stays at 16. The test in step 5 decides which.

5 Forensic techniques: testing controls and finding their failures

5.1 Walkthroughs and design versus operating effectiveness

A walkthrough follows one transaction from initiation to the general ledger, inspecting each document, approval and system screen, and interviewing the person who performs each step. It tests design. Operating effectiveness is tested by sampling: a common attribute-sampling convention for a control performed daily is 25–40 items, with any deviation requiring analysis. The evidence produced is a deviation list that states precisely which approvals were missing, late, or by the wrong person.

5.2 User-access and SoD conflict analysis

Export user-role assignments and the audit log from the ERP and build a conflict matrix (roles as rows and columns, incompatible pairs flagged). Then go beyond permissions to actual use: join the vendor-creation log to the payment-approval log on user ID. Example: if user U117 created 22 vendors in the year and approved payments to 9 of them totaling $318,400, that is a documented SoD breach with a quantified exposure and a ready list of transactions to vouch.

5.3 Vendor master file analytics

• Match vendor addresses, bank accounts and phone numbers to the employee master; any match is a conflict-of-interest lead.
• Flag P.O. Box-only addresses, vendors with no tax ID, and vendors with sequential invoice numbers (a vendor billing $4,100, $4,350 and $4,600 under invoices 0001, 0002 and 0003 has no other customers).
• Fuzzy-match names to catch near-duplicates ("Acme Supply" versus "ACME Suply Inc").

5.4 Duplicate and threshold testing

Duplicate-payment tests join on vendor, invoice number, amount and date in progressively looser combinations: same vendor and amount within 30 days; same invoice number with transposed digits. For approval limits, compare the count of invoices just under a limit with adjacent bands. Illustration with a $10,000 limit: if 410 invoices fall between $9,000.00 and $9,499.99 but 1,260 fall between $9,500.00 and $9,999.99, a roughly threefold excess immediately below the limit suggests splitting or limit-avoidance, and the examiner then inspects those 1,260 for common approvers and vendors. The same logic underlies Benford's Law digit tests (see Fraud Detection Analytics).

5.5 Three-way match and override exceptions

Compare purchase order, receiving report and invoice. Count payments released with no receiving record, quantity or price variances approved manually, and manual overrides of system holds. A rising override rate (for example 0.8% to 4.1% of invoices over two quarters) is itself a red flag (see Red Flags). Evidence: exception report, user IDs, and the approver comments justifying each override.

5.6 Reconciliation and timing review

Re-perform bank reconciliations for sample months, tracing every reconciling item to clearing; reconciling items outstanding more than 90 days, or reconciliations prepared and approved by the same person or signed weeks late, point to concealment. Proof-of-cash and deposit-lapping tests (matching customer remittance dates against posting dates) detect skimming that leaves no entry (see Net Worth Method for indirect methods when records are absent).

5.7 Behavioral and HR controls

Review leave records: employees who never take consecutive vacation in sensitive roles, or whose files show duplicate address or bank data with others. Surprise cash counts and inventory observations produce a first-hand count that can be compared with the book balance. Hotline logs should be analyzed for volume, time-to-triage and substantiation rate; a hotline that has received zero reports in several years is not evidence of honesty but of low awareness or low trust.

6 ISO 37001 and anti-bribery controls

ISO 37001, Anti-bribery management systems, is a certifiable management-system standard first issued in 2016. A second edition, ISO 37001:2025, was published in February 2025. Reported changes include requirements to consider climate-change effects on bribery risk, an explicit concept of anti-bribery culture, renaming the "anti-bribery compliance function" the "anti-bribery function" with clearer independence, a fuller treatment of conflicts of interest, and harmonization with ISO 37301 and ISO 37000.^[5] It requires bribery risk assessment, due diligence on projects and business associates, financial and non-financial controls over gifts, hospitality and donations, and reporting and investigation procedures. Certification does not confer immunity under statutes such as the FCPA, but regulators have treated an effective program as relevant (see Anti-Bribery Statutes and Anti-Corruption OSINT). The forensic counterpart is testing third-party payments: agent commissions above benchmark percentages, payments to jurisdictions unrelated to services, and consultants with no deliverables.

7 Limits of controls

Controls reduce, but do not eliminate, fraud. Collusion defeats segregation; management override (19% of ACFE cases above) bypasses the control environment entirely, which is why auditing standards treat override as a presumed risk in every audit. Controls also decay: staff turnover, system upgrades and workarounds erode design over time. An assessment should therefore be paired with continuous monitoring and independent testing, and findings should be documented in a form that can support later reporting if an investigation follows.

See also: Auditing Standards and Fraud, Occupational Fraud, Fraud Triangle, Fraud Detection Analytics, Red Flags, Forensic Accounting.

References

1. Association of Certified Fraud Examiners. Fraud examination and prevention literature.
2. COSO (2013). Internal Control — Integrated Framework. coso.org
3. COSO & ACFE (2016). Fraud Risk Management Guide, 2nd ed. coso.org (executive summary)
4. ACFE (2024). Occupational Fraud 2024: A Report to the Nations. acfe.com
5. ISO 37001:2025, Anti-bribery management systems. iso.org; summary of changes: DQS