Fraud can disrupt operations, pose compliance risks, blemish an organization’s reputation, and cost an organization and its stakeholders substantial amounts of money. While management, with board oversight, holds the primary responsibility for establishing and monitoring effective controls to deter and detect fraud, the internal audit activity is required to evaluate the risk of fraud, according to the International Standards for the Professional Practice of Internal Auditing. Additionally, the chief audit executive (CAE) must report significant risk and control issues, including fraud, to senior management and the board (Standard 2060 – Reporting to Senior Management and the Board). The Standards require the internal audit activity to assess fraud risks at the organizational and engagement level. To ensure adequate review of the risks relevant to each engagement, internal auditors should conduct a fraud risk assessment as part of engagement planning (Standard 2210.A1). Over time, the knowledge the internal audit activity obtains during individual engagements can be compiled into a more robust and comprehensive organizationwide fraud risk assessment. This practice guide describes the characteristics of fraud and the process of identifying and assessing fraud risks during engagement planning. The exact process of incorporating a fraud risk assessment into engagement planning may vary according to the needs of the individual organization, internal audit activity, and engagement. However, the process generally includes the following steps: Gather information to understand the purpose and context of the engagement, as well as the governance, risk management, and controls relevant to the area or process under review. Brainstorm fraud scenarios to identify potential fraud risks. Assess the identified fraud risks to determine which risks require further evaluation during the engagement.
