CFFE Module III
Fraud Risk Management flashcards
Read the question, say the answer to yourself, then turn the card to check. The first 10 of 50 cards are free; the rest come with the subject.
Card 1 of 50
Jump to a card
Complete Flashcard Reference
Review every card in this deck. Open any card to reveal its answer. The first 10 are free; the other 40 come with the subject.
What is fraud risk?
The vulnerability an organisation faces from internal or external parties capable and willing to perpetrate fraud against it. It is a specific category of operational risk, and it involves a deliberate actor actively seeking to defeat the organisation's controls.
What is the difference between inherent and residual fraud risk?
Inherent fraud risk: the level of fraud risk before considering the effect of any controls. Residual fraud risk: the level that remains after existing controls are taken into account. The gap between the two is what the existing controls are achieving.
On a 1-5 risk matrix, how is a risk score worked out? Score a scheme with likelihood 4 and impact 5.
Risk score = likelihood x impact, each rated 1-5 (5 = highest). 4 x 5 = 20, a high-risk rating. If controls cut likelihood to 2 and impact stays at 5, the residual score is 2 x 5 = 10.
What is the board of directors' role in fraud risk management?
Ultimate oversight responsibility for the organisation's risk management, including fraud risk. It sets risk appetite and holds management accountable for the programme's effectiveness.
What are the five objectives of a fraud risk management programme?
1. Reduce the likelihood of fraud occurring. 2. Limit the impact of fraud that does occur. 3. Detect fraud promptly when prevention fails. 4. Respond effectively: investigation, remediation, recovery. 5. Provide assurance to the board and stakeholders that fraud risk is being actively managed.
What are the five steps of the fraud risk management process, in order?
1. Risk identification. 2. Risk analysis. 3. Risk evaluation. 4. Risk treatment. 5. Monitoring and communication, which loops back to identification.
What are the four risk treatment options?
Avoid: cease the activity that gives rise to the risk. Reduce: strengthen controls to lower likelihood or impact. Transfer: shift the financial consequence, for example through fidelity insurance. Accept: consciously retain the risk where it falls within risk appetite and further mitigation is not cost-justified.
What columns should a well-designed fraud risk register include?
The specific fraud scheme, taken from the fraud tree. Likelihood and impact ratings, inherent and residual. Existing controls and their assessed effectiveness. An assigned risk owner accountable for it. The planned treatment or response, and the target timeline.
What is the ownership-versus-assurance test for fraud risk roles?
Ownership: management and the roles reporting to it design, implement and operate fraud risk management. Assurance: internal audit and the external auditors independently evaluate whether it works. No one does both for the same activity, because auditing your own work destroys independence.
What are the seven tasks of the fraud risk management case study?
1. Identify various fraud risks. 2. Analyse the schemes on a risk matrix (likelihood and impact). 3. Identify the existing detective and preventive controls. 4. Evaluate the effectiveness of those controls. 5. Evaluate the level of the risks. 6. Identify responses for the fraud risks. 7. Develop fraud risk frameworks: a fraud risk register and a key fraud risk register.
How is risk defined?
This answer comes with Fraud Risk Management. Buy the subject
What three types of fraud risk follow the fraud tree's branches?
This answer comes with Fraud Risk Management. Buy the subject
What is risk management, and does it aim to eliminate risk?
This answer comes with Fraud Risk Management. Buy the subject
What are the principles of risk management?
This answer comes with Fraud Risk Management. Buy the subject
What does 'tailored to the organisation's context' mean for a small NGO compared with a large bank?
This answer comes with Fraud Risk Management. Buy the subject
What is enterprise risk management (ERM), and how did it arise?
This answer comes with Fraud Risk Management. Buy the subject
How do COSO ERM and ISO 31000 differ as risk management frameworks?
This answer comes with Fraud Risk Management. Buy the subject
Where do ERM and internal control meet in fraud risk management?
This answer comes with Fraud Risk Management. Buy the subject
What does the audit and risk committee do?
This answer comes with Fraud Risk Management. Buy the subject
What is management's role in fraud risk management?
This answer comes with Fraud Risk Management. Buy the subject
What does the risk and compliance function do?
This answer comes with Fraud Risk Management. Buy the subject
What is internal audit's role, and to whom does it report?
This answer comes with Fraud Risk Management. Buy the subject
What is the legal department's role in fraud risk management?
This answer comes with Fraud Risk Management. Buy the subject
What do human resources and IT each contribute to fraud risk management?
This answer comes with Fraud Risk Management. Buy the subject
When does the investigation function come in?
This answer comes with Fraud Risk Management. Buy the subject
What front-line responsibility does every employee carry for fraud risk?
This answer comes with Fraud Risk Management. Buy the subject
What is the external auditors' place in fraud risk management?
This answer comes with Fraud Risk Management. Buy the subject
How do sector regulators and anti-corruption agencies differ in the fraud risk landscape?
This answer comes with Fraud Risk Management. Buy the subject
Why is a cross-functional fraud risk management team needed?
This answer comes with Fraud Risk Management. Buy the subject
What is fraud risk management?
This answer comes with Fraud Risk Management. Buy the subject
What principles should a fraud risk management programme follow?
This answer comes with Fraud Risk Management. Buy the subject
How does fraud risk appetite shape a fraud risk management programme?
This answer comes with Fraud Risk Management. Buy the subject
What are the six components of a fraud risk management programme?
This answer comes with Fraud Risk Management. Buy the subject
What should a fraud risk policy cover?
This answer comes with Fraud Risk Management. Buy the subject
Why embed anti-fraud work in the ERM framework rather than run a parallel programme?
This answer comes with Fraud Risk Management. Buy the subject
What stages does ISO 31000:2018 set for managing risk?
This answer comes with Fraud Risk Management. Buy the subject
What is a fraud risk assessment, and what is its objective?
This answer comes with Fraud Risk Management. Buy the subject
A vendor-kickback scheme scores 20 inherent and 10 residual, but appetite tolerates only scores up to 8. What does that tell you?
This answer comes with Fraud Risk Management. Buy the subject
What factors influence an organisation's level of fraud risk?
This answer comes with Fraud Risk Management. Buy the subject
Why conduct a fraud risk assessment?
This answer comes with Fraud Risk Management. Buy the subject
What makes a fraud risk assessment effective?
This answer comes with Fraud Risk Management. Buy the subject
What happens at the risk identification and risk analysis steps?
This answer comes with Fraud Risk Management. Buy the subject
In the fraud risk management process, what does the risk evaluation step do?
This answer comes with Fraud Risk Management. Buy the subject
Which treatment suits a low-likelihood, high-impact scheme where more controls are not cost-justified but the exposure still needs addressing?
This answer comes with Fraud Risk Management. Buy the subject
Why is monitoring and communication ongoing rather than a final step?
This answer comes with Fraud Risk Management. Buy the subject
What does the fraud risk management process culminate in?
This answer comes with Fraud Risk Management. Buy the subject
Why is a fraud risk register called a living tool?
This answer comes with Fraud Risk Management. Buy the subject
What is a key (top) fraud risk register?
This answer comes with Fraud Risk Management. Buy the subject
What goes wrong when a register entry has no risk owner?
This answer comes with Fraud Risk Management. Buy the subject
Why is an informal spreadsheet of fraud concerns, with no ratings, owners or board review, not a fraud risk management programme?
This answer comes with Fraud Risk Management. Buy the subject
How to revise with these cards
- Answer out loud or on paper before you turn the card: recalling is what fixes it.
- Go through the deck in short sessions of ten to fifteen minutes, every day.
- Shuffle once you know the order, so you are not answering from memory of the sequence.
- When a card catches you out, read the chapter it links to, then try the topic in a past paper.