Part A: The integrated case
Prevention and detection of fraud
Key takeaways
- A case-study answer on prevention and detection works through four connected steps: diagnose the risk exposure, assess the existing control environment, identify the prevention gaps and recommend detective measures.
- Diagnosis applies the fraud tree and the fraud triangle to the facts given, tying pressure, opportunity and rationalisation to the specific organisation described.
- An existing control is judged on whether it actually works, not just on whether it is present on paper.
- Ground every recommendation in the case facts and name the fraud triangle element it addresses; a generic list of controls scores lower than the same controls explained against the weakness found.
- Keep prevention (stopping fraud before it happens) and detection (catching it after) distinct in the answer structure.
This capstone paper is not broken down any further in the syllabus, it draws together the whole diploma into an integrated case-study exercise. This first topic revisits prevention and detection (covered in CFFE Fraud Prevention and Detection) as an applied, case-study skill: given a described organisation, identify its weaknesses and design a coherent response, rather than recalling isolated facts about any one technique.
A case study answer on prevention and detection typically works through four connected steps:
- Always ground each recommendation in the case facts, a generic list of controls scores lower than the same controls explained against the specific scheme and weakness identified
- Reference the fraud triangle element each recommendation addresses (pressure, opportunity or rationalisation), examiners reward that explicit connection
- Distinguish prevention (stopping fraud before it happens) from detection (catching it after) explicitly in the answer structure
- Where a fraud risk assessment (CFFE Fraud Risk Management, under fraud risk assessment) is called for, use its inherent-versus-residual risk framing to show how recommended controls change the risk picture
Exam tip
This topic is best revised by practising full case studies end to end, not by re-reading the prevention and detection material in isolation, take a past-paper-style scenario, diagnose it using the fraud triangle, then write out prevention and detection recommendations the way a real answer would be marked.
Self-check
(a) A regional SACCO's branch manager has unilateral authority to approve loans up to KES 2,000,000, with no second sign-off, and the SACCO has had no surprise audit in three years. Using the four-step structure above, diagnose the risk exposure and assess the existing control environment. (6 marks)
(b) For the same scenario, identify one specific prevention gap and one detective measure you would recommend, explicitly connecting each to a fraud triangle element. (5 marks)
(c) Explain why a generic list of controls, unconnected to the specific facts given, scores lower than the same controls explained against the diagnosed weakness. (4 marks)
Show worked answer
(a) Risk exposure: the branch manager's unchecked approval authority creates significant opportunity for insider lending or approving loans to fictitious or related-party borrowers, since no second person's judgement stands between the request and approval. Pressure and rationalisation cannot be assessed from the facts alone, but the opportunity element of the fraud triangle is clearly elevated by the absence of a second sign-off. Control environment assessment: the lack of any surprise audit in three years suggests a weak detective control layer, even if the manager's own conduct has been sound so far, there has been no independent check capable of catching a scheme early, meaning any fraud that did occur could persist undetected for a long period. (6 marks)
(b) Prevention gap: the absence of a mandatory second sign-off (dual authorisation) on loan approvals above a defined threshold, which directly reduces the opportunity element of the fraud triangle, a single individual can no longer unilaterally convert intent into an approved, fraudulent loan. Detective measure: reinstating regular, genuinely unannounced surprise audits of branch lending activity, which addresses the opportunity element differently, by increasing the perceived and actual likelihood of detection, which in turn can also weaken rationalisation (a manager confident that misconduct will remain undetected finds it easier to rationalise). (5 marks)
(c) A recommendation grounded in the specific case facts demonstrates that the candidate has actually diagnosed the described organisation's particular weakness, rather than reciting a memorised, generic control checklist that could apply to any scenario. Examiners specifically reward recommendations tied explicitly to the diagnosed risk and the fraud triangle element it addresses, since that connection is what shows genuine analytical application rather than rote recall, the skill this capstone paper is specifically testing. (4 marks)
Full-length integrated case study: Tumaini Sacco Society Limited (Part One, diagnosis)
Tumaini Sacco Society Limited (TSSL) is a deposit-taking SACCO regulated by SASRA, with 45,000 members and total assets of KES 3.2 billion, operating twelve branches alongside a mobile lending app, 'Tumaini Chapchap'. Eight months ago TSSL hired a new Head of ICT, who was given both system-administrator and database-administrator credentials for the core banking system 'to move faster' during a system migration; the SACCO's IT access policy has not been updated to separate these roles since. Credit officers may approve and disburse mobile loans up to KES 500,000 with no second sign-off, a limit the board raised from KES 150,000 fourteen months ago to speed up loan processing and improve member satisfaction scores. Internal audit's last full systems audit of the core banking platform was two years ago, and the current year's audit plan does not include one. Three weeks ago, the CEO's anonymous whistleblower line received a tip alleging that a credit officer at the Eastleigh branch, Officer X, has approved several mobile loans to members whose registration details do not match any known person, with disbursed funds transferred to a small, recurring set of M-Pesa numbers. Separately, and apparently unconnected, the external auditors' interim review two months ago flagged that several loan write-offs recorded in the November ledger were reversed in December, three days before the year-end financial statements were finalised, with no supporting board minute authorising the reversals. Part Two of this case study, at the end of the next chapter, continues this same scenario once these two matters are investigated. This is a genuine 50-mark integrated case study, worked in two connected halves; the answer to each part should be written the way an actual examination answer would be, in full, marked sentences, not as a bare list of key words.
Self-check
(a) Identify three distinct fraud risk indicators in the narrative above, and for each, state whether it points primarily toward asset misappropriation or toward fraudulent financial statements. (6 marks)
(b) Using the fraud triangle, analyse the suspected scheme at the Eastleigh branch (Officer X). (6 marks)
(c) Assess TSSL's control environment as described: identify three specific control weaknesses, and state whether each represents a missing preventive control or a missing detective control. (7 marks)
(d) Recommend two prevention measures and two detective measures for TSSL, each explicitly tied to one of the weaknesses identified in (c). (6 marks)
Show worked answer
(a) (i) The Head of ICT holding both system-administrator and database-administrator access is a segregation-of-duties red flag, primarily pointing toward fraudulent financial statements (or their concealment), since combined access lets one person both alter underlying data and control the system's own record of that alteration with no independent check. (ii) The credit limit raised from KES 150,000 to KES 500,000 with no accompanying second sign-off is a red flag pointing toward asset misappropriation, since it widens the value a single credit officer can unilaterally divert through a fraudulent loan. (iii) The unexplained November-to-December write-off reversals immediately before year-end finalisation, with no supporting board minute, is a red flag pointing toward fraudulent financial statements, the classic pattern of a late, unauthorised adjustment made specifically to influence a reported year-end figure. (6 marks)
(b) Opportunity is clearly elevated: a KES 500,000 unilateral approval limit with no second sign-off, combined with a core banking system whose access controls are already known to be weak (the Head of ICT's own combined credentials), gives Officer X a genuine, practical opportunity to approve loans to fabricated member identities and redirect the proceeds. Pressure cannot be established directly from the facts given, though a credible answer may note that a recurring set of receiving M-Pesa numbers is consistent with a sustained personal financial need rather than a single opportunistic act. Rationalisation is similarly not directly evidenced, but the absence of any recent surprise audit or systems review may have allowed Officer X to believe, correctly as it turned out, that the scheme was unlikely to be detected soon, which can itself lower the psychological barrier to a first, and then repeated, act. (6 marks)
(c) Weakness one: the Head of ICT's combined system-administrator and database-administrator access, a missing preventive control (segregation of incompatible IT duties). Weakness two: the KES 500,000 credit-officer approval limit with no second sign-off, a missing preventive control (dual authorisation above a risk-appropriate threshold). Weakness three: no systems audit of the core banking platform in two years, and none planned for the current year, a missing detective control (independent, periodic verification that access controls and system configurations remain appropriate). (7 marks)
(d) Prevention measure one: separate the Head of ICT's system-administrator and database-administrator roles between two individuals, directly closing weakness one. Prevention measure two: reinstate a mandatory second sign-off for mobile loan approvals above a defined, risk-based threshold (for instance, reverting toward something closer to the original KES 150,000 limit, or introducing a second approver above it rather than removing the higher limit outright), directly closing weakness two. Detective measure one: schedule and actually carry out a full systems audit of the core banking platform in the current audit plan, directly closing weakness three. Detective measure two: introduce regular, genuinely unannounced surprise audits of branch-level loan disbursements, which would independently increase the likelihood of catching a scheme such as Officer X's promptly, addressing the same underlying detection gap from a different angle. (6 marks)