5.4 Common Traps in Fraud Risks
Key Takeaways
A fraud risk assessment identifies, analyzes, and responds to where and how fraud could occur and who could perpetrate it; it is management's tool that internal audit evaluates.
Do not confuse the auditor's role (evaluate fraud risk) with the investigator's role (gather evidence) or management's role (own controls).
Reasonable assurance, not absolute assurance: even well-designed controls cannot guarantee fraud will never occur due to collusion and override.
Management override can bypass otherwise effective controls, and COSO lists it, with collusion, among the limitations of internal control.
Trap 1: Confusing the Three Roles
Many wrong answers in this section come from blurring three distinct roles. The exam deliberately offers answer choices that are correct for the wrong actor.
| Role | Responsibility for fraud |
|---|---|
| Management | Owns fraud risk; designs and operates preventive and detective controls; performs the fraud risk assessment; sets the ethical tone |
| Internal audit | Evaluates the potential for fraud and how fraud risk is managed; stays objective; reports findings; provides assurance and advice |
| Fraud investigator / forensic specialist | Conducts the detailed investigation, gathers legally admissible evidence, interviews suspects |
When a stem asks who is responsible for establishing controls to prevent fraud, the answer is management — not internal audit. When it asks what internal audit does, the answer involves evaluating and reporting, not owning or detecting everything. And when forensic, evidence-gathering, or interview-of-suspect language appears, that is the investigator's domain, which internal auditors support but are not required to lead. Master this triangle of roles and a large share of Section D becomes automatic.
Trap 2: Absolute vs. Reasonable Assurance
A second reliable trap is the assurance standard. Internal controls and internal audit provide reasonable assurance, never absolute assurance, that fraud is prevented or detected. Two structural reasons make absolute assurance impossible:
- Collusion — two or more people working together can defeat segregation of duties, because the control assumed they would act as a check on each other.
- Management override — those with authority can bypass controls that work perfectly for everyone else. Management override of controls is especially dangerous because it neutralizes otherwise strong controls.
So any answer promising that a control will guarantee, ensure, eliminate, or completely prevent fraud is a distractor. The defensible language is reduce, mitigate, deter, or provide reasonable assurance. This is also why a layered approach — prevention plus detection plus a strong ethical culture — is the recommended posture rather than reliance on any single control.
Trap 3: Misreading the fraud risk assessment
A fraud risk assessment systematically identifies where and how fraud could occur, analyzes the likelihood and significance of each scheme, identifies who could perpetrate it, and links each risk to controls and responses. The trap: candidates assume the fraud risk assessment is internal audit's deliverable. It is fundamentally a management process (often built on the COSO-ACFE Fraud Risk Management Guide); internal audit evaluates whether it is adequate and operating, and may facilitate or advise, but does not own organizational fraud risk.
Trap 4: Treating All Anomalies as Fraud
Not every irregularity is fraud, and not every fraud indicator means fraud has occurred. The exam distinguishes:
- Error vs. fraud — the dividing line is intent. Same misstatement, different cause: an honest miscalculation is error; a deliberate one to deceive is fraud.
- Red flag vs. proven fraud — a flag triggers inquiry, not a conclusion. Over-reacting (accusing, terminating) and under-reacting (ignoring) are both wrong.
- Waste/abuse vs. fraud — inefficiency or misuse of resources without deceptive intent may be waste or abuse, not fraud.
Trap 5: Independence and objectivity during fraud work
If internal audit becomes deeply involved in fraud investigation or remediation, the exam may probe a threat to objectivity. An auditor who designed or operated a control must not provide assurance over it: Standard 2.2 presumes objectivity is impaired for 12 months after that responsibility ends, so another auditor does the work. An auditor who led an investigation may also face an objectivity threat; disclose it and assign someone independent. Forgetting that fraud work can impair objectivity is a subtle but recurring trap that links Section D back to the objectivity material in Section B.
| Trap | The fix to remember |
|---|---|
| Role confusion | Management owns, audit evaluates, investigator probes |
| Absolute assurance | Controls give reasonable assurance; collusion and override defeat them |
| FRA ownership | Management's process; audit evaluates it |
| Anomaly = fraud | Intent makes fraud; a flag is only a cue |
| Objectivity | Prior responsibility: reassign (12-month rule); other fraud involvement: disclose and reassign |
Trap 6: Wrong Sequencing and Over-Promising Detection
Two further traps round out the section. The first is wrong sequencing. When a fraud concern surfaces, the defensible order is: maintain objectivity, preserve evidence, expand procedures, then escalate to the CAE / per policy before any external or law-enforcement contact. Answers that put notify law enforcement or inform the press first are wrong; that decision belongs to senior management and legal counsel after the facts are established. Similarly, fixing the control before understanding the scheme can destroy evidence.
The second is over-promising detection by audit. Even a strong internal audit function that performs fraud-aware work cannot promise it will detect fraud, because audits are periodic, risk-based, and sample-or-analytics-driven rather than continuous and exhaustive. The honest framing is that internal audit improves the likelihood of detection and deters through its presence — not that its existence eliminates fraud risk.
Putting the traps together
Most fraud questions are answerable by asking three quick questions: Whose job is this (management, audit, or investigator)? Is this asking for absolute or reasonable assurance? Is the response proportionate to the evidence? If your candidate answer fails any of these — it owns a control audit should only evaluate, it guarantees a result, or it accuses on a single flag — eliminate it. The remaining choice is almost always the one consistent with the Standards. This disciplined elimination is faster and more reliable than trying to positively justify each option, especially under exam time pressure.
Who is primarily responsible for designing and implementing the controls that prevent and detect fraud within an organization?
The internal audit activity
The external auditors
Management
The audit committee chair personally
Why can even a well-designed system of internal controls provide only reasonable, not absolute, assurance against fraud?
Because auditors are not required to test controls
Because fraud is always immaterial
Because preventive controls are prohibited by the Standards
Because collusion and management override can circumvent controls
An internal auditor personally led an extensive fraud investigation in the procurement function last year. This year she is assigned to provide assurance over procurement controls. The primary concern is:
A potential impairment to her objectivity that should be disclosed
That she now knows too much about fraud
That she should refuse all future audit work
That management's controls are automatically deficient
Sections you finish are checked off in the contents.