A fraud risk assessment answers a narrow question: where could someone intentionally misstate the financial statements or steal assets, and which controls stand in the way? The SEC's interpretive guidance for management makes fraud part of the ICFR evaluation, COSO's 2013 framework makes it a principle, and Section 302 requires officers to tell the auditors and audit committee about fraud involving management or employees with a significant role. This post ties the three together and builds a fraud risk matrix.
What the guidance and the framework say
SEC guidance. Management's evaluation of the risk of misstatement should include consideration of the entity's vulnerability to fraudulent activity, such as fraudulent financial reporting, misappropriation of assets and corruption, and whether any exposure could result in a material misstatement. The extent of the work is commensurate with the size and complexity of the company. The risk of material misstatement due to fraud ordinarily exists in any organization, regardless of size, and may vary by location, segment and financial reporting element. One type of fraud risk that has resulted in fraudulent financial reporting in companies of all sizes is improper override of controls in the financial reporting process. Identifying a fraud risk does not mean a fraud occurred, and the absence of identified fraud does not mean no fraud risks exist. The assessment is used to evaluate whether adequate controls are in place.
COSO 2013. Principle 8 reads: the organization considers the potential for fraud in assessing risks to the achievement of objectives. It sits in the risk assessment component alongside principles 6, 7 and 9. See /us/blog/coso-2013-seventeen-principles-checklist-for-a-small-company.
IIA Standards. Standard 13.2 requires auditors to consider specific risks related to fraud when identifying risks to review, and Standard 9.4 requires the annual plan to consider coverage of fraud risk.
Section 302. The signing officers certify that they have disclosed to the auditors and the audit committee any fraud, whether or not material, that involves management or other employees who have a significant role in the issuer's internal controls. See /us/blog/sox-302-and-906-certifications-versus-section-404-reporting.
Method
- List the three categories the SEC names: fraudulent financial reporting, misappropriation of assets, corruption.
- Map schemes to accounts and processes. For each financial reporting element, ask how someone could misstate it intentionally, and how they could hide theft in it.
- Identify incentives and opportunity. Compensation tied to targets, covenant pressure, loose approval limits, access to cash or inventory, weak supervision.
- Link to existing controls. Mark which controls prevent or detect each scheme.
- Score residual risk and decide where more controls or tests are needed. See /us/blog/risk-register-scoring-likelihood-impact-and-residual-risk.
- Include override. For every area, ask what a senior person could do outside the normal process.
- Refresh when the business changes.
Worked fraud risk matrix: a hypothetical $130 million distributor
| Scheme | Category | Account | Opportunity | Existing control | Residual |
|---|---|---|---|---|---|
| Premature revenue through bill-and-hold shipments at quarter-end | Financial reporting | Revenue, receivables | Sales compensation tied to quarterly targets | Cutoff review; customer confirmations on large accounts | Medium |
| Top-side journal entries to meet covenant | Financial reporting | Multiple | CFO and controller can post entries | Entry approval; quarterly review of manual entries by the audit committee chair's designee | Medium |
| Fictitious vendor | Misappropriation | Cash, expense | AP lead can create vendors | Monthly vendor change review; vendor master comparison with employee addresses | Medium |
| Payroll ghost employee | Misappropriation | Payroll expense | Payroll specialist can add employees | HR approval; quarterly headcount to payroll match | Low |
| Kickback from a freight vendor | Corruption | Freight expense | Purchasing manager selects carriers | Annual conflict of interest disclosure; bid process over a threshold | Medium |
| Inventory theft concealed by adjustments | Misappropriation | Inventory | Warehouse supervisor posts adjustments | Cycle counts; adjustments approved by controller | Low |
The matrix drives the plan: higher residual rows get dedicated tests, such as a full-population analysis of manual journal entries posted by the CFO and controller on weekends or near period end. See /us/blog/management-override-of-controls-audit-response and /us/blog/journal-entry-testing-au-c-240.
Anti-fraud controls
The SEC guidance references management antifraud programs and controls guidance published by professional organizations, and the AICPA's paper on management override. Components often seen in practice:
- A code of conduct and annual acknowledgment.
- A hotline with audit committee oversight. See /us/blog/audit-committee-complaint-procedures-rule-10a-3-and-whistleblower-intake.
- Pre-employment screening for finance and procurement roles.
- Mandatory leave and rotation.
- Tone at the top and communications about consequences.
- Independent review of unusual transactions.
The GAO's Fraud Risk Management Framework, issued July 28, 2015 for federal program managers, describes the same cycle for government programs. It is useful as a reference for public sector and grant-funded clients.
Reporting a suspected fraud
Fraud by senior management, whether or not material, is one of the four indicators of a material weakness in the SEC guidance. Identified fraud involving management triggers the Section 302 disclosure to the audit committee and the auditors, and a suspicion short of that goes to counsel and the audit committee chair. IIA Standard 15.1 requires a final engagement communication to specify the individuals responsible for addressing findings and the planned completion dates, and Standard 11.3 requires the chief audit executive to seek advice from legal counsel or senior management before releasing communications outside the organization unless law says otherwise. Involve counsel early.
Mistakes to avoid
- Treating the fraud assessment as a one-time questionnaire.
- Leaving override out because "we trust our CFO."
- Writing the matrix without owners or dates.
- Confusing the fraud risk assessment with the audit committee's hotline report.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.A.1.a (identifying financial reporting risks, fraud risk and override) and Section II.B.1 (indicators): https://www.sec.gov/rules/interp/2007/33-8810.pdf
- Sarbanes-Oxley Act section 302, 15 U.S.C. 7241(a)(5): https://www.law.cornell.edu/uscode/text/15/7241
- COSO, Internal Control: Integrated Framework (2013), Principle 8 (framework guidance at https://www.coso.org/guidance-on-ic)
- The IIA, Global Internal Audit Standards (2024), Standards 9.4, 11.3, 13.2, 15.1: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
- GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP (July 28, 2015): https://www.gao.gov/products/gao-15-593sp
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error