Implementing COSO's New Fraud - Aventri

Implementing COSO’s New FraudRisk Management Guidelines

Fraud risk management is much more than amere fraud risk assessment The responsibility for managing fraud risk falls on everyone: “The board of directors, and top management and personnel at alllevels of the organization — including every level of management,staff, and internal auditors — have responsibility for managing fraudrisk.”Fraud deterrence is achieved when the organization: Establishes a visible and rigorous fraud governance processCreates a transparent and sound anti-fraud cultureIncludes a thorough fraud risk assessment periodicallyDesigns, implements, and maintains preventive and detective fraudcontrol processes and proceduresTakes swift action in response to allegations of fraud, including, whereappropriate, actions against those involved in wrongdoingSource: 2016 COSO Fraud Risk Management GuidelinesPage 2

2008: First major attempt to increase fraud riskmanagement and fraud risk assessmentsIIA, ACFE, AICPA Sponsors Fraud Risk Governance Fraud Risk Assessment Fraud Prevention Fraud Detection Fraud Investigation andCorrective ActionPage 3

2016 COSO Fraud Risk Management Guidelines1)2)3)4)5)Establishment of a Fraud RiskManagement ProgramPerforms comprehensivefraud risk assessmentsSelects, develops anddeploys preventative anddetective fraud controlactivitiesInvestigation programOngoing evaluations andcorrective action of the overallprogramSource: 2016 COSO Fraud Risk Management GuidelinesPage 4

Summary of Fraud Risk ManagementComponents and PrinciplesSource: 2016 COSO Fraud Risk Management GuidelinesPage 5

What do the COSO Fraud Risk ManagementGuidelines (FRMG) mean for my organization?COSO ERM Organization A fraud risk assessment no longercovers the expectation of Principle 8of COSO – ERM FrameworkA formal fraud risk managementprogram is the expectation.Internal auditors are expected toassess internal anti-fraud processesand controls against the FRMGExternal Auditors can assess theentity’s implementation of Principle8 of the COSO ERM Frameworkusing this guide.Page 6Non-COSO Organization Non-COSO organizations will beunable to claim that sufficientguidance or information anti-fraudprograms, controls, processes andsystems was not available.Fraud loss litigation, such asshareholder suits, could point to theCOSO FRM Guidelines and placemore responsibility for the loss onmanagement and the lack of aneffective anti-fraud program.

Principle 1 - Fraud Risk GovernancePage 7

Principle 1 - Fraud Risk GovernanceBoard and Senior Management: Makes an organizational commitment to fraud riskmanagement. Supports fraud risk governance. Establishes a comprehensive fraud risk managementpolicy. Establishes fraud governance roles and responsibilitiesthroughout the organization. Documents the fraud risk management program. Communicates fraud risk management at all organizationlevels.Source: 2016 COSO Fraud Risk Management GuidelinesPage 8

A Documented and Formal fraud riskmanagement program1.2.3.4.5.A stand-alone comprehensive document addressing indetail all aspects of fraud control activities.Development of a brief strategy outline emphasizing theattributes of fraud control activities with design andspecifics left to the responsible business functions.Providing defined, proactive processes and controlactivities to deter, prevent, and detect fraud AND theindividuals who will execute the activities.Providing a strategy for proactively using data analysisProviding a compilation of plans developed by divisionsor subsidiariesSource: 2016 COSO Fraud Risk Management GuidelinesPage 9

Analytics considerationsPrinciples 1 through 5: Aligned with GovernanceCOSO 2013 FrameworkPrinciplesControl Environment1. The organization demonstratesa commitment to integrity andethical values2. The board of directorsdemonstrates independence frommanagement and exercisesoversight of the development andperformance of internal control.3. Management establishes, withboard oversight, structures,reporting lines, and appropriateauthorities and responsibilities inthe pursuit of objectives.4. The organization demonstratesa commitment to attract, develop,and retain competent individualsin alignment with objectives.5. The organization holdsindividuals accountable for theirinternal control responsibilities inthe pursuit of objectives.Page 10Fraud Risk ManagementPrinciples1. The organizationestablishes andcommunicates afraud riskmanagementprogram thatdemonstrates theexpectations of theboard of directorsand seniormanagement andtheir commitmentto high integrityand ethical valuesregardingmanaging fraudrisk.Analytic Considerations Executivereporting Interactivedashboards Targeted analysisaround metrics,compliance andratios

Principle 2 – Fraud Risk AssessmentPage 11

Principle 2 – Fraud Risk Assessment Involves the appropriate level of managementIncludes entity, subsidiary, division, operating unit and functional levelsAnalyzes internal and external factorsConsiders various types of fraudSpecifically considers the risk of management override of controlsEstimates the likelihood and significance of risks identifiedAssess personnel or departments involved and all aspects of the fraudtriangleIdentifies existing fraud control activities and assesses their effectivenessDetermines how to respond to risksUses data analytics techniques for fraud risk assessment and fraud riskresponsesPerforms periodic risk assessments and assess changes to fraud riskDocuments the risk assessmentSource: 2016 COSO Fraud Risk Management GuidelinesPage 12

Analytics considerationsPrinciples 6 through 9: Aligned with Fraud Risk AssessmentCOSO 2013 FrameworkPrinciplesRisk Assessment6. The organization specifiesobjectives with sufficient clarity toenable the identification andassessment of risks relating toobjectives.7. The organization identifiesrisks to the achievement of itsobjectives across the entity andanalyzes risks as a basis fordetermining how the risks shouldbe managed.8. The organization considersthe potential for fraud inassessing risks to theachievement of objectives.9. The organization identifies andassesses changes that couldsignificantly impact the system ofinternal control.Page 13Fraud Risk ManagementPrinciplesAnalytic Considerations Surveys & heat maps2. The organizationperformscomprehensivefraud riskassessments toidentify specificfraud schemes andrisks, assess theirlikelihood andsignificance,evaluate existingfraud controlactivities, andimplement actionsto mitigate residualfraud risks. Media scans andexternal sources suchas industry news Complaints database

Principle 3 - Fraud Control ActivitiesPage 14

Principle 3 – Fraud Control Activities Promotes fraud deterrence through preventive anddetective control activitiesIntegrates with the fraud risk assessmentConsiders organization-specific factors and relevantbusiness processesConsiders the application of control activities to differentlevels of the organizationUtilizes a combination of fraud control activitiesConsiders management override of controlsUses proactive data analytics proceduresDeploys control activities through policies andproceduresSource: 2016 COSO Fraud Risk Management GuidelinesPage 15

A comprehensive and methodical dataanalytics process is the keySource: 2016 COSO Fraud Risk Management GuidelinesPage 16

Analytics considerationsPrinciples 10 through 12: Aligned with Fraud Control ActivitiesCOSO 2013 FrameworkPrinciplesFraud Risk ManagementPrinciplesAnalytic Considerations ABaC analyticsControl Activities10. The organization selects anddevelops control activities thatcontribute to the mitigation ofrisks to the achievement ofobjectives to acceptable levels.11. The organization selects anddevelops general control activitiesover technology to support theachievement of objectives.3. The organizationselects, develops,and deployspreventive anddetective fraudcontrol activities tomitigate the risk offraud eventsoccurring or notbeing detected in atimely manner. P2P, O2C, T&E,CRM analysis General ledgertransaction analysis12. The organization deployscontrol activities through policiesthat establish what is expectedand procedures that put policiesinto action.Page ementDemo

Frequent compliance analytics risk areas,particularly in emerging marketsMeals & EntertainmentMarketing & EventsCRM and SalesInformationSecurity/Insider ThreatEmployee PayrollSales, Distributor &Margin AnalysisVendor Payments / APCapital ProjectsAccountingReservesInventory3rd Party Due Diligence &Watchlist,Shell CompaniesCharity & DonationsEmerging monitoring activities may include Social MediaMonitoringPage 18Advanced EmailMonitoringMobil Devices

Big data techniques to counter fraud Multiple data sources – structured and unstructured Data visualization Text analytics Payment/transaction risk scoring Predictive modeling – technology assisted monitoring Case management, issue coding and built in workflow Flexible deployment modelsPage 19

Utilizing data visualization to do morePlan and build tests for: Payment risk scoring Vendor risk scoring High risk transactions Revenue recognition orsales commissions Conflicts of interestsAdditional tests forenhanced reviews: Inventory management Salaries & payroll Employee travel &entertainment FCPA/UKBA (corruptionrisks) Selected compliancetopicsPage 20Interactivedashboards inthe hands of thebusiness users

Data visualization: Accounts payable monitoringHigh risk payment descriptionsPage 21

Utilizing transaction risk scoring to do morePage 22

Forensic data analytics frameworkAn integrated, platform – from a work flow and monitoring perspectiveMonitoring UNTINGDATALibrary ofCounterFraud testsInvestigationToolsPattern MatchingText mining& advancedsearchMASTER &REFERENCEDATAStatistical& PredictiveINTERNALRISK ELEMENTSWatson / CognitiveBig dataprocessing platformEXTERNAL,SOCIAL MEDIADATAVISUALIZATION& RISK RANKINGRepeat the process:Continuous AuditingTriage, Stop Paymentand/orSample Audit SelectionAudit, Shared Services, CompliancePage 23Case Manager, TaskDelegation andData Refresh / ScriptingAutomationInvestigative mindset

Principle 4 - Fraud Investigation andCorrective ActionPage 24

Why is a formal investigation programnecessary? Increasing number of poorly performed investigationsFrauds and fraudsters missed,Root causes not obtained and internal controls notimproved,Legal and human resource implications,Poor interviewing skills and increased liabilities,Lack of dedicated and experienced forensic orinvestigative skill sets,Inadequate technological resources,Lack of routine and repetitive investigation trainingInconsistent or non-existent corrective actionPoor investigation tracking and reporting mechanismsPage 25

Principle 4 - Fraud Investigation andCorrective Action Establishes fraud investigation and response protocols Confidentiality, urgency, evidence preservation, legal protections,forensic support, investigation protocols, reporting process, rootcause and mitigating controls, etc.Conducts investigationsCommunicates investigation resultsTakes corrective actionEvaluates investigation performanceSource: 2016 COSO Fraud Risk Management GuidelinesPage 26

Monitoring investigation performance metrics Resolution timeInvestigation costsRepeat incidentsIncident location (business unit, operational area orgeography)Value of losses recovered and future losses preventedCorrective actions Internal control remediation, business process remediation,disciplinary action, training, insurance claims, extendedinvestigations, civil actions, criminal referrals**Corrective actions for fraud related incidents is an evaluationcomponent within the Federal Sentencing GuidelinesSource: 2016 COSO Fraud Risk Management GuidelinesPage 27