The Implementation Of Fraud Risk Assessment In .

out of business. Based on the results of the researchinterviews with the management of PT X, fraud as an issuewas never contemplated and the potential costs werecertainly never calculated. Management considered that fraudwas unlikely to occur if there was a sense of kinship withinthe company. Therefore, management had little motivation todedicate resources to ameliorate the risk of fraud because asfar as they were concerned, it was unlikely to occur and,consequently, there was little or no threat to the companyAwareness of the possibility of and the threat of fraudshould be promoted constantly to the management andemployees in every company. One way to anticipate the riskof fraud is to apply fraud risk assessment. The main idea offraud risk assessment is to help the management see theinherent fraud risk in every process within the company sothat the relevant personnel can more easily manage the risks,including setting priority controls and prevention efforts toaddress these risks. Each identified risk must be measured,prioritized, and logged in a risk register so that it is easy tomanage and handle. Then, every risk should be mitigated ormanaged so as to eliminate it. Risks are dynamic – theychange constantly over time and situations - so they must bemonitored and evaluated consistently to militate againstthem.COSO issued guidelines in the Fraud Risk ManagementGuide [3] to conduct a risk assessment. The following is therecommended fraud risk assessment process for PT X. Itshould be adopted among the strategies it uses to anticipatethe risk of fraud faced by the company.1) Establish a fraud risk assessment teamThe fraud risk assessment team may comprise anemployee from the purchasing department as the main riskowner; an employee from the accounting or financedepartment; someone from the operations department; anemployee from the Human Resource Department (HRD); asales and marketing officer; a security officer, and directorleaders who are responsible for the effectiveness of riskmanagement.2) Identify fraudulent schemes and risksTo identify fraud risks, potential vulnerabilities must beidentified (both internal and external). achieving companyobjectives for one year.3) Estimate the likelihood and significance of eachfraud scheme and fraud riskThis evaluation is based on historical information, knownfraud schemes, and on interviews with those involved in abusiness process. There are five levels of the likelihood of afraud occurring:I. ImprobableII. RemoteIII. OccasionalIV. ProbableV. FrequentSignificance Impact states the degree of gravity or impactthat occurs when the risks faced actually become a reality.There are five levels of the significance of the effects offraud based on the size of the impact on a company'sfinances, reputation, and operations:I. NegligibleII. MinorIII. ModerateIV. MajorV. Catastrophic4) Determine what individuals and departments maybe involvedThe determination of the individuals and departments thatmay engage in fraudulent behavior can be gauged using thefraud triangle theory. These may include: the incentives andpressures that motivate individuals to commit fraud; theprevalence of opportunities that may give an individualconfidence that he/she can commit fraud indiscriminately;and the behavior or rationalization an individual uses tojustify acts of fraud.5) Identify existing controls and assess the effectivenessof those controlsThe next step is to examine the controls the companyalready has in place and employing before assessing theeffectiveness of these controls.6) Assess and determine the response to residual risksthat need to be mitigatedRisk-handling is conducted to reduce the impact of riskand the likelihood of it occurring. This process consists ofmodeling alternatives to deal with risks, assessing responseoptions or handling, preparing risk management plans, andimplementing them.7) Documenting the Fraud Risk AssessmentThe results of fraud risk assessment are documentedusing a fraud risk register table or a fraud risk assessmentmatrix.8) Perform risk assessment regularlyEach company will experience certain changes and thismeans the vulnerabilities to fraud will also change.Therefore, companies need to conduct regular assessments tominimize the risk on a continuous basis.B. Fraud Scenarios on the Goods Purchasing Cycle at PT XIn identifying fraud scenarios in the goods purchasingcycle of PT X, researchers collected and processed dataobtained from interviews with the PT X management,company historical information, known fraud schemes, andinterviews with people involved in the process. Thisproduced 11 possible fraud scenarios in the company’s goodspurchasing cycle. The identified scenarios were classifiedbased on the level of probability they would become realityand on the resulting impacts, which allowed them to becategorized into the various levels of risk set out in thefollowing Table II.The classification of schemes and fraud scenarios basedon the risk rankings listed above can be used by companies in176

setting priority controls and in prevention efforts. The higherthe level of risk, the higher the priority it should receive.Management must pay attention to allocating the necessaryresources to ensure the risks concerned take precedence.Conversely, the lower the risk, the fewer resourcesmanagement should allocate.TABLE II.RiskRankingFRAUD SCHEMES AND SCENARIOS AT PT XAfter conducting a fraud risk assessment on the PT Xgoods purchasing cycle, the researcher formulated controlproposals to address each of the risks identified. Based on theproposed controls summarized in the Fraud Risk Registertable, the researcher assessed the possibility and the possibleimpact of fraud to PT X so that the risk ranking estimatesafter the implementation of control. Mapping of thecompany’s fraud risks before and after the implementation ofproposed controls is summarized in Fig. 1.Fraud Schemes and ScenariosMark-up Billing SchemeAn employee marks up the value indicated on theinvoice as well as the receipt for the purchase so that theamount of money the company pays on the purchase ofthe item is greater than the money paid to the supplier.HighTheft of Inventory and EquipmentTheft of goods by taking some goods that have beenpurchased by the company for personal use or resale.KickbacksEmployees collude with suppliers to replace goods witha specification or quality that is lower than thespecification or quality required/ordered by thecompany.Shell CompanyEmployees invoice for payments to fictitious companiesthat they themselves control by:- Creating a fictitious company- Creating fictitious invoices- Make fictitious purchases, and/or- Buying products through pass-through suppliersBriberyA supplier may provide undisclosed benefits to anemployee in return for purchases.MediumOverbilling and KickbacksEmployees receive kickbacks for buying goods abovemarket valueConflicts of interestThe employee purchases goods from a supplier that theymay have a preferential relationship with, excludingother qualified applicants in the process.Insider tradingRunning a personal business within the company byacting as a supplier without authorization.Billing for Personal PurchasesAdd personal expenses into the purchase of companygoods or make purchases of goods that companies donot need and use them for personal use.LowCash LarcenyThe theft of money that should be paid to the supplierby way of delaying or taking payment money forpersonal gain.Purchasing and ReceivingChanging the quantity of purchased goods so that it doesnot match the quantity required by the company.Employees ask for more material than is needed tocomplete the job and steal the excess.a.Sumber: Pengolahan Data dari PenelitiFig. 1. Fraud Scenario – Risk MappingC. Anti-fraud Strategy on the Goods Purchasing Cycle atPT XIn this research, the anti-fraud strategy designed toanticipate fraud at PT X was based on the twin pillars offraud prevention and fraud detection.1) Prevention strategies that can be used by PT X are:1. Increasing anti-fraud awareness through:a. Fraud Training for EmployeesAll employees should be trained on thecompany's anti-fraud policy and culture.Employees should sign recognition statements,certifying that they have received training andthat they understand the policies.b. Background checks on employees andprospective employees should be companypolicy. Background checks may includeemployee criminal records and/or credit ratings.Particular attention should be paid to keyemployees who have control or access topurchasing goods.c. Enhance awareness of the detection processOne way to improve awareness of the process offraud detection is by announcing to allstakeholders that supervision has been, is, andwill be ongoing. Companies should ensure thatsupervision is done in such a way that people are177

confident that the company will actually followup on suspicious activities.2. Fraud Risk AssessmentThe head of each division should perform the process ofidentifying any possible opportunities for fraud, whetherfrom systemic or individual employee behavior, and take thesteps necessary to overcome the fraud (fraud risk response).3. Code of ConductCompanies need to document and apply a code of ethicsas one of the key mechanisms for communicating withemployees and to demonstrate the management's commitmentto creating entity integrity (clear organizational structures,fraud-related policy formulation, etc.).4. Tone at the TopHonesty and integrity among the management willstrengthen the honesty and integrity of employees throughoutthe organization. Through its actions and communications,the management can demonstrate that dishonest andunethical behavior will not be tolerated, even if the resultsmight be seen to benefit the company. The successfulimplementation of a comprehensive anti-fraud strategy reliesheavily on the direction and enthusiasm of the managementto create a positive work environment and build anti- fraudawareness across the entire organization.b. Adequate documentation and recordsPT X must adopt adequate recording procedures. Morethan 50 percent of the demand for goods purchases is stillmade through oral requests to the purchasing function.Therefore, less than half of all purchasing requests aresupported by requisition documents from the relevantdivisions. In addition, Purchase Order documentation is onlycreated when a supplier requires the document. Therefore,PT X should make the necessary corrections to ensure thatevery process in the buying cycle is recorded anddocumented correctly and consistently. Documents relatingto the buying cycle should be numbered and controlledappropriately. Therefore, the researcher recommendsimprovement in the recording procedures, including: Each purchase request needs to be made in the formof a Purchase Request Form containing informationon the quantity of goods and specifications of thedesired item Any purchase request that has been approved mustbe accompanied by a Purchase Order document tothe Supplier that:-Contains information regarding the description ofgoods, quantity, price, and date-Is reviewed and authorized by management5. Establish a company's internal control system-Is pre-numberedThe element of opportunity in the fraud triangle can beanticipated through internal controls. Improvements in theinternal control system of PT X should include the following:a. Adequate separation of duties and responsibilitiesA common weakness in the control activities of small andmedium enterprises is the lack of separation of duties.Resources tend to be limited to the extent that checks andbalances are not followed. It may be difficult in practice butattempts should be made to ensure a separation in theauthorizing, storing, and recording functions. In the case ofPT X, the researcher recommends improvement in theorganizational structure so as to minimize the likelihood andimpact of fraud. This might include: The purchase function should be separate from thegoods receiving function The purchase function should be separate from thepayment function The purchase function should be separate from theaccounting function The purchase function should be separate from thestorage function The purchase function should be separate from theinventory recording function The receipt function should be separate from thegoods storage function Purchase transactions should be carried out by thestorage function, the purchasing function, thereceipt of goods, the debt recorder, and otheraccounting functions-Is recorded on the company's purchasing list-Is completely documented (including cancelledorders) The receipt function must be documented in theform of a Goods Receipt Report containing thefollowing provisions:-It must cover all receipts of goods-It should contain a record of the amount of goodsreceived on the basis of actual calculations-It should be pre-numbered-All details should be saved for every invoice,including cancelled orders-Copies should be sent to the Accounting departmentto be matched with Purchase Orders and invoices,as well as parts of the purchase as proof ofreceipt-Liability recording should be based on the PurchaseOrder document, the Goods Receipt Report, andthe invoice from the supplierc. Procedures for authorizing transactions and activitiesAll activities and transactions conducted by PT X shouldbe carried out by the head of each division. Management anddivision heads may reduce the likelihood of fraud risk byreviewing purchase documents prior to authorizing anytransaction. This procedure may include examining thecompany's requirements for the goods, checking the purchasebudget, checking purchase support documents, etc.Therefore, the researcher recommends improvements in theauthorization system, including:178

Purchase requisitions must be reviewed in advanceby the relevant function head regarding thecompany's needs for the goods as well as checkingthe purchase budget and the supporting documentsfor the purchase Purchase requisition should be authorized by thehead of division A Purchase Order should be authorized bypurchasing function and manager A Goods Receipt Report should be authorized bythe goods receiving functiond. Physical control of assetsThe company must compile a detailed inventory of itsgoods. PT X needs to separate ready-to-use items from highvalue items. In addition, access should be limited to storerooms. At present, every PT X employee can access thegoods storage area. This is extremely risky because itprovides an opportunity to commit fraud.e. Anti-fraud Procedures and PolicyThe management needs to communicate its anti-fraudpolicies to all employees as part of its new hire inductionprocess. Companies need to confirm the procedures in theevent of uncovering fraud, emphasizing the various sanctionsthat it will apply depending on the degree of the offense. Thisis a useful deterrent measure. If implemented, it will reducethe risk of fraud. Therefore, the researchers believecompanies should apply this and other internal controlpractices, including: Purchase requisitions should be pre-numbered andtheir use must be monitored by the relative division Purchase Orders should be pre-numbered and theiruse must be monitored by the purchasing function Goods receiving Reports should be pre-numberedand their use must be accounted for by the goodsreceiving function Suppliers should be selected on the basis ofcompetitive pricing from various suppliers Items should only be checked and received by thegoods receipt function, which should compare thesewith a copy of the relevant Purchase Order from thepurchase function The goods receiving function should inspect thegoods received from the supplier by counting andinspecting the goods and comparing them with acopy of the Purchase Order There should be a check for conformity between thePurchase Order, the Goods Receiving Report, andthe invoice from the supplier prior to payment of theinvoice Cash disbursement with supporting documentsshould be stamped "paid off" by the financedepartment after payment has been sent to thesupplierThe full recommendations are available in the finalresearch paper.2) Fraud detection strategies PT X might usefully adoptinclude:1. SupervisionCompanies need to monitor areas where there is ahigh risk of theft, such as stores and loading bays.2.3.Supervision might entail the deployment ofsurveillance cameras and dedicated securitypersonnel in key areas.Independent inspectionPerformance checks should be conducted directly bythe management through observation. Accountingfunctions in small and medium enterprises can helpmanagement to detect fraud. Random audits not onlydetect instances of fraud, they also act as a deterrent.The perpetrators will never know when an audit isdue so they do not have a chance to cover up theirfraud.WhistleblowingEncouraging whistleblowing can be an effective wayof detecting fraud. Employees who see somethingsuspicious can inform the management using ahotline or a complaint box. Best practices in creatingan anonymous complaint program include propermanagement involvement and the use of multiplecommunication methods (telephone, mail, email,etc.). These make the implementation of the programeasy, strategic, and convenient for employees tobring their concerns to the management.The successful implementation of a comprehensiveanti-fraud strategy relies on the direction and spirit ofmanagement to build an anti-fraud culture across theentire organization.The strategies to prevent and detect fraud in PT X are shownin Fig. 2 below:b.Source: AuthorFig. 2. Anti-Fraud Strategy at PT XV.CONCLUSIONS AND RECOMMENDATIONSA. ConclusionsAmong the strategies that PT X might use to anticipateand mitigate fraudulent practices, it should apply fraud risk179

6. Conduct supervision and inspections, as well asproviding anonymous ways of reporting allegedviolations of policies and fraud through a hotline or acomplaints box handled directly by the management.assessment in accordance with the guidelines contained inthe COSO Fraud Risk Management Guide [3]. Fraud riskassessment can help the management view the risks involvedin various processes within the company and manage these.This may include setting priority controls and preventionefforts to anticipate such risks.7. Since PT X does not have an internal audit function,the author recommends that it uses therecommendation contained in this research as a basisfor introducing audit procedures and corporatestandard operating procedures relative to the level ofrisk facedBased on the results of the assessment on the purchasingcycle of goods of PT X, there are three fraud scenarios thatshould be considered as high risk. At present, the company isparticularly vulnerable to the following frauds:1. The employee may mark up the value stated on the invoiceso that the amount of money the company spends on thepurchase of the item is greater than the money paid to thesupplier (Mark-up Billing Scheme).2. An employee may simply steal goods by taking itemspurchased by the company for personal use and resale(Theft of Inventory and Equipment Scheme)3. Employees may collude with suppliers to replace goodswith a specification or quality lower than the specificationor quality required by the company (Kickback Scheme)The anti-fraud strategy to anticipate fraud in PT X isbased on the application of the

COSO issued guidelines in the Fraud Risk Management Guide [3] to conduct a risk assessment. The following is the recommended fraud risk assessment process for PT X. It should be adopted among the strategies it uses to anticipate the risk of fraud faced by the company. 1) Establish a fraud risk assessment team The fraud risk assessment team may .