CHAPTER III: INTODUCTION TO THE NEEED FOR A THE NATURE OF MANAGEMENT FRAUD

CODE OF ETHICS AND INTERNAL CONTROL ❖ Management fraud, conducted by one or more top‐level
managers within the company, is usually in the form of fraudulent
STEWARDSHIP - is the careful and responsible oversight and use financial reporting. Oftentimes, the chief executive officer (CEO) or
of the assets entrusted to management. This requires that management chief financial officer (CFO) conducts fraud by misstating the
maintain systems which allow it to demonstrate that it has financial statements through elaborate schemes or complex
appropriately used these funds and assets. transactions.

ACCOUNTING-RELATED FRAUD ❖ Managers misstate financial statements in order to receive

such indirect benefits as the following:
FRAUD - can be defined as the theft, concealment, and conversion to 1. Increased stock price
personal gain of another’s money, physical assets, or information. 2. Improved financial statements.
3. Enhanced chances of promotion, or avoidance of firing
❖ In fraud, there is a distinction between misappropriation or demotion.
of assets and misstatement of financial records. 4. Increased incentive‐based compensation
➢ Misappropriation of assets involves theft of any item 5. Delayed cash flow problems or bankruptcy.
of value. It is sometimes referred to as a defalcation, or
internal theft, and the most common examples are THE NATURE OF EMPLOYEE FRAUD
theft of cash or inventory. ❖ Employee fraud is conducted by non management
➢ Misstatement of financial records involves the employees. This usually means that an employee steals cash
falsification of accounting reports. This is often or assets for personal gain.
referred to as earnings management, or fraudulent
financial reporting. KINDS OF EMPLOYEE FRAUD

FRAUD TRIANGLE 1. Inventory theft. Inventory can be stolen or misdirected.

Incentive This could be merchandise, raw materials, supplies, or
(Pressure) finished goods inventory.
2. Cash receipts theft. This occurs when an employee steals cash
from the company. An example would be the theft of checks
collected from customers.
3. Accounts payable fraud. Here, the employee may submit a
false invoice, create a fictitious vendor, or collect kickbacks from
a vendor. A kickback is a cash payment that the vendor gives
Opportunity the employee in exchange for the sale; it is like a business bribe.
4. Payroll fraud. This occurs when an employee submits a false
Rationalization or inflated timecard.
(Attitude) 5. Expense account fraud. This occurs when an employee submits
false travel or entertainment expenses or charges an expense
❖ Incentive to commit the fraud. Some kind of incentive or pressure account to cover the theft of cash.
typically leads fraudsters to their deceptive acts. Financial
pressures, market pressures, job‐related failures, or addictive SKIMMING
behaviors may create the incentive to commit fraud. ➢ where the organization’s cash is stolen before it is entered into the
accounting records
❖ Opportunity to commit the fraud. Circumstances may provide
access to the assets or records that are the objects of fraudulent LARCENY
activity. Only those persons having access can pull off the ➢ Stealing the company’s cash after it has been
fraud. Ineffective oversight is often a contributing factor. recorded in the accounting records.
❖ Rationalization of the fraudulent action. Fraudsters typically COLLUSION
justify their actions because of their lack of moral character. They ➢ occurs when two or more people work together to
may intend to repay or make up for their dishonest actions in the commit a fraud.
future, or they may believe that the company owes them as a
result of unfair expectations or an inadequate pay raise. THE NATURE OF CUSTOMER FRAUD
❖ Customer fraud occurs when a customer improperly obtains cash
or property from a company or avoids a liability through
deception. Although customer fraud may affect any company, it
is an especially common problem for retail firms and companies
that sell goods through Internet‐based commerce.

EXAMPLES OF CUSTOMER FRAUD

1. Credit card fraud and check fraud involve the
customer’s use of stolen or fraudulent credit cards and
checks.
2. Refund fraud occurs when a customer tries to return
stolen goods to collect a cash refund.

THE NATURE OF VENDOR FRAUD

❖ Vendor fraud occurs when vendors obtain payments to which
they are not entitled. Unethical vendors may
Page | 1
 intentionally submit duplicate or incorrect invoices, send shipments ➢ Email Spoofing is to the direct financial interests of
in which the quantities are short, or send lower‐ quality goods than most business organizations, it is nevertheless a
ordered. Vendor fraud may also be perpetrated through collusion. source of irritation and inconvenience at the
workplace.
VENDOR AUDITS involve the examination of vendor records in
support of amounts charged to the company. POLICIES TO ASSIST IN THE AVOIDANCE OF FRAUD
AND ERRORS
THE NATURE OF COMPUTER FRAUD
❖ Computer fraud is the use of computers, the Internet, Internet Concepts in a Code of Ethics
devices, and Internet services to defraud people or organizations Following are three critical actions that an organization can
of resources. undertake to assist in the prevention or detection of fraud and
errors:
Industrial Espionage - the theft of proprietary company information, by 1. Maintain and enforce a code of ethics.
digging through the trash of the 2. Maintain a system of accounting internal controls.
intended target company. 3. Maintain a system of information technology controls.

Software Piracy - the unlawful copying of software programs. MAINTENANCE OF A CODE OFETHICS
INTERNAL SOURCES OF INTERNAL FRAUD Establishing and maintaining a culture where ethical conduct is
❖ When an employee of an organization attempts to recognized, valued, and exemplified by all employees. This includes:
conduct fraud through the misuse of a computer‐ based • Obeying applicable laws and regulations that govern
system, it is called internal computer fraud. business.
• Conducting business in a manner that is honest, fair, and
Internal computer fraud concerns each of the following activities: trustworthy.
1. Input manipulation - usually involves altering data that is input • Avoiding all conflicts of interest
into the computer. • Creating and maintaining a safe work environment
2. Program manipulation - occurs when a program is • Protecting the environment
altered in some fashion to commit a fraud.
3. Output manipulation - if a person alters the system’s checks
MAINTENANCE OF ACCOUNTING INTERNAL
or reports.
CONTROLS
EXAMPLES OF PROGRAM MANIPULATION
Attempting to prevent or detect fraud is only one of the
reasons that an organization maintains a system of internal
1. Salami Technique - to alter a program to slice a small controls.
amount from several accounts and then credit those small
amounts to the perpetrator’s benefit. The objectives of an internal control system are as follows:
2. Trojan Horse Program - is a small, unauthorized • Safeguard assets (from fraud or errors).
program within a larger, legitimate program, used to • Maintain the accuracy and integrity of the
manipulate the computer system to conduct a fraud. accounting data.
3. Trap Door Alteration - is a valid programming tool that is • Promote operational efficiency.
misused to commit fraud. As programmers write software • Ensure compliance with management directives.
applications, they may allow for unusual or unique ways to
enter the program to test small portions, or modules, of the
CONTROL ENVIRONMENT sets the tone of an organization
system.
and influences the control consciousness of its employees.
EXTERNAL SOURCES OF COMPUTER FRAUD
RISK ASSESSMENT considers existing threats and the potential
❖ External computer frauds are conducted by
for additional risks and
someone outside the company who has gained
stands ready to respond should these events occur.
unauthorized access to the computer.

TWO COMMON TYPES OF EXTERNAL FRAUD

1. Hacking is the term commonly used for computer network

break‐ins. Hacking may be undertaken for various reasons,
including industrial espionage, credit card theft from online
databases, destruction or alteration of data, or merely thrill‐
seeking.
➢ [DOS Attack] A denial of service attack is
intended to overwhelm an intended target computer
system with so much bogus network traffic that the
system is unable to respond to valid network traffic.

2. Spoofing occurs when a person, through a computer system,

pretends to be someone else.
➢ Internet Spoofing is the most dangerous to the
accounting and control systems, because a spoofer
fools a computer into thinking that the network traffic
arriving is from a trusted source.

Page | 2
CONTROL ACTIVITIES policies and procedures that help extensive framework of information technology controls, entitled
ensure that management directives are carried out and that COBIT, for Control Objectives for Information Technology
management objectives are achieved.
Trust Service Principles.10 This guidance addresses risks and
The control activities include a range of actions that should opportunities of information technology, and the most recent
be deployed through the company’s policies and procedures. version became effective in 2006. The Trust Services Principles
These activities can be divided into the following categories: set forth guidance for CPAs who provide assurance services for
1. Authorization of transactions organizations.
2. Segregation of duties
3. Adequate records and documents Risk and controls in IT are divided into five categories in
4. Security of assets and documents the Trust Services
5. Independent checks and reconciliations Principles, as follows:
1. security
AUTHORIZATION refers to an approval, or endorsement, from a 2. availability
responsible person or department in the organization that has been 3. processing integrity
sanctioned by top management. 4. online privacy
5. confidentiality
When management delegates authority and develops guide- lines as to
the use of that authority, it must assure that the authorization is
separated from other duties. This separation of related duties is called THE SARBANES–OXLEY ACT OF 2002
SEGREGATION OF DUTIES. The Sarbanes–Oxley Act was signed into law on July 30, 2002, for
the purpose of
improving financial reporting and reinforcing the importance of corporate
ethics.

SEGREGATION OF DUTIES.
• AUTHORIZATION SECTION 404—MANAGEMENT ASSESSMENT OF
• RECORDING INTERNAL CONTROLS
• CUSTODY An internal control report is required to accompany each
financial statement filing. The internal control report must establish
management’s responsibility for the company’s internal controls
and related financial reporting systems.

SECTION 406—CODE OF ETHICS FOR SENIOR

ADEQUATE RECORDS AND DOCUMENT is management is FINANCIAL OFFICERS
conscientious and thorough about preparing and retaining The Act requires all public companies to have in place a code of ethics
documentation in support of its accounting transactions, internal covering its
controls are strengthened. CFO and other key accounting officers. The code must include principles
that advocate honesty and moral conduct, fairness in financial
SECURITY OF ASSETS AND DOCUMENTS Organizations reporting, and compliance with applicable governmental rules and
should establish control activities to safeguard their assets, documents, regulations.
and records.

INDEPENDENT CHECKS AND RECONCILIATION, Group 3:

Independent checks on performance are an Janoden, Faisa
important aspect of control activities. INDEPENDENT CHECKS serve Baunto, Shairah
as a method to confirm the accuracy and completeness of data in the
accounting system. A RECONCILIATION is a procedure that
Abdullah, Hafsa
compares records from different sources. Solaiman, Abdulmoin
Japar, Janifah
Monitoring involves the ongoing review and evaluation of the Junaid, Johanie
system. Hadji Hassan, Johanisah
Goling, Jehan
Reasonable assurance means that the controls achieve a sensible Cali, Hakima
balance of reducing risk when compared with the cost of the control. Guba, Aina

MAINTENANCE OF A INFORMATION TECHNOLOGY

CONTROLS

➢ Information technology plays such an important role in

organizations that any failure in these systems can halt
such ongoing operations as sales, manufacturing, or
purchasing. IT systems have become the lifeblood of
operations for most companies.

In response to this need, the Information Systems Audit and

Control Association (ISACA) developed an
Page | 3