Hrm 531 Week 3 Individual Assignment

Professional auditing standards discuss the three key “conditions” that are typically present when a financial fraud occurs and identify a lengthy list of “fraud risk factors.”

2 Managing fraud risk: The audit committee perspective Fraud in a fi nancial statement audit

Effective planning & execution of risk assessment procedure in all financial & operating sectors to identify potential risk to organization.

CAS 300 requires auditors to their audit using a risk based model where the nature, timing and extent of audit procedures are based on the assessed risk of material misstatement. Pickett (2006) argues that for audits to be effective and efficient, much of the audit effort should be focused on areas that are considered to pose the highest audit risk. Additional audit procedures should be linked to individual audit assertions whereas other audit procedures need to be performed as and when needed. Thus, for an audit plan to be put in place, it is necessary for an auditor to come up with a risk profile of the client comprising an understanding of the business operating by the audit client, assess business risk and also perform its preliminary analytical review.

In other words, risk assessment is the process of determining the nature and extent of the breach. It is part of determining what needs to happen next. One of the most common next steps is giving notification of the breach to the affected parties.

Risk assessment is the systematic process of evaluating and estimation of the level of risk in the potential risks that may be involved in a projected activity or undertaking.

Risk refers to a likelihood, probability, a chance that a loss may occur in a given organization. Most of the times, there is a high risk when there is vulnerability. In this case, vulnerability refers to a weakness that the organization has. Risk assessment refers to the process of identification of potential hazards and proper analysis of the expected losses if those hazards occur (Homeland Security, n.d.). Risk assessment as a way of profiling risk according to impact to the organization. Some organizations have business impact analysis exercises geared towards determination of potential hazards based risk assessment approaches. Organizations’ risk differ depending on the size and the type of business they are doing. The disparity in organizations’ risk call for different adaptation of risk assessment approaches. Even with the disparities of the businesses, proper risk management not only ranks the risks according to the seriousness but also identifies the best methods to control risks in an organization.

These businesses realize that maintaining the public’s trust is one of the keys to commercial success, so they employ investigative accountants to strategically manage the complexities of risks and threats. Investigative accountants scrutinize fraudulent activities, assist senior management with risk management and strive to mitigate potential vulnerabilities. Investigate accountants often respond to fraud allegations and reported financial irregularities. They adopt a strategic threat management approach that enables them to anticipate and respond to risks. They apply advanced technology approaches to help internal customers track and manage data activities. They employ information management principles, data analytics techniques and sophisticated technology tools to help management make well-informed

Risk analysis is an integral part of data safety within an organization and the analysis is vital to the mission and success of an organization. Risk analysis is used “to identify threats and then provide recommendations to address these threats” (Taylor et al, 2006). Risk analysis encompasses not only the equipment and programs used in an organization but also covers the culture, managerial, and administrative processes to assure data security. A key factor in risk analysis is to have a good Information Resource Management Plan.

The purpose of this memo is to address the topics of inherent risk, control risk, and detection risk. We will do this by addressing an accounting policy stated in the company’s 10-K report. We will discuss risks associated with the accounting policy, recognize company controls, and test those controls. Substantive analytics and tests of details will follow. Lastly, we will discuss fraud and extended procedures to detect fraud. To end, we will conclude by outlining the main points and emphasizing our audit plan.

A risk assessment is a way to identify, evaluate, quantify, and prioritize risks (Gibson, 2011).

A risk assessment is a process which identifies the risks to confidentiality, integrity, and availability of protected information, determines the probability of a breach of information, and the resulting impact for each threat/vulnerability pair identified given the security controls already in place.

Fraud is defined as a deliberate misrepresentation that causes a person or business to suffer damages, often in the form of monetary losses through deception or concealment. And Occupational Fraud as defined by the ACFE is the use of one’s occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization’s resources or assets. Traditional fraud triangle theory by Donald Cressey explains that propensity of fraud occurring in an organization lies on three critical elements which are Pressure, Opportunity, and Rationalization.

Following the risk assessment procedures, substantive procedures are designed and conducted to detect material misstatements of relevant assertions. Substantive procedures include analytical procedures and tests of details. Analytical procedures involve evaluations of financial statement information by a study of relationships among financial and nonfinancial data. Tests of details may be divided into three types. One test is the test of account balances to address whether there are misstatements in the ending balance of an account. In the case of Crazy Eddie, auditors should have put greater attention to inventory and accounts payable accounts. The second test is a test of classes of transactions to determine whether particular types of transactions have been properly accounted for during the period. Crazy Eddies fraudulently classified these transshipping transactions as retail sales to inflate its sales revenue and continue growth at existing stores. A key ratio for retailers is to compare growth in existing stores to growth from new stores. The third and final test is a test of disclosures to evaluate whether financial statement disclosures are properly presented. Crazy Eddie prepared bogus debit memos of over $20 million to understate accounts payable.

Proper survey and the complete scenario is taken into consideration about risks in the organization which enables the proper risk assessment. Potential of each threat or risk is evaluated and graded in order to reduce the impact of the risks or reduced the probability of its occurrence.