1. Available free of charge:
Responding to Fraud Risk: Exploring Where Internal Auditing Stands
Farah G. Araj,
CIA, CPA, CFE, QIAL
The IIARF encourages those who are presenting this slideshow to download the full report from The IIA Research Foundation and make it available to their audience.
Available free of charge:

2. CBOK 2015 Practitioner Study
CBOK is the Global Internal Audit Common Body of Knowledge:
The global practitioner survey is the largest ongoing study of internal audit professionals in the world.
More than 25 free reports about practitioners and the profession will be released from July 2015 to July
Download free reports from the CBOK Resource Exchange at The IIA website at any time (

3. CBOK 2015 Practitioner Survey
Practitioner Survey Results
Survey completed April 1, 2015
14,518 usable survey responses
Participation Levels
100% representation from IIA institutes
Responses from 166 countries
23 languages

4. CBOK 2015 Practitioner Study
Global Regions are based on World Bank Categories. Percentages are the percentage of total survey responses from that region compared to all survey responses.
North America: 19%
Latin America & Caribbean: 14%
Middle East & North Africa: 8%
Sub-Saharan Africa: 6%
Europe & Central Asia: 23%
South Asia: 5%
East Asia & Pacific: 25%

5. CBOK 2015 Practitioner Study
The speaker does not necessarily need to say this, but it’s important to remember that each pie chart is based only on those who answered that particular question (in other words, not all 14,518 survey respondents provided an answer to every question.) Below are the specific number of responses for each question shown on the slide.
Age was obtained from 12,780 respondents; Organization Type was obtained from 13,032 respondents; Gender was obtained from 14,357 respondents; Staff Level was obtained from 12,716 respondents.
Age was obtained from 12,780 respondents; Organization Type was obtained from 13,032 respondents; Gender was obtained from 14,357 respondents; Staff Level was obtained from 12,716 respondents.

6. Responding to Fraud Risk: Exploring Where Internal Auditing Stands
Research Objectives
How important is fraud risk to internal audit and its stakeholders?
To what extent are internal auditors responsible for fraud prevention and detection?
Are internal auditors capable of responding to fraud risk?
This report takes a closer look at fraud related questions and responses from the Survey in order to answer 3 important questions.

7. The IIA’s Standards
1210: Proficiency (1210.A2) – Internal auditors must have sufficient knowledge to evaluate the risk of fraud and the manner in which it is managed by the organization…
2120: Risk Management (2120.A2) – The internal audit activity must evaluate the potential for the occurrence of fraud and how the organization manages fraud risk.
2210: Engagement Objectives (2210.A2) – Internal auditors must consider the probability of significant errors, fraud, noncompliance, and other exposures when developing the engagement objectives.
Before we look at the results of the research it is important to recap the requirements of the IIA’s Standards as they relate to fraud risk. This isn’t a comprehensive list and there are Standards relating to the role of internal audit in evaluating an organization’s ethics and values which also impact the effectiveness of how fraud risk is managed.

8. A Closer Look The Global Focus on Fraud Risk
Internal Audit’s Responsibility for Fraud Prevention and Detection
Internal Audit Capabilities in Responding to Fraud Risk
Five Ways to Improve Internal Audit’s Approach to Fraud Risk
The Survey results are divided into 3 sections in the research report.

9. Section 1: The Global Focus on Fraud Risk
Globally, only 19% believe their executive management focuses on fraud as a top five risk, while 31% say that internal audit focuses on fraud as a top five risk. I.e. internal audit places more emphasis on fraud risk than they believe executive management does.
Globally, the most focus on fraud risk seems to be in South Asia, where the vast majority of survey responses are from India. This added focus in India is the result of new regulation with specific provisions on fraud.

10. Section 1: The Global Focus on Fraud Risk
Focus on Fraud Risk Is Highest in Privately Held Organizations, while only 24% of CAEs in the financial sector selected fraud as a top 5 risk.

11. Section 1: The Global Focus on Fraud Risk
Although 71% of internal auditors in said in the CBOK 2010 study that they were engaged in fraud investigations, this year in CBOK 2015 only 3 out of 10 CAEs selected “investigating or deterring fraud” as a top five value-adding activity.
In 2010, the financial crisis was cited as a reason for the increased activity around fraud investigations.
A explanation as to why CAEs didn’t select investigating or deterring fraud as a top 5 value add activity is that detecting and investigating fraud takes a significant amount of time and redirects internal audit efforts away from important organizational issues.

12. Section 1: The Global Focus on Fraud Risk
Only 25% of CAEs globally believe that internal audit focus on fraud risk will increase in 2015 compared to the previous year.
The CAEs from Emerging and Developing markets seem to expect more focus on fraud risk.

13. Section 2: IA’s Responsibility for Fraud Prevention and Detection
About 3 out of 10 of all survey respondents say internal audit has “all or most of the responsibility” for detecting or preventing fraud at their organizations.
You can also see some anomalies in terms of:
All responsibility for fraud prevention (6%): Where is the 1st line of defense? Management is responsible for internal control including anti-fraud controls.
- No responsibility for fraud detection (12%): This goes against the Standards!

14. Section 2: IA’s Responsibility for Fraud Prevention and Detection
FRAUD DETECTION (REGIONAL)
Focus on the green bars which show internal audit departments with all or most of the responsibility for FRAUD DETECTION. The highest is in India followed by the Middle East and Latin America.
North America has a more balanced view whereby the vast majority have some responsibility for fraud detection (which takes into account mgmt’s responsibility)

15. Section 2: IA’s Responsibility for Fraud Prevention and Detection
FRAUD PREVENTION (REGIONAL)
Focus on the green bars which show internal audit departments with all or most of the responsibility for FRAUD PREVENTION. The results for prevention are also similar with the highest being in India followed by the Middle East and Latin America.

16. Section 2: IA Responsibility for Fraud Prevention and Detection
Privately held organizations:
All or Most Responsibility for Fraud Detection 36% (Global Average 29%)
All or Most Responsibility for Fraud Prevention 35% (Global Average 26%)
IA Departments with More than 50 Internal Auditors:
All or Most Responsibility for Fraud Detection 37% (Global Average 29%)
All or Most Responsibility for Fraud Prevention 33% (Global Average 26%)
Other insights on IA’s Responsibility for Fraud Prevention and Detection:
Internal audit has more responsibility for both fraud prevention and detection in privately held organisations. Could be attributed to the tendency of privately held organizations to lack a second line of defense.
- Internal audit has more responsibility for both fraud prevention and detection in companies with more than 50 internal auditors. The results may be explained by the existence of dedicated fraud specialists or investigators in larger internal audit departments, which usually cannot be justified in smaller departments due to cost constraints.

17. Section 3: IA Capabilities in Responding to Fraud Risk
Internal auditors appear confident when it comes to incorporating fraud risk into engagements and supporting fraud risk awareness.
About 6 out of 10 respondents believe they are advanced or expert when it comes to incorporating ethics and fraud considerations in audit engagements, and another 5 out of 10 feel this way about supporting fraud risk awareness (see the gold and purple bars in exhibit 13).

18. Section 3: IA Capabilities in Responding to Fraud Risk
Only 6% of internal auditors globally (5% in 2010) have a fraud examiner certification, such as the ACFE’s certified fraud examiner (CFE) certification.
The highest region of internal auditors with fraud examination certification was North America at 15%, followed by 8% in the Middle East. The remaining
global regions had an average of about 3%.

19. Section 3: IA Capabilities in Responding to Fraud Risk
The use of data analytics is an important component of mature anti-fraud programs.
About 5 out of 10 internal audit departments that have data analytics activity use it to identify possible frauds, among other things. This rises to 62% in organizations with more than 100,000 employees.

20. Section 4: Five Ways to Improve IA’s Approach to Fraud Risk
Establish internal audit’s role regarding fraud.
Educate management about fraud risk.
Be proactive in addressing fraud risk.
Build a database of lessons learned.
Create access to the right skills.
Establish internal audit’s role regarding fraud risk: Will internal audit support or lead investigations, manage hotlines, review fraud related procedures & policies. etc We learned earlier that only 1/3 of CAEs view fraud investigations as a top 5 value added activity. As such you may want to push responsibility on to the business….unless you work for a privately held organization where there are different expectations.
Educate management about fraud risk: Hold sessions on occupational fraud, the Standards and the role of internal auditing, the 3 lines of defence as it relates to fraud risk management, etc. Do this regularly.
Be proactive in addressing fraud risk: Audit management’s anti-fraud program, or anti-bribery & corruption program, facilitate fraud risk assessments, audit high risk areas. Don’t just wait for fraud to happen!
Build a database of lessons learned: Those who ignore history are bound to repeat it!!! This should be part of the training your team receive.
Create access to the right skills: Whether training your employees or relying on outsourced providers, if your mandate requires IA to investigate, you should have the ability to respond quickly.

21. Conclusion: Responding to Fraud Risk
More than 80% of internal auditors globally indicate they have some or most of the responsibility for detecting and preventing fraud in their organizations.
On average, only 3 out of 10 CAEs chose fraud as one of their top five risks.
Fraud risk is more likely to be chosen as a top five risk by internal audit than by management.
Internal auditors in privately held organizations are more focused on fraud than other organization types.
Even though fraud is not the primary focus of internal audit, when major fraud happens in an organization, management and internal auditors often redirect all of their focus and energy to fraud risk. NOTE CONTINUED ON NEXT CONCLUSION SLIDE

22. Conclusion: Responding to Fraud Risk
94% of internal auditors do not have fraud examination certification.
Yet about half of internal auditors believe they are competent or better at supporting fraud awareness and incorporating fraud considerations in audit engagements.
CAEs should make sure the role of internal audit is very clear to all stakeholders. Otherwise, questions may be raised about their effectiveness.
CAEs need to be proactive when it comes to addressing fraud risk and apply a risk-based approach to their efforts.

23. CBOK 2015 Releases Jul. 2015 Aug. 2015 Sept. 2015 Oct. 2015 Nov. 2015
IIA International Conference
Governance, Risk, and Control Conference
South Africa Conference
IIA Financial Services Exchange
ECIIA Conference
All Star Conference
Southern Regional Conference
ACIIA Conference
IIA Midyear Committee Meetings
Jul. 2015
Aug. 2015
Sept. 2015
Oct. 2015
Nov. 2015
Dec. 2015
Driving Success in a Changing World: 10 Imperatives for Internal Audit
Navigating Technology’s Top 10 Risks: Internal Audit’s Role
Staying a Step Ahead: Internal Audit’s Use of Technology
A Global View of Financial Services Audits:
Challenges, Opportunities, and the Future
Who Owns Risk?
A Look at Internal Audit’s Changing Role
Combined Assurance: One Language, One
Voice, One View
Responding to Fraud: Exploring Where Internal Auditing Stands
Auditing the Public Sector: Managing Expectations, Delivering Results
Measuring Internal Audit Value and Performance
Core Competency Levels for Internal Auditors
Please share information about the publication of upcoming CBOK reports and where to go for the free download.

24. CBOK 2016 Releases GAM Conference SoPac Conference
Leadership Conference
IIA International Conference
Jan. 2016
Feb. 2016
Mar. 2016
Apr. 2016
May 2016
Jun. 2016
The Skills Most Desired by IA Managers for Their Staffs
Use of Third Parties by Internal Audit
Interacting with Audit Committees
CAE Career Path
Women in IA: Representation and Trends
Maturity Levels for IA Dept. Around the World
How to Evaluate and Motivate Your Staff
Certifications Held by Internal Auditors
Ethical Pressures Faced by Internal Auditors
IIA Standards: Conformance and Trends
Quality Assurance and Improvement Program Trends
Integrated Reporting
Organizational Governance: Internal Audit's Role
Additional reports that will be available for a free download..

25. YOUR DONATION DOLLARS AT WORK
FREE thanks to generous contributions from individuals, organizations, IIA chapters, and IIA institutes around the world.
Download your FREE copy today at the
CBOK Resource Exchange.
This report was generously
sponsored by
The IIARF encourages those who are presenting this slideshow to download the full report from The IIA Research Foundation and make it available to their audience.

26. About The IIA Research Foundation
CBOK is administered through The IIA Research Foundation (IIARF), which has provided groundbreaking research for the internal audit profession for nearly four decades. Through initiatives that explore current issues, emerging trends, and future needs, The IIARF has been a driving force behind the evolution and advancement of the profession. For more information, visit:

27. Copyright and Disclaimer
The IIARF publishes this document for information and educational purposes only. IIARF does not provide legal or accounting advice and makes no warranty as to any legal or accounting results through its publication of this document. When legal or accounting issues arise, professional assistance should be sought and retained.
Copyright © 2015 by The Institute of Internal Auditors Research Foundation (IIARF). All rights reserved. For permission to reproduce or quote, please contact