COSO Fraud Risk Management Guide Executive Summary
COSO Fraud Risk Management Guide Executive Summary
EXECUTIVE SUMMARY
Committee of Sponsoring
Organizations of the
Treadway Commission
Principal Authors
David L. Cotton, CPA, CFE, CGFM
Chairman, Cotton & Company LLP
Sandra Johnigan, CPA/CFF, CFE
Owner, Johnigan, P.C.
Leslye Givarz, CPA
Technical Editor, Public Company Accounting Oversight Board (Retired)
Acknowledgements
COSO and ACFE thank each of the Fraud Risk Management Task Force and Advisory Panel
members (see Page vii) for their generous contributions of time, resources and knowledge.
In particular, COSO and ACFE gratefully acknowledge David L. Cotton,
Chair of the Fraud Risk Management Task Force, for his outstanding leadership
and efforts toward the completion of this guide.
Preface
This project was commissioned by the Committee of Sponsoring Organizations of the Treadway Commission
(COSO), which is dedicated to providing thought leadership through the development of comprehensive
frameworks and guidance on enterprise risk management, internal control, and fraud deterrence designed to
improve organizational performance and governance and to reduce the extent of fraud in organizations.
COSO is a private-sector initiative jointly sponsored and funded by the following organizations:
coso.org
September, 201 6
Research Commissioned by
Committee of Sponsoring
Organizations of the
Treadway Commission
coso.org
Foreword
In 1992 the Committee of Sponsoring Organizations of the
Treadway Commission (COSO) released its Internal Control
Integrated Framework (the original framework). The
original framework has gained broad acceptance and
is widely used around the world. It is recognized as a
leading framework for designing, implementing, and
conducting internal control and assessing the
effectiveness of internal control.
Per the 2013 COSO Framework, relevant principles represent fundamental concepts associated with components of internal control.
Per the 2013 COSO Framework, points of focus are important characteristics of principles.
Per the 2013 COSO Framework, a component is one of ve elements of internal control. The internal control components are the Control
Environment, Risk Assessment, Control Activities, Information and Communication, and Monitoring Activities.
coso.org
James D. Ratley
ACFE President and CEO
coso.org
vii
Bert Edwards
Formerly State Department
Bill Leone
Norton Rose Fulbright
Jeffrey Steinhoff
KPMG
Michael Birdsall
Comcast Corporation
Frank Faist
Charter Communications
Andi McNeal
ACFE
William Titera
Formerly EY
Toby Bishop
Formerly ACFE, Deloitte
Eric Feldman
Affiliated Monitors, Inc.
Linda Miller
GAO
Michael Ueltzen
Ueltzen & Company
Margot Cella
Center for Audit Quality
Dan George
USAC
Kemi Olateju
General Electric
Pamela Verick
Protiviti
David Coderre
CAATS
John D. Gill
ACFE
Chris Pembroke
Crawford & Associates, PC
Vincent Walden
EY
Leslye Givarz
Formerly AICPA, PCAOB
J. Michael Peppers
University of Texas
Bill Warren
PwC
James Dalkin
GAO
Cindi Hook
Comcast Corporation
Richard Woodford
U.S. Coast Guard
Investigative Service
Ron Durkin
Durkin Forensic, Inc.
Sandra K. Johnigan
Johnigan, PC
Michael Justus
University of Nebraska
Zahn Bozanic
The Ohio State University
Theresa Nellis-Matson
New York Office of the State Comptroller
Greg Brush
Tennessee Comptroller of Treasury
Jennifer Paperman
New York Office of the State Comptroller
Tamia Buckingham
Massachusetts School Building Authority
Daniel Rossi
New York Office of the State Comptroller
Ashley L. Comer
James Madison University
Molly Dawson
Cotton & Company LLP
Rosie Tomforde
Regional Government
Eric Eisenstein
Cotton & Company LLP
The COSO Board gratefully acknowledges David L. Cotton, Chair of the Fraud Risk Management Task Force, for his
outstanding leadership and efforts toward the completion of this guide.
coso.org
For purposes of this guide, the authors developed this practical denition. The authors recognize that many other denitions of fraud exist,
including those developed by the Auditing Standards Board of the American Institute of Certied Public Accountants, the Public Company
Accounting Oversight Board, and the Government Accountability Office.
Throughout this guide, the terms board and board of directors refer to the governing or oversight body or those charged with governance of
the organization.
Per COSOs Internal Control Integrated Framework (May 2013) (2013 COSO Framework), Relevant Principles represent fundamental
concepts associated with components of internal control. Points of Focus are important characteristics of principles.
coso.org
ix
Control
Environment
Risk
Assessment
Control
Activities
10. The organization selects and develops control activities that contribute to the
mitigation of risks to the achievement of objectives to acceptable levels.
11. The organization selects and develops general control activities over
technology to support the achievement of objectives.
Monitoring
Activities
Information &
Communication
12. The organization deploys control activities through policies that establish
what is expected and procedures that put policies into action.
13. The organization obtains or generates and uses relevant, quality information
to support the functioning of other components of internal control.
14. The organization internally communicates information, including
objectives and responsibilities for internal control, necessary to support
the functioning of internal control.
The 2013 COSO Frameworks 17 internal control principles have been adopted by the U.S. federal government in the Standards for Internal
Controls in the Federal Government, issued by the Comptroller General of the United States. The Federal Managers Financial Integrity Act of
1982 requires federal agencies to follow the Comptroller Generals standards. In addition, the Government Accountability Office (GAO) has
issued a Framework for Managing Fraud Risks in Federal Programs, which was developed based on leading practices as a tool for federal
agencies to use in developing Fraud Risk Management Programs. [See gao.gov/assets/680/671664.pdf.]
coso.org
Principle
Control
Environment
Principle
Risk
Assessment
coso.org
Principle
Control
Activities
Information &
Communication
Monitoring
Activities
Principle
Principle
xi
coso.org
This guide is intended to be supportive of and consistent with the 2013 COSO Framework and can serve as best practices
guidance for organizations to follow in performing a fraud risk assessment.
coso.org
xiii
This rigorous approach results in an ongoing, comprehensive fraud risk management process as follows:
Figure 1. Ongoing, Comprehensive Fraud Risk Management Process
Establish a fraud
risk management
policy as part of
organizational
governance
Establish a fraud
reporting process and
coordinated approach
to investigation and
corrective action
Perform a
comprehensive
fraud risk
assessment
coso.org
coso.org
Internal Audit
Internal auditors review their internal audit plans and how
the plans are applied to the entitys Fraud Risk Management
Programs in connection with implementation of this
guidance. Internal auditors will review this guide and
consider possible implications of changes to the entitys
fraud risk program on audit plans, evaluations, and any
reporting on the entitys fraud risk management and system
of internal control.
Independent Auditors
In many situations, an independent auditor is engaged to
audit or examine the effectiveness of the clients internal
control over financial reporting in addition to auditing the
entitys financial statements. The 2013 COSO Framework
introduced principle 8: the organization considers the
potential for fraud in assessing risks to the achievement of
objectives. Auditors can assess the entitys implementation
of that principle using this guide.
Other Professional Organizations
Other professional organizations providing guidance
on fraud risk as it relates to operations, reporting, and
compliance may consider their standards and guidance in
comparison to the guide. To the extent diversity in concepts
and terminology is eliminated, all parties benefit.
Educators
With the presumption that the guide attains broad
acceptance, its concepts and terms will find their way into
university curricula.