ACFE Fraud Risk Assessment 2 — Questions and Answers
Question 1: Which of the following best describes the concept of 'inherent risk' in a fraud risk assessment?
- The risk of fraud after controls are applied
- The risk of fraud that exists before considering any controls (Correct answer)
- The risk that auditors fail to detect fraud
- The risk arising from ineffective internal audits
Correct answer: The risk of fraud that exists before considering any controls
Inherent risk is the exposure to fraud that exists in the absence of any mitigating controls.
Question 2: A fraud risk assessment team discovers that management routinely overrides system-generated purchase order approvals. This finding is best classified as:
- A control deficiency only
- An inherent fraud risk
- A fraud risk indicator related to management override of controls (Correct answer)
- A detection risk issue
Correct answer: A fraud risk indicator related to management override of controls
Management override of controls is a classic fraud risk indicator that can enable financial statement fraud or asset misappropriation.
Question 3: When prioritizing fraud risks identified during an assessment, which factor is typically used alongside likelihood to determine overall risk rating?
- Detection lag time
- Impact or significance (Correct answer)
- Number of employees involved
- Regulatory jurisdiction
Correct answer: Impact or significance
Fraud risks are typically rated by combining the likelihood of occurrence with the potential impact or significance of the fraud.
Question 4: The 'fraud risk universe' in an organization's fraud risk assessment refers to:
- The list of convicted fraudsters in the industry
- All conceivable fraud schemes the organization could face (Correct answer)
- Only frauds that have been committed in the past year
- External fraud threats from cybercriminals only
Correct answer: All conceivable fraud schemes the organization could face
The fraud risk universe encompasses all potential fraud schemes and scenarios that could affect an organization, regardless of whether they have occurred.
Question 5: Which COSO component is most directly addressed when an organization identifies fraud risk as part of its enterprise risk management process?
- Control activities
- Risk assessment (Correct answer)
- Information and communication
- Monitoring activities
Correct answer: Risk assessment
COSO's ERM framework places fraud risk identification within the Risk Assessment component, which involves identifying and analyzing risks to achieving objectives.
Question 6: During a fraud risk assessment, an interviewer asks employees whether they are aware of any pressure to meet financial targets through questionable methods. This technique primarily assesses which fraud triangle element?
- Opportunity
- Rationalization
- Pressure/Incentive (Correct answer)
- Capability
Correct answer: Pressure/Incentive
Questions about pressure to meet financial targets directly probe the Pressure/Incentive leg of the fraud triangle.
Question 7: A residual fraud risk is best defined as:
- Fraud risk discovered after an investigation is complete
- The fraud risk remaining after management's response and controls are applied (Correct answer)
- Risk that cannot be quantified in monetary terms
- The initial fraud risk before any assessment is conducted
Correct answer: The fraud risk remaining after management's response and controls are applied
Residual risk is what remains after controls and other mitigating responses have been implemented to address inherent risk.
ACFE Fraud Risk Assessment 2
Which of the following best describes the concept of 'inherent risk' in a fraud risk assessment?