Requirement
The entity considers the potential for fraud in assessing risks to the achievement of objectives.
Points of Focus
Considers Various Types of Fraud
Requirement: The assessment of fraud considers fraudulent reporting, possible loss of assets, and corruption resulting from the various ways that fraud and misconduct can occur.
Assesses Incentives and Pressures
Requirement: The assessment of fraud risks considers incentives and pressures.
Assesses Opportunities
Requirement: The assessment of fraud risk considers opportunities for unauthorized acquisition, use, or disposal of assets, altering the entity’s reporting records, or committing other inappropriate acts.
Assesses Attitudes and Rationalizations
Requirement: The assessment of fraud risk considers how management and other personnel might engage in or justify inappropriate actions.
Considers the Risks Related to the Use of IT and Access to Information
Requirement: The assessment of fraud risks includes consideration of internal and external threats and vulnerabilities that arise specifically from the use of IT and access to information.
Explanation
Fraud is a distinct risk that ordinary risk assessment can miss, so the organization must deliberately consider how fraud could occur — through false reporting, asset theft, or corruption — and who might have the incentive, opportunity, or rationalization to commit it. Auditors check that fraud scenarios, including IT-enabled ones, are explicitly assessed.
