The COSO/ACFE Fraud Risk Management Guide
What the COSO/ACFE Fraud Risk Management Guide offers a client, how an accountant or auditor can use it, and the independence questions to settle first.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
After a fraud, the client's board usually asks the same question: what should we have had in place? The honest answer is rarely "more controls" in the abstract. It is a deliberate programme: someone responsible for fraud risk, an assessment of where the business is exposed, controls designed for those exposures, ways for people to report concerns, and a plan for what to do when something is found.
The Fraud Risk Management Guide published jointly by COSO and the ACFE, the fraud examiners' professional association, gives that programme a structure. For accountants and auditors in South Africa, Nigeria and Kenya, it is a useful reference in two ways: as a framework to recommend to clients, and as the basis for a separate advisory engagement. This article covers what the guide offers and how a firm can use it.
What the second edition adds
COSO states that on 2 May 2023, COSO and the ACFE announced the release of the Fraud Risk Management Guide: Second Edition, which offers a blueprint for helping organisations establish an overall fraud risk management programme.
The second edition, COSO says, updates the original version released in 2016. It addresses more recent anti-fraud developments, revises terminology and adds information on technology developments, specifically data analytics. COSO also says the guide includes examples of key programme components and resources organisations can use to develop a programme effectively and efficiently, and references to other guidance for tailoring a programme to a specific industry.
For a client, the value is in having a recognised structure to work to, rather than a list of controls assembled after the last incident.
No one-size-fits-all programme
COSO states that the guide is intended to give organisations of all sizes, across all industries, the information needed to design a plan specific to the fraud risks of that entity, and adds that there is no one-size-fits-all approach to managing fraud risk.
That matters for the clients most firms serve. A family-owned distributor in Kano or Mombasa, a school in Pretoria or a farming co-operative in the Rift Valley will not build the programme a listed bank would. The guide's approach is to scale to the entity: identify the fraud risks this business actually faces, and design responses that fit its size and resources. A practical first version for a small client might be:
- a named person responsible for fraud risk, often the owner or a non-executive director;
- a short fraud risk assessment by process: cash, purchasing, payroll, inventory, revenue;
- a few targeted controls for the highest risks;
- a way for staff and suppliers to report concerns in confidence;
- an agreed response if fraud is suspected.
How fraud risk management relates to internal control
COSO states that the guide contains principles and points of focus aligned with the framework and principles of COSO's 2013 Internal Control – Integrated Framework. It also states that the second edition explains how internal control and fraud risk management are related and support each other, but differ in some important respects.
For the auditor, this is a helpful distinction to explain to clients. A business can have a reasonable system of internal control and still not be managing fraud risk deliberately, because fraud involves concealment and override that ordinary controls are not designed for. Our article on using the COSO framework to understand controls covers the internal control side.
Data analytics, interviews and whistleblower systems
COSO states that the second edition expands information on data analytics, while continuing to emphasise the importance of interviewing and whistleblower systems.
That balance is worth keeping in mind. Analytics can scan whole populations for patterns, such as duplicate suppliers, round-sum payments and unusual journals, but many frauds come to light because someone noticed and said so. A programme with strong analytics and no safe reporting channel is missing half its detection.
Offering a fraud risk review as its own engagement type
Many firms are well placed to help clients build a programme along the guide's lines, as an advisory engagement separate from the audit. In Achekam, staff choose an engagement's type when creating it, from built-in types such as annual financial statements compilation, independent review or statutory audit, and a firm can add its own named types. A firm can set up a "fraud risk review" type so that the work is planned, staffed and tracked as its own engagement rather than inside an audit file.
Achekam ships working-paper template packs written in its own words, including packs for internal audit and forensic work, which a firm can adopt and approve. They are marked as unapproved platform content until the firm adopts them. Treat them as a starting point to adapt to the firm's methodology and to the guide, not as the guide itself. Our article on internal audit and forensic assignments covers running those engagements.
Independence questions when the client is also audited
If the client is also an audit client, settle the independence questions before accepting:
- Self-review. Will the firm later audit controls it helped design?
- Management responsibility. Is the client, not the firm, making the decisions about which risks to accept and which controls to implement?
- Fee dependence and scale. Is the advisory work large relative to the audit fee?
- Public interest entities. Are stricter rules on non-assurance services for these clients relevant?
Check the ethical code that applies to the firm, and the rules of its regulator or professional body, before accepting. Record the assessment and any safeguards, and make clear in the engagement letter that management owns the programme.
COSO's fraud deterrence page describes the second edition of the Fraud Risk Management Guide, its relationship to the internal control framework and the resources that come with it.
When a client next asks what it should do about fraud, point it to the guide and offer to walk the board through the first fraud risk assessment. It is a practical conversation, and it often shows the board how much of its exposure nobody owns.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
