Business Fraud Management Checklist
By John Kyriazoglou*
This is complemented by Business Ethics Policy Example and Business Ethics Policy Checklist. See my blog: http://businessmanagementcontrols.blogspot.com/
Ethics Policy Statement
1. Does the organization have, within the corporate ethics policy, a statement with respect to fraud?
2. Who is responsible for the issue of this statement?
3. Has this policy statement been approved and ratified by the Board or other Top Management Committee?
4. Is this statement widely publicized in the organization?
5. Is this statement reviewed and improved annually (at least)?
6. Is the policy statement linked to Internal Controls?
Fraud Policy Statement
7. Does the organization have a Fraud Policy?
Consider: Procedure for a disciplinary interview, employee services termination procedure, obligations of employees during notice periods and upon termination of employment, complaints procedure, theft and threats policy, obligations of external contractors, investigating procedure, use of external approved investigators or expert internal audit personnel, and the protection procedure for the information sources.
8. How is fraud defined?
9. Has this policy been approved and ratified by the Board?
10. What kind of aspects does the policy deal with (e.g. preventive, investigative or recovery aspects)?
11. What are the objectives of the policy (e.g., avoid fraud, catch fraud, take legal action, etc.)?
12. Does the policy apply to all employees, management, board members, and external contractors?
13. Who is (manager, function, etc.) responsible for ownership and administration of the Fraud Policy?
14. How are fraud risks monitored e.g. through risk registers?
15. Is there a budget for investigative costs on potential fraud issues?
16. Does the organization specify roles and responsibilities within the Fraud Policy (e.g., for the audit committee, the Board, the HR Function, a Fraud Liaison Officer, etc.)?
Reporting Fraud and Corruption
17. What is the procedure for reporting suspicions of fraud?
18. What guidance is provided on dealing with incoming mail (such as anonymous letters, e-mails, etc.)?
19. Who are the first points of contact for reporting suspected dishonesty?
20. Does the organization operate a Fraud Hot-line?
21. Does the organization have a Whistle blowing Policy, which sets out the principles for protection of employees when reporting suspicions?
Response to Fraud and Corruption
22. Does the organization keep a register of fraud?
23. Who is responsible for maintenance of this register (e.g., A Fraud Officer)?
24. What the access rights to the fraud register?
25. Is the fraud register held securely?
26. Who is responsible for the investigation (e.g., Internal Audit)?
27. Who oversees the investigation?
28. Do written reports have to be submitted and to whom?
29. How does the organization deal with enquiries from the media?
30. Are employees suspended from work pending an investigation?
31. Are all reasonable means of recovering any identified loss pursued?
Investigation of Fraud and Corruption
32. Who monitors actual resources used against the agreed budget?
33. If a member of staff refuses to cooperate in a workplace investigation, are they liable to disciplinary action?
34. How is the interview recorded?
35. If the interview is tape recorded, is this with the permission of the suspect?
36. What does the organization do to avoid a similar occurrence of fraud in the future?
37. Who is responsible for making claims under insurance policies?
38. What is the process for notifying the police?
Rights of Employees
39. If an employee is charged with a criminal offence involving potential exposure to a term of imprisonment, are they required to report this and who to?
40. If an employee is the subject of an improper approach where a bribe is offered, is there a requirement for this to be reported and to whom?
41. Is there a presumption of innocence, unless proved otherwise?
42. At fact finding or investigative interviews, are employees suspected of dishonesty entitled to representation and by whom?
*Author’s Credentials
John Kyriazoglou, CICA, B.A(Hon), is an International IT and Management Consultant, author of the book ‘IT STRATEGIC & OPERATIONAL CONTROLS’ (published in 2010 by www.itgovernance.co.uk), and co-author of the book CORPORATE CONTROLS’ ( to be published in 2/2012 by www.theiic.org), with Dr. F. Nasuti and Dr. C. Kyriazoglou.
E-Mail: jkyriazoglou@hotmail.com
Blogs:Articles, Opinions, etc.: http://businessmanagementcontrols.blogspot.com/
Publications: http://johnkyriazoglou-works.blogspot.com/
