Continuous controls monitoring can help deter and prevent fraud.

• Author: Ramamoorti, Sridhar
• Position: Technology

The biannual survey of the Association of Certified Fraud Examiners'(ACFE) found that U.S. organizations lose an estimated 7 percent of annual revenues to fraud. Based on corresponding United States GDP figures from the World Bank, this percentage indicates a staggering estimate of losses--around $994 billion--among U.S. organizations, despite increased emphasis on anti-fraud controls and recent legislation to combat fraud.

As the survey suggests, almost every large and small organization is potentially susceptible to fraud risk, both internally from employee theft and corruption, and externally by vendors and other third parties engaged in fraud against the organization.

The recent spate of corporate governance failures further underscores the need to establish strong anti-fraud programs and controls. Organizations have seriously evaluated making fraud risk assessments a mandatory part of internal audit coverage with follow up in areas with a heightened sensitivity to fraud risk.

Many companies have set up separate units to handle potential fraud allegations. For example, Microsoft Corp. launched a Department of Financial Integrity. Most audit committees typically check with individuals from the company's internal audit function as to whether fraud risk assessments have been performed and whether the audit coverage concerning potential fraud risk is adequate, typically as part of their enterprise risk management efforts.

Financial executives realize that fraud remains a largely unmitigated risk because those perpetrating fraud naturally attempt to conceal their tracks, leaving no audit trail. However, manual detection of fraud that is perpetrated within information-intensive transaction processing operations or financial processes is increasingly impractical due to the sheer volume and complexity of the data.

Further, manual detection occurs too late to prevent expensive fraud and its devastating reputational and financial consequences. Controls that use automation are indispensable for detecting fraud within automated operations. As such, and for a variety of reasons, proactive fraud risk management and mitigation efforts must involve automated anti-fraud programs and controls.

However, even if organizations have implemented automated controls, they need to have a way of monitoring these automated internal controls to ensure that they are operating effectively over time. It is in such instances that continuous controls monitoring (CCM)...