A business owner discovers an employee has been stealing supplies and falsifying inventory records to conceal the theft. The employee is terminated, and the company strengthens its internal controls to help prevent similar incidents. Yet despite these improvements, the organization still faces what forensic accountants call residual fraud risk.
How can fraud risk remain after stronger safeguards are implemented? The answer is simple: no system can eliminate all risk. Residual risk is the level of risk that remains after a business has implemented controls designed to reduce exposure. Even the strongest policies and procedures can sometimes be bypassed or fail under certain circumstances.
The good news is that while businesses can’t eliminate every threat, they can take proactive steps to manage and reduce their exposure.
Mitigating Threats
In general, there are two types of business risk: inherent risk, which exists before management takes steps to mitigate exposure with controls, and residual risk, which remains afterward. Consistently followed policies and procedures reduce inherent risk but usually leave organizations with some residual risk. In other words, residual risk equals inherent risk minus the impact of internal controls.
Engaging a forensic accountant to conduct a risk assessment can help your business evaluate residual risk. These professionals typically use a risk matrix, a visual tool that depicts the likelihood and severity of risk, to identify threats that require further examination. Another option is to transfer residual risk to a third party, such as an insurer. Your business might, for example, buy an errors and omissions insurance policy to reduce its financial exposure from unintentional mistakes that more robust controls might have prevented.
Sometimes, however, the cost of expanding controls or transferring residual risk outweighs the benefits. Although it may be possible to reduce residual risk, installing additional controls could be too costly or add unnecessary administrative red tape that inconveniences employees and customers. In such cases, many businesses allow residual risk to remain.
Planning For Contingencies
If you decide to leave residual risk, develop a fraud contingency plan to help reduce any potential damage. Suppose your business reconciles its bank accounts monthly, rather than daily or weekly. In this case, the residual risk is that you might not discover fraud until several weeks after it has occurred. A contingency plan could help by providing step-by-step procedures (such as “notify our bank immediately”) to remediate fraud.
Also regularly review and monitor residual risk levels. To return to the previous example, if your organization reconciles monthly and then decides to increase the number of bank accounts it uses, residual risk may rise to unacceptable levels. At that point, you might want to start reconciling weekly or daily. Staying current with industry best practices and compliance standards can further help you keep residual risk in check.
A Comprehensive Program
Although you should be aware of residual risk, you shouldn’t panic. Monitoring fraud threats and working to ensure controls are followed strictly are ongoing components of a comprehensive risk management program. Contact us to conduct a risk assessment and to potentially add new internal controls to address any vulnerabilities. We can also help investigate suspicions that a fraud scheme is underway.
