Fraud and Risk (Self) Assessments Using Process Mapping and Documentation, Questionnaires and Root Cause Analysis

Registration Process: 8:30 AM – 9:00 AM

Session Start Time: 9:00 AM

1. Why Risk and Fraud? How are they alike and where do they differ?
2. Enterprise Risk Management vs. Risk Assessment vs. Self-Assessment vs. Fraud programs
1. A quick review: What are exactly are each of these, how they work, and why ALL are of critical importance
2. Why Process Mapping and Documentation (PMD) and Root Cause Analysis are the core to each area, and the core to organizational health
1. What is PMD and how does it differ from Business Process Mapping (BPM)
2. When to use each, and continuous improvement strategies, to increase the value of your services to your own work function, to others and to the organization as a whole
3. The secret of the 95%, the two key components to highly successful organizations, and where your contribution lays
3. Gaining People's Buy-In to looking at risk and fraud and adopting an ethical organizational culture
1. Step-by-step strategies of gaining "buy-in" from the necessary people at any and all levels of your organization
1. How to address and handle people’s fear of change
2. What to do and say when any level of management says things are fine as they are (and they are not!)
3. Learn the six steps to positively influence people to see the value of integrating risk and fraud (self) assessments into organizational culture and strategy, and into their own function
2. More Critical Communication and Influencing Skills: Tying your function’s activities (ie.; audits, investigations, assessments) and your goals and objectives to another group or person’s activities and goals
1. Why it is very important to show this link in order to build rapport and their trust
3. How to show the value of using PMD, Root Cause Analysis and other techniques (see details below) to Boards, executives and management.
1. How Business Process Mapping and PMD activities ties in and fills the gap between management’s desire to achieve goals and their actual ability to achieve goals.
2. How these tools cause organizational functions to stay in alignment with the larger vision of senior management and the strategic vision for the organization.
3. How these same tools, plus a few others, can target fraud and unethical behavior more quickly.
4. How to show executives and management that they actually want a fraud program- that they will actually benefit the most from one.
5. Most important of all, learn the successful process of how to obtain PMD of potential fraud, risks and controls from the executive team, how to obtain the same plus root cause analysis at key lower levels and functions, and how to then bring the real and true information back up to management, Board and executive levels in such a manner that will increase their buy-in and support for your efforts.
4. Building a partnership both “horizontally and vertically” throughout the organization through FRSA and collaborative process mapping, documentation and root cause analysis
5. Making sure Audit Committees or equivalent also understand your objectives, how all parts of the process (i.e., from RA to FRSA to Audit Plans) all fit together and are committed.
4. FRSA Overview
1. How does FRSA fit into risk assessment, fraud and audit programs?
2. The truth about fraud: a fascinating look behind the mind of the white collar criminal.
3. Learn a specific approach for obtaining critical risks for you’re a work function to focus on.
4. Learn how to use this model to identify core risks, controls and residual risk with ANY group of people, including management and executive level teams.
5. Use this methodology for any type of organization of any size: companies, government sectors and non-profit organizations.
5. The Core Process for Leading a FRSA Workshop
1. A detailed five step process for planning and delivering the FRSA workshop from beginning to end
1. Learn exactly what to do, and where, when and how to use PMD, Root Cause Analysis to assess, fraud, risks, processes, control vulnerabilities and the state of residual risk
2. The facilitation, interviewing and probing skills to increase the participants’ respect and trust in opening up to you
3. Introduction to the tools and how you will use them with a group of people (ideal) or in one on one meeting
1. Brainstorming, Business Process Mapping and Process Mapping and Documentation, Root Cause Diagrams to Assist in making the correct and best analyses of real causes, the real control situation
2. Additional Analyses, Action Planning and Follow-up
3. Literally hundreds of strategies you never thought of or learned anywhere else for PMD and Root Cause Analysis
4. How to Use these Tools to Increase the Quality and Quantity of Information From the Participants- and the secret as to why they are so effective
5. How to Use These Tools to Manage Group Dynamics and difficult people in the group or in a one-on-one meeting
6. Using simple risk universe maps from other companies (i.e.; Caterpillar) or of your own making within the workshop to get maximum information from your participants
7. Fun ways to get even more fraud scenarios from the clients and participants
8. Additional questions you will learn the answers to:
1. How do FROAs done with executives and management teams differ from FRSAs?
2. What is the secret to making people open up and tell the truth?
3. What is my role as a facilitator and/or interviewer during this process? How do I obtain and maintain independence and objectivity? When should I NOT be objective? What is the secret to inserting my opinion without alienating the group- is that possible? When should I NOT insert my opinion(s)?
4. What do I do when the group or individual does not come up with the same risks, potential frauds, or control status that my pre-work shows to exist?
5. Can I modify this process to use at other points in an audit, i.e.; a shortened version at the engagement stage to determine scope?
6. If I only do compliance audits and assessments or only fraud investigations, how do I make these tools work for me?
7. How do I directly apply the information gathered to risk assessments, audit plans, building out the content for my fraud program, and/or to constructing a really powerful questionnaire?

1. Yet More Things You Will Learn in order to conduct outstanding Information-Gathering Sessions, AND Practice, Practice Practice!
1. Prework:
1. Planning the meeting from beginning to end to ensure success
2. Meeting with the function or division’s management before the FRSA meeting (or before an FROA): what to say and do. What results you want to get from that meeting with management
3. How to address sensitive issues (i.e.; politics, resistance, conflicts) and set clear expectations before and during the meeting
2. The actual workshop: How to start the workshop: agenda, ground rules, etc.
3. How to turn any goal into a process, procedure or system to be mapped (and how to turn any process back into a goal!)
4. Does benchmarking or further research need to be done before finishing?
1. Creating action plans for gathering necessary research before meeting again.
5. Determining and ranking risks while encouraging creativity and innovation
1. Determining the criteria for ranking risks and controls
2. Bringing the type of risk into the picture- inherent risk, present risk, and residual risk
3. Making sure the criteria for ranking and BPM improvements are customer focused, consider the vendor, and enhance quality, strategic goals and stated business objectives.
6. Assessing controls from the map or from deeper root analysis tools
1. How the participants will automatically turn controls that need to be strengthened or created into action plans
7. Ending the workshop, follow-up decisions and monitoring improvements
8. Bringing the results back to the higher levels of larger risk assessments and to your risk universe or ERM program
2. Voting/consensus ranking Techniques
1. Statistically valid, consensus-building voting techniques when accuracy is critical
2. Fun and creative voting techniques for prioritizing and also getting to consensus on which risks are the most important
3. The pros and cons of voting technology, and how to make it work for you if you decide to invest (optional).
4. Determining the right criteria to use for prioritizing risks and controls
1. Comparing voting and prioritizing and weighting techniques used in this course to the standard frequency and likelihood categories
2. For example, what criteria should be used to make sure the rankings reflect a customer focus? Should criteria differ if prioritizing and measuring reputational risk vs. financial risk?
3. Practice, Practice, Practice
1. Practice on facilitation skills and the tools for doing PMD, Root Cause Analysis, assessing and prioritizing risks and controls.
2. Going through a live simulation of a FRSA workshop
1. Specific coaching will be provided throughout to help learn the tools, body language and verbal language skills that are very effective
3. Debrief, and personally experience how FRSA all fits together as one whole system
4. Discuss applications ongoing to your own unique organization and situation
4. A Brief Introduction to the White Collar Criminal Mind
1. The two main types of criminals to know in the workplace
2. The Five components that make up the hard core white collar criminal
3. How and why it is important to learn how to think like a criminal for fraud programs
5. All about Questionnaires
1. What types of questionnaires are there and what works best in companies and different organizational cultures
2. Pros and cons to using questionnaires in risk assessments and fraud programs
1. When to use them and when not
2. Different types of questionnaires: self-assessment, 360, and abilities- based, and the strengths and limitations of each
3. Why questionnaires are not enough- they supplement and work hand in hand with PMD
3. How to put together a proper questionnaire that will gather the best information: what the experts say
4. When to use a questionnaire before doing FRSAs and when to use them as a follow up after doing FRSAs
1. Yes, you can use them both before and after process mapping, documentation and analysis
2. How to determine where to do business process mapping to verify risk and control information given in the questionnaire.
3. Asking follow-up questions after reviewing the questionnaires
5. Reviewing questionnaires from the class
1. Small groups and facilitated discussions
NOTE: If you or your colleagues have created and used a questionnaire for any aspect of risk or fraud information gathering, please bring it along with 5 copies.
6. Action Plans and Close
1. Developing a preliminary plan, prioritizing areas to cover, that you will start implementing upon your return to work
2. If time, sharing your preliminary plan in group