The SEC's Division of Enforcement, under Director David Woodcock, is prioritizing aggressive fraud enforcement. This shift means your fraud detection procedures must withstand increased regulatory scrutiny. Don't wait for an SEC inquiry to uncover gaps in your audit approach.
This template offers a structured audit program you can adapt to assess fraud risk controls. Use it to document your fraud detection procedures, demonstrate audit rigor, and prepare your organization for potential SEC examination.
Purpose of This Template
This audit program template helps internal auditors evaluate the design and effectiveness of fraud prevention and detection controls. It focuses on three critical areas the SEC examines during fraud investigations:
Management override controls, How your organization prevents executives from bypassing established controls to manipulate financial results.
Financial reporting integrity, Whether revenue recognition, expense classification, and disclosure processes contain adequate fraud deterrents.
Whistleblower protection mechanisms, How effectively your organization receives, investigates, and protects individuals who report suspected fraud.
The template structures your audit fieldwork to produce evidence that your organization maintains robust fraud prevention capabilities. When regulators ask "What did internal audit do?", you'll have documented procedures and findings ready.
Prerequisites
Before using this template, ensure you have:
Access to the fraud risk assessment completed by management or the audit committee. You're testing controls that address identified fraud risks, not conducting the risk assessment itself.
Authority to interview executives and board members without management pre-approval. Professional skepticism requires unfettered access to key personnel.
Control documentation for entity-level controls, financial close processes, and the whistleblower hotline. You need baseline control descriptions before you can test them.
Three years of financial data including journal entries, account reconciliations, and supporting documentation. Fraud patterns often emerge over multiple periods.
The Audit Program Template
Copy this structure into your audit management system or working papers. Each section includes specific procedures and evidence requirements.
FRAUD AUDIT PROGRAM: Management Override Controls
Objective: Evaluate whether controls prevent or detect management's ability to override established processes.
Procedure 1.1: Select 25 manual journal entries from the most recent fiscal year that meet high-risk criteria (posted after period close, made by executives, lacking standard supporting documentation, affecting sensitive accounts).
Evidence required: List of selected entries, approval documentation, business rationale, supporting calculations.
Procedure 1.2: Interview the Chief Financial Officer and Controller separately. Ask: "Describe a situation where you needed to override a control. What approval did you obtain?"
Evidence required: Interview notes documenting responses, any override instances mentioned, follow-up on approval evidence.
Procedure 1.3: Review access rights for all individuals with the ability to post journal entries to revenue, expense, or equity accounts without secondary approval.
Evidence required: Access rights report, segregation of duties matrix, explanation for any individuals with posting authority who also prepare entries.
Procedure 1.4: Test 15 significant estimates (revenue reserves, warranty obligations, asset impairments) to determine whether management's assumptions align with historical accuracy and external benchmarks.
Evidence required: Calculation workpapers, comparison of prior estimates to actual results, documentation of assumption sources.
FRAUD AUDIT PROGRAM: Financial Reporting Integrity
Objective: Assess whether financial close processes contain effective fraud deterrents.
Procedure 2.1: Reconstruct the complete approval chain for 10 revenue transactions recorded in the final month of each quarter. Verify that contract terms, delivery evidence, and collection probability support revenue recognition timing.
Evidence required: Contracts, shipping documentation, customer acceptance records, payment history.
Procedure 2.2: Identify all accounts where balances changed by more than 25% year-over-year without a corresponding operational explanation. Investigate the drivers of each variance.
Evidence required: Account analysis, management explanations, corroborating operational data (headcount changes, facility closures, product launches).
Procedure 2.3: Test 20 expense reclassifications made during the financial close process. Determine whether the reclassifications improved earnings presentation or corrected legitimate errors.
Evidence required: General ledger detail, reclassification justifications, pattern analysis across periods.
Procedure 2.4: Review all related-party transactions disclosed in Form 10-K and Form 10-Q. Verify that pricing, terms, and business purpose receive independent review before approval.
Evidence required: Related-party transaction log, pricing comparisons to third-party transactions, board approval minutes.
FRAUD AUDIT PROGRAM: Whistleblower Protection Mechanisms
Objective: Determine whether the organization effectively receives and investigates fraud allegations.
Procedure 3.1: Request all whistleblower hotline reports from the past 24 months. Analyze time-to-investigation, investigation quality, and outcome documentation.
Evidence required: Hotline reports, investigation files, resolution communications, tracking of corrective actions.
Procedure 3.2: Test whether employees can report concerns anonymously by submitting a test report through each available channel (hotline, web portal, direct to audit committee).
Evidence required: Test submission confirmations, receipt acknowledgments, demonstration that reporter identity remains protected.
Procedure 3.3: Interview five employees across different departments and levels. Ask: "If you suspected financial fraud, would you know how to report it? Would you feel protected from retaliation?"
Evidence required: Interview notes, assessment of awareness levels, identification of communication gaps.
Procedure 3.4: Review the investigation protocols used by the compliance function or legal department. Confirm that investigations include interviews with relevant parties, document review, and independent fact-finding.
Evidence required: Investigation procedures, sample investigation files, assessment of investigator independence.
How to Customize This Template
Adjust sample sizes based on transaction volume and organizational complexity. A company with 50,000 journal entries annually needs larger samples than one with 5,000.
Add industry-specific procedures for fraud schemes common in your sector. Healthcare organizations should test billing code accuracy; financial services firms need procedures for trading activity monitoring.
Incorporate automated testing where your GRC platform supports it. Automated control testing can flag journal entry anomalies, unusual account relationships, or policy violations in real time.
Expand whistleblower procedures if your organization operates internationally. Different jurisdictions have varying whistleblower protection requirements that affect investigation protocols.
Link to specific fraud risks identified in your organization's risk portfolio. If management identified channel stuffing as a risk, add procedures testing shipment timing and customer return patterns.
Validation Steps
Before finalizing your audit program, verify these elements:
Coverage confirmation: Map each procedure to a fraud risk in your organization's risk register. Every material fraud risk should have corresponding audit procedures.
Evidence sufficiency: Review your evidence requirements. Can you defend your conclusions if the SEC questions your audit work? Ensure you're collecting persuasive, documented evidence.
Professional skepticism check: Read through your procedures. Do they assume controls work, or do they test whether controls actually prevent fraud? Rewrite any procedures that accept management explanations without independent verification.
Regulatory alignment: If your organization operates in a regulated industry, confirm your procedures address sector-specific fraud risks that regulators examine (clinical trial data integrity in pharma, loan loss reserve manipulation in banking).
Workpaper review: Have a senior auditor review your completed workpapers against the procedures. Incomplete evidence or unsupported conclusions create vulnerability during regulatory examinations.
The SEC's focus on fraud enforcement means your audit work needs to demonstrate rigor, independence, and professional skepticism. This template provides the structure. Your judgment and industry knowledge provide the insight that makes it effective.
