What Is the Role of Internal Audit in Fraud Risk Management?

Internal auditing is essential for effective fraud risk management, especially in areas like travel and expense management, where risks of unauthorized or inappropriate spending are high.

But, the way internal audits are conducted has changed significantly over the past decades, transforming from a traditional compliance function to a proactive strategy for identifying and mitigating fraud risks.

Evolution of Internal Auditing

With advancements in digital technology, auditing has moved beyond manual processes to embrace automation, data analytics, and real-time reporting. These tools allow internal auditors to monitor spending continuously, making it easier to detect discrepancies or irregularities as they occur.

The best way to conduct internal audits is to review 100% of expense reports. However, doing that manually is exhaustive, costing staff time and money. Modern automated solutions like those offered by SAP Concur can provide real-time analytics and enhanced visibility into expense data. This helps you track spending behaviours and identify potential areas of concern before they escalate.

Automated solutions also contribute to more effective monitoring, which reduces the likelihood of human error and enhances accuracy.

Identification and Mitigation of Fraud Risks

What does an internal audit do? At its core, internal auditing identifies and mitigates fraud risks. By establishing robust auditing procedures, you can detect fraudulent activities more easily and take corrective action.

Internal auditors employ a variety of techniques to identify fraudulent patterns. These include:

• Transaction monitoring: Regularly reviewing all transactions to detect inconsistencies, such as expenses submitted outside of policy limits.
• Anomaly detection: Using data analytics to pinpoint outlier transactions, which could signal fraud.
• Pattern recognition: Identifying repeated instances of suspicious behaviour across various expense reports or among specific employees.

SAP Concur solutions can help with these processes, using AI-enhanced algorithms to detect anomalies and suspicious patterns in real-time. For example, automated alerts can notify auditors of duplicate or noncompliant spend, making it easier for organizations to address potential fraud before it incurs financial losses.

The platform’s reporting tools also help auditors examine expense trends, allowing them to proactively refine policies and address areas where fraud may occur.

Examples of Common Frauds

Fraudulent activities in travel and expense reporting are, unfortunately, not uncommon. A Pulse survey commissioned by SAP Concur revealed that 65% of business travellers admitted questionable expenses where employees tried to get reimbursed for personal expenses.

Below are some examples of frequent types of fraud that internal auditing aims to uncover and prevent:

Mischaracterized Expense Fraud

Mischaracterized expense fraud occurs when employees report non-business-related expenses as legitimate business expenses. These expenses may appear reasonable on the surface but are actually personal in nature.

Examples of mischaracterized expenses

• Golf course fees for personal leisure labeled as "client entertainment."
• Family cell phone lines included as a "communication expense" for the business
• A meal that includes friends or family members, reported as a business meeting

Falsified Claim Expense Fraud

Falsified claim fraud involves the submission of altered, fabricated, or stolen receipts to inflate expenses. Employees may create fake receipts or modify existing ones to claim more than they spent. For example, they might alter a $30 meal receipt to show a $130 meal, pocketing the difference.

Examples of falsified claim expense fraud

• Creating receipts using online tools
• Submitting a friend’s hotel receipt as a business expense
• Altering meal receipts to add extra guests or increase the total

Inflated Claims Expense Fraud

In inflated claims fraud, employees overstate the amount they spent on legitimate expenses to receive a larger reimbursement. For example, an employee might buy office supplies totalling $500, submit that receipt for reimbursement, and then return part of the purchase for a $300 refund, effectively keeping the difference.

Examples of inflated claims

• Submitting expenses at a higher rate than actually incurred
• Reporting add-ons for flights or accommodations that were refunded or unused
• Claiming additional mileage for personal car use by overstating distances.

Multiple Claim Expense Fraud

Multiple claim fraud, or double-dipping, involves submitting the same expense more than once, hoping approvers won’t notice the duplication. This might happen over several months, or it could involve sending the expense to separate approvers, making detection more challenging without a central tracking system.

Examples of multiple claim fraud

• Submitting the same meal or hotel receipt in different months
• Claiming the same travel expenses multiple times
• Reporting the same business purchase in different departments to avoid scrutiny

Best Practices in Internal Auditing

To maximize the effectiveness of fraud prevention, organizations need to embrace best practices for internal auditing. Here are a few of the keys to improving your internal audits.

Implement Automated Solutions for Expense Auditing

Using platforms like SAP Concur can help companies streamline the auditing process. Automation reduces the manual workload on auditors, who can then focus more on strategic oversight and less on data entry or processing.

Automated auditing solutions also enable a proactive approach by providing near real-time monitoring, making it easier to identify and prevent fraud. According to Occupational Fraud 2024: A Report to the Nations from the Association of Certified Fraud Examiners (ACFE), 84% of fraud displayed at least one behavioural red flag.

Establish Clear Policies and Procedures

Internal auditing is most effective when supported by clear, comprehensive policies. According to the ACFE report, more than half of occupational frauds occur because of a lack of internal controls or overriding existing controls.

Organizations should implement detailed guidelines on what constitutes acceptable expenses, documentation requirements, and protocols for submitting reimbursements. Regularly communicating these policies to employees helps to establish a culture of compliance.

Conduct Regular Audits

Routine audits are essential for detecting fraud and ensuring compliance with expense policies. By scheduling audits at regular intervals, organizations can assess their exposure to fraud and adjust their strategies as necessary.

Prioritize Employee Training and Awareness

Internal auditors should work closely with HR and management to ensure employees are well-informed about fraud risks and consequences. Training sessions and workshops can raise awareness about fraudulent behaviours and reinforce the importance of adhering to policies.

Monitor and Analyze Data Trends

Internal auditors should leverage data analytics to monitor spending trends over time. This enables them to identify anomalies or concerning patterns, such as departments with consistently high expense claims or employees who regularly submit expense reports that push policy limits.

Creating a Culture of Compliance

To effectively combat fraud, you should embrace automated tools that foster a culture of compliance throughout your organization. SAP Concur solutions and accompanying best practices can help you detect and mitigate fraud, strengthening your defences against financial misconduct.

Get in touch with us today and see why SAP Concur is an industry leader in global expense, travel, and invoice automation.