[Fraud Risk Management] Gian is a manager at Ram Co. and is tasked with building the company's fraud risk management program. As a starting point, Gian wants to formally define the program's objectives. Which of the following is TRUE regarding the process of defining the objectives of the fraud risk management program?

A fundamental step in designing a fraud risk management program is conducting a thorough fraud risk assessment. This assessment involves identifying potential fraud schemes and scenarios relevant to the organization. A critical input for this process is the analysis of past fraud incidents, both internal and external to the company. By examining how previous frauds were perpetrated, an organization can identify specific control weaknesses and vulnerabilities. This historical analysis directly informs the objectives of the new program, ensuring it is designed to prevent or detect similar occurrences in the future, making it a practical and effective starting point.

A. This statement incorrectly reverses the cost-benefit principle. The benefit derived from fraud risk management controls should outweigh the investment (cost) in implementing them.
B. An organization's risk appetite must be defined in the context of its specific culture, strategic objectives, and operations to be relevant and effective. Ignoring these factors leads to a disconnected program.
C. While using both quantitative and qualitative measures for risk appetite is a best practice, it is not a mandatory requirement. The key is that the risk appetite is clearly defined, understood, and communicated.

1. Association of Certified Fraud Examiners (ACFE). (2023). Fraud Examiners Manual, International Edition. Section 4.303, "Performing a Fraud Risk Assessment." The manual states, "A fraud risk assessment should be a systematic process for identifying and assessing the risks of fraud... This process should consider the specific industry, geography, and nature of the business, as well as any known instances of fraud." This supports analyzing past events to inform the program.

2. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2016). Fraud Risk Management Guide, First Edition. Principle 2: "The organization performs comprehensive fraud risk assessments to identify specific fraud schemes and risks..." (p. 33). The guide elaborates that this includes considering "known and alleged instances of fraud" and "pressures and incentives that may lead to fraud." This directly validates the approach in option D.

3. Association of Certified Fraud Examiners (ACFE). (2023). Fraud Examiners Manual, International Edition. Section 4.209, "Cost-Benefit Analysis." This section explains that the costs of implementing controls should not exceed the benefits. This directly refutes the reversed logic in option A.

4. Committee of Sponsoring Organizations of the Treadway Commission (COSO). (2016). Fraud Risk Management Guide, First Edition. Principle 1: "The organization establishes and communicates a fraud risk management program..." (p. 21). This principle emphasizes that the program, including the definition of risk appetite, must align with the organization's "business objectives and values," which encompass culture and operations, thereby refuting option B.