IIA-CHAL-QISA practice question 6 of 25

Which of the following would be the most effective fraud prevention control?

Full set: 150 questions
Answer options
A: Email alert sent to management for checks issued over S100.000.
B: installation of a video surveillance system in a warehouse prone to inventory loss
C: New hire training to explain fraud and employee misconduct. Correct answer
D: Daily report that Identifies unsuccessful system log-in attempts
Correct Answer:
C. New hire training to explain fraud and employee misconduct.
Explanation

New hire training is a fundamental preventive control. It establishes an ethical tone and control consciousness from the outset, clearly communicating expectations regarding misconduct and the consequences of fraudulent actions. By influencing employee behavior and fostering a culture of integrity, it addresses the root causes of fraud, making it the most effective measure for prevention among the options. The other options are primarily detective controls, which identify fraudulent activities after they have occurred or as they are occurring.

Why Incorrect

A. This is a detective control. The email alert is triggered after a large check has already been issued, aiming to detect potential irregularities.
B. This is primarily a detective control used to investigate theft after it happens, though it can have a secondary deterrent (preventive) effect.
D. This is a detective control. The report identifies unauthorized access attempts after they have occurred, not preventing them in the first place.

References

1. COSO, Fraud Risk Management Guide, 2nd Edition (2023). Principle 2, "The board of directors exercises oversight of the fraud risk management program," emphasizes the importance of a strong ethical culture. The guide states, "A strong 'tone at the top' and throughout the organization is the foundation for all other components of fraud risk management... communicated through training and other means" (p. 21). This highlights training as a core preventive measure.

2. The Institute of Internal Auditors (IIA), International Professional Practices Framework (IPPF), Standard 2120: Risk Management. The standard requires internal audit to evaluate risk exposures, including the risk of fraud. The implementation guidance (2120.A1) notes that internal auditors should evaluate the potential for fraud and how the organization manages fraud risk. Preventive controls, such as training and creating a culture of ethics, are the first line of defense in managing this risk.

3. Albrecht, W. S., Albrecht, C. O., Albrecht, C. C., & Zimbelman, M. F. (2011). Fraud Examination. Cengage Learning. In academic literature on fraud, creating a culture of honesty and high ethics is consistently cited as the single most important element in fraud prevention. The text states, "The first and most important step in preventing fraud involves creating a culture of honesty and high ethics... This is done through... communicating expectations through a code of conduct and fraud awareness training" (Chapter 5, "Fraud Prevention").

Question breakdown

Tests
Distinguish preventive fraud controls from detective controls
Difficulty
Medium

Key idea: Preventive controls stop fraud before it happens by shaping behavior and awareness, while alerts, reports and surveillance mainly detect or deter fraud after it starts.

How to reach the answer

  1. The question asks for the most effective prevention control, so judge each option by when it acts.
  2. Alerts on large checks and reports of failed log-ins flag events that have already happened, which makes them detective.
  3. Video surveillance mostly records losses and only partly deters them.
  4. New-hire fraud training reaches employees before any misconduct and builds an anti-fraud culture, which makes it preventive.

Each option

  • AIncorrect. The alert goes out after the check is issued, so it is a detective control.
  • BIncorrect. Surveillance in a warehouse that already has losses mainly records and investigates theft, so it is detective with only limited deterrence.
  • CCorrect. Training sets expectations, explains consequences and builds integrity before fraud can happen, so it prevents fraud across the organization.
  • DIncorrect. A daily report of failed log-ins identifies attempts after they occur, so it is detective.

Common trap: Cameras feel like a strong physical safeguard, so candidates confuse deterrence or detection with prevention.

In practice: When auditors assess fraud risk management, they check whether the program goes beyond monitoring and includes preventive elements such as onboarding training, code-of-conduct acknowledgment and tone at the top.

Remember: Ask whether a control acts before the act or after it; awareness training acts before, while reports and alerts act after.

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free IIA-CHAL-QISA practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test

More questions

Other IIA-CHAL-QISA practice questions

Scroll to Top