Fraudulent transactions are those that involve deception, manipulation, or misrepresentation of information or data to obtain an unauthorized or improper benefit or advantage1. Fraudulenttransactions can pose significant risks and losses for an organization, such as financial damages, legal liabilities, reputational damages, or operational disruptions2.
Enterprise resource planning (ERP) systems are integrated software applications that support the core business processes and functions of an organization, such as accounting, finance, human resources, supply chain, inventory, or customer relationship management3. ERP systems can facilitate the efficiency, accuracy, and security of business transactions, but they can also be vulnerable to fraudulent transactions, such as:
Creating fake vendors or customers and processing false invoices or payments
Manipulating or falsifying financial or accounting data or reports
Changing or deleting critical or sensitive information or records
Abusing or misusing access privileges or credentials
Bypassing or compromising the system controls or security measures4
The design of procedures to prevent fraudulent transactions within an ERP system should be based on the control environment. The control environment is the set of standards, processes, and structures that provide the basis for carrying out internal control across the organization. The control environment comprises the following elements:
The tone at the top, which reflects the leadership’s commitment and attitude towards internal control and ethical conduct
The organizational structure, which defines the roles and responsibilities, reporting lines, and authority levels for internal control
The human resource policies and practices, which ensure that the staff have the appropriate skills, competencies, and incentives for internal control
The risk assessment process, which identifies and evaluates the potential risks and threats to the organization’s objectives and transactions
The control activities, which are the specific policies, procedures, and mechanisms that prevent, detect, or correct errors or fraud in transactions
The information and communication systems, which provide reliable and timely data and information for internal control and decision-making
The monitoring and evaluation activities, which measure and report the performance and effectiveness of internal control and ensure continuous improvement
By basing the design of procedures to prevent fraudulent transactions within an ERP system on the control environment, the organization can:
Ensure that the procedures are aligned with the organization’s objectives, values, and expectations regarding internal control and fraud prevention
Provide clear and consistent guidance and instructions for the staff and stakeholders involved in the transactions and the ERP system
Implement adequate and appropriate controls and safeguards to mitigate the risks and vulnerabilities of the transactions and the ERP system
Monitor and evaluate the compliance and effectiveness of the procedures and the ERP system, and identify and address any issues or gaps
References = What is Fraud?, Fraud Risk Management - AICPA, What is ERP?, ERP Fraud: How to Prevent It - ERP Focus, [COSO – Control Environment - Deloitte], [How to use COSO to assess IT controls - Journal of Accountancy]
