{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"operational","domain":["Governance, Policy & Oversight","Financial Reporting Controls (SOX)","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-internal-misappropriation","description":"Employees defraud the entity for financial gain: embezzlement or theft of company/client funds, fraudulent expense/payroll claims, forgery to obtain unauthorized disbursements, bribery/kickback schemes, insider trading on own account, and wilful tax evasion.","details":{"category":"operational","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"fraud-internal-misappropriation","taxonomies":["basel-operational-risk","coso-erm-risk","sox-rmm-assertion"],"treatment":"mitigate"},"id":"risk:fraud-internal-misappropriation","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Afraud-internal-misappropriation","sourceIds":["coso-erm","coso-ic","iso-27001","nis2","nist-800-53","nist-csf-2","soc2","sox"],"sourceUrl":null,"title":"Internal fraud — asset misappropriation, embezzlement, forgery","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:0f4df0b1f2b6286be0d0bf893b312a382f06412a78120807b6ffc7ac5611042e","properties":{"rationale":"An insider-threat program with defined indicators, reporting channels, and response detects and deters insider theft and fraud.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-37-8fd5a91b.json","sourceId":"uc:UC-GOV-37","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1d31b6b1de784aee0e5a2b8e088554a0f83561899dc4a9b70daf9fa9b29afb71","properties":{"rationale":"Independent cash/account reconciliation detects embezzlement and misappropriation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-03-a90abe13.json","sourceId":"uc:UC-FIN-03","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:2431e3961ef61021fa739553b3e9a9fd764301116b9683c1a57593bed0e37e41","properties":{"rationale":"Three-way match and tolerance checks block fraudulent or duplicate disbursements.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-07-880ee951.json","sourceId":"uc:UC-FIN-07","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:63b99959066009fb7396581f8790b61c48e9f8acf6ed913c8acd56401c01bc06","properties":{"rationale":"Restricting physical custody and performing counts prevents and detects theft/embezzlement of assets.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-10-f87a53c1.json","sourceId":"uc:UC-FIN-10","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:63ebbbc35c597cf5bba4e4837a4cc9c058bcb3a4ba923205f09d8b39c4d950f0","properties":{"rationale":"An ethical culture, code of conduct, and disciplinary follow-through deter the rationalization leg of insider fraud.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-04-849a3e91.json","sourceId":"uc:UC-GOV-04","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:68d27ccb03fbd66b5674b0f14150c97a1d6a5d3e1d393a4cdac3d30ac979f1b5","properties":{"rationale":"Least-privilege authorization and personnel screening/termination requirements reduce insider-fraud opportunity.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-31-46e68199.json","sourceId":"uc:UC-GOV-31","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:7cf868d19e732d1b5a6d883c2cf48ca90660fc61f6e6e6b72439cb7eaf2e9d4a","properties":{"rationale":"Authorization before execution prevents unauthorized disbursements and forgery.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-04-70e42862.json","sourceId":"uc:UC-FIN-04","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:83727cec2a5d5a6d89c3795e67244680a907e03213177a9e9183383c3a547772","properties":{"rationale":"Custody separated from recording and reconciliation prevents concealed asset theft.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-fin-05-52738635.json","sourceId":"uc:UC-FIN-05","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:8846a3876f3031f025badfe8e50998bdfeb21e5875852c8e41a301de7d4ac2cc","properties":{"rationale":"Fraud risk assessment plus anti-override controls (journal-entry and significant-estimate review) directly detect and deter employee embezzlement, forgery and unauthorized disbursements.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-12-210e108b.json","sourceId":"uc:UC-RISK-12","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b8c85c7f25e7f410ca0602a89b8ea3a8d7d05afb049ad59868b362553c4865aa","properties":{"rationale":"Separating initiate-versus-approve prevents one person from both perpetrating and concealing misappropriation.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-08-187d37c0.json","sourceId":"uc:UC-GOV-08","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:bf07ea55fc952704c5d303cbd5c6caf2fbdf32cd3874064dffdbd61f4f97d0f3","properties":{"rationale":"Access control activities limiting unauthorized access reduce opportunity for insider misappropriation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-access-15-84699cae.json","sourceId":"uc:UC-ACCESS-15","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:cda48ad4d1dec1640413617ad43f47543331ae1078834e438135c46b7c8195d3","properties":{"rationale":"Accountability, performance incentives, and disciplinary consequences deter insider misappropriation.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-gov-07-2a8998f7.json","sourceId":"uc:UC-GOV-07","targetDetailPath":"/data/v1/records/risk-fraud-internal-misappropriation-d235cd10.json","targetId":"risk:fraud-internal-misappropriation","type":"mitigates"}],"schemaVersion":1}