Risk Assessment & Underwriting Flashcards

Which payroll internal control is MOST effective at preventing ghost employee fraud?

Answer: Periodic reconciliation of the HR headcount roster to active payroll records

Regular headcount reconciliation between HR records and active payroll ensures no fictional employees are receiving paychecks.

An employee in payroll has the ability to both add new employees to the system and approve their own timesheets. This represents a failure of:

Answer: Segregation of duties

Segregation of duties requires that no single employee controls multiple phases of the same transaction to prevent fraud and error.

During a payroll risk assessment, an auditor finds that terminated employee access to the payroll system was not revoked for 60 days post-termination. This is a risk of:

Answer: Unauthorized access and potential data theft or fraudulent payments by former employees

Failure to promptly revoke system access for terminated employees creates a window for unauthorized transactions or data exfiltration.

Which red flag during a payroll fraud risk assessment suggests potential timesheet manipulation?

Answer: Multiple employees always reporting exactly 80 hours biweekly with no variation

Perfectly uniform timesheet submissions with no variation often indicate supervisors are rubber-stamping or employees are auto-filling rather than accurately reporting hours.

A company uses a single bank account for both payroll and general operating expenses. What specific risk does this create?

Answer: Difficulty reconciling payroll disbursements and potential masking of unauthorized payments

Commingling payroll and operating funds makes it harder to identify unauthorized payroll transactions and weakens the audit trail.

What is the primary purpose of requiring a second authorized signature on payroll checks above a certain dollar threshold?

Answer: To reduce the risk of large unauthorized or fraudulent payroll disbursements

Dual signature requirements on large checks create an additional control point that makes it harder for a single fraudulent actor to authorize significant payments.

An employer discovers that a payroll clerk has been inflating their own overtime hours for six months. Which control failure allowed this?

Answer: Absence of independent supervisory review of overtime hours before payroll processing

Independent supervisory review of overtime data before payroll runs is the key detective control that would have caught inflated hours before disbursement.