Inherent, Residual, Internal and External Fraud Risk

Why This Topic Matters

Fraud risk assessment sits at the heart of the Fraud Prevention and Deterrence section of the CFE Exam, and the four concepts covered here — inherent risk, residual risk, internal fraud risk and external fraud risk — are the vocabulary every other part of the assessment process is built on. If you cannot distinguish the risk that exists before controls from the risk that remains after controls, or the threat posed by an employee from the threat posed by a vendor or hacker, you will struggle with questions on risk identification, likelihood and significance scoring, risk responses and the design of anti-fraud controls.

In practice, these distinctions matter because organisations have limited resources. Management and the board need to know which fraud schemes are realistically possible given the nature of the business (inherent risk), how much exposure is left once existing controls are considered (residual risk), and whether the people most likely to commit the fraud are inside or outside the organisation (internal versus external risk). Those answers drive where controls are strengthened, where monitoring is focused and where the organisation decides it can simply live with the exposure.

What Is Inherent Fraud Risk?

Inherent fraud risk is the risk that fraud could occur in an organisation in the absence of any controls, or before considering management's response to that risk. It is sometimes described as the gross or raw risk. Inherent risk is driven by factors that exist regardless of how well the organisation is managed, such as:

• The nature of the industry (cash-intensive businesses, construction, healthcare and government contracting carry higher inherent risk).
• The nature of the assets (cash, inventory that is small and valuable, intellectual property).
• The complexity of transactions, estimates and accounting judgments.
• The volume of transactions and the degree of automation versus manual processing.
• Organisational structure, geographic spread and the degree of decentralisation.
• Pressures and incentives facing management and employees (bonus targets, debt covenants, analyst expectations).
• The regulatory and economic environment, including operations in jurisdictions with high corruption indices.

Inherent risk is not a judgment about the quality of controls. A company can have excellent controls and still have very high inherent fraud risk simply because of what it does. The first stage of a fraud risk assessment is therefore to brainstorm and catalogue inherent fraud risks — every scheme that could plausibly be perpetrated against or on behalf of the organisation — and to assess each one for likelihood (how probable it is) and significance (its potential financial, reputational, legal and operational impact). The ACFE and COSO guidance stresses that this identification should be done without yet giving credit for controls, so that management does not overlook risks simply because it assumes they are already covered.

What Is Residual Fraud Risk?

Residual fraud risk is the risk that remains after existing anti-fraud controls, programs and other mitigating factors have been taken into account. Conceptually:

Residual risk = Inherent risk less the risk-reducing effect of controls

Once inherent risks have been identified and rated, the assessment team maps the existing preventive and detective controls to each risk, evaluates whether those controls are properly designed and operating effectively, and then determines how much exposure is left. Key points to remember:

• Residual risk is never zero. No system of internal control eliminates fraud risk entirely because of inherent limitations: management override, collusion, human error and the cost-benefit constraint on controls.
• Residual risk is what management compares against the organisation's risk tolerance (sometimes called risk appetite). If residual risk exceeds what the board and management are willing to accept, further action is required.
• If controls are poorly designed or not operating, residual risk may be nearly as high as inherent risk. If controls are strong, residual risk may be considerably lower.
• A control that reduces likelihood (for example, segregation of duties) and a control that reduces significance (for example, insurance or transaction limits) both reduce residual risk, but in different ways.

Responding to Residual Risk

After residual risk has been established, management chooses a risk response. The CFE Exam commonly tests the four standard responses:

• Avoid the risk — exit the activity, product line or market that creates it.
• Transfer the risk — purchase fidelity or fraud insurance, or outsource the activity with contractual protection.
• Mitigate the risk — implement or strengthen preventive and detective controls to bring residual risk down to an acceptable level.
• Assume (accept or tolerate) the risk — consciously decide to live with the residual exposure because the cost of further mitigation exceeds the benefit.

The choice should be documented and approved at the appropriate level, and the risk should be re-assessed periodically because both inherent risk and control effectiveness change over time.

What Is Internal Fraud Risk?

Internal fraud risk is the risk of fraud committed by people inside the organisation: employees at any level, managers, executives, officers and directors. This is essentially the risk of occupational fraud, which the ACFE defines as the use of one's occupation for personal enrichment through the deliberate misuse or misapplication of the employing organisation's resources or assets. It covers the three branches of the Fraud Tree:

• Asset misappropriation — skimming, cash larceny, billing schemes, payroll schemes, expense reimbursement fraud, check tampering, register disbursements, inventory theft and misuse.
• Corruption — conflicts of interest, bribery, kickbacks, bid rigging, illegal gratuities and economic extortion by employees.
• Financial statement fraud — fictitious revenues, timing differences, concealed liabilities, improper disclosures and improper asset valuations, typically committed by management.

Internal fraud risk is shaped heavily by the Fraud Triangle: the pressures (financial need, performance targets), opportunities (weak controls, excessive trust, lack of oversight) and rationalisations available to insiders. When assessing internal fraud risk, the assessment team should think about which positions have access to assets, authority to approve transactions and the ability to override or circumvent controls. The ACFE's research consistently shows that frauds committed by owners, executives and senior managers cause far larger losses than those committed by lower-level employees, even though they occur less frequently — a point the exam likes to test.

What Is External Fraud Risk?

External fraud risk is the risk of fraud perpetrated against the organisation by outside parties who are not employees or insiders. Common sources include:

• Vendors and suppliers — overbilling, billing for goods not delivered, substituting inferior products, bid rigging among competing suppliers, and false invoices.
• Customers — bad checks, counterfeit currency, credit card fraud, chargeback abuse, refund fraud and false insurance or warranty claims.
• Third parties and strangers — hackers and cybercriminals, identity thieves, phishing and business email compromise schemes, intellectual property theft, counterfeiting of the organisation's products, and fraudsters impersonating executives or suppliers to redirect payments.
• Agents, contractors and intermediaries — misrepresenting work performed or inflating costs.

External fraud risk has grown in importance with the expansion of e-commerce, remote work and digital payments. The controls used to address it differ from those used against internal fraud: vendor due diligence, customer verification, cybersecurity controls, payment authentication procedures, independent confirmation of changes to vendor bank details and fraud analytics on customer transactions.

Collusion: Where Internal and External Risk Meet

Many of the most damaging schemes involve collusion between an insider and an outsider — for example, a purchasing manager who accepts kickbacks from a supplier in exchange for inflated invoices, or an employee who shares system credentials with an external criminal. Collusive schemes are especially dangerous because they defeat controls such as segregation of duties, which assume that two people will not act together. A thorough fraud risk assessment considers internal risks, external risks and collusive risks separately so that controls designed for one category are not assumed to cover another.

How It All Works Together in a Fraud Risk Assessment

1. Identify inherent fraud risks — brainstorm all potential schemes (internal, external and collusive) using the Fraud Tree, interviews, surveys, past incidents and industry data.
2. Assess likelihood and significance of each inherent risk, considering the people and departments involved.
3. Identify and map existing controls to each risk and evaluate whether they are designed and operating effectively.
4. Determine residual risk for each scheme.
5. Compare residual risk to risk tolerance and select a response: avoid, transfer, mitigate or assume.
6. Document, report to the board or audit committee, and re-assess on a regular cycle or when significant changes occur.

Exam Tips: Answering Questions on Inherent, Residual, Internal and External Fraud Risk

Tip 1 — Watch for the control trigger words. If a question describes risk before, without, absent or irrespective of controls, the answer is inherent risk. If it describes risk after, remaining, net of or once controls are considered, the answer is residual risk. The exam frequently tests this distinction with simple definition questions.

Tip 2 — Remember that residual risk is never zero. Any answer choice stating that effective controls eliminate fraud risk, or that residual risk can be reduced to nothing, is wrong. Internal control provides reasonable, not absolute, assurance.

Tip 3 — Inherent risk is about the business, not the controls. A true/false question might state that strong internal controls reduce inherent fraud risk. That is false — controls reduce residual risk. Inherent risk changes only when the underlying nature of the business, assets, transactions or environment changes.

Tip 4 — Identify the perpetrator to classify internal versus external. Ask: who commits the fraud? Employees, managers, executives and directors = internal (occupational fraud). Vendors, customers, hackers, competitors and other outsiders = external. If both are involved, the scheme is collusive, and the exam may expect you to note that collusion circumvents segregation of duties.

Tip 5 — Do not confuse the category with the scheme. Bid rigging can be internal (an employee rigs the award), external (vendors conspire among themselves) or collusive. Read the facts rather than relying on the scheme name.

Tip 6 — Know the four risk responses. Avoid, transfer, mitigate and assume (accept). A scenario about buying fidelity insurance is transfer; adding a second approver is mitigate; discontinuing a product line is avoid; deciding the cost of control exceeds the benefit and doing nothing further is assume.

Tip 7 — Residual risk is measured against risk tolerance. Questions about whether management should take further action hinge on comparing residual risk to the organisation's risk tolerance or appetite, which is set by the board and senior management — not by the fraud examiner or auditor alone.

Tip 8 — Remember who causes the biggest losses. When internal fraud risk is tested in terms of significance, recall that owner and executive frauds produce the largest median losses while employee-level frauds are the most frequent. Questions sometimes reverse these facts to create a distractor.

Tip 9 — Apply the Fraud Triangle to internal risk. When asked what increases internal fraud risk, look for answers involving pressure, opportunity or rationalisation — unrealistic targets, weak oversight, excessive trust in a single employee, or a culture that tolerates minor dishonesty.

Tip 10 — Think about which controls fit which risk. Segregation of duties, mandatory vacations, job rotation and management review target internal risk. Vendor due diligence, customer identity verification, cybersecurity controls and call-back procedures for payment changes target external risk. If a question asks for the most appropriate control, match it to the risk category described.

Tip 11 — Sequence matters in process questions. Inherent risks are identified first, controls are mapped second, residual risk is determined third and responses are chosen last. Any answer that places the evaluation of controls before the identification of inherent risks is out of order.

Tip 12 — Eliminate absolutes. Answer choices containing words such as always, never, all or eliminates are usually incorrect in this topic, because fraud risk assessment is built on reasonable assurance, professional judgment and probabilities rather than certainties.

Quick Revision Summary

• Inherent fraud risk: the risk of fraud before considering controls; driven by the nature of the business, assets, transactions, incentives and environment.
• Residual fraud risk: the risk remaining after controls are applied; never zero; compared against risk tolerance; drives the choice to avoid, transfer, mitigate or assume.
• Internal fraud risk: fraud by insiders (occupational fraud) — asset misappropriation, corruption and financial statement fraud; explained by the Fraud Triangle; executive frauds are the costliest.
• External fraud risk: fraud by outsiders — vendors, customers, hackers and other third parties; addressed through due diligence, verification and cybersecurity controls.
• Collusion: insiders and outsiders working together; defeats segregation of duties; must be assessed separately.

Master these definitions and the logic connecting them, and you will be well prepared for any fraud risk assessment question the CFE Exam presents.