Responding to Residual Fraud Risk
5 minutes
5 Questions
Responding to residual fraud risk is a key step in the fraud risk management process described in the ACFE/COSO Fraud Risk Management Guide and the CFE Exam's Fraud Prevention and Deterrence section. Residual fraud risk is the level of fraud risk that remains after existing anti-fraud controls (preventive and detective) have been identified, mapped to specific fraud schemes, and evaluated for design and operating effectiveness. Because no control environment can eliminate fraud entirely, management must consciously decide how to deal with the risk that is left over. The response begins by comparing the residual risk to the organization's fraud risk appetite and tolerance, which should be defined by senior management and the board or audit committee. Where residual risk exceeds tolerance, management selects one or more response strategies: (1) Avoid the risk by eliminating the activity, product line, or relationship that creates the exposure; (2) Reduce (mitigate) the risk by designing or strengthening controls, such as segregation of duties, enhanced approvals, data analytics, continuous monitoring, surprise audits, or hotline awareness; (3) Transfer or share the risk through fidelity bonds, fraud insurance, or outsourcing with contractual protections; or (4) Accept the risk, formally documenting the rationale when the cost of additional controls outweighs the expected loss or when the likelihood and impact are low. An effective response also includes assigning ownership of each risk and control, establishing timelines for remediation, and integrating findings into the internal audit plan so that high residual risks receive priority testing. Responses should be documented in the fraud risk register, communicated to the audit committee, and revisited periodically because residual risk changes as the business, personnel, technology, and fraud schemes evolve. CFEs add value by challenging whether controls truly address the specific scheme (not just general risk), considering management override and collusion, and ensuring that detective controls and investigation protocols exist for risks that are accepted rather than fully mitigated.
Responding to Residual Fraud Risk: A Complete CFE Exam Guide
Overview
Responding to residual fraud risk is one of the final and most decision-oriented steps in the fraud risk assessment process tested in the Fraud Prevention and Deterrence section of the CFE Exam. Once an organization has identified its inherent fraud risks, assessed their likelihood and significance, mapped existing controls, and evaluated how well those controls actually work, what remains is residual fraud risk. Management must then decide what to do about it. This guide explains why this step matters, what residual risk is, how organizations respond to it, and how to handle exam questions on the topic.
Why It Is Important
Identifying fraud risks is pointless if nothing is done with the results. The response step turns analysis into action. It matters because:
1. No organization can eliminate fraud risk entirely. Controls are never perfect, collusion can defeat segregation of duties, and management override is always possible. Residual risk is therefore unavoidable, and the organization must consciously decide how much of it to live with.
2. Resources are limited. Anti-fraud spending must be prioritized toward the risks that are most likely and most damaging. The response step forces a cost-benefit discipline.
3. It establishes accountability. Each residual risk should have an owner and a documented response, so that later failures can be traced to a decision rather than an oversight.
4. It supports governance and compliance. Boards, audit committees, regulators, and external auditors expect management to demonstrate that fraud risks were assessed and addressed, consistent with frameworks such as the COSO Internal Control framework and the ACFE/COSO Fraud Risk Management Guide.
5. It completes the assessment cycle. Fraud risk assessment is an ongoing, iterative process. Responses chosen today become the controls evaluated in the next assessment.
What Residual Fraud Risk Is
Two definitions must be crystal clear for the exam:
Inherent fraud risk is the risk of fraud that exists before considering any controls. It reflects the nature of the business, industry, transactions, and the opportunities, pressures, and rationalizations present in the environment.
Residual fraud risk is the risk that remains after existing preventive and detective controls have been taken into account. Conceptually: Residual Risk = Inherent Risk less the Mitigating Effect of Controls.
Residual risk arises for two main reasons: (a) a control does not exist for a particular fraud scheme, or (b) a control exists but is poorly designed or not operating effectively. The fraud risk assessment team identifies these gaps, typically by comparing the inherent risk ranking (likelihood x significance) with the strength of mapped controls. High inherent risk combined with weak or missing controls produces high residual risk, which demands priority attention.
How It Works: The Four Risk Responses
Management, with board oversight, selects a response for each significant residual risk. The CFE materials describe four fundamental options, which may also be used in combination:
1. Avoid the risk
The organization eliminates the activity, product, location, or relationship that gives rise to the risk. Example: exiting a high-corruption-risk foreign market, discontinuing a cash-intensive product line, or refusing to deal with third-party agents in a jurisdiction where bribery is common. Avoidance is the most drastic response and is usually reserved for risks whose residual exposure exceeds the organization's risk appetite and cannot be cost-effectively reduced.
2. Transfer (or share) the risk
The financial consequences are shifted to a third party, most commonly through insurance (fidelity bonds, crime policies, employee dishonesty coverage) or through outsourcing an activity to a vendor who assumes responsibility for it. Contractual indemnification is another form. Important nuance: transferring risk shifts the financial loss, but reputational damage and ultimate legal responsibility often cannot be transferred. Insurance also typically has deductibles, exclusions, and limits, so transfer rarely removes all residual risk.
3. Mitigate (reduce) the risk
The organization implements new controls or strengthens existing ones to lower the likelihood or impact of the fraud. This is the most common response. Examples include adding segregation of duties, implementing continuous monitoring or data analytics, strengthening approval limits, enhancing background checks, introducing a hotline, improving reconciliation procedures, or providing targeted anti-fraud training. Mitigation should focus on the specific scheme and control gap identified in the assessment, and should be weighed against cost: a control that costs more than the expected loss it prevents is generally not justified.
4. Assume (accept) the risk
Management consciously decides to take no further action because the residual risk is within the organization's risk tolerance, or because the cost of other responses outweighs the benefit. Acceptance is legitimate and common for low-likelihood, low-impact risks. The key is that acceptance must be a deliberate, documented decision by an appropriate level of management, not a default result of ignoring the risk.
Combination responses are frequent. For example, an organization may add controls over disbursements (mitigate) while also purchasing a crime policy (transfer) and accepting the remaining small exposure (assume).
Factors That Drive the Choice of Response
- Risk appetite and tolerance: how much fraud risk the board and management are willing to accept in pursuit of objectives.
- Cost-benefit analysis: the cost of the response versus the expected reduction in loss (likelihood x significance).
- Likelihood and significance ratings: high-high risks demand mitigation or avoidance; low-low risks are often accepted.
- Regulatory and legal requirements: some risks (e.g., FCPA compliance, financial reporting fraud) cannot simply be accepted.
- Reputational considerations: some frauds carry damage far beyond their monetary value.
- Feasibility: whether an effective control can realistically be designed and operated.
Roles and Responsibilities
A frequently tested point: the fraud risk assessment team identifies and evaluates residual risk and recommends responses, but management owns the decision about how to respond. Management is responsible for designing and implementing the response; the board or audit committee oversees management's fraud risk management; internal audit provides independent assurance that responses are implemented and operating. Each residual risk and its chosen response should be assigned to a specific risk owner.
Documenting and Monitoring the Response
After responses are selected they should be documented in the fraud risk assessment (often in a risk register or risk-control matrix) showing: the fraud scheme, inherent risk rating, existing controls, control effectiveness, residual risk rating, chosen response, action items, owner, and target dates. Progress should be reported to the board or audit committee. Because people, processes, and the business change, the assessment and responses must be revisited periodically, typically at least annually and whenever there are significant changes such as mergers, new systems, new markets, or discovered frauds.
Common Misconceptions to Avoid
- Believing the goal is zero fraud risk. It is not achievable; the goal is to reduce residual risk to an acceptable level.
- Treating acceptance as negligence. Properly documented acceptance of low-level risk is a valid response.
- Assuming insurance eliminates risk. It transfers only part of the financial exposure.
- Thinking the fraud examiner or auditor decides the response. Management decides; others advise and provide assurance.
- Confusing residual risk with inherent risk. Residual risk is always measured after considering controls.
Exam Tips: Answering Questions on Responding to Residual Fraud Risk
1. Memorize the four responses and a textbook example of each: Avoid (exit the activity), Transfer (insurance, outsourcing), Mitigate (add or improve controls), Assume (accept within tolerance). Many questions present a scenario and ask which response it illustrates.
2. Watch for definition questions. If the question says risk remaining after controls, the answer is residual risk. If it says risk before considering controls, the answer is inherent risk.
3. When asked who decides how to respond, choose management (with board oversight), not the fraud examiner, internal auditor, or assessment team.
4. If a scenario involves insurance or fidelity bonds, the response is transfer. If it involves outsourcing an entire function to a third party, that is also transfer, though be alert to answer choices noting that reputational risk cannot be fully transferred.
5. If a scenario involves new controls, training, monitoring, or segregation of duties, the response is mitigate.
6. If a scenario involves discontinuing a product, closing an operation, or leaving a market, the response is avoid.
7. If management decides the cost of controls exceeds the potential loss and takes no further action, the response is assume/accept. Do not be tricked into thinking this is always wrong; it is appropriate for low-likelihood, low-impact risks.
8. Remember that responses can be combined. If an answer choice says management may use a combination of responses, it is generally correct.
9. Cost-benefit is the governing principle. Any answer stating that all identified residual risks must be mitigated regardless of cost, or that the objective is to eliminate all fraud risk, is almost certainly a distractor.
10. True/false style items: Statements such as residual risk can be reduced to zero through strong controls are FALSE. Statements such as fraud risk assessment is an ongoing process that should be revisited when the organization changes are TRUE.
11. Sequence questions: Know that identifying and responding to residual risk comes after identifying inherent risks, assessing likelihood and significance, identifying likely perpetrators and schemes, mapping existing controls, and evaluating control effectiveness.
12. Read the whole scenario. Exam questions often embed the key word (insurance, discontinue, implement, accept) in the middle of a longer fact pattern. Identify the action management actually took, then match it to the response category.
Quick Review Summary
Residual fraud risk is what remains after controls. Because it cannot be eliminated, management must choose to avoid, transfer, mitigate, or assume each significant residual risk, guided by cost-benefit analysis and the organization's risk tolerance. Responses must be documented, assigned to owners, overseen by the board, and revisited as the organization changes. Master the four responses, the inherent-versus-residual distinction, and the management-owns-the-decision principle, and you will handle this topic confidently on the CFE Exam.
Responding to residual fraud risk is one of the final and most decision-oriented steps in the fraud risk assessment process tested in the Fraud Prevention and Deterrence section of the CFE Exam. Once an organization has identified its inherent fraud risks, assessed their likelihood and significance, mapped existing controls, and evaluated how well those controls actually work, what remains is residual fraud risk. Management must then decide what to do about it. This guide explains why this step matters, what residual risk is, how organizations respond to it, and how to handle exam questions on the topic.
Why It Is Important
Identifying fraud risks is pointless if nothing is done with the results. The response step turns analysis into action. It matters because:
1. No organization can eliminate fraud risk entirely. Controls are never perfect, collusion can defeat segregation of duties, and management override is always possible. Residual risk is therefore unavoidable, and the organization must consciously decide how much of it to live with.
2. Resources are limited. Anti-fraud spending must be prioritized toward the risks that are most likely and most damaging. The response step forces a cost-benefit discipline.
3. It establishes accountability. Each residual risk should have an owner and a documented response, so that later failures can be traced to a decision rather than an oversight.
4. It supports governance and compliance. Boards, audit committees, regulators, and external auditors expect management to demonstrate that fraud risks were assessed and addressed, consistent with frameworks such as the COSO Internal Control framework and the ACFE/COSO Fraud Risk Management Guide.
5. It completes the assessment cycle. Fraud risk assessment is an ongoing, iterative process. Responses chosen today become the controls evaluated in the next assessment.
What Residual Fraud Risk Is
Two definitions must be crystal clear for the exam:
Inherent fraud risk is the risk of fraud that exists before considering any controls. It reflects the nature of the business, industry, transactions, and the opportunities, pressures, and rationalizations present in the environment.
Residual fraud risk is the risk that remains after existing preventive and detective controls have been taken into account. Conceptually: Residual Risk = Inherent Risk less the Mitigating Effect of Controls.
Residual risk arises for two main reasons: (a) a control does not exist for a particular fraud scheme, or (b) a control exists but is poorly designed or not operating effectively. The fraud risk assessment team identifies these gaps, typically by comparing the inherent risk ranking (likelihood x significance) with the strength of mapped controls. High inherent risk combined with weak or missing controls produces high residual risk, which demands priority attention.
How It Works: The Four Risk Responses
Management, with board oversight, selects a response for each significant residual risk. The CFE materials describe four fundamental options, which may also be used in combination:
1. Avoid the risk
The organization eliminates the activity, product, location, or relationship that gives rise to the risk. Example: exiting a high-corruption-risk foreign market, discontinuing a cash-intensive product line, or refusing to deal with third-party agents in a jurisdiction where bribery is common. Avoidance is the most drastic response and is usually reserved for risks whose residual exposure exceeds the organization's risk appetite and cannot be cost-effectively reduced.
2. Transfer (or share) the risk
The financial consequences are shifted to a third party, most commonly through insurance (fidelity bonds, crime policies, employee dishonesty coverage) or through outsourcing an activity to a vendor who assumes responsibility for it. Contractual indemnification is another form. Important nuance: transferring risk shifts the financial loss, but reputational damage and ultimate legal responsibility often cannot be transferred. Insurance also typically has deductibles, exclusions, and limits, so transfer rarely removes all residual risk.
3. Mitigate (reduce) the risk
The organization implements new controls or strengthens existing ones to lower the likelihood or impact of the fraud. This is the most common response. Examples include adding segregation of duties, implementing continuous monitoring or data analytics, strengthening approval limits, enhancing background checks, introducing a hotline, improving reconciliation procedures, or providing targeted anti-fraud training. Mitigation should focus on the specific scheme and control gap identified in the assessment, and should be weighed against cost: a control that costs more than the expected loss it prevents is generally not justified.
4. Assume (accept) the risk
Management consciously decides to take no further action because the residual risk is within the organization's risk tolerance, or because the cost of other responses outweighs the benefit. Acceptance is legitimate and common for low-likelihood, low-impact risks. The key is that acceptance must be a deliberate, documented decision by an appropriate level of management, not a default result of ignoring the risk.
Combination responses are frequent. For example, an organization may add controls over disbursements (mitigate) while also purchasing a crime policy (transfer) and accepting the remaining small exposure (assume).
Factors That Drive the Choice of Response
- Risk appetite and tolerance: how much fraud risk the board and management are willing to accept in pursuit of objectives.
- Cost-benefit analysis: the cost of the response versus the expected reduction in loss (likelihood x significance).
- Likelihood and significance ratings: high-high risks demand mitigation or avoidance; low-low risks are often accepted.
- Regulatory and legal requirements: some risks (e.g., FCPA compliance, financial reporting fraud) cannot simply be accepted.
- Reputational considerations: some frauds carry damage far beyond their monetary value.
- Feasibility: whether an effective control can realistically be designed and operated.
Roles and Responsibilities
A frequently tested point: the fraud risk assessment team identifies and evaluates residual risk and recommends responses, but management owns the decision about how to respond. Management is responsible for designing and implementing the response; the board or audit committee oversees management's fraud risk management; internal audit provides independent assurance that responses are implemented and operating. Each residual risk and its chosen response should be assigned to a specific risk owner.
Documenting and Monitoring the Response
After responses are selected they should be documented in the fraud risk assessment (often in a risk register or risk-control matrix) showing: the fraud scheme, inherent risk rating, existing controls, control effectiveness, residual risk rating, chosen response, action items, owner, and target dates. Progress should be reported to the board or audit committee. Because people, processes, and the business change, the assessment and responses must be revisited periodically, typically at least annually and whenever there are significant changes such as mergers, new systems, new markets, or discovered frauds.
Common Misconceptions to Avoid
- Believing the goal is zero fraud risk. It is not achievable; the goal is to reduce residual risk to an acceptable level.
- Treating acceptance as negligence. Properly documented acceptance of low-level risk is a valid response.
- Assuming insurance eliminates risk. It transfers only part of the financial exposure.
- Thinking the fraud examiner or auditor decides the response. Management decides; others advise and provide assurance.
- Confusing residual risk with inherent risk. Residual risk is always measured after considering controls.
Exam Tips: Answering Questions on Responding to Residual Fraud Risk
1. Memorize the four responses and a textbook example of each: Avoid (exit the activity), Transfer (insurance, outsourcing), Mitigate (add or improve controls), Assume (accept within tolerance). Many questions present a scenario and ask which response it illustrates.
2. Watch for definition questions. If the question says risk remaining after controls, the answer is residual risk. If it says risk before considering controls, the answer is inherent risk.
3. When asked who decides how to respond, choose management (with board oversight), not the fraud examiner, internal auditor, or assessment team.
4. If a scenario involves insurance or fidelity bonds, the response is transfer. If it involves outsourcing an entire function to a third party, that is also transfer, though be alert to answer choices noting that reputational risk cannot be fully transferred.
5. If a scenario involves new controls, training, monitoring, or segregation of duties, the response is mitigate.
6. If a scenario involves discontinuing a product, closing an operation, or leaving a market, the response is avoid.
7. If management decides the cost of controls exceeds the potential loss and takes no further action, the response is assume/accept. Do not be tricked into thinking this is always wrong; it is appropriate for low-likelihood, low-impact risks.
8. Remember that responses can be combined. If an answer choice says management may use a combination of responses, it is generally correct.
9. Cost-benefit is the governing principle. Any answer stating that all identified residual risks must be mitigated regardless of cost, or that the objective is to eliminate all fraud risk, is almost certainly a distractor.
10. True/false style items: Statements such as residual risk can be reduced to zero through strong controls are FALSE. Statements such as fraud risk assessment is an ongoing process that should be revisited when the organization changes are TRUE.
11. Sequence questions: Know that identifying and responding to residual risk comes after identifying inherent risks, assessing likelihood and significance, identifying likely perpetrators and schemes, mapping existing controls, and evaluating control effectiveness.
12. Read the whole scenario. Exam questions often embed the key word (insurance, discontinue, implement, accept) in the middle of a longer fact pattern. Identify the action management actually took, then match it to the response category.
Quick Review Summary
Residual fraud risk is what remains after controls. Because it cannot be eliminated, management must choose to avoid, transfer, mitigate, or assume each significant residual risk, guided by cost-benefit analysis and the organization's risk tolerance. Responses must be documented, assigned to owners, overseen by the board, and revisited as the organization changes. Master the four responses, the inherent-versus-residual distinction, and the management-owns-the-decision principle, and you will handle this topic confidently on the CFE Exam.
Test mode:
CFE - Responding to Residual Fraud Risk Example Questions
Test your knowledge of Responding to Residual Fraud Risk
Question 1
Which of the following pairings CORRECTLY matches a response to residual fraud risk with what that response does?
Question 2
Which of the following statements accurately describes how a chosen response to a residual fraud risk affects the likelihood or impact of that risk?
Question 3
An organization that purchases fidelity insurance covering employee theft at a warehouse, after rating that residual fraud risk above its risk appetite, is responding to the risk by mitigating it.
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Responding to Residual Fraud Risk questions
20 questions (total)