A total of 34 IT processes are listed within these four domains
Whether or not a fraud is likely to occur in each of the identified IT processes is debatable. To better understand if a fraud is likely to occur, the fraud triangle hypothesis, developed by criminologist Dr. Donald R. Cressey, should be considered by all auditors.5According to Cressey, three factors, each of which is briefly described in figure 2, are associated with any person who commits fraud.
Since there is a human association in any IT process, regardless of the IT system's degree of automation, the possibility of a fraud should always be considered.
Types of Fraud
Typically, occupational frauds fall into one of three major categories:6
Asset misappropriation—Any scheme that involves the theft or misuse of an organization's assets, e.g., use of software and software licenses purchased by the company for personal use or financial gain
Corruption—Any scheme in which a person uses his/her influence in a business transaction to obtain an unauthorized benefit contrary to that person's duty to his/her employer, e.g., awarding outsourcing IT equipment maintenance services to the vendor that provides cash and/or gifts