ISO 31000:2018 emphasizes that effective risk management must be integrated into all activities across the organization-not just high-risk ones.
"An effective and efficient risk management program... is integrated into all organizational activities, is structured and comprehensive, and is customized and proportionate to the organization's operations and objectives." Reference:ACFE Fraud Examiners Manual, 2020 International Edition -Fraud Risk Management, Section
4.806.

Fraud and fraud risk are related but different concepts. Fraud refers to an intentional or deliberate act to deprive another of money or property through deception, guile, or other unfair means. Fraud risk, however, refers to the organization's vulnerability to individuals or groups who might combine pressure, opportunity, and rationalization to commit fraud. In other words, fraud is the actual wrongful act, while fraud risk is the potential that such an act could occur. Option D correctly captures this distinction. The other choices confuse fraud risk with frequency, total criminal activity, or opportunity alone. In fraud prevention and deterrence, organizations must identify and manage fraud risk before actual fraud occurs. Therefore, option D is the best answer.

* Reporting Fraud Risk Assessment Results:
* Reports should align with the organization's operational language to ensure comprehension by management and stakeholders.
* Why A is Correct:
* Using business-appropriate language ensures effective communication of findings and recommendations.
* Why Other Options are Incorrect:
* B:Comprehensive details may overwhelm the audience; only key findings are usually reported.
* C:Reports should reflect objective analysis, not subjective perspectives.

Board Responsibilities in Fraud Risk Management:
* The board plays a critical role in overseeing the organization's fraud risk management activities to ensure accountability and effective governance.
Why A is Correct:
* The board provides high-level oversight but does not typically involve itself in the design or implementation of the fraud risk management program.
Why Other Options are Incorrect:
* B and D:Design and implementation are management responsibilities.
* C:Punishment of fraud perpetrators is not directly within the board's purview.

ACFE Code of Professional Ethics:
CFEs must act with integrity and report material fraud findings to the appropriate authority within the organization.
Why A is Correct:
Informing the board of trustees ensures that those responsible for governance can take appropriate action.
Reporting to law enforcement (option B) may breach contractual obligations unless legally required.
Why Other Options are Incorrect:
B:Reporting to law enforcement may overstep Daniela's authority as an independent investigator.
C:Not disclosing the information violates ethical responsibilities.
D:Resignation avoids responsibility and does not fulfill ethical obligations.