INTRODUCTION When developing a fraud control system, it is very difficult to know what to protect and how to protect it if one does not first perform a risk assessment to see where the risks lie in the entity (except for a fraud that has alreadyoccurred!). The goal of any antifraud program is to prevent fraud, not just detect it. The old axiom of ‘‘An ounce of prevention is worth a pound of cure’’ is an understatement with regard to fraud. The passage of the Sarbanes-Oxley (SOX) Act of 2002 puts into law tenets intended to prevent fraud. Although detecting fraud is important, it obviously would be better if fraud could be mitigated or minimized—prevented to the degree possible. Detection is inevitably tied to prevention, and the two together provide the system of antifraud controls. PREVENTION ENVIRONMENT A key to successful fraud prevention is to look at the entity’s culture and try to change it, if necessary. Some activities and attitudes can help in achieving this goal. ...