2 Patrick is a newly appointed Independent Non-Executive Director of a listed company. He has been tasked to submit a report to the Chairman of the Audit Committee to critically review the company's risk management policies and procedures with a view to enhance the current fraud risk governance. Patrick conducted some due diligent enquiries and interviews with key employees, stakeholders and regulators including the Securities and Futures Commission, who are currently investigating suspected insider dealing offences committed by Joseph, a former Chief Financial Officer who was believed to have used inside information to purchase shares on behalf of the company. The Independent Commission Against Corruption is also investigating suspected corruption activities concerning possible procurement fraud committed by Chris, the Procurement Director and his girlfriend, Ivy. The internal control function is undertaken, on a part time basis, by a junior Human Resources Officer with no formal qualification in internal auditing nor fraud detection and prevention experience. The whistleblowing hotline is personally managed by Ken, the Chief Operations Officer, who has no qualifications or experience in internal investigation. Some employees hinted that they would not dare to make any complaint as they are worried that they may be targeted for revenge. Ken would have the final say on how the complaint should be dealt with and there is no oversight by the Board as to the process and results of the investigation of complaints. There are rumors that Ken did not inform the Board about some anonymous complaints made against Chris, the Procurement Director, who is his brother. Patrick is also not able to locate details and results of any complaints received by the Company from more than six months ago. REQUIRED Advise Patrick as to the following: (a) The appropriate steps to be taken to conduct an effective Fraud Risk Assessment in the light of the circumstances of this case by applying the Fraud Risk Management Principles recommended by the Association of Certified Fraud Examiners as set out in a Guide Book titled "Managing the Business Risks of Fraud", published in 2008. (15 marks) (b) How Patrick could enhance the current Whistleblowing Programme to encourage employees and third parties to report malpractices and criminal activities. (5 marks) (Total 20 marks)