Control Environment The company seemed to lack an organizational culture of honesty and high ethical standards. If it were in place, it potentially would have helped reduce opportunities to commit fraud. Proper pre-hire screening should have been in place to eliminate or decrease the chances of potential imposture. The hiring policy should not have been of such loose standards. They should have not let their guard down just because of the acquisition process. Instead, they should have put even more emphasis on the screening process. It would also help to have an employee support programs available, offering free and confidential assessments, counseling, and similar services to employees who have either personal or work-related issues. Risk Assessment As mentioned above, the acquisition process was handled somewhat loosely. The company should have been cautious about having new people coming in. The company should have assessed changes that could impact the system of internal control, acquiring new company is definitely one of those changes. They should have also considered the "fraud triangle" and try to identify potential shortcomings. Control Activities Control activities seemed to fail the most. First of all, the company should have set the amount that one person can authorize per transaction much lower than $250,000. This would not necessarily prevent the embezzlement, but it would probably reduce the damages at least. The segregation of duties was not implemented correctly. No single person should have control over two or more phases of a transaction or operation. This error on the company's side allowed for the fraud to stay hidden by creating fictitious debits by the fraudster. The company should have created better authentication controls. The fact that one person was able to log in to the computer system as someone else shows us that the protection was weak. It would be more secure if the company used multifactor authentication. The company also should have prevented the same person who approves check to have access to them