Which statement best differentiates red flags from control weaknesses?

• A. Red flags are warning indicators.
• B. Red flags are warning indicators; control weaknesses are deficiencies in design or operation that enable fraud.
• C. Control weaknesses are warning indicators; red flags are process gaps.
• D. Red flags are warning indicators; control weaknesses are deficiencies in design or operation that enable fraud.

Answer: (D)

Understanding the difference between red flags and control weaknesses hinges on recognizing one as an alert and the other as a vulnerability. Red flags are warning indicators that something may be off in a process; they prompt you to investigate further but don’t by themselves prove fraud or a design flaw. Control weaknesses are deficiencies in the design or operation of controls that create opportunities for errors or fraud to occur. The strongest differentiation is that red flags signal potential risk, while control weaknesses describe actual gaps in how controls are built or carried out that could enable fraud if not addressed. For example, an unusual vendor payment pattern can be a red flag requiring further inquiry, whereas a lack of proper separation of duties is a control weakness that could directly enable improper transactions.