Which statement best differentiates red flags from control weaknesses?

Which statement best differentiates red flags from control weaknesses?

• A. Red flags are warning indicators.
• B. Red flags are warning indicators; control weaknesses are deficiencies in design or operation that enable fraud.
• C. Control weaknesses are warning indicators; red flags are process gaps.
• D. Red flags are warning indicators; control weaknesses are deficiencies in design or operation that enable fraud.

Answer: (D)

Red flags signal potential problems; they are warning indicators that something could be off. Control weaknesses are flaws in the design or operation of internal controls that create an opportunity for fraud to occur or go undetected. This distinction fits best because it separates the alert signals from the underlying deficiencies: red flags point auditors toward possible issues, while control weaknesses describe tangible flaws in how controls are designed or carried out that could enable fraud. For example, unusual or large journal entries might be a red flag, whereas a lack of proper approvals or insufficient segregation of duties is a control weakness that could allow fraud to happen.