COSO Fraud Risk Management: Preventing and Detecting Fraud

The email seemed legitimate enough. A vendor we'd worked with for three years was requesting a change to their bank account details. The finance manager processed it without a second thought. By the time we realized it was a sophisticated phishing attack, $847,000 had been wired to criminals halfway around the world.

This happened to a client in 2020—a well-established manufacturing company with "proper controls" in place. Or so they thought.

After fifteen years investigating fraud cases, conducting forensic audits, and helping organizations build anti-fraud programs, I've learned one uncomfortable truth: fraud doesn't happen because controls don't exist. It happens because the right controls don't exist in the right places, monitored in the right ways.

That's where COSO's Fraud Risk Management framework becomes invaluable. Not as a compliance checkbox, but as a battle-tested methodology for actually preventing and detecting fraud before it destroys your organization.

The $5 Trillion Problem Nobody Wants to Talk About

Let me hit you with a number that should terrify every executive: organizations lose approximately 5% of their annual revenue to fraud. That's not my estimate—that's from the Association of Certified Fraud Examiners' 2024 Report to the Nations.

Do the math. A $100 million company is likely losing $5 million annually to fraud. A billion-dollar enterprise? $50 million walking out the door.

But here's what keeps me up at night: the median fraud case goes undetected for 12 months. Think about that. For a full year, someone inside or outside your organization is actively stealing, manipulating data, or corrupting your financial integrity. And your controls are missing it.

I remember conducting a fraud investigation for a regional healthcare provider in 2019. We discovered that a billing specialist had been creating fake patient accounts and pocketing insurance reimbursements for fabricated services.

For how long? Four years and seven months.

Total loss? $2.3 million.

The gut-punch moment came when the CFO asked me: "How did our auditors miss this?"

My answer: "Because you were checking for compliance, not for fraud. There's a difference."

"Compliance asks, 'Are we following the rules?' Fraud risk management asks, 'If someone wanted to steal from us, how would they do it—and how do we make sure they can't?'"

Understanding the COSO Fraud Risk Management Framework

COSO—the Committee of Sponsoring Organizations of the Treadway Commission—developed their Fraud Risk Management Guide to address a critical gap in enterprise risk management. Traditional internal controls often fail to prevent fraud because they're not designed with fraud scenarios in mind.

The COSO framework is built on five interconnected principles:

The Five Principles of COSO Fraud Risk Management

Let me walk you through each principle with real-world examples from my years in the field.

Principle 1: Fraud Risk Governance—Setting the Tone That Actually Matters

I once worked with a company where the CEO regularly joked about "creative accounting" and praised employees who found "clever workarounds" to policies. Three years later, they uncovered a $4.2 million inventory fraud scheme involving five employees across three departments.

Were they shocked? Absolutely. Should they have been? Not at all.

Fraud doesn't grow in a vacuum. It flourishes in cultures where ethical shortcuts are tolerated, even celebrated.

The Anatomy of Effective Fraud Governance

From my experience, effective fraud governance requires four critical elements:

1. Board-Level Oversight

The board needs a direct line to fraud risk management. I've seen too many organizations where the board hears sanitized summaries while the real fraud risks never make it past middle management.

One financial services client I worked with transformed their approach by creating a quarterly "fraud risk briefing" for the board that included:

• Recent fraud attempts (successful and unsuccessful)

• Emerging fraud trends in their industry

• Gaps in current fraud controls

• Investment needed to address high-risk areas

The result? Fraud losses dropped 67% over two years because the board prioritized funding for prevention programs.

2. Clear Accountability

Here's a question I ask every organization: "Who wakes up every morning thinking about fraud risk?"

If the answer is "nobody specifically," you have a problem.

Effective fraud governance assigns clear ownership:

3. Code of Conduct That's Actually Enforced

I can't count how many "codes of conduct" I've seen that are beautiful documents gathering dust on intranets. The difference between effective codes and window dressing? Enforcement.

A manufacturing client had a perfect example. Their code of conduct prohibited gifts from vendors above $50. Sounds reasonable, right?

Then we discovered that the procurement director had accepted a $15,000 "consulting fee" from a supplier. When confronted, he claimed it wasn't a gift—it was payment for "advisory services."

Why did he think he could get away with it? Because in fifteen years, the company had never once enforced their gift policy. The code of conduct was meaningless.

After implementing the COSO framework, they:

• Mandated quarterly gift and conflict disclosures

• Implemented automated monitoring of vendor relationships

• Created consequences (including termination) for violations

• Published enforcement actions (anonymized) organization-wide

The message was clear: the code of conduct isn't a suggestion.

4. Whistleblower Programs That Work

Here's a statistic that shocked me when I first encountered it: 43% of fraud cases are discovered through tips. Not internal audits. Not management review. Tips from employees, customers, or vendors.

But here's the catch—people only report fraud when they believe:

1. Their report will be taken seriously

2. They'll be protected from retaliation

3. Something will actually be done

I helped a retail company redesign their whistleblower program after discovering that employees had reported suspicious activity in a store manager's inventory practices for eight months with no action. The fraud eventually cost them $340,000.

Their new program included:

• Anonymous reporting hotline (third-party managed)

• Guaranteed 48-hour acknowledgment of all reports

• Quarterly reporting to audit committee on all tips received

• Strict anti-retaliation policy with CEO enforcement

• Public sharing of "fraud prevented" stories (protecting whistleblower identity)

Tips increased 340% in the first year. Fraud losses decreased 58%.

"Your employees know where the bodies are buried. The question is: have you given them a safe way to tell you?"

Principle 2: Fraud Risk Assessment—Mapping Your Vulnerability Landscape

Most organizations approach fraud risk assessment completely backward. They look at what controls they have and assume they're protected. That's like looking at the locks on your front door and assuming burglars won't try the windows.

The COSO approach flips this: start by understanding how fraud could occur, then assess whether your controls actually address those scenarios.

The Fraud Triangle: Understanding Why People Commit Fraud

Before we can assess fraud risk, we need to understand what drives fraud. The classic "Fraud Triangle" identifies three factors that must be present:

I investigated a case where a 22-year employee with no disciplinary history embezzled $680,000. Here's what we discovered:

• Pressure: Her husband developed a chronic illness with massive medical bills not covered by insurance

• Opportunity: She processed vendor payments with minimal oversight

• Rationalization: She convinced herself it was a "temporary loan" she'd repay once her husband recovered

Understanding the fraud triangle helps us assess risk more effectively. We can't eliminate pressure (life happens), and we can't control rationalization (that's psychology). But we can absolutely close opportunities.

Conducting a Comprehensive Fraud Risk Assessment

Here's the framework I use with clients:

Step 1: Identify Fraud Schemes Relevant to Your Organization

Don't waste time on theoretical fraud scenarios. Focus on what's actually likely in your industry and business model.

I worked with a software company that spent six months building controls for cash theft—despite being 100% digital with no cash handling. Meanwhile, they had zero controls around revenue recognition fraud, which is where their actual exposure existed.

Step 2: Assess Likelihood and Impact

For each identified fraud scheme, evaluate:

Risk Score = Likelihood × Impact

Here's a practical assessment matrix I use:

This prioritization is critical. You can't address every risk simultaneously. Focus on high-impact, high-likelihood scenarios first.

Step 3: Map Existing Controls

Now—and only now—do you inventory your existing controls and assess whether they actually address your high-priority risks.

I've seen organizations with 200+ controls that miss their top three fraud risks entirely. More controls don't equal better protection. Targeted controls aligned to actual risks do.

Principle 3: Fraud Prevention—Building Controls That Actually Work

Prevention is always cheaper than detection. Always. Let me prove it with numbers from a real case:

Cost of Prevention: $45,000 annually for enhanced segregation of duties and dual approval requirements

Cost of Detection: $280,000 for forensic investigation + $150,000 in legal fees + $830,000 in stolen funds = $1,260,000

The ROI is obvious.

The Four Pillars of Fraud Prevention

1. Segregation of Duties

This is fraud prevention 101, yet I'm constantly shocked by how often it's ignored.

The principle is simple: no single person should control an entire transaction from beginning to end.

Here's a real-world example from a manufacturing client:

Before COSO Implementation:

• Purchasing manager: Created vendor accounts, placed orders, approved invoices, processed payments

• Result: $1.8M fraud over 3 years through fake vendor scheme

After COSO Implementation:

Notice how no single person touches more than two steps in the process? That's proper segregation.

"If one person can both create a problem and hide it, you don't have a control—you have a suggestion."

2. Authorization Controls

I love this example from a healthcare client. They had a policy requiring dual signatures for checks over $25,000. Sounds great, right?

Then we discovered that their procurement manager had written 127 checks for $24,900 over 18 months. Total fraud: $3.16 million.

Why? Because authorization thresholds are worthless without pattern detection.

Effective Authorization Matrix:

That pattern trigger? That's what would have caught the $24,900 scheme.

3. Physical and Logical Access Controls

A construction company I worked with discovered that terminated employees could still access their systems for an average of 47 days after termination.

In one case, a fired project manager accessed the system six months after termination and deleted critical project files, causing $230,000 in recovery costs and project delays.

Critical Access Control Requirements:

4. Vendor Management Controls

Vendor fraud is incredibly common yet often overlooked. Here's why: organizations focus on employee fraud and forget that vendors have just as much opportunity and motivation.

Red Flags in Vendor Relationships:

I investigated a case where a logistics manager created 13 fake vendor companies over four years. The scheme was elegant in its simplicity:

• Used PO boxes in different cities

• Created professional-looking websites (total cost: $400)

• Submitted invoices for "consulting services" just below approval thresholds

• Deposited checks into personal accounts at different banks

Total fraud: $2.7 million

What finally caught him? A new accounts payable clerk noticed that three "different" vendors used identical invoice formatting and similar language in their service descriptions. She reported it through the whistleblower hotline.

Vendor Verification Protocol We Implemented:

1. Setup Phase

   • Physical address verification (no PO boxes)

   • Business license verification

   • Tax ID validation

   • D&B or similar credit report

   • Conflict of interest disclosure from all employees

2. Ongoing Monitoring

   • Duplicate payment detection

   • Address matching (vendor vs. employee)

   • Statistical analysis for unusual patterns

   • Periodic vendor confirmation calls

   • Annual vendor recertification

Principle 4: Fraud Detection—Finding What Prevention Missed

Here's an uncomfortable truth: perfect prevention is impossible. Determined fraudsters will find creative ways around controls. That's why detection is critical.

The question isn't "Will fraud occur?" It's "How quickly will we catch it?"

Remember: the median fraud goes undetected for 12 months. Every month that fraud continues, losses compound. Early detection is everything.

Data Analytics: Your Early Warning System

In 2021, I helped a distribution company implement data analytics for fraud detection. Within the first month, we identified:

• 34 duplicate payments totaling $127,000

• 17 vendor addresses matching employee addresses

• 8 instances of sequential invoice numbers from "different" vendors

• 23 payments to vendors with no purchase orders

Total recovered: $340,000

The crazy part? All this data existed in their system. They just weren't looking at it.

High-Value Data Analytics Tests:

Benford's Law Example:

Benford's Law states that in naturally occurring datasets, the first digit is more likely to be small (30% start with "1") than large (less than 5% start with "9").

When someone fabricates numbers, they typically create a more uniform distribution. We caught a $480,000 expense fraud scheme because the fraudster's fake receipts violated Benford's Law—their amounts started with each digit almost equally.

Continuous Monitoring vs. Periodic Testing

Traditional audit approaches test samples periodically. Continuous monitoring examines 100% of transactions in real-time or near-real-time.

Comparison:

A financial services client implemented continuous monitoring on their wire transfer process. Within two weeks, they detected an attempted $2.3 million fraud that their quarterly sampling would have missed for at least 60 days.

The fraud would have succeeded if caught later (funds would have been moved offshore). Instead, they stopped it before the transfer completed.

ROI of continuous monitoring:

• Investment: $180,000 annually

• Fraud prevented in year one: $2.3M + $840K + $670K = $3.81M

• Return: 2,017% in first year

Key Fraud Indicators (KFIs) to Monitor

Just like KPIs (Key Performance Indicators) measure business performance, KFIs measure fraud risk exposure.

Critical KFIs by Category:

Financial Indicators:

• Invoices just below approval thresholds (>10% is a red flag)

• After-hours system access to financial systems (>5 instances/month)

• Vendor payment velocity (same vendor paid >2x/week)

• Manual journal entries as % of total (>15% warrants review)

• Inventory shrinkage rates (>2% industry average)

Behavioral Indicators:

• Employees who never take vacation (76% of fraudsters work without breaks)

• Resistance to process changes or audits

• Unexplained wealth (cars, homes beyond salary)

• Close relationships with vendors/customers

• Department turnover rates (very high or very low both problematic)

Operational Indicators:

• Failed login attempts (>5/day from single user)

• Unusual transaction patterns (timing, amounts, frequency)

• Override frequency (>2% of transactions)

• Exception report trends (increasing exceptions)

• Control bypass frequency

Case Study: Detection in Action

Let me share how detection worked in a real investigation:

The Scenario: A regional hospital discovered potential fraud in their medical supply purchasing. A buyer had been with the company for 11 years with excellent performance reviews.

Detection Sequence:

Week 1: Data analytics flagged that 23% of medical supply purchases were just under the $10,000 dual-approval threshold.

Week 2: Further analysis revealed that 67% of these below-threshold purchases went to three vendors.

Week 3: Address verification showed one vendor shared an address with an employee's family member.

Week 4: Invoice analysis revealed identical formatting across all three "different" vendors.

Week 5: Forensic investigation confirmed the buyer had created three shell companies and was approving purchases to himself.

Total fraud: $1.43 million over 4 years

Why detection succeeded:

1. Automated threshold analysis (would have been missed in manual sampling)

2. Cross-reference of multiple data points (vendor, employee, address, pattern)

3. Rapid escalation and investigation (5 weeks from flag to confirmation)

4. Documented process prevented tipping off the fraudster

"Fraud detection isn't about catching criminals. It's about creating an environment where fraud is so likely to be caught quickly that rational people don't attempt it."

Principle 5: Investigation and Remediation—What Happens After Detection

Detecting fraud is only half the battle. How you investigate and remediate determines whether you:

1. Recover stolen assets

2. Successfully prosecute

3. Prevent recurrence

4. Maintain employee morale

5. Protect your reputation

I've seen organizations botch fraud investigations so badly that they couldn't prosecute despite overwhelming evidence. I've also seen cases where proper investigation led to criminal convictions, full asset recovery, and improved controls.

The Investigation Framework

Phase 1: Initial Response (Hours 1-24)

When fraud is suspected, the first 24 hours are critical.

Critical Actions:

Common Mistakes in First 24 Hours:

I watched a company destroy their fraud prosecution case by confronting the suspected fraudster before securing evidence. He immediately deleted emails, wiped his laptop, and shredded documents. We eventually proved fraud, but couldn't recover the assets or successfully prosecute.

DO NOT:

• Confront the suspect before evidence is secured

• Discuss the investigation broadly (maintain confidentiality)

• Allow suspect to access systems

• Make accusations without evidence

• Handle investigation internally when external expertise is needed

Phase 2: Forensic Investigation (Weeks 1-8)

A proper forensic investigation follows a methodical process:

1. Evidence Collection

   • Email and document review

   • System access logs

   • Financial transaction analysis

   • Witness interviews

   • Physical evidence (documents, devices)

2. Analysis

   • Timeline reconstruction

   • Financial impact quantification

   • Method and scheme documentation

   • Control failure identification

   • Co-conspirator assessment

3. Documentation

   • Detailed investigation report

   • Evidence catalog with chain of custody

   • Financial loss calculation

   • Control weakness analysis

   • Prosecution recommendation

Investigation Cost Reality:

These numbers show why prevention is so much cheaper than cure.

Phase 3: Remediation and Control Enhancement

This is where most organizations fail. They investigate, maybe prosecute, then move on without fixing the underlying issues.

Comprehensive Remediation Plan:

The Prosecution Decision

Not every fraud investigation leads to prosecution. Here's the decision framework I use with clients:

Factors Supporting Prosecution:

• Clear evidence of intentional fraud (not just negligence)

• Quantifiable financial loss

• No mitigating factors (coercion, mental illness, etc.)

• Strong evidence chain

• Cooperative witnesses

• Strategic deterrent value

• Asset recovery potential

Factors Against Prosecution:

• Weak evidence (conviction unlikely)

• Very small amounts (prosecution cost exceeds loss)

• First-time offense with full restitution

• Publicity harm outweighs justice benefit

• Victim unwilling to cooperate

• Statute of limitations issues

I worked on a case where a 30-year employee stole $85,000. She made full restitution, was genuinely remorseful, and the theft was driven by a family medical emergency.

The company chose not to prosecute but did terminate employment and implement controls to prevent recurrence. Sometimes that's the right answer.

But in another case, an executive stole $3.2 million through elaborate financial statement fraud. Despite his age (67) and health issues, the company prosecuted aggressively. He received a 7-year sentence.

Why the different approach? The executive's fraud was premeditated, sophisticated, and harmed thousands of shareholders. Deterrent value was critical.

"The goal of fraud investigation isn't punishment—it's prevention. Sometimes that means prosecution. Sometimes it means fixing systems and moving forward. Wisdom is knowing which path serves justice better."

Building Your COSO Fraud Risk Management Program: A Practical Roadmap

After implementing COSO fraud frameworks at over 30 organizations, here's the roadmap that works:

Months 1-3: Assessment and Planning

Week 1-2: Stakeholder Alignment

• Executive sponsorship (critical!)

• Board buy-in and oversight commitment

• Resource allocation

• Success metrics definition

Week 3-6: Current State Assessment

• Document existing fraud controls

• Interview key process owners

• Review historical fraud incidents

• Assess organizational culture

Week 7-12: Fraud Risk Assessment

• Identify potential fraud schemes

• Assess likelihood and impact

• Map control gaps

• Prioritize risks

Deliverables:

• Fraud risk assessment report

• Gap analysis

• Implementation roadmap

• Budget and resource plan

Months 4-9: Implementation

Prevention Controls:

• Redesign high-risk processes

• Implement segregation of duties

• Enhance authorization controls

• Strengthen vendor management

Detection Capabilities:

• Deploy data analytics tools

• Establish continuous monitoring

• Define and track KFIs

• Create exception reporting

Investigation Readiness:

• Document investigation procedures

• Identify forensic partners

• Train investigation team

• Create evidence preservation protocols

Months 10-12: Testing and Refinement

Control Testing:

• Test prevention controls

• Validate detection capabilities

• Conduct tabletop exercises

• Perform simulated fraud scenarios

Training and Awareness:

• Executive fraud awareness

• Manager fraud detection training

• Employee general awareness

• Specialized role-based training

Program Launch:

• Communication campaign

• Policy publication

• Monitoring activation

• Metrics baseline establishment

Year 2+: Continuous Improvement

Ongoing Activities:

• Monthly KFI review and action

• Quarterly fraud risk reassessment

• Annual program effectiveness evaluation

• Continuous control enhancement

Maturity Evolution:

Real-World Results: What Good Fraud Risk Management Achieves

Let me share results from actual COSO implementations I've led:

Case Study 1: Regional Healthcare System

Starting Point:

• Annual fraud losses: ~$2.8M (estimated)

• Detection time: 18 months average

• Successful prosecutions: 0 in 5 years

18 Months Post-Implementation:

• Annual fraud losses: $340K (88% reduction)

• Detection time: 6 weeks average

• Successful prosecutions: 3 cases

• Controls prevented: $1.9M in attempted fraud

Key Success Factors:

• Executive commitment (CEO personally championed)

• Data analytics investment ($220K)

• Culture change (ethics training for all staff)

• Whistleblower program (anonymous hotline)

Case Study 2: Manufacturing Company

Starting Point:

• Major vendor fraud ($1.8M over 3 years)

• Weak segregation of duties

• No fraud risk assessment

12 Months Post-Implementation:

• Zero material fraud incidents

• Vendor fraud attempt detected and stopped (would have been $430K)

• Insurance premium reduced by $180K annually

• Employee confidence increased (survey data)

Investment:

• Program implementation: $165K

• Ongoing annual cost: $95K

• ROI in year one: 526%

Case Study 3: Financial Services Firm

Starting Point:

• Regulatory pressure following industry frauds

• Adequate controls but siloed

• Limited board oversight of fraud risk

24 Months Post-Implementation:

• Integrated fraud risk management across all divisions

• Board-level fraud risk committee established

• Fraud losses decreased from 0.8% to 0.1% of revenue

• Customer trust scores improved 23%

Unexpected Benefits:

• Operational efficiency improved (streamlined processes)

• Employee satisfaction increased (clear expectations, fair enforcement)

• Competitive advantage (customers value fraud protection)

The Human Element: Why Culture Matters More Than Controls

After fifteen years in this field, I've reached a counterintuitive conclusion: technical controls matter less than organizational culture.

Let me explain.

I've seen organizations with sophisticated controls and massive fraud. I've also seen companies with basic controls and virtually no fraud.

The difference? Culture.

In organizations where fraud thrives:

• Leadership tolerates ethical shortcuts

• Employees feel pressure to make numbers "no matter what"

• Whistleblowers face retaliation

• "Results" matter more than "how you get results"

• Fraud is seen as an individual's moral failure, not a systemic issue

In fraud-resistant organizations:

• Leadership models ethical behavior

• Employees feel psychologically safe reporting concerns

• Mistakes are distinguished from misconduct

• Processes are designed to make right easier than wrong

• Fraud is treated as a system failure requiring root cause analysis

Building a Fraud-Resistant Culture

The Tone at the Top Must Be Real

I worked with a CEO who talked passionately about ethics in town halls while privately praising a sales executive who violated company policies to close deals. Guess what happened? Within two years, they uncovered fraud in three departments totaling $4.7M.

Employees watch what leaders do, not what they say.

Effective Cultural Elements:

Common Pitfalls to Avoid

After watching numerous fraud risk management implementations, here are the mistakes that derail programs:

1. Checkbox Compliance Mentality

Organizations implement fraud controls to satisfy auditors, not to actually prevent fraud. The controls exist on paper but not in practice.

Solution: Design controls that genuinely address fraud scenarios, not just audit requirements.

2. Over-Reliance on Technology

Technology is powerful, but it's not a silver bullet. I've seen companies spend millions on fraud detection software while ignoring basic segregation of duties.

Solution: Technology enables controls; it doesn't replace them. Focus on fundamentals first.

3. Inadequate Investigation Response

Discovering fraud and not properly investigating sends a message: fraud isn't really a serious concern here.

Solution: Every suspected fraud deserves appropriate investigation, even if prosecution isn't pursued.

4. Ignoring Small Frauds

"It's only $5,000, not worth investigating."

Small frauds tell you about control weaknesses. Today's $5,000 fraud is tomorrow's $500,000 fraud.

Solution: Investigate all fraud, not based on amount but on what it reveals about vulnerabilities.

5. Siloed Fraud Risk Management

Fraud risk management sits in internal audit, disconnected from operations, compliance, and cybersecurity.

Solution: Integrate fraud risk management across all three lines of defense.

Your Next Steps: Starting Your Fraud Risk Management Journey

If you're ready to implement COSO fraud risk management, here's your action plan:

This Week:

• Get executive sponsorship (nothing happens without it)

• Form a fraud risk working group

• Schedule initial assessment planning session

• Review recent fraud incidents (what did they reveal?)

This Month:

• Conduct preliminary fraud risk brainstorming

• Inventory existing fraud controls

• Identify quick wins (low-hanging fruit)

• Research fraud trends in your industry

This Quarter:

• Complete formal fraud risk assessment

• Prioritize top 10 fraud risks

• Design prevention controls for top 3 risks

• Implement initial detection analytics

This Year:

• Full fraud risk management program implementation

• Training and awareness rollout

• Continuous monitoring activation

• First program effectiveness assessment

Final Thoughts: The Cost of Inaction

I started this article with an $847,000 wire fraud. Let me end with what happened next.

The company implemented COSO fraud risk management. They redesigned their vendor payment process, implemented dual verification for banking changes, and deployed analytics to detect unusual payment patterns.

Eight months later, they received another fraudulent bank change request—nearly identical to the one that had succeeded before.

This time, their controls caught it. The verification call revealed the fraud. Zero dollars lost.

The CFO called me afterward. "The program paid for itself in a single prevented fraud," he said. "Everything else is pure value."

That's the power of systematic fraud risk management. Not eliminating fraud—that's impossible. But creating an environment where:

• Fraud is difficult to commit

• Fraud is likely to be detected quickly

• Fraud consequences are certain and severe

• Honest people have clear paths to raise concerns

The question isn't whether you can afford to implement fraud risk management. It's whether you can afford not to.

Because somewhere in your organization right now, someone might be:

• Creating fake vendors

• Manipulating financial statements

• Stealing inventory

• Falsifying expense reports

• Accepting kickbacks

The only question is: will you catch them in weeks, months, or years?

And by the time you do, how much will they have taken?