Fraud risk management: from governance to response.

Why fraud happens, and the two main types

Fraud is deliberate. The US auditing standard on fraud, PCAOB AS 2401, says intent is what separates fraud from a mistake.

Two main types in an organisation, as the standard describes them:

• Fraudulent financial reporting: deliberately misstating or leaving things out of the accounts to mislead the people who rely on them, for example by falsifying records or misapplying accounting rules. It does not need a grand plan; it can start small.
• Misappropriation of assets, in other words theft: embezzling receipts, stealing assets, or paying for goods and services that were never received.

Many organisations, especially in financial services, also face external fraud: criminals outside the organisation who attack it or its customers through scams, stolen identities and payment fraud. The same management principles apply.

Why people commit fraud. The standard says three conditions are generally present:

• Incentive or pressure: debt, targets, a lifestyle to maintain, or pressure from others.
• Opportunity: weak or missing controls, or the ability of managers to override them.
• Rationalisation: a story the person tells themselves, such as "I'll pay it back" or "they owe me".

These three are widely known as the fraud triangle, although the standard itself simply calls them three conditions. The standard notes that even honest people can commit fraud under enough pressure.

What follows for managers. You cannot control people's pressures or private thoughts, but you can control opportunity, and you can shape the culture that makes rationalisation harder. The standard's own examples of opportunity for theft include large amounts of cash on hand, poor separation of duties, weak reconciliations, and no requirement for staff in key roles to take leave, which is when hidden schemes often come to light.

Prevention is cheaper than cure. The US Government Accountability Office (GAO) puts it simply: preventing fraud is generally the most cost-effective approach, because recovering money after it has gone, often called "pay and chase", is expensive and often fails.

A framework, from commitment to evaluation

The GAO's Framework for Managing Fraud Risks in Federal Programs (2015) is one of the clearest public models for managing fraud. It was written for US government programmes, but its principles apply to any organisation, and US law later required federal agencies to follow it.

It has four components, surrounded by monitoring and feedback:

1. Commit: create a culture and a structure that support fraud risk management.
2. Assess: assess fraud risks on a regular schedule and build a fraud risk profile.
3. Design and implement: choose a strategy and specific controls, and work with others.
4. Evaluate and adapt: measure results, learn and improve.

GAO stresses that these are not a step-by-step sequence; all four run continuously.

Commit in practice:

• Senior leaders show they are committed to integrity and to fighting fraud, and all levels help set an anti-fraud tone.
• A dedicated anti-fraud lead or team is named, with clear responsibilities, real authority and a direct line to senior management. It understands the business and its fraud risks, runs the risk assessment, leads training and coordinates anti-fraud work.
• That team sits inside the organisation's management. GAO notes it should be separate from the independent auditors or inspectors, so that their independence is protected.

The UK government's counter fraud standard (GovS 013) takes a similar approach. It asks organisations for a counter fraud policy and a fraud response plan, assurance at several levels, regular risk assessment, reporting routes for staff and the public, trained investigators, and measurement of fraud loss and prevention.

Assessing fraud risk

A fraud risk assessment answers four questions: what could go wrong, how likely is it, how bad would it be, and how much are we prepared to accept?

GAO describes five actions:

• Identify the inherent fraud risks, before any controls. Think about financial reporting fraud, theft, corruption and non-financial fraud such as false claims of eligibility. The fraud triangle helps: where are the incentives, the opportunities and the excuses?
• Assess likelihood and impact. This can be done with numbers or with simple scales, for example likelihood from "rare" to "almost certain" and impact from "immaterial" to "extreme". Include harm beyond money, such as reputation and legal compliance.
• Set a fraud risk tolerance: the level of risk the organisation is willing to accept to achieve its goals. GAO's focus groups agreed that eliminating fraud entirely is not realistic; a programme that tried would stop serving its genuine users.
• Examine existing controls and work out the residual risk, the risk left after controls, then rank what needs attention.
• Document the fraud risk profile: the risks, their ratings, the controls and the decisions taken. GAO's appendix gives an example.

How often? GAO says assessments should be repeated regularly and whenever the business changes; the experts it consulted quoted intervals from one to five years. The UK standard calls fraud risk assessment "an ongoing process". A new product, channel or system is always a trigger.

Who takes part? People who know the business, the anti-fraud team and, where useful, outside experts. GAO notes that independent auditors may contribute but should not lead the assessment, so they can later check it objectively.

Responding to each risk. For each risk, the organisation can accept it if it is within tolerance, reduce it with controls, share it, for example through insurance, or avoid it by not doing the activity at all.

Controls and the three lines

The three lines model. The Institute of Internal Auditors' Three Lines Model (2020, updated 2024) describes who does what:

• The governing body, such as the board, is accountable to stakeholders, sets risk appetite and oversees risk management.
• First line roles deliver products and services and own and manage the risks in what they do, including fraud risk.
• Second line roles, such as compliance, risk and security, provide expertise, monitoring and challenge.
• The third line, internal audit, gives independent assurance and advice to the governing body.

The IIA stresses that the "lines" are roles, not walls, and all operate at the same time. In some organisations, fraud investigation sits with the third line.

Types of control, from GAO's framework:

• Data analytics: automated checks on data as it is entered, matching against other data sources, and mining data for patterns. GAO notes automated controls tend to be more reliable than manual ones.
• Fraud awareness training, at hiring and regularly afterwards, so staff know what fraud looks like and how to report it.
• Reporting channels: hotlines and other routes, with anonymity, confidentiality and protection from retaliation. Tip-offs remain one of the main ways fraud is found.
• Employee integrity: background checks and a clear code of conduct.
• Separation of duties, so that no one person can start, approve and record a transaction, which also limits management override.

Balance the cost. GAO asks organisations to weigh the cost of a control against its benefit, and to remember that controls which stop genuine customers or beneficiaries have a cost too.

Responding when fraud is found

Fraud will happen despite good controls. What matters then is a prompt, consistent response, planned in advance.

The response plan. The UK counter fraud standard says a response plan should cover:

• where and how to report suspected fraud;
• how information and intelligence are handled;
• how the organisation decides to respond, and how investigations are monitored and concluded;
• who does what;
• how matters are reported inside the organisation and to outside bodies, including law enforcement.

GAO adds that responding promptly and consistently, including referring possible fraud to law enforcement, shows staff and customers that reports are taken seriously and deters others.

Evidence. The UK standard asks for records to be stored securely and retrievable so that they can support a case, and kept in line with policy and law. Do not alert the suspect, do not alter the evidence, and involve trained investigators early.

Learn and adapt. GAO's final component is to evaluate outcomes and adapt:

• measure outcomes, such as fraud losses prevented and recovered, not just activity, such as the number of alerts;
• use what investigations and prosecutions reveal to strengthen prevention and detection;
• share results so that the whole organisation learns.

In Kenya: the Banking Act prohibits institutions from conducting business in a fraudulent or reckless manner, and defines fraudulent conduct to include intentional deception and concealment of material facts that cause loss to the institution. The Central Bank of Kenya's risk management guidelines ask banks to keep a log of major operational risk events, including frauds and attempted frauds, and the National Payment System Regulations, 2014 require payment service providers to report incidents of fraud in their monthly returns. The Directorate of Criminal Investigations has a Banking Frauds Investigations Unit, which investigates fraud reported by banks and other financial institutions and works to recover stolen funds. The Central Bank published draft updated risk management guidelines for comment in 2026; check the current version.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.