Fraud risk is the one risk every internal audit function is expected to understand, assess and respond to, and the one most functions handle by reflex: a line in the engagement risk assessment, a sentence in the report, a hotline nobody audits. That is not negligence so much as a gap in the literature. Most writing on fraud is either forensic (how investigators work a case) or sensational (how the famous ones happened), and neither tells an audit function how to build and test a fraud risk management programme. This guide does that. It defines fraud risk in the terms the profession uses, sets out the five-principle framework that governs a programme, walks through a fraud risk assessment with a worked example, catalogues the controls and the analytics that detect schemes, describes what the Global Internal Audit Standards expect of the function, and ends with the legal frame that has made “failure to prevent” a corporate offence in some jurisdictions. It is written for the auditor who has to assess the programme and for the manager who has to run one.
In this guide
- What fraud risk is, and how it is classified
- Why people commit fraud: pressure, opportunity, rationalisation
- The fraud risk management framework: five principles
- The fraud risk assessment, step by step
- Worked example: a fraud risk assessment for a distributor
- Anti-fraud controls by scheme
- Detection: the analytics that find schemes
- Reporting channels and the culture around them
- Internal audit’s role under the Standards
- The legal and regulatory frame
- Frequently asked questions
- Related guides
What fraud risk is, and how it is classified
Fraud is an intentional act of deception to obtain an unjust or illegal gain; fraud risk is the exposure of an organisation to such acts, by insiders or outsiders, measured by their likelihood and their consequence. The profession classifies occupational fraud, the kind committed by people against the organisation that employs them, using the taxonomy the Association of Certified Fraud Examiners has maintained for three decades, and the classification matters because each branch has its own schemes, its own perpetrators and its own controls.
| Category | What it is | Common schemes | Typical perpetrator | Pattern in the ACFE’s Report to the Nations |
|---|---|---|---|---|
| Asset misappropriation | Theft or misuse of the organisation’s assets | Billing schemes (fictitious or inflated vendors), payroll schemes (ghost employees, falsified hours), expense reimbursement, cheque and payment tampering, skimming of receipts, inventory theft, cash larceny | Employees and managers with access to the asset or the process | By far the most frequent category and the least costly per case |
| Corruption | Misuse of influence in a business transaction for personal benefit | Bribery and kickbacks in procurement, conflicts of interest in purchasing or sales, bid rigging, illegal gratuities, economic extortion | Managers and executives with authority over suppliers, customers or contracts | Present in a large share of cases; often co-occurs with asset misappropriation |
| Financial statement fraud | Intentional misstatement or omission in financial reports | Fictitious revenue, timing differences, concealed liabilities, improper asset valuation, improper disclosures | Senior executives, sometimes with finance staff under pressure | The least frequent category and the most costly per case by a wide margin |
| External fraud (not occupational) | Fraud by outsiders against the organisation | Vendor impersonation and bank-detail change scams, business email compromise, customer and claims fraud, cyber-enabled payment fraud | Organised actors; opportunists | Outside the ACFE occupational taxonomy; a growing share of corporate loss |
Two findings from the ACFE’s biennial study have stayed stable across editions and shape everything that follows. Frauds typically run for about a year before detection, and tips are the most common detection method, ahead of internal audit, management review and any analytic technique. The first means the control environment usually fails quietly for a long time; the second means the reporting channel is the single most valuable detective control an organisation has, and one of the least audited. The fraud red flags guide covers the behavioural and transactional indicators that precede a tip; this guide covers the programme that acts on it.
Why people commit fraud: pressure, opportunity, rationalisation
Cressey’s fraud triangle, developed from interviews with convicted embezzlers in the 1950s, remains the working model because it tells a control designer where to intervene. Fraud requires a pressure (a financial need, a target, an addiction, a lifestyle), an opportunity (access, authority, weak controls, no oversight) and a rationalisation (I am owed this, I will pay it back, everyone does it). Later writers added capability (the position and skills to execute and conceal) to make a diamond. The practical point is that controls can act on only one element with confidence: opportunity. Pressure is personal and mostly invisible; rationalisation is cultural and slow to change; opportunity is a matter of access, segregation and supervision, which the organisation controls directly. Programmes that spend their effort on ethics messaging alone are addressing the element they can influence least.
| Element | What creates it | What the organisation can observe | What reduces it |
|---|---|---|---|
| Pressure | Personal financial difficulty; unrealistic targets and incentives; addiction; family circumstances | Living beyond means; unusual stress; refusal to take leave; intense target pressure in a unit | Realistic targets; incentive design review; employee support channels; attention to the conduct risk indicators |
| Opportunity | Access combined with authority; weak segregation; absent review; override capability; unmonitored exceptions | Access reports; segregation-of-duties conflicts; override logs; exception volumes | Segregation of duties; access management; independent review; analytics on the processes with cash or payment flows |
| Rationalisation | Perceived unfairness; a culture of corner-cutting; leaders seen to bend rules; weak consequences | Survey results; the pattern of disciplinary outcomes; tone from leaders | Visible consistency of consequences at every level; a code that leaders follow; see the ethics and compliance program audit |
| Capability | Seniority; technical skill; knowledge of the control gaps; a position of trust | Long tenure in a sensitive role without rotation; a single person understanding a system | Rotation; mandatory leave; dual knowledge of critical processes |
The fraud risk management framework: five principles
The reference framework is the Fraud Risk Management Guide published jointly by COSO and the ACFE, first issued in 2016 and updated in 2023 to reflect data analytics and the growth of external and cyber-enabled fraud. It extends COSO’s internal control framework with five fraud-specific principles. A programme that can show evidence under each principle is a programme; one that has a policy and a hotline is a start. The table sets out the principles, the evidence a mature programme produces, and the tests an auditor applies.
| Principle | What it requires | Evidence a mature programme produces | How internal audit tests it |
|---|---|---|---|
| 1. Fraud risk governance | The board and management establish and communicate a fraud risk management programme with roles, responsibilities and a policy | Board-approved anti-fraud policy; named programme owner; board reporting; a code of conduct that addresses fraud; training records | Inspect policy, approvals and reporting; interview the owner; test training completion and content |
| 2. Fraud risk assessment | A comprehensive assessment of fraud schemes, their likelihood and significance, and the controls that address them, refreshed periodically | A documented scheme-level assessment by process and entity; residual ratings; linkage to the control inventory; refresh on triggers | Reperform a sample of ratings; test completeness against the scheme taxonomy and against incidents; check refresh timing |
| 3. Fraud control activities | Preventive and detective controls selected and deployed to address the assessed schemes | A control inventory mapped to schemes; segregation of duties; analytics; access controls; vendor and payroll controls | Test design and operating effectiveness of the key anti-fraud controls; see the design vs operating effectiveness guide |
| 4. Fraud investigation and corrective action | A process to receive, evaluate and investigate allegations, and to take corrective action including discipline and recovery | Investigation protocol; case management records; consistent outcomes; root-cause remediation; legal and HR involvement | Walk through a sample of cases from intake to closure; test consistency of discipline; check that control weaknesses found in cases were remediated |
| 5. Fraud risk management monitoring | Ongoing evaluation of the programme’s effectiveness and communication of results | Programme metrics (hotline volumes, case cycle times, loss trends, analytics hits); periodic independent assessment; board reporting | Review metrics for completeness and use; confirm independent assessment occurred; test that monitoring led to change |
The framework assigns ownership clearly: management owns the programme and the controls, the board oversees it, and internal audit assesses it. Functions that drift into owning the hotline or running every investigation have taken on first-line roles, and the Three Lines Model guide explains why that is a problem for the function’s later assurance over the same activities.
The fraud risk assessment, step by step
Principle 2 is where most programmes are weakest, because a fraud risk assessment is different from the enterprise risk assessment and from the audit function’s own annual risk assessment. It works at the level of schemes rather than risk categories: not “procurement fraud” but “a buyer directs purchases to a vendor in which they hold an interest, concealed by splitting orders below the approval threshold”. Scheme-level thinking is what makes the controls specific. Seven steps produce a defensible assessment.
- Scope by process and entity. List the processes with cash, payments, assets, revenue recognition or reporting judgment, by legal entity or location; the risk register and the RCSA supply the unit list.
- Build the scheme inventory. For each process, list the schemes that could occur, drawn from the ACFE taxonomy, the organisation’s own incident history and industry cases; a procurement process typically yields ten to fifteen schemes, payroll six to eight, revenue eight to twelve.
- Identify who could commit each scheme and how. Role, access and authority, including collusion and management override; this step surfaces the segregation-of-duties conflicts, and the segregation of duties guide supplies the toxic-combination logic.
- Rate inherent likelihood and significance. On anchored scales, significance including reputational and regulatory consequence, not only the amount; a scheme that would be small in money but would breach a licence condition is significant.
- Map existing controls to each scheme and rate residual exposure. Preventive and detective separately; a scheme with only preventive controls has no way of being found if prevention fails.
- Decide the response for the residual Highs. New or strengthened controls, analytics, insurance, acceptance by someone with authority, with owners and dates.
- Document, report and set the refresh triggers. New systems, reorganisations, incidents, acquisitions and changes in incentive plans reopen the assessment; an annual full refresh is the floor.
Two disciplines separate a useful assessment from a compliance exhibit. The first is management override as an explicit scheme for every process, because the controls that stop a clerk do not stop a controller, and financial statement fraud is almost always an override story. The second is the brainstorm with the people who run the process, structured and recorded: the question “if you wanted to steal from this process, how would you do it?” produces schemes that no taxonomy contains, and the answers belong in the inventory.
Worked example: a fraud risk assessment for a distributor
A composite. A regional beverage distributor with 1,200 staff, 300 delivery routes collecting cash from smaller customers, twelve warehouses, a central procurement team and a thinly staffed finance function refreshed its fraud risk assessment after a route driver was found to have skimmed collections for fourteen months. The abridged assessment for three processes shows the scheme-level logic and what the responses looked like. Ratings are likelihood/significance on a five-point anchored scale.
| Process and scheme | Who and how | Inherent | Existing controls | Residual | Response |
|---|---|---|---|---|---|
| Route cash: driver skims collections and records a short payment or a customer dispute | Drivers with cash custody; concealment by altering delivery tickets or recording fictitious disputes | 5/3 | Daily depot reconciliation (performed by the same supervisor who approves disputes); route audits twice a year | 4/3 | Separate dispute approval from reconciliation; analytics on dispute rates by driver; unannounced route audits; mobile payment pilot to reduce cash |
| Route cash: depot supervisor and driver collude to delay deposits (lapping) | Collusion defeats the reconciliation; concealment by applying later collections to earlier accounts | 3/4 | None specific; bank deposit timing not analysed | 3/4 | Deposit-lag analytics by depot; customer statement confirmations on a sample; rotation of supervisors |
| Procurement: buyer directs spend to a related vendor, splitting orders below threshold | Buyers with vendor-creation and ordering access; concealment by order splitting and generic descriptions | 4/4 | Vendor master approval by procurement manager; annual conflict-of-interest declarations | 3/4 | Vendor master changes approved outside procurement; analytics for orders just below thresholds and vendor-employee address or bank matches; declaration follow-up |
| Procurement: kickbacks from an incumbent supplier to the category manager | Category manager with sourcing authority; concealment through sole-source justifications | 3/5 | Sole-source approval by the CFO above a threshold | 3/4 | Competitive tender rules with audit of exceptions; supplier anti-bribery clauses and audit rights; hotline promotion to suppliers |
| Payroll: ghost employee or falsified overtime at a warehouse | Warehouse managers with hire and timekeeping authority | 3/3 | HR approval of hires; overtime approved by the same manager | 3/3 | Analytics: duplicate bank accounts, employees without system logins, overtime outliers; independent overtime approval above a limit |
| Financial reporting: management overrides accruals and rebate estimates to meet covenant ratios | Controller and CFO under covenant pressure; concealment through late manual journals | 2/5 | Audit committee review; external audit | 2/5 | Journal entry analytics on late, round and manual entries; see the journal entry testing guide; committee attention to covenant headroom |
The assessment changed three things. The audit plan gained a route cash engagement with an analytics component and an unannounced element; the finance function gained a monthly deposit-lag report that found a second depot with a lapping pattern within two months; and the board’s audit committee received, for the first time, a fraud risk report structured by scheme rather than a hotline statistics page. The driver case that prompted the refresh had cost about 90,000; the second depot pattern, caught early, had reached 30,000. The programme’s cost was mostly analyst time.
Anti-fraud controls by scheme
Controls against fraud follow the same preventive, detective and corrective taxonomy as any other control, and the controls taxonomy guide covers the general design logic. What is specific to fraud is that the perpetrator is actively trying to defeat the control, so prevention must assume concealment and detection must assume that prevention has failed. The table lists the controls with the best record against each major scheme family.
| Scheme family | Preventive controls | Detective controls | Design note |
|---|---|---|---|
| Billing and vendor schemes | Vendor master changes approved outside the ordering function; three-way match; competitive sourcing rules; bank-detail change call-back | Vendor-employee data matching; duplicate payment analytics; spend-just-below-threshold analytics; vendor audits | The vendor master is the control point; whoever can create a vendor and order from it can steal |
| Payroll schemes | Independent hire approval; timekeeping separated from approval; leaver processing tied to access removal | Payroll-to-HR reconciliation; duplicate bank accounts; employees without network activity; overtime outliers | Small payroll teams need compensating analytics because segregation is impossible |
| Cash and receipts schemes | Reduce cash; dual custody; prenumbered receipts; immediate recording | Deposit-lag analysis; customer confirmations; dispute and write-off analytics by employee | The best preventive control is removing the cash |
| Expense reimbursement | Policy with limits; receipts required; manager approval with visibility of totals | Duplicate claims across employees; weekend and round-amount patterns; claims just below receipt thresholds | Approvers rarely see the pattern; analytics do |
| Corruption and procurement | Conflict-of-interest declarations with follow-up; tender rules; anti-bribery clauses and audit rights; gifts and hospitality register | Sole-source and exception analytics; supplier concentration by buyer; hotline open to suppliers; lifestyle indicators from the red flags guide | Corruption leaves fewer records; the supplier side is where the evidence lives |
| Financial statement fraud | Realistic targets; incentive design; segregation of estimate preparation and approval; disclosure committee | Journal entry analytics; analytical review of estimates and reserves; audit committee attention to pressure points; whistleblower channel | Override defeats process controls; governance and detection carry the weight |
| External payment fraud | Call-back on bank detail changes; dual authorisation; email authentication; supplier portal with verification | Payment analytics on new or changed beneficiaries; reconciliation of rejected and returned payments | Speed is the attacker’s advantage; the call-back control must be mandatory and logged |
The design principle that unites the table is that the control owner must not be a plausible perpetrator of the scheme the control addresses. A reconciliation performed by the person who could divert the cash is a control in name only, which is the lesson of the distributor’s first depot. The control design principles guide describes how to redesign such controls; the RCM Workbench is a free tool for recording them against the schemes.
Detection: the analytics that find schemes
Analytics have changed fraud detection more than any other development since the hotline, because they test full populations and find patterns that samples cannot. A fraud analytics programme need not be sophisticated; most of its value comes from a dozen routine tests run on a schedule and investigated when they fire. The table lists the tests with the longest record, the data each needs and what a hit usually means. The SQL for auditors guide gives query patterns for several of them; the documenting analytics as audit evidence guide covers how to record them so a reviewer can rely on the result.
| Test | Data needed | What a hit suggests | False-positive management |
|---|---|---|---|
| Duplicate payments (same vendor, amount, near date; same invoice number with variants) | Payables ledger | Billing scheme or error; either way, money to recover | Tolerance on dates; exclude recurring contracts |
| Vendor master to employee master matching (address, bank account, phone, tax ID) | Vendor and HR masters | Fictitious vendor or undeclared interest | Legitimate employee-owned small vendors exist; follow up, do not accuse |
| Spend just below approval thresholds, by requester | Purchase orders with approver and threshold rules | Order splitting to avoid approval | Compare with the requester’s normal profile |
| Benford’s law on invoice or expense amounts | Transaction amounts by population | Fabricated amounts, usually in a sub-population | Only meaningful on large, naturally distributed populations |
| Journal entries: late, weekend, round-amount, manual, by preparer, posted by senior finance staff | General ledger journals with user and timestamp | Override or earnings management | Period-end patterns are normal; the outliers are the preparers who differ from their own history |
| Payroll: duplicate bank accounts, no login activity, no leave taken, overtime outliers | Payroll, HR, identity and access data | Ghost employees or falsified hours | Shared accounts for family members occur; verify through HR |
| Deposit lag and dispute rates by collector or location | Collections, deposits, disputes and write-offs | Skimming or lapping | Seasonal and geographic norms matter; compare like with like |
| New or changed beneficiary payments without logged call-back | Payment files, vendor master change log, call-back log | External payment fraud or a control that is not operating | The absence of a log entry is itself the finding |
| Sole-source and tender-exception frequency by category manager | Procurement records with sourcing method | Kickback exposure | Some categories are legitimately sole-sourced; the pattern by person is the signal |
Three rules make an analytics programme credible. Every test has an owner and a documented response when it fires, because an unreviewed alert is a liability rather than a control, as the trade-surveillance cases in the trading floor controls guide show. Tests are run on complete populations with the completeness documented, because a test on an extract that missed a system is a false comfort. And results are reported in aggregate to the programme owner and the audit committee, because the trend in hits is a programme metric in its own right. Functions without a platform can run most of the table in a spreadsheet or a database query; the continuous monitoring on a small budget guide shows how.
Reporting channels and the culture around them
Since tips detect more fraud than any other method, the reporting channel is the programme’s most important detective control, and it is assessed by behaviour rather than by existence. A hotline that nobody uses, or that routes allegations to the manager accused, or whose outcomes are never fed back, is a hotline in name. The metrics below are the ones that tell a committee whether the channel works; benchmarks vary by sector and workforce, and the trend matters more than the level.
| Metric | What it measures | Healthy pattern | Warning sign |
|---|---|---|---|
| Reports per 100 employees per year | Awareness and trust in the channel | Steady or rising with awareness campaigns; a range of report types, not only HR grievances | Near zero; or a spike after an incident followed by silence |
| Anonymous share | Fear of retaliation | A mix of anonymous and named reports | Almost all anonymous (fear) or none (channel unknown) |
| Substantiation rate | Quality of reports and of triage | A meaningful share substantiated in whole or part | Near zero (triage dismissing reports) or near 100 per cent (only obvious cases reported) |
| Time to triage and time to close | Responsiveness | Days to triage; weeks to months to close, by complexity | Cases open for a year; triage backlog |
| Retaliation allegations | Whether reporters are protected | Rare, and investigated with the same rigour | Any pattern of reporters leaving within a year |
| Feedback to reporters | Whether the loop closes | Acknowledgement and outcome communicated where possible | Reporters hear nothing |
| Reports from suppliers and customers | Whether the channel reaches the parties who see corruption | Some volume; the channel is promoted externally | None; the channel is internal only |
Culture is the environment in which the channel sits, and it is assessable. The ethics and compliance program audit guide covers how to test tone, consistency of consequences and training effectiveness rather than their existence; the conduct risk guide covers the indicators that show where pressure is building. One cultural test is worth applying everywhere: do the outcomes of substantiated cases differ by the seniority of the person involved? A programme that disciplines clerks and quietly separates executives has told the workforce what it values, and the workforce will report accordingly.
Internal audit’s role under the Standards
The Global Internal Audit Standards do not make internal audit responsible for detecting fraud, and a function that lets the board believe otherwise has set itself up to fail. What the Standards require is competence, consideration and response. Standard 3.1 requires internal auditors to have the knowledge to evaluate the risk of fraud and the manner in which it is managed, while recognising that they are not expected to have the expertise of someone whose primary responsibility is investigating fraud. Standard 13.2 requires the engagement risk assessment to consider the probability of fraud among the things that could affect the activity under review. Elsewhere the Standards expect the function to assess the organisation’s governance, risk management and control processes, of which the fraud programme is one, and to communicate significant matters, of which fraud is one, to the board. The table turns those expectations into the function’s working responsibilities.
| Responsibility | What it means in practice | What it does not mean | Reference |
|---|---|---|---|
| Competence | Auditors trained to recognise schemes and red flags; access to forensic skills when needed, in-house or co-sourced | Every auditor a certified fraud examiner | Standard 3.1; the professional skepticism guide |
| Assess the programme | Periodic audit of the fraud risk management programme against the five principles, reported to the committee | Owning the programme | Principle 5 of the COSO/ACFE guide; Standards on assessing governance, risk and control |
| Consider fraud in every engagement | Scheme-level fraud risks in the engagement risk assessment; procedures that would detect them; red flags noted and pursued | Designing every engagement as a fraud examination | Standard 13.2; the engagement-level risk assessment guide |
| Use analytics | Full-population tests on the processes with cash, payments and journals as a routine part of fieldwork | A guarantee that analytics will find every scheme | Standards on evidence and the audit evidence hierarchy |
| Respond when fraud is suspected | Stop, preserve, escalate per protocol; the investigation belongs to trained people with counsel; see the first 48 hours protocol | Confronting the suspect; expanding the audit on one’s own; concluding guilt | The protocol itself; legal privilege considerations |
| Report to the board | Significant fraud, programme weaknesses and the function’s own fraud risk conclusions reported to the audit committee | Reporting every allegation | Standards on communicating to the board; the quarterly pack guide |
| Audit the investigations process | Sample cases from intake to closure for consistency, timeliness, root-cause remediation and recovery | Re-investigating closed cases | Principle 4 of the COSO/ACFE guide |
One design question comes up in every function: should internal audit run investigations? The answer depends on size and independence. Small functions often do, with counsel and HR, because nobody else can; large organisations usually house investigations in a corporate security, legal or compliance function, and internal audit audits the process. Where the function does investigate, the investigators should not later provide assurance over the control environment they examined, and the charter should say so. The assurance vs advisory guide covers the independence reasoning.
The legal and regulatory frame
Fraud risk management has acquired a legal frame that changes its stakes. The table summarises the main instruments that bear on corporate programmes in the United States and the United Kingdom, with the implication for the programme; it is a description of the terrain rather than legal advice, and counsel should confirm what applies to a given organisation.
| Instrument | Jurisdiction | What it does | Programme implication |
|---|---|---|---|
| Sarbanes-Oxley Act (2002) | US listed companies | Management assessment and auditor attestation of internal control over financial reporting (Section 404); CEO and CFO certifications (302); whistleblower protection (806) and criminal penalties for retaliation; audit committee responsibility for complaint procedures (301) | The fraud programme and the whistleblower channel are part of ICFR governance; the audit committee owns the complaint process |
| Dodd-Frank whistleblower programme (2010) | US | SEC awards to whistleblowers whose information leads to enforcement; anti-retaliation provisions | Employees have a well-funded external route; internal channels must be at least as responsive |
| Foreign Corrupt Practices Act (1977) and the DOJ’s Evaluation of Corporate Compliance Programs | US (extraterritorial reach) | Prohibits bribery of foreign officials; requires accurate books and internal accounting controls; prosecutors assess programme effectiveness when deciding charges and penalties | Corruption controls and their testing are a prosecutorial consideration; “paper programmes” are explicitly discounted |
| UK Bribery Act (2010) | UK (extraterritorial reach) | Corporate offence of failing to prevent bribery, with “adequate procedures” as the only defence | The programme is the defence; its documentation and testing must be able to show adequacy |
| Economic Crime and Corporate Transparency Act 2023: failure to prevent fraud offence | UK large organisations; in force since September 2025 | Corporate liability where an employee or agent commits fraud intending to benefit the organisation, unless reasonable fraud prevention procedures were in place | A fraud risk assessment and documented prevention procedures have become a legal defence; see the UK fraud and corruption guide |
| Bank supervisory expectations | Regulated financial institutions | Supervisors examine fraud, conduct and financial-crime programmes and the audit function’s coverage of them | The programme is inspected; see the banking guide and the BSA/AML work programme |
| Corporate governance codes | Listed companies in many jurisdictions | Board responsibility for risk management and internal control, with reporting on effectiveness | The board’s oversight of fraud risk is a reportable matter |
The direction of travel is consistent across jurisdictions: liability attaches to the organisation for frauds committed by its people unless it can show a programme that was designed to prevent them and was working. That makes the documented fraud risk assessment, the control inventory mapped to schemes and the evidence of monitoring more than good practice; in several regimes they are the defence. Internal audit’s assessment of the programme, properly documented, is part of that evidence, and the what regulators expect guide describes how supervisors read it. The history of the great frauds, from the energy trader whose special-purpose entities hid its debt to the payments company whose cash never existed, is the history of programmes that looked complete on paper; the lessons from big scandals guide draws out what internal audit could have seen.
Frequently asked questions
What is fraud risk management?
The programme by which an organisation governs, assesses, controls, investigates and monitors its exposure to fraud. The reference framework is the COSO and ACFE Fraud Risk Management Guide, whose five principles are fraud risk governance, fraud risk assessment, fraud control activities, fraud investigation and corrective action, and monitoring. Management owns the programme, the board oversees it and internal audit assesses it.
What is a fraud risk assessment?
A documented assessment, at the level of specific schemes rather than risk categories, of how fraud could occur in each process and entity, who could commit it and how, its inherent likelihood and significance, the controls that address it and the residual exposure, with responses for the residual Highs and triggers for refresh. Management override is assessed explicitly for every process.
What is the fraud triangle?
Cressey’s model of the three conditions present when fraud occurs: pressure (a need or incentive), opportunity (access and weak controls) and rationalisation (a justification). A fourth element, capability, is sometimes added. Controls act most reliably on opportunity, through segregation of duties, access management and independent review.
Is internal audit responsible for detecting fraud?
No. The Global Internal Audit Standards require internal auditors to have the knowledge to evaluate fraud risk and how it is managed (Standard 3.1), to consider the probability of fraud in engagement risk assessments (Standard 13.2), to assess the organisation’s fraud risk management as part of governance, risk and control, and to report significant matters to the board. Management owns prevention and detection; audit provides assurance over them and responds per protocol when it finds indicators.
What are the most effective anti-fraud controls?
Segregation of duties and access management (which remove opportunity), vendor master and payment controls including call-back on bank-detail changes, independent reconciliations performed by people who could not divert the asset, a reporting channel that people trust, and routine full-population analytics on payables, payroll, journals, collections and procurement. Tips remain the most common detection method, so the hotline’s health matters most.
How often should a fraud risk assessment be refreshed?
Annually in full, and on triggers: a new system, a reorganisation, an incident, an acquisition, a change in incentive plans or a new regulatory offence such as the UK failure to prevent fraud offence in force since September 2025.
What should internal audit do when it finds fraud?
Stop expanding the work on its own, preserve the evidence, and escalate through the organisation’s fraud response protocol so that trained investigators, counsel and HR take over; the auditor does not confront the suspect or conclude guilt. The first 48 hours protocol guide sets out the sequence.
Related guides
- When internal audit finds fraud: the first 48 hours protocol — what to do, in order, when fieldwork turns up a scheme.
- Fraud red flags — the behavioural and transactional indicators, and the discipline for acting on them.
- Journal entry testing — the risk-scored approach to the entries that carry override.
- Segregation of duties — the four function types and the toxic combinations.
- How to audit the ethics and compliance program — effectiveness, not existence.
- Conduct risk — definition, examples, indicators and how internal audit assesses it.
- How to run a compliance risk assessment — obligations, exposure and prioritisation.
- How to audit the BSA/AML program — independent testing that satisfies examiners.
- UK fraud and corruption: internal audit’s anti-fraud role — the UK regime, including failure to prevent.
- Lessons from big scandals — what internal audit could have seen.
- The Risk Library — frameworks, registers and assessment tools in one place.
Leave a Reply