How do you assess the fraud risk appetite of your organization?

Fraud risk factors encompass conditions or circumstances heightening the probability or consequences of fraud, varying across industries and sectors. Internal factors like weak controls, inadequate oversight, and high turnover, alongside external factors such as complex transactions or external threats, can contribute to fraud. Incentives to meet targets, lack of transparency, and conflicts of interest further exacerbate risks. Recognising these factors is pivotal for implementing effective fraud prevention and detection measures, safeguarding against potential losses and reputational damage.

An example for this would be in quite a lot of banks where a disgruntled employee who has been fired when all of the his systems accesses haven’t been revoked to go ahead and either download confidential information or perform actions which either compromise the data access or bring down the source of data like a database or a table.

Identify the internal and external factors influencing fraud risks, such as industry norms, regulatory requirements, organizational structure, and past fraud incidents.

In my opinion, fraud risk drivers follow the MMO framework: 1. Motive - the reason the person is committing the fraudulent act e.g. financial benefit. 2. Means - is the person capable of performing the fraudulent act 3. Opportunity - does the person has a chance to commit the fraudulent act. Does the person have any access to commit the act.

Understand what drives fraud risk in your organization, including financial pressures, opportunities to commit fraud, and the rationalization of fraudulent behavior by employees.

While I often see "risk appetite" stated in terms of the amount of an undesired impact this is equally often misleading. As said, the appetite for fraud should be zero. What matters is the impact of fraud and fraud controls on desired business objectives. It's a classic optimization problem. More controls, less fraud. Less controls more fraud. What's the optimum level of controls that minimizes the combined impact of both controls and fraud on stated business objectives.

I have not seen a company with a fraud risk appetite other than zero. But most places I worked in Asia lack a direct approach on Fraud risk assessment (or control since no one will come to ORM and share that s/he defraud the company). For example, (1) an alert to notify ORM on suspense account items over a given period or amount, and (2) unexplained or poor documented month end adjustments and reversing entries. Both control/ review I have done in places and found issues.

An effective fraud risk appetite framework takes into consideration the financial implications associated with the implementation of anti-fraud measures and assesses the potential advantages of managing fraud risk proficiently. Although an ideal scenario would involve a fraud risk appetite of zero, practical constraints, including financial, technological, and human resource limitations, necessitate prioritization in safeguarding against potential risks. This entails a thorough evaluation of areas where the risk exposure is comparatively lower and recognition of aspects that surpass the organization's capacity for comprehensive scrutiny.

Define the level of fraud risk your organization is willing to accept. Balance the potential risks and rewards, and set clear boundaries for what is tolerable within your strategic objectives.

In case of IT external auditors regularly do a penetration or pen test to check for systems vulnerabilities. Also auditors usually check for unauthorized access at the hands of existing employees. The access owner is responsible for certifying that the access provided for each employee has been reviewed at regular intervals and based on this an assessment is made on vulnerabilities of Fraud by either internal audit or an external auditor.

Conduct a thorough evaluation of potential fraud scenarios. Assess the likelihood and impact of each, review current controls, and determine areas needing improvement.

Both when designing and testing your assessment, make it as tailored and scenario-focused as you can. Fraud tends to occur in fairly narrow, specific ways in each vulnerable area.

List all possible fraud types, such as asset misappropriation and financial statement fraud. Evaluate the effectiveness of existing controls, including policies and monitoring systems. Estimate the probability and potential damage of fraud occurrences. Rank risks to focus on the most significant threats. Create action plans to strengthen controls and reduce risk exposure.

In addition, Fraud risk assessment offers numerous advantages to organizations, such as early detection, customized fraud controls, resource optimization, improved decision-making, and enhanced internal controls. It also boosts stakeholder confidence, employee morale, and data security while potentially reducing insurance premiums. Additionally, it fosters customer trust, ensures global compliance, and contributes to long-term sustainability, making organizations more resilient in times of crisis.

Identify and mitigate fraud risks before they occur. Enhance internal controls and fraud detection capabilities. Use risk assessment data to guide strategic decisions. Ensure adherence to laws and standards. Build trust with investors, regulators, and employees by demonstrating robust fraud management.