Kaakati Fraud Risk Assessment
Required Inputs
- Organization: Company name, industry, size (revenue, employees), and organizational structure.
- Business Processes: Key revenue, procurement, payroll, treasury, and financial reporting processes.
- Control Environment: Existing internal controls, segregation of duties, approval authorities.
- Prior Fraud History: Known fraud incidents, investigation outcomes, losses incurred.
- Regulatory Context: Industry-specific anti-fraud requirements (SOX, FCPA, UK Bribery Act, etc.).
- Whistleblower Program: Current hotline/reporting mechanism details.
- Data Availability: Access to transactional data for analytics (ERP, accounting, procurement, HR systems).
Execution Steps
1. Fraud Risk Universe
Define the complete taxonomy of fraud schemes relevant to the organization.
Fraud Scheme Taxonomy (ACFE Classification)
| Category | Scheme | Description | Typical Perpetrator | Avg. Loss Range |
|---|---|---|---|---|
| Asset Misappropriation | ||||
| Cash Theft — Skimming | Removing cash before recording | Cashiers, front-line employees | $10K-$100K | |
| Cash Theft — Larceny | Removing cash after recording | Accounts receivable, cash handlers | $25K-$250K | |
| Billing Schemes | Fictitious vendor, personal purchases, inflated invoices | Procurement, AP staff | $50K-$500K | |
| Payroll Fraud | Ghost employees, falsified hours, commission manipulation | HR, payroll, managers | $25K-$250K | |
| Expense Reimbursement | Fictitious expenses, inflated amounts, duplicate claims | All employees, executives | $10K-$100K | |
| Check/Payment Tampering | Forged checks, altered payee, unauthorized disbursements | AP staff, signers, treasury | $50K-$500K | |
| Inventory/Asset Theft | Theft or misuse of inventory, equipment, supplies | Warehouse, operations staff | $25K-$500K | |
| Financial Statement Fraud | ||||
| Revenue Recognition | Premature recognition, fictitious revenue, channel stuffing | Senior management, sales | $1M-$100M+ | |
| Expense/Liability Manipulation | Understating expenses, hiding liabilities, improper capitalization | Senior management, accounting | $1M-$100M+ | |
| Asset Overstatement | Inflating asset values, improper impairment avoidance | Senior management, accounting | $500K-$50M+ | |
| Improper Disclosures | Omitting material information, misleading footnotes | Senior management, legal, accounting | $1M-$50M+ | |
| Corruption | ||||
| Bribery | Payments to influence decisions (commercial or government) | Sales, executives, agents | $50K-$10M+ | |
| Conflicts of Interest | Undisclosed relationships benefiting decision-maker | Procurement, management, board | $50K-$5M | |
| Illegal Gratuities | Payments for favorable past decisions | Sales, management | $10K-$500K | |
| Economic Extortion | Demanding payments under threat | Vendors, partners (external) | $25K-$1M | |
| Bid Rigging | Colluding to predetermine contract award | Procurement, contractors | $100K-$10M+ | |
| Cyber Fraud | ||||
| Business Email Compromise (BEC) | Impersonating executive/vendor to redirect payments | External actors (targeting finance) | $50K-$5M | |
| Account Takeover | Compromising credentials to authorize fraudulent transactions | External actors (targeting any) | $25K-$1M | |
| Invoice Fraud (cyber-enabled) | Compromised vendor emails requesting payment changes | External actors (targeting AP) | $50K-$2M | |
| Data Theft for Fraud | Stealing PII/credentials for identity fraud | Internal or external actors | $100K-$10M+ | |
| Cryptocurrency/Payment Fraud | Manipulating digital payment systems | Technical insiders, external actors | $25K-$5M |
2. Fraud Triangle / Pentagon Analysis
Assess organizational exposure through the lens of fraud motivation theory.
Fraud Triangle Factors
| Factor | Definition | Assessment Questions | Risk Level |
|---|---|---|---|
| Pressure / Motivation | Financial or personal pressure to commit fraud | ||
| Financial pressure on employees | Are employees under financial stress? Aggressive incentive targets? | [High/Med/Low] | |
| Organizational pressure | Are there unrealistic financial targets? "Make the numbers" culture? | [High/Med/Low] | |
| External pressure | Industry downturns? Competitive pressure? Covenant compliance? | [High/Med/Low] | |
| Opportunity | Ability to commit and conceal fraud | ||
| Weak internal controls | Are there gaps in segregation of duties, approvals, reconciliations? | [High/Med/Low] | |
| Override capability | Can management override controls without detection? | [High/Med/Low] | |
| Inadequate monitoring | Is there limited oversight of transactions, access, behavior? | [High/Med/Low] | |
| Complex transactions/structures | Are there complex related-party transactions, off-book entities? | [High/Med/Low] | |
| Rationalization | Ability to justify fraudulent behavior | ||
| Tone at the top | Do leaders model ethical behavior? Is there a "rules don't apply to me" attitude? | [High/Med/Low] | |
| Organizational justice | Do employees perceive fair treatment, compensation, recognition? | [High/Med/Low] | |
| Ethical culture | Is there a strong code of conduct? Is it enforced consistently? | [High/Med/Low] |
Extended Pentagon Factors (Beyond the Triangle)
| Factor | Definition | Assessment Questions | Risk Level |
|---|---|---|---|
| Capability | Skills and position to execute fraud | ||
| Technical knowledge | Does the individual understand systems well enough to exploit them? | [High/Med/Low] | |
| Authority level | Does the position carry sufficient authority to override or conceal? | [High/Med/Low] | |
| Coercion ability | Can the individual pressure others to assist or remain silent? | [High/Med/Low] | |
| Arrogance | Belief that rules do not apply | ||
| Entitlement | Does the culture tolerate "star performers" who bend rules? | [High/Med/Low] | |
| Ego / overconfidence | Do key individuals believe they are too smart to be caught? | [High/Med/Low] |
3. COSO Fraud Risk Management Guide Application
Apply the 5 COSO principles for fraud risk management.
COSO Fraud Risk Management Principles Assessment
| Principle | Description | Current Maturity (1-5) | Evidence | Gap |
|---|---|---|---|---|
| Principle 1: Fraud Risk Governance | Organization establishes and communicates a fraud risk management program that demonstrates expectations of the governing body and senior management and their commitment to high integrity and ethical values. | [1-5] | [Evidence] | [Gap] |
| Principle 2: Fraud Risk Assessment | Organization performs comprehensive fraud risk assessments to identify specific fraud schemes and risks, assess their likelihood and significance, evaluate existing fraud risk management activities, and implement actions to mitigate residual fraud risks. | [1-5] | [Evidence] | [Gap] |
| Principle 3: Control Activities | Organization selects, develops, and deploys preventive and detective fraud control activities to mitigate the risk of fraud events occurring or not being detected in a timely manner. | [1-5] | [Evidence] | [Gap] |
| Principle 4: Investigation and Corrective Action | Organization establishes a communication process to obtain information about potential fraud and deploys a coordinated approach to investigation and corrective action to address fraud appropriately and in a timely manner. | [1-5] | [Evidence] | [Gap] |
| Principle 5: Fraud Risk Management Monitoring | Organization selects, develops, and performs ongoing evaluations to ascertain whether each of the five principles of fraud risk management is present and functioning and communicates fraud risk management program deficiencies in a timely manner to parties responsible for taking corrective action, including senior management. | [1-5] | [Evidence] | [Gap] |
Maturity Scale for COSO Principles
| Level | Definition |
|---|---|
| 1 - Initial | No formal program. Fraud risk addressed reactively. |
| 2 - Developing | Some elements exist but not comprehensive. Limited documentation. |
| 3 - Defined | Formal program with policies, procedures, and assigned responsibilities. |
| 4 - Managed | Program actively monitored with metrics. Regular assessments conducted. |
| 5 - Optimized | Continuous improvement. Advanced analytics. Industry-leading practices. |
4. Fraud Risk Assessment Matrix
Map each fraud scheme to business processes, assess likelihood and impact.
Fraud Risk Assessment Matrix
| Scheme ID | Fraud Scheme | Business Process | Likelihood | Impact | Inherent Risk | Existing Controls | Control Effectiveness | Residual Risk |
|---|---|---|---|---|---|---|---|---|
| FR-001 | Billing — Fictitious vendor | Procurement / AP | [1-5] | [1-5] | [1-25] | [Control descriptions] | [Strong/Moderate/Weak] | [1-25] |
| FR-002 | Payroll — Ghost employees | HR / Payroll | [1-5] | [1-5] | [1-25] | |||
| FR-003 | Revenue recognition — Channel stuffing | Sales / Revenue | [1-5] | [1-5] | [1-25] | |||
| FR-004 | BEC — Payment redirection | Treasury / AP | [1-5] | [1-5] | [1-25] | |||
| FR-005 | Bribery — Government official | Sales / Government relations | [1-5] | [1-5] | [1-25] |
Risk Scoring
Inherent Risk = Likelihood (1-5) x Impact (1-5)
Range: 1-25
Residual Risk = Inherent Risk x (1 - Control Effectiveness %)
Control Effectiveness: Strong = 80%, Moderate = 50%, Weak = 20%
Risk Classification:
Critical (20-25): Immediate action required
High (13-19): Remediation within 30 days
Medium (7-12): Remediation within 90 days
Low (1-6): Accept or monitor
5. Anti-Fraud Control Mapping
Map preventive, detective, and corrective controls to each fraud scheme.
Control Mapping Matrix
| Fraud Scheme | Preventive Controls | Detective Controls | Corrective Controls |
|---|---|---|---|
| Billing — Fictitious vendor | Vendor master approval workflow (dual approval); Vendor verification (TIN validation, address verification, bank account confirmation); Segregation of duties (requester ≠ approver ≠ payer) | Three-way match (PO-receipt-invoice); Vendor master analytics (duplicate addresses, P.O. boxes, employee address matches); Invoice analytics (round amounts, sequence gaps) | Vendor termination procedure; Loss recovery process; Disciplinary action per policy |
| Payroll — Ghost employees | New hire approval workflow with HR verification; Segregation of duties (hire ≠ approve pay); Annual headcount reconciliation | Payroll-to-HR master data reconciliation (monthly); Duplicate SSN/bank account detection; Terminated employee payroll audit | Overpayment recovery; System access termination; Law enforcement referral |
| Expense reimbursement | Written expense policy with limits; Pre-approval for expenses > threshold; Receipt requirements | Duplicate expense detection; Benford's law analysis on amounts; Supervisor review of all claims; Analytics for round numbers, weekend dates, split transactions | Reimbursement clawback; Policy violation consequences; Enhanced monitoring |
| Revenue — Premature recognition | Revenue recognition policy aligned with ASC 606/IFRS 15; Deal desk approval for non-standard terms; Contract review process | Revenue trend analysis (quarter-end spikes); Credit memo analysis post-quarter; Contract-to-revenue reconciliation; Side agreement audit | Revenue restatement process; Disclosure to audit committee; Regulatory notification if material |
| BEC / Payment fraud | Callback verification for payment changes (using independently sourced number); Email authentication (DMARC, SPF, DKIM); Wire transfer dual approval | Payment change audit trail review; Domain monitoring (lookalike domains); Unusual payment pattern detection | Immediate bank notification and recall; Law enforcement (FBI IC3); Insurance claim |
| Bribery / Corruption | FCPA/anti-bribery policy; Third-party due diligence; Gift and entertainment policy with pre-approval; Compliance training | Third-party payment analytics (round amounts, unusual destinations); Gift and entertainment log review; Whistleblower reports; Travel expense anomaly detection | Investigation protocol; Self-disclosure analysis (DOJ/SEC); Remediation and enhanced controls |
| Conflicts of interest | Annual COI disclosure requirement; Vendor relationship disclosure; Board member independence certification | COI disclosure vs. transaction analysis (undisclosed relationships); Related-party transaction review; Procurement award pattern analysis | Disclosure remediation; Recusal procedures; Contract renegotiation or termination |
6. Red Flag Indicators by Fraud Type
Behavioral Red Flags (Applicable Across All Fraud Types)
| Red Flag | Possible Indication | Follow-Up Action |
|---|---|---|
| Living beyond apparent means | Employee may be supplementing income through fraud | Discreet observation; if pattern persists, analytics on their transactions |
| Refusal to take vacation or share duties | Concealment risk — fraud may be discovered in their absence | Mandatory vacation enforcement; cross-training with job rotation |
| Unusually close relationship with vendor/customer | Potential conflict of interest or kickback scheme | COI disclosure review; transaction analysis |
| Excessive overtime without clear business reason | Time theft or concealment activity requiring extra hours | Workload review; access log analysis |
| Resentment or complaints about perceived unfairness | Rationalization factor; may justify fraudulent behavior | Management attention; engagement assessment |
| Defensiveness when questioned about work | May indicate concealment | Supervisory review of work products |
| Known financial difficulties (garnishments, bankruptcy) | Pressure factor in fraud triangle | Heightened transaction monitoring |
Transactional Red Flags
| Fraud Type | Red Flag | Detection Method |
|---|---|---|
| Billing fraud | Vendor with P.O. box only; same address as employee; round-dollar invoices; sequential invoice numbers from different vendors; invoices just below approval thresholds | Vendor master analytics, invoice analytics |
| Payroll fraud | Employees with same bank account; employees with no tax withholding changes; overtime outliers; commission rate anomalies | Payroll analytics, HR-payroll reconciliation |
| Expense fraud | Expenses on weekends/holidays; round amounts; sequential receipt numbers; duplicate submissions; meals exceeding headcount | Expense report analytics, duplicate detection |
| Revenue fraud | Quarter-end revenue spikes > 40% of quarterly total; unusual credit memo volume post-quarter; large revenue reversals; channel inventory buildup | Revenue pattern analytics, credit memo analysis |
| Corruption | Payments to high-risk jurisdictions (CPI < 40); unusual commission structures; large cash payments; consultant payments without clear deliverables | Third-party payment analytics, due diligence |
| Cyber fraud | Email domain misspellings; payment instruction changes via email; unusual login locations; large transfers to new beneficiaries | Email security, payment verification, access analytics |
Analytical Red Flags
| Technique | What It Detects | Application |
|---|---|---|
| Benford's Law deviation | Fabricated numbers (natural datasets follow expected digit distribution) | Expense reports, vendor invoices, journal entries |
| Duplicate detection | Duplicate payments, invoices, or reimbursements | AP transactions, expense reports, payroll |
| Round number analysis | Fabricated amounts (fraudsters tend to use round numbers) | All financial transactions |
| Threshold analysis | Transactions structured just below approval limits | Purchase orders, expense claims, wire transfers |
| Gap/sequence analysis | Missing transactions, altered sequence numbers | Check numbers, invoice numbers, receipt numbers |
| Trend analysis | Unusual patterns over time | Revenue, expenses, vendor payments, payroll |
| Outlier detection | Statistical anomalies (Z-score > 3) | Any high-volume transaction dataset |
| Network analysis | Hidden relationships between entities | Vendor-employee, vendor-vendor, customer-vendor |
7. Whistleblower Program Assessment
Program Effectiveness Scorecard
| Element | Best Practice | Current State (1-5) | Gap |
|---|---|---|---|
| Reporting Channels | Multiple channels: phone hotline (24/7, multilingual), web portal, email, in-person, anonymous options | [1-5] | [Gap] |
| Independence | Managed by independent third party; reports to audit committee, not management | [1-5] | |
| Anonymity | Anonymous reporting available and assured; no caller ID, no IP tracking | [1-5] | |
| Non-Retaliation Policy | Written anti-retaliation policy; active enforcement; consequences for retaliation | [1-5] | |
| Awareness | Regular promotion (posters, training, intranet, onboarding); all employees know how to report | [1-5] | |
| Accessibility | Available to employees, contractors, vendors, customers; multilingual if applicable | [1-5] | |
| Triage Process | Documented triage criteria; timely acknowledgment; clear escalation paths | [1-5] | |
| Investigation Protocol | All reports investigated; qualified investigators; documented procedures | [1-5] | |
| Feedback Loop | Reporters receive status updates (while maintaining investigation integrity) | [1-5] | |
| Metrics and Reporting | Report volume, types, resolution time, substantiation rate tracked and reported to audit committee | [1-5] | |
| Benchmarking | Reports per 100 employees benchmarked against industry (ACFE median: 1.4 per 100) | [1-5] |
Whistleblower Program Maturity Score: Total / 55 = [X]%
| Score Range | Maturity Level | Action |
|---|---|---|
| 85-100% | Leading | Maintain; benchmark externally |
| 70-84% | Effective | Address specific gaps |
| 50-69% | Developing | Significant enhancement needed |
| < 50% | Inadequate | Program redesign required |
8. Data Analytics for Fraud Detection
Analytics Program Design
| Analytics Type | Frequency | Data Source | Fraud Schemes Detected |
|---|---|---|---|
| Continuous (automated, real-time) | Daily/weekly | ERP, payment systems | Duplicate payments, threshold splitting, unauthorized payments |
| Periodic (scheduled analysis) | Monthly/quarterly | ERP, HR, expense systems | Ghost employees, vendor anomalies, expense fraud, payroll anomalies |
| Ad Hoc (investigation support) | As needed | All available data | Specific allegation testing, relationship mapping |
Core Analytics Tests
| Test | Method | Target Data | Expected Output |
|---|---|---|---|
| Benford's Law | Compare first-digit frequency distribution against expected Benford distribution; chi-square test for significance | Expense reports, vendor invoices, journal entries | Digit frequency chart with conformity score; p-value < 0.05 flags non-conformity |
| Duplicate Detection | Match on amount + date, amount + vendor, invoice number across vendors, employee bank account matches | AP transactions, expense reports, payroll | List of potential duplicates with match criteria |
| Round Number Analysis | Flag transactions where amount ends in 00, 000, 0000; compare % round numbers to expected baseline (< 5%) | All disbursements | Percentage of round amounts; list of round-number transactions above threshold |
| Threshold Analysis | Identify transactions at 90-99% of approval thresholds; cluster analysis for split transactions | Purchase orders, expense claims, wire transfers | Transactions near thresholds; related transactions suggesting splitting |
| Vendor Master Analytics | Match vendor addresses/phone/bank accounts to employee records; identify P.O. box-only vendors; dormant vendor activity | Vendor master, HR master, AP transactions | Potential shell vendors, conflict of interest matches |
| Ghost Employee Detection | Compare active payroll to HR master; identify employees with no benefit elections, no tax changes, duplicate SSN/bank accounts | Payroll, HR, benefits data | Potential ghost employees for investigation |
| Journal Entry Testing | Identify manual entries posted on weekends/holidays, round amounts, by unusual users, to unusual accounts, near period-end | General ledger | Suspicious journal entries ranked by risk indicators |
| Payment Pattern Analysis | Identify new payees receiving large first payments, payments to high-risk jurisdictions, payments without PO/contract | AP disbursements | Anomalous payment patterns for review |
| Anomaly Detection (Statistical) | Z-score analysis on transaction amounts by vendor/employee/account; isolation forest for multivariate anomalies | Any high-volume transaction set | Transactions with Z-score > 3 or anomaly score above threshold |
| Network Analysis | Map relationships between vendors, employees, bank accounts, addresses, phone numbers to detect hidden connections | Vendor, employee, payment master data | Relationship graph; clusters of connected entities |
9. Investigation Readiness Framework
Investigation Readiness Checklist
| Element | Required | Status | Gap |
|---|---|---|---|
| Written investigation policy and procedures | Yes | [In place/Partial/Missing] | [Gap] |
| Qualified investigators (internal or retained external) | Yes | [Status] | |
| Forensic accounting firm on retainer | Recommended | [Status] | |
| Digital forensics capability (in-house or retained) | Yes | [Status] | |
| Outside counsel with investigation experience | Yes | [Status] | |
| Evidence preservation protocol (legal hold process) | Yes | [Status] | |
| Interview protocol (rights, documentation, witnesses) | Yes | [Status] | |
| Chain of custody procedures | Yes | [Status] | |
| Investigation reporting template | Yes | [Status] | |
| Board/audit committee investigation reporting protocol | Yes | [Status] | |
| Law enforcement referral criteria and procedures | Yes | [Status] | |
| Recovery and restitution procedures | Yes | [Status] | |
| Post-investigation control enhancement process | Yes | [Status] |
Investigation Decision Tree
Allegation Received
|
+--> Is it credible? (Initial assessment within 48 hours)
| NO --> Document assessment rationale; close with audit committee notification
| YES --> Proceed
|
+--> Does it involve senior management?
| YES --> Audit committee directs; outside counsel leads; do NOT notify subject
| NO --> Internal investigation team or outsource based on complexity
|
+--> Preserve evidence immediately
| +--> Implement litigation hold
| +--> Preserve electronic data (do NOT alert subject)
| +--> Secure physical evidence
|
+--> Scope the investigation
| +--> Who: Subjects, witnesses, affected parties
| +--> What: Transactions, time period, systems
| +--> Where: Locations, jurisdictions
|
+--> Execute investigation
| +--> Document review and data analytics
| +--> Witness interviews (peripheral witnesses first, subject last)
| +--> Expert analysis if needed (forensic accounting, digital forensics)
|
+--> Determine outcome
+--> Substantiated --> Disciplinary action, recovery, control enhancement, law enforcement referral
+--> Unsubstantiated --> Document findings, communicate to reporter, close
+--> Inconclusive --> Enhanced monitoring, periodic reassessment
10. Fraud Loss Quantification
Loss Quantification Framework
| Loss Category | Calculation Method | Example |
|---|---|---|
| Direct Loss | Sum of misappropriated funds/assets | $X in fraudulent payments identified |
| Investigation Cost | Internal hours + external fees (forensic, legal, consulting) | 500 hours x $150/hr + $200K external |
| Recovery Cost | Legal fees for recovery, insurance deductible, asset tracing | $X in legal fees; $X insurance deductible |
| System Remediation | Control enhancements, system changes, additional staff | $X in new controls, systems, and personnel |
| Regulatory Fines | Penalties from regulators for control failures | $X in SEC, DOJ, or other fines |
| Reputational Damage | Customer churn, revenue impact, recruiting difficulty | Estimated $X based on churn analysis |
| Opportunity Cost | Management time diverted, delayed projects | $X in estimated opportunity cost |
| Total Fraud Cost | Sum of all categories | $X total organizational impact |
Loss Multiple Analysis
Total Fraud Cost is typically 2x-5x the direct loss amount
Industry benchmarks (ACFE Report to the Nations):
Median loss per fraud case: $117,000
Mean loss per fraud case: $1,783,000
Median duration before detection: 12 months
Estimated total fraud loss: 5% of annual revenue (ACFE estimate)
11. Industry-Specific Fraud Schemes
Financial Services
| Scheme | Description | Key Controls |
|---|---|---|
| Rogue trading | Unauthorized trading positions exceeding limits | Position limits, independent P&L valuation, trade surveillance |
| Loan fraud | Fictitious borrowers, inflated collateral values | Independent appraisals, borrower verification, credit committee |
| AML failures | Structuring, layering, insufficient KYC | Transaction monitoring, CTR/SAR filing, enhanced due diligence |
| Insurance fraud | Fictitious claims, inflated losses, staged events | Claims investigation unit, analytics, SIU referrals |
Healthcare
| Scheme | Description | Key Controls |
|---|---|---|
| Upcoding | Billing for more expensive services than rendered | Claims data analytics, coding audits, compliance reviews |
| Phantom billing | Billing for services never provided | Patient verification, visit documentation, hotline |
| Kickbacks (Stark/Anti-Kickback) | Referral payments for patient volume | Fair market value assessments, compliance program, OIG exclusion checks |
| Diversion | Drug diversion by healthcare workers | Controlled substance tracking, discrepancy investigation |
Government / Public Sector
| Scheme | Description | Key Controls |
|---|---|---|
| Contract fraud | Bid rigging, change order abuse, cost mischarging | Competitive bidding, change order review, cost audit |
| Grant fraud | Misuse of grant funds, false progress reporting | Grant expenditure monitoring, progress verification |
| Time and attendance | Falsified time records, no-show employees | Biometric timekeeping, supervisor verification |
| Procurement fraud | Favoritism, split purchases to avoid bidding | Vendor rotation analysis, threshold monitoring |
Retail
| Scheme | Description | Key Controls |
|---|---|---|
| POS fraud | Fictitious returns, void abuse, discount abuse | POS analytics, void/return review, exception reporting |
| Inventory shrinkage | Theft by employees or organized retail crime | Inventory counts, CCTV, loss prevention team |
| Gift card fraud | Fraudulent activation, balance draining | Gift card reconciliation, activation monitoring |
| Vendor allowance fraud | Fictitious deductions, unauthorized markdowns | Vendor allowance reconciliation, deduction analytics |
12. Anti-Fraud Program Maturity Model
Maturity Assessment
| Domain | Level 1: Reactive | Level 2: Basic | Level 3: Proactive | Level 4: Managed | Level 5: Optimized |
|---|---|---|---|---|---|
| Governance | No anti-fraud policy | Basic policy exists | Comprehensive policy; board oversight | Regular board reporting; fraud risk in ERM | Continuous program evaluation; industry leadership |
| Risk Assessment | No fraud risk assessment | Ad hoc assessment | Annual formal assessment per COSO guide | Assessment tied to business changes; scenario-based | Continuous reassessment; predictive risk modeling |
| Prevention | Minimal controls | Basic SOD and approvals | Comprehensive preventive controls mapped to schemes | Controls tested regularly; design kept current | Adaptive controls; AI-based prevention |
| Detection | Discovered by accident | Basic whistleblower hotline | Hotline + periodic data analytics | Continuous monitoring + advanced analytics | Real-time detection; machine learning models; full population testing |
| Investigation | Ad hoc, untrained investigators | Basic investigation process | Formal protocol; trained investigators; outside counsel retained | Structured program with metrics; lessons learned integration | Best-in-class capability; proactive intelligence |
| Response | Inconsistent consequences | Documented disciplinary process | Consistent enforcement; recovery pursued; law enforcement referral criteria | Root cause analysis; control enhancement post-incident | Comprehensive remediation; industry sharing; regulatory cooperation |
| Monitoring | No program monitoring | Annual review by management | Regular KPIs; audit committee reporting | Benchmarking against peers; program effectiveness metrics | Independent program assessment; continuous improvement cycle |
Maturity Score Calculation
Domain Score = Assessed Level (1-5)
Overall Maturity = Average of 7 Domain Scores
Target Maturity by Organization Profile:
Public company (SEC registrant): Level 4 minimum
Large private company: Level 3 minimum
Mid-market company: Level 3 target
Small/startup: Level 2 minimum, Level 3 target within 2 years
Government / regulated entity: Level 4 minimum
Output Template
## Fraud Risk Assessment: [Organization]
### Assessment Parameters
| Field | Detail |
|---|---|
| Organization | [Name] |
| Industry | [Industry] |
| Revenue / Size | [$X / # employees] |
| Assessment Date | [Date] |
| Methodology | COSO Fraud Risk Management Guide |
| Assessor | [Name/team] |
### Executive Summary
[Overall fraud risk profile, critical findings, top fraud risk scenarios,
anti-fraud program maturity score, priority recommendations]
### Fraud Triangle / Pentagon Assessment
| Factor | Risk Level | Key Drivers |
|---|---|---|
| Pressure | [High/Med/Low] | [Key drivers] |
| Opportunity | [High/Med/Low] | [Key drivers] |
| Rationalization | [High/Med/Low] | [Key drivers] |
| Capability | [High/Med/Low] | [Key drivers] |
| Arrogance | [High/Med/Low] | [Key drivers] |
### COSO Fraud Risk Management Maturity
| Principle | Score (1-5) | Key Gap |
|---|---|---|
| Principle 1: Governance | [1-5] | [Gap] |
| Principle 2: Risk Assessment | [1-5] | [Gap] |
| Principle 3: Control Activities | [1-5] | [Gap] |
| Principle 4: Investigation & Corrective Action | [1-5] | [Gap] |
| Principle 5: Monitoring | [1-5] | [Gap] |
### Fraud Risk Heat Map
| Risk Zone | Fraud Schemes | Residual Risk Score |
|---|---|---|
| Critical (20-25) | [Schemes] | [Scores] |
| High (13-19) | [Schemes] | [Scores] |
| Medium (7-12) | [Schemes] | [Scores] |
| Low (1-6) | [Schemes] | [Scores] |
### Anti-Fraud Control Gap Analysis
[Control mapping with identified gaps and remediation recommendations]
### Red Flag Monitoring Program
[Key red flags to monitor with detection methods and responsible parties]
### Data Analytics Program Design
[Recommended analytics tests with data requirements and implementation priority]
### Whistleblower Program Assessment
[Effectiveness scorecard with improvement recommendations]
### Investigation Readiness
[Readiness assessment with gaps and remediation plan]
### Anti-Fraud Program Maturity Scorecard
| Domain | Current Level | Target Level | Gap |
|---|---|---|---|
| Governance | [1-5] | [Target] | [Gap] |
| Risk Assessment | [1-5] | [Target] | [Gap] |
| Prevention | [1-5] | [Target] | [Gap] |
| Detection | [1-5] | [Target] | [Gap] |
| Investigation | [1-5] | [Target] | [Gap] |
| Response | [1-5] | [Target] | [Gap] |
| Monitoring | [1-5] | [Target] | [Gap] |
| **Overall** | [Avg] | [Target] | [Gap] |
### Remediation Roadmap
| Priority | Action | Owner | Timeline | Est. Cost |
|---|---|---|---|---|
| Immediate | [Action] | [Role] | 0-30 days | [$X] |
| Near-term | [Action] | [Role] | 30-90 days | [$X] |
| Medium-term | [Action] | [Role] | 90-180 days | [$X] |
| Long-term | [Action] | [Role] | 180-365 days | [$X] |
### Disclaimers
> This fraud risk assessment provides a framework for identifying and
> mitigating fraud risk. It does not guarantee the detection or prevention
> of all fraud. No system of internal controls can provide absolute
> assurance against fraud. This assessment should be updated annually or
> when significant organizational changes occur.
Quality Checks
- Fraud risk universe covers all 4 major categories (asset misappropriation, financial statement fraud, corruption, cyber fraud) with specific schemes relevant to the organization's industry.
- Fraud triangle/pentagon analysis assesses pressure, opportunity, AND rationalization (plus capability and arrogance for pentagon) with specific organizational evidence.
- COSO Fraud Risk Management Guide principles (all 5) are assessed with specific maturity scores and evidence.
- Fraud risk assessment matrix maps specific schemes to specific business processes with scored likelihood and impact.
- Anti-fraud controls are mapped as preventive, detective, AND corrective for each significant fraud scheme.
- Red flag indicators include behavioral, transactional, AND analytical categories with specific detection methods.
- Whistleblower program assessment covers all key elements (channels, independence, anonymity, non-retaliation, awareness, triage, investigation, feedback, metrics).
- Data analytics program includes specific tests (Benford's law, duplicate detection, anomaly detection) with data requirements, not just general descriptions.
- Investigation readiness framework includes both the readiness checklist and decision tree for investigation management.
- Fraud loss quantification covers direct losses AND indirect costs (investigation, remediation, regulatory, reputational).
- Industry-specific fraud schemes are included for the organization's industry.
- Anti-fraud program maturity model scores all 7 domains on a 5-level scale with defined level descriptions.