Fraud Risk Management

Fraud risk management is the organised process by which a company, bank or public body identifies the ways it could be defrauded, judges how likely and how damaging each one is, puts controls in place to prevent and detect fraud, responds to cases that occur and keeps the whole system under review. It covers fraud by outsiders, such as customers, criminals and suppliers, and fraud by insiders, such as employees and managers.

Fraud risk management is a specialised part of wider risk management and of a firm's internal controls. It is broader than fraud detection or fraud prevention on their own, which are individual activities inside the programme. The best-known frameworks are the Fraud Risk Management Guide published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO) and the Association of Certified Fraud Examiners (ACFE), and the US Government Accountability Office's Fraud Risk Framework for federal agencies.

Think of how a careful household protects itself from burglary. First it walks around the house asking where someone could get in: a loose window, a spare key under the mat. Then it fixes the weakest spots, adds a lock or an alarm, and decides what to do if something does go wrong, such as whom to call.

Fraud risk management does the same for an organisation's money. It asks where a dishonest customer, criminal or employee could take money, closes the biggest gaps, watches for warning signs and has a plan for investigating and recovering losses. Then it checks again every so often, because criminals keep looking for new ways in.

Most programmes start from the fraud triangle, developed from the work of the American criminologist Donald Cressey in the 1950s. It holds that occupational fraud usually needs three elements at once:

• Pressure or incentive. Debts, sales targets or personal problems that push a person toward fraud.
• Opportunity. Weak controls that let the fraud happen and stay hidden, such as one person both approving and paying invoices.
• Rationalisation. A story the person tells themselves, such as "I will pay it back" or "the company owes me".

Controls mainly reduce opportunity, which is the element an organisation can most directly change. External fraud against payment firms, such as payment fraud and identity theft, follows a different logic: criminals look for the easiest target, so the aim is to be harder to attack than the alternatives.

The COSO and ACFE guide, first published in 2016 and updated in a second edition in 2023, sets out five principles that line up with COSO's internal control framework. In summary, a programme needs:

1. Governance. A board-approved fraud risk policy, clear ownership, a tone from the top against fraud and a named senior person accountable for the programme.
2. Fraud risk assessment. A regular, documented review of fraud schemes that could affect the organisation, rating each for likelihood and impact before and after controls. Payment firms often fold this into their compliance risk assessment.
3. Preventive and detective controls. Prevention includes segregation of duties, know your customer checks, strong customer authentication and access control. Detection includes transaction monitoring, velocity checking, anomaly detection, data analytics and whistle-blowing hotlines.
4. Investigation and corrective action. A process for reporting suspicions, investigating them, recovering funds, disciplining staff, reporting to authorities and fixing the control that failed.
5. Monitoring. Ongoing measurement of the programme, such as loss rates, false-positive rates and time to detection, with regular reports to senior management and the board.

Many institutions organise these duties along the three lines model: business units own their fraud risks, a fraud or risk function sets standards and challenges the business, and internal audit gives independent assurance, sometimes supported by an independent auditor.

For banks, card issuers, payment service providers and money transmitters, much of the work is automated. A fraud management system scores each login, payment or account application in real time using rules, behavioral analytics and machine-learning models, and sends doubtful cases to analysts. Firms must balance losses against friction: blocking too much annoys good customers and loses revenue, while blocking too little lets fraud through. That balance is usually expressed as a risk appetite, such as a target fraud loss in basis points of payment volume.

Fraud risk also overlaps with anti-money laundering work, because stolen funds must be laundered and mule accounts serve both crimes. Many firms now run combined fraud and AML teams, sometimes called FRAML, that share data and alerts and file a suspicious activity report where required. Third parties are covered as well, through vendor risk management, since fraud often enters through suppliers and outsourced partners.

Regulators increasingly expect formal programmes. In the United Kingdom, the "failure to prevent fraud" offence in the Economic Crime and Corporate Transparency Act 2023 came into force on 1 September 2025. It makes large organisations criminally liable when an employee or other associated person commits fraud intended to benefit them, unless the organisation can show it had reasonable fraud prevention procedures; Home Office guidance describes what those procedures should include. In the US, the Payment Integrity Information Act of 2019 requires federal agencies to establish fraud risk controls based on the leading practices in the GAO framework, and from March 2026 Nacha's operating rules require participants in the ACH network to run risk-based processes to identify entries made as a result of fraud.

• ACFE: COSO and ACFE Fraud Risk Management Guide tools
• GOV.UK: Offence of failure to prevent fraud (ECCTA)
• COSO: Guidance