Fraud Risk Management and Prevention
Framework, not a checklist
Fraud risk management (FRM) is a continuous cycle: govern, assess, treat (prevent/detect), monitor and report. Candidates must distinguish inherent risk (likelihood × impact before controls) from residual risk (after controls), and know the fraud triangle - pressure/incentive, opportunity, rationalisation - plus the fraud diamond's fourth element, capability.
Governance concepts: tone at the top, a board or audit-committee-owned fraud risk policy, three lines of defence (operations own controls, risk/compliance monitor, internal audit gives independent assurance), a fraud risk register, and key risk indicators such as rising duplicate-vendor counts or unusual period-end journal entries.
Prevention versus detection
Prevention reduces opportunity: segregation of duties, authorisation limits, mandatory vacations and job rotation, physical and IT access controls, vendor master-file controls, and a documented ethics and whistleblowing programme. Detection (hotlines, surprise audits, analytics, reconciliations) does not prevent loss - it shortens it.
Traps. Questions often imply strong internal control makes fraud impossible (collusion and management override defeat it), or that a hotline is a prevention control. Another trap is treating risk assessment as an annual document rather than a trigger-based process (new system, merger, remote working).
Rule of thumb. Score likelihood and impact 1–5 for each scheme in the fraud tree (asset misappropriation, corruption, financial statement fraud); treat any residual score of 15+ as requiring a named control owner and a monitoring test.