Fraud Risk Governance and Program Design
Fraud risk governance is the accountability structure that decides how much fraud risk an organization accepts and who owns the response. CFBE questions in this domain test whether you can distinguish a working program from a policy binder: board and audit committee oversight, a named fraud risk owner, a documented appetite for fraud risk, and a response protocol that survives contact with a real allegation.
The five-principle program model
The ACFE/CSO Fraud Risk Management Guide organizes a program into five principles:
- Fraud risk governance - board and audit committee oversight, written policy, tone at the top.
- Fraud risk assessment - a recurring, documented assessment of scheme-level risks.
- Fraud control activities - preventive and detective controls mapped to assessed risks.
- Fraud investigation and corrective action - a defined, independent response.
- Fraud risk management monitoring - periodic evaluation of the program itself.
The IIA Three Lines Model separates management (first line), risk and compliance functions (second line), and internal audit (third line). Internal audit must not own the fraud program; it assures it. The chief audit executive reports functionally to the audit committee.
Worked example
An entity's whistleblower hotline is administered by the controller and the CFO, with complaints about the AP manager routed to that same manager, who also reconciles the bank account. The audit committee asks whether this is a control weakness.
Reasoning: the hotline is a detection control, but it fails independence. Complaints about the CFO go to the CFO; complaints about the AP manager go to the person whose reconciliation the AP manager prepared. The fix is structural - third-party intake, complaints routed to the audit committee chair or general counsel under a defined escalation path, and tracking metrics reviewed quarterly by the audit committee. Note that report volume is a weak performance metric; a low count may indicate a suppressed channel rather than low fraud.
Traps that cost marks
- Treating a code of conduct as a fraud risk management program.
- Assuming internal audit owns fraud risk because it investigates cases.
- Assuming a hotline must be anonymous everywhere; EU and many national laws require channels that permit, and protect, named reporting.
- Confusing zero tolerance with risk appetite - zero tolerance is a response posture, not a tolerance level.
- Forgetting that the program must cover corruption and third parties, not only asset misappropriation.