III IC-39 common mistakes
III IC-39 · Understand the traps and how to avoid them.
Treating fraud risk management as a control checklist to recite, rather than as an ongoing cycle of risk identification, assessment, control design, monitoring, and review; candidates list anti-fraud controls without linking each control to a specific identified fraud risk and its assessed likelihood and impact.
Study notes and course outlines often present controls as a flat list, so candidates memorise items such as segregation of duties, verification, and audit without practising the mapping step that exam scenarios require.
What to do instead
For each fraud risk in a scenario, write a three-column table: risk, inherent likelihood/impact, and the control that mitigates it with the evidence it generates. Practise converting any list of controls into this risk-to-control map until the mapping becomes automatic.
Confusing fraud risk assessment with audit or compliance review, and answering scenario questions by describing what an auditor would test instead of how management identifies, prioritises, and owns fraud risk across the business.
Fraud risk management borrows vocabulary from audit and compliance, and candidates with an audit background default to assurance language rather than the management-side ownership and decision-making the exam asks about.
What to do instead
Before answering, identify who the question is asking about: the board, senior management, the fraud risk function, or internal audit. Draft answers in terms of management ownership, risk appetite, and treatment decisions, and reserve audit language for questions explicitly about assurance.
Answering fraud awareness and culture questions with generic statements such as 'train staff' or 'have a whistleblowing policy', without specifying the elements that make these measures effective, such as tone from the top, a protected reporting channel, proportionate response, and reinforcement through performance management.
Culture and awareness feel soft and are easy to treat as a box to tick, so candidates give one-line answers that miss the design features examiners look for.
What to do instead
Build a short framework of culture elements and practise attaching concrete design features to each: leadership messaging, code of conduct attestation, targeted training by role, confidential reporting routes, non-retaliation guarantees, and visible follow-up on reported concerns.
Failing to distinguish first-party fraud from third-party fraud and from internal collusion, and applying the same detection and control response to all three when the exposure, data sources, and controls differ substantially.
The categories overlap in real claims, and candidates who learn definitions without practising classification misapply controls in scenario questions.
What to do instead
Create a comparison table for internal, intermediary, and customer or third-party fraud covering who commits it, where it appears in the process, which data reveals it, and which control prevents or detects it. Test yourself by classifying short scenarios until each category is reliably identified.
Ignoring the insurance value chain and answering generic corporate-fraud questions; candidates discuss financial statement fraud or procurement fraud when the scenario is about application fraud, claims exaggeration, intermediary misappropriation, or premium diversion.
General fraud material dominates many study resources, and candidates do not rehearse how fraud manifests at each stage of underwriting, policy administration, claims, and distribution.
What to do instead
Map the insurance process end to end and list the fraud typologies and red flags at each stage: proposal and disclosure, premium collection and remittance, policy servicing and beneficiary changes, claims notification and assessment, and distribution commission. Answer scenario questions by locating the stage first.
Treating red flags as proof and either dismissing a case for lack of evidence or over-reacting with accusations; candidates answer investigation questions by declaring fraud confirmed as soon as an indicator appears.
Red flags are memorable and concrete, while the reasoning from indicator to evidence is harder, so candidates skip the corroboration step and jump to conclusions.
What to do instead
Practise writing the inference chain explicitly: indicator, plausible innocent explanation, evidence needed to distinguish the two, and the decision point. In answers, state that red flags trigger investigation rather than establish fraud, and name the evidence that would confirm or eliminate the concern.
Describing detection technology such as analytics, scoring models, or link analysis as a complete solution, without addressing data quality, model governance, false positive handling, alert triage, and the investigative capacity needed to act on outputs.
Technology features are easy to memorise and sound impressive, so candidates list capabilities without the operational conditions that make them work.
What to do instead
For any detection tool mentioned, add the surrounding operating model: data completeness and accuracy, thresholds and tuning, alert triage and ownership, investigation capacity, feedback loops, and periodic validation. Practise answering with one sentence on capability and one on governance.
Writing responses to suspected fraud that skip sequence and preservation: candidates jump to interviewing the suspect or confronting the customer before securing records, isolating system access, and considering legal privilege and regulatory notification.
Interviewing and confrontation feel like decisive action, and the procedural steps that protect evidence and the organisation are less intuitive to recall under exam pressure.
What to do instead
Memorise a response sequence: detect and triage, preserve evidence and restrict access, assess scope and materiality, engage legal and HR, plan and conduct interviews, decide on recovery and reporting, then remediate controls. Practise placing scenario actions into this order and justifying the sequencing.
Giving one-sided answers on data protection, privacy, and information sharing; candidates either ignore privacy constraints when proposing monitoring, or refuse to share information across the industry at all, rather than describing lawful bases, proportionality, and permitted channels.
Privacy and anti-fraud objectives appear to conflict, and candidates without practice default to one extreme instead of balancing them.
What to do instead
Rehearse the balance explicitly: purpose limitation, minimisation, proportionality of monitoring, documented lawful basis, controlled access, retention limits, and use of recognised information-sharing arrangements with appropriate safeguards. Answer with both the objective and the constraint in the same sentence.
Managing fraud risk as a one-off project; candidates omit the monitoring, reporting, and feedback loop, so answers never mention metrics, trend review, control testing, lessons learned from cases, or updating the risk assessment when the environment changes.
Frameworks are often learned as static lists of components, and the cyclical nature of risk management is lost when candidates revise components separately.
What to do instead
Close every answer with the feedback loop: define two or three metrics, state the review frequency and owner, describe how case findings feed back into the risk assessment and control design, and note triggers such as new products, channels, or fraud patterns that require reassessment.