A Fraud Risk Assessment That Changes Nothing Has Not Been Done

Many fraud risk assessments end the same way: a coloured grid, a handful of red cells that everyone expected, and a recommendation to "strengthen controls". Twelve months later the grid is refreshed, the colours barely move, and the internal audit plan looks much as it did before.

If the assessment did not change a decision, it was a compliance exercise. The test of a fraud risk assessment is what it causes to happen next.

Why most assessments fail

They assess categories, not schemes. "Procurement fraud: high" is not actionable. "A buyer could split purchase orders below the approval threshold and route them to a vendor owned by a relative" is. Only the second can be tested against a control.

They are scored by the people being assessed. Process owners are essential sources, but asking them to rate their own fraud risk produces predictable results.

They ignore override. Most assessments ask whether a control exists. Fewer ask what happens when the person who owns the control decides to get around it. The ACFE's Occupational Fraud 2026 report found that a lack of internal controls was the primary weakness in 33% of cases, and override of existing controls in another 19%.

They stop at the rating. Without owners and dates, a rating is an opinion.

What good looks like

1. Start from how money and value leave the business

Map the routes by which value can leave: payments to vendors and distributors, payroll, discounts and credit notes, scheme payouts, inventory and scrap, related-party transactions, and commissions to agents. Add the routes by which the numbers can be made to look better than they are: revenue recognition, provisions, capitalisation and inventory valuation.

2. Write schemes in plain sentences

For each route, write specific schemes: who, what, how, and how concealed. Use your own history (past investigations and audit findings), your industry's known patterns, and an honest conversation with experienced managers about "how would you do it if you wanted to?"

A manufacturing company with a large distributor network might write:

• a regional sales head inflates secondary sales claims to earn scheme payouts, with a distributor sharing the proceeds;
• a buyer favours a vendor in which they hold a hidden interest, concealed through a relative or a shell company;
• a plant manager sells good material as scrap to a connected buyer;
• finance books revenue on goods shipped at quarter end to distributors who have the right to return them.

3. Assess the controls against each scheme

For each scheme, ask three questions: would a control prevent it, would anything detect it, and could the person committing it switch off either? Look specifically at segregation of duties and at who can approve their own exceptions.

4. Rate residual risk, then decide

Rate likelihood and impact after controls, and then make decisions. A high residual risk should lead to at least one of: a new or redesigned control, a recurring analytics test, an internal audit review in the next plan, or a decision by the board to accept the risk, recorded as such.

5. Close the loop

Report to the audit committee which decisions the assessment produced. Next year, start by checking whether they happened.

The decision points

• Scope: whole company or high-risk units first? Start where money leaves fastest and oversight is thinnest, often regional sales, procurement and new acquisitions.
• Who leads: internal audit, compliance, or external specialists? Independence matters more than title.
• Depth on third parties: distributors, agents and consultants who deal with government need their own assessment, because the Prevention of Corruption Act 1988 as amended in 2018 makes a company liable for bribes paid by associated persons on its behalf.
• Data: will each high-rated scheme get a recurring data test? If not, how will you know whether it is happening?

Common mistakes

• Treating it as an annual form. The value lies in the conversation about schemes, not the template.
• Leaving out senior management. If the assessment does not consider what the CFO or a business head could do, it has left out the costliest schemes.
• Copying last year. Businesses change; an assessment that does not reflect new markets, channels or systems is assessing a company that no longer exists.
• Forgetting non-financial-statement fraud. Kickbacks and conflicts of interest may never misstate the accounts, but they drain margin every year.
• No link to the audit plan. If internal audit's plan is the same before and after, the assessment changed nothing.

Where we can help

We facilitate scheme-based fraud risk assessments, write the analytics tests that go with them through our forensic accounting and data analytics team, and assess third-party bribery exposure as part of anti-bribery and corruption work. For the wider framework, see our article on building a fraud risk management framework. Speak to us in confidence.