How to Build a Fraud Risk Management Framework: A Board-Level Guide

A fraud risk management framework is the governance structure that turns fraud prevention from a set of isolated controls into an owned, tested programme. To build one, the board sets expectations and assigns accountability, management assesses fraud risks and designs controls to match, suspected fraud is investigated and corrected consistently, and the whole system is monitored and improved. The COSO/ACFE Fraud Risk Management Guide provides the most widely used blueprint, and Indian company law already places much of the responsibility on directors, audit committees, CFOs and auditors.

This guide is written for boards and audit committees. It focuses on structure and accountability. For how to run the assessment itself, see our view on a fraud risk assessment that changes decisions.

Why does fraud need its own framework?

Most companies have internal controls and an enterprise risk register. Fraud still slips through because it is deliberate: people who understand the controls look for ways around them. The ACFE's Occupational Fraud 2026: A Report to the Nations, based on 2,402 cases across 143 countries and territories, found that a lack of internal controls contributed to 33% of cases and override of existing controls to 19%. A typical fraud lasted 12 months before detection.

Those figures point to weak governance as much as weak control design. A framework answers the questions that general risk management often leaves open: who owns fraud risk, what is the organisation's tolerance, who investigates, and how does the board know the programme works?

What are the five principles of the COSO/ACFE guide?

The second edition of the COSO/ACFE Fraud Risk Management Guide, released in 2023, sets out five principles aligned with the five components of the COSO 2013 internal control framework.

The second edition also adds emphasis on data analytics as a tool across the programme.

Principle 1: fraud risk governance

Governance comes first. It means a board-approved fraud risk management policy, a statement of the organisation's attitude to fraud, defined roles, and resources. Without it, the other four principles become a collection of activities that nobody is answerable for.

Principle 2: fraud risk assessment

The fraud risk assessment identifies how fraud could occur in each business process, including asset misappropriation, financial reporting fraud and corruption, and rates likelihood and impact. At board level, the questions are whether it is done regularly, whether it involves the right people, and whether it considers management override.

Principle 3: preventive and detective controls

Controls should be mapped to the risks identified. Preventive controls include authorisation limits and segregation of duties; detective controls include data analytics, reconciliations and exception reporting. Our view on controls built for the people who can override them covers control design in more depth.

Principle 4: investigation and corrective action

The organisation needs a defined route for allegations to be received, triaged and investigated, with consistent outcomes. The same ACFE study found that 43% of frauds were detected by tips, more than half of them from employees, so the reporting channel is a core control. Corrective action includes discipline, recovery, control fixes and, where required, reporting to regulators or law enforcement.

Principle 5: monitoring

Monitoring asks whether the programme is working: are assessments current, are controls operating, are investigations timely, and are lessons fed back? Internal audit typically provides independent assurance here.

Who does what? Governance roles in an Indian company

Indian law already assigns fraud-related responsibilities. A framework should build on these rather than create parallel structures.

The board of directors

For listed companies, s. 134(5)(e) of the Companies Act 2013 requires the directors' responsibility statement to confirm that internal financial controls are laid down, adequate and operating effectively. The Explanation to that clause defines internal financial controls to include the prevention and detection of frauds and errors. In practice, the board should:

• approve the fraud risk management policy and set the tone on fraud;
• assign ownership to a senior executive and oversight to a board committee;
• receive periodic reporting on fraud risk, incidents and programme health;
• ensure the programme is adequately resourced.

Independent directors have specific duties under Schedule IV, including ensuring an adequate and functional vigil mechanism and reporting concerns about actual or suspected fraud.

The audit committee

Section 177(4) of the Companies Act 2013 includes, within the audit committee's terms of reference, the evaluation of internal financial controls and risk management systems. Section 177(9) and (10) require listed and prescribed companies to establish a vigil mechanism, overseen through the audit committee, with protection against victimisation and direct access to its chairperson in appropriate cases.

For listed companies, Part C of Schedule II to the SEBI LODR Regulations requires the audit committee to review the functioning of the whistle-blower mechanism and to review the findings of internal investigations into suspected fraud, irregularity or material failure of internal control, and report the matter to the board. The audit committee is usually the natural home for oversight of the fraud risk framework.

The CFO and management

Management owns the day-to-day programme. The CFO is central because most fraud schemes move through the books. For listed companies, the CEO and CFO certification under regulation 17(8) of the SEBI LODR Regulations includes statements to the auditors and audit committee about significant fraud they have become aware of. A sensible split of responsibilities is:

• CFO / finance: financial controls, analytics on high-risk ledgers, fraud risk in financial reporting;
• Chief risk or compliance officer: the fraud risk assessment, policy maintenance and training;
• Legal / ethics: investigation protocols, whistleblowing and regulatory reporting;
• Business heads: owning fraud risks and controls in their processes.

Internal and statutory auditors

Internal audit tests whether the programme is operating. Statutory auditors have their own duties. Under s. 143(12) of the Companies Act 2013, an auditor who has reason to believe that a fraud is being or has been committed against the company by its officers or employees must report it to the Central Government where the prescribed threshold of INR 1 crore or more is met, and to the audit committee or board below it. CARO 2020, paragraph 3(xi), requires auditors to report whether any fraud by or on the company was noticed or reported, whether an ADT-4 report was filed, and whether they considered whistle-blower complaints received during the year. Our knowledge base entry on auditor fraud reporting under s. 143(12) and CARO 2020 explains the process.

These requirements mean the auditor will ask about fraud and whistleblowing. A framework that records how allegations were handled makes those conversations simpler and better evidenced.

How should a board get started?

A practical sequence for a board or audit committee:

1. Commission a baseline. Ask management to map existing fraud-related policies, controls, reporting channels and investigation practices against the five principles.
2. Approve a fraud risk management policy. Define the organisation's stance, scope, roles and reporting lines.
3. Assign ownership. Name an executive owner and confirm which committee provides oversight.
4. Require a current fraud risk assessment and a plan to close significant gaps.
5. Set reporting expectations. Agree a regular dashboard: new allegations, open investigations and ageing, confirmed frauds, losses and recoveries, control failures identified and remediation status.
6. Test the investigation route. Confirm there is a protocol for independent investigation, including when to use external forensic specialists and how evidence is preserved.
7. Review annually. Monitor whether each principle is present and functioning, and update the framework as the business changes.

Where an incident is already unfolding, the first 72 hours after an allegation covers the immediate steps.

How Spectra Forensics can help

Spectra Forensics brings 19+ years of experience, 1,250+ investigations and INR 2,000+ crore of financial impact to fraud risk work. Our forensic accounting and data analytics service covers fraud risk assessments, control testing and analytics on high-risk processes. Our fraud and whistleblower investigations for corporates cover independent investigation of allegations and reporting to audit committees. To discuss your framework, contact us.