Part A: Risk and its governance
Introduction to risk management
Key takeaways
- Risk is the effect of uncertainty on objectives: the possibility that an event will occur and adversely, or less commonly favourably, affect an organisation's goals.
- Fraud risk is the vulnerability an organisation faces from internal or external parties capable and willing to commit fraud against it, organised along the fraud tree into asset misappropriation, corruption and financial statement fraud risk.
- Risk management identifies, assesses and responds to risk in line with the organisation's strategy and risk appetite; it aligns risk-taking rather than eliminating risk altogether.
- COSO ERM integrates risk with strategy and performance, while ISO 31000 provides principles and generic guidelines on risk management.
- Fraud risk management sits where ERM, which identifies and prioritises fraud among other risks, meets internal control, which implements the specific controls that mitigate it; it needs both.
Definitions of risk
Risk is the effect of uncertainty on objectives, the possibility that an event will occur and adversely (or, less commonly discussed, favourably) affect the achievement of an organisation's goals.
Fraud risk
Fraud risk is the vulnerability that an organisation faces from internal or external parties capable and willing to perpetrate fraud against it, a specific category of operational risk this paper focuses on managing systematically.
Types of fraud risk
Fraud risk can be organised using the fraud tree's branches (see CFFE Fraud and Corruption Schemes): asset misappropriation risk, corruption risk, and financial statement fraud risk, each carrying distinct likelihood and impact profiles worth assessing separately.
Risk management
Risk management is the coordinated set of activities an organisation undertakes to identify, assess, and respond to risk, aligning risk-taking with the organisation's strategy and risk appetite rather than eliminating risk altogether.
Principles and aims
- Creates and protects value
- Is integrated into organisational processes and decision-making
- Is structured, systematic and timely
- Is based on the best available information
- Is tailored to the organisation's context
- Takes human and cultural factors into account
The rise of enterprise risk management
Risk management has matured from a siloed, compliance-driven activity into an integrated, enterprise-wide discipline (enterprise risk management, ERM) embedded in strategic planning, a trend fraud risk management is itself part of.
Risk management frameworks
Risk management process
The generic risk management process, establishing context, risk identification, analysis, evaluation, treatment, and monitoring/communication, is the template the chapter on the fraud risk management process applies specifically to fraud risk.
Where ERM and internal control meet
Fraud risk management sits at the intersection of enterprise risk management (which identifies and prioritises risk broadly) and internal control (COSO, covered in CFFE Fraud Prevention and Detection, which implements the specific controls that mitigate it), effective fraud risk management requires both working together rather than as separate, disconnected disciplines.
Exam tip
The convergence point is a favourite conceptual exam question, be ready to explain it precisely: ERM identifies and prioritises fraud as one risk among many at the strategic level, internal control (COSO) implements the specific day-to-day controls that actually mitigate it, fraud risk management is where the two must connect.
Self-check
(a) Distinguish between risk and fraud risk, and explain why fraud risk is treated as a distinct category worth its own systematic management approach. (4 marks)
(b) Explain the convergence point: how do enterprise risk management and internal control each contribute to fraud risk management, and why does effective fraud risk management require both? (5 marks)
(c) State four of risk management's principles, and explain what 'tailored to the organisation's context' means in practice for a small NGO versus a large multinational bank. (4 marks)
(d) Distinguish between COSO ERM and ISO 31000 as risk management frameworks. (3 marks)
Show worked answer
(a) Risk is the effect of uncertainty on objectives, the possibility an event will occur and adversely or favourably affect an organisation's goals. Fraud risk is the specific vulnerability an organisation faces from internal or external parties capable and willing to perpetrate fraud against it, a narrower category within the broader universe of risk. Fraud risk warrants its own systematic management because it involves a deliberate, adversarial actor actively seeking to defeat the organisation's controls, unlike many other risk categories (e.g. market risk) that arise from impersonal external conditions, requiring specifically anti-fraud techniques (schemes, red flags, investigation) rather than only general risk controls. (4 marks)
(b) Enterprise risk management identifies and prioritises fraud as one risk category among many at the strategic level, deciding how much attention and resource it deserves relative to other organisational risks. Internal control implements the specific day-to-day controls, segregation of duties, authorisation, reconciliation, that actually mitigate the fraud risk once it has been prioritised. Effective fraud risk management requires both because ERM alone identifies the risk without doing anything to reduce it, while internal control alone, applied without ERM's prioritisation, risks either under-investing in high-priority fraud risks or over-investing in low-priority ones. (5 marks)
(c) Creates and protects value; is integrated into organisational processes and decision-making; is structured, systematic and timely; and is tailored to the organisation's context. 'Tailored to context' means a small NGO's fraud risk management should be proportionate to its size, resources and actual exposure, perhaps a simple, informal risk register and basic segregation of duties, while a large multinational bank's should be far more elaborate, dedicated risk and compliance functions, sophisticated data analytics, formal board-level reporting, reflecting its far greater scale, complexity and regulatory exposure. Applying the bank's approach to the NGO would waste its limited resources; applying the NGO's approach to the bank would leave it dangerously under-managed. (4 marks)
(d) COSO ERM is the Committee of Sponsoring Organizations' Enterprise Risk Management framework, integrating risk with strategy and performance, developed specifically with a US corporate governance and internal control lineage. ISO 31000 is the international standard providing principles and generic guidelines on risk management, deliberately generic and applicable across any type of organisation and risk category, not tied to a specific corporate governance tradition. Both are legitimate frameworks an organisation can adopt; the choice often reflects regional convention or existing familiarity rather than one being objectively superior. (3 marks)