Fraud Risk Management cheat sheet

Introduction to risk management

• Risk is the effect of uncertainty on objectives: the possibility that an event will occur and adversely, or less commonly favourably, affect an organisation's goals.
• Fraud risk is the vulnerability an organisation faces from internal or external parties capable and willing to commit fraud against it, organised along the fraud tree into asset misappropriation, corruption and financial statement fraud risk.
• Risk management identifies, assesses and responds to risk in line with the organisation's strategy and risk appetite; it aligns risk-taking rather than eliminating risk altogether.
• COSO ERM integrates risk with strategy and performance, while ISO 31000 provides principles and generic guidelines on risk management.
• Fraud risk management sits where ERM, which identifies and prioritises fraud among other risks, meets internal control, which implements the specific controls that mitigate it; it needs both.