The audit committee chair's two questions
Near the end of a routine audit committee meeting, in an illustrative but familiar scene, the chair asks the CFO two questions: what are our five largest fraud risks, and what stops each one? The CFO can answer for outgoing payments, because the bank set up dual release last year. Payroll gets a vaguer answer. Revenue, credit memos and the journal entries that finance itself posts get none.
That gap is common, and closing it does not take a month. A first fraud risk assessment can be done in one afternoon with five or six people, a handful of system reports and a structure that forces specific answers. It will not be complete. It will be written down, scored and owned, which is more than many organizations of this size have.
Why one afternoon is worth it
The ACFE's Occupational Fraud 2026, the 14th edition of its study, covers 2,402 cases from 143 countries and territories. The Certified Fraud Examiners surveyed estimate that organizations lose 5% of revenue to fraud each year. The median loss per case was $104,000, and the typical fraud ran 12 months before it was detected.
Two findings bear directly on this exercise. Formal fraud risk assessments were in place at 51% of the victim organizations. Where they existed, the median loss was $80,000 against $150,000 without, and the median duration was 10 months against 15. Among organizations with fewer than 100 employees, only 16% had one, against 61% of larger organizations. The report presents these as associations rather than proof of cause, but the pattern holds across the 18 anti-fraud controls it studied: each was associated with lower median losses, and all but one (employee support programs) with faster detection.
What the assessment must produce
The COSO and ACFE Fraud Risk Management Guide, whose second edition was released in May 2023, puts the requirement in one sentence. The organization "performs comprehensive fraud risk assessments to identify specific fraud schemes and risks, assess their likelihood and significance, evaluate existing fraud control activities, and implement actions to mitigate residual fraud risks." The guide's scope covers misstated financial information, misstated non-financial information, misappropriated assets, and illegal acts or corruption.
Your afternoon should produce exactly that: specific schemes, a score for each, the controls that address them, and an action for whatever risk remains.
Pull five reports beforehand
Ask for these a week ahead so the room works from data:
- The vendor master change log for the last 12 months, including bank detail changes.
- User and role lists from the ERP, the bank portals and the payroll system.
- The year's manual journal entry listing, showing who posted and who approved.
- Credit memos, write-offs and refunds for the year.
- Bank accounts, signers and payment release limits.
Add any hotline reports and prior audit letters. Tips detected 43% of the frauds in the ACFE study, and 55% of those tips came from employees, so whatever reporting channel you have is evidence too.
The agenda, hour by hour
Invite the CFO or controller, the AP lead, whoever runs payroll, someone from billing or sales operations, the system administrator, and one person from outside finance, such as HR or an audit committee member. Keep it under eight people. Each block below starts at the time shown and runs until the next one begins.
1:00 p.m.: rules and scope
State that the session is about opportunities, not suspicions of colleagues. Nobody is being accused. Agree the processes in scope: cash out, cash in, payroll, financial reporting, inventory and fixed assets, and procurement.
1:20 p.m.: who touches the money
For each process, walk one real transaction from request to ledger. Who can start it, approve it, change it after approval and record it? Mark every point where one person can do two of those. Use the user lists to check what people can actually do in the systems, not what the policy says they do.
2:10 p.m.: write the schemes
For each process, ask two questions. How would someone take money out of here? How would someone make the numbers look better than they are? Write each answer as a sentence with a person, an action and a way to hide it. "An AP clerk adds a vendor with her own bank account and bills amounts just under the approval limit" is a scheme. "Vendor fraud" is not. Include schemes open to the people in the room, and include management override: entries that bypass controls, pressure on estimates, side agreements with customers.
The ACFE data offers a starting list. Theft of noncash assets appeared in 23% of cases and billing schemes in 21%, with a median loss of $90,000. Check and payment tampering appeared in 10%, with a median loss of $114,000. Corruption featured in almost half of all cases. Financial statement fraud was the least common category and the most costly, with a median loss of $1,000,000.
3:10 p.m.: a short break
3:25 p.m.: score and test
Score each scheme for likelihood and significance from 1 to 5, taking existing controls into account. Then test one claim against the reports you brought. If the room says every bank change is verified by phone, pick three changes from the log and look for the evidence. If it is missing, the control is partial and the score stays high.
4:15 p.m.: decide the responses
Give every scheme one response, one owner and one date. A response can be a new control, a change in access, a data test run monthly, or a recorded decision to accept the risk. For anything scoring 12 or more, acceptance is not an option.
4:45 p.m.: report and repeat
Agree what goes to the board, usually the five highest residual risks and their actions. Put the next assessment in the calendar for a year out, and earlier if the business changes: a new ERP, an acquisition, rapid hiring or new finance leadership.
The risk register template
Copy this into a spreadsheet, one row per scheme. L is likelihood and S is significance, each scored 1 to 5 after existing controls; the score is L times S. The rows show the level of detail that makes a register useful.
| Scheme | Process and owner | L | S | Score | Existing controls and evidence | Response, owner, date |
|---|---|---|---|---|---|---|
| AP changes a vendor's bank account to one it controls and redirects a real payment | Payables, controller | 3 | 5 | 15 | Callback policy; evidence found for 1 of 3 sampled changes | Callback signed off before entry; weekly change log review; controller, 30 days |
| An employee sets up a fictitious vendor and bills under the $5,000 approval limit | Payables, controller | 2 | 3 | 6 | Bill approval above $5,000 only | Monthly test for vendors sharing an address or bank account with employees; staff accountant, 60 days |
| The controller posts a late entry to meet a covenant | Close, CFO | 2 | 5 | 10 | None after close | Owner reviews entries posted after day 5; CFO, next close |
| A sales rep issues credit memos to a customer in return for a kickback | Billing, sales operations lead | 2 | 3 | 6 | Sales manager approves credit memos | Finance approval above $1,000; quarterly review by customer; controller, 90 days |
| A payroll rate is changed without approval | Payroll, HR lead | 2 | 4 | 8 | Changes approved by email | Register reviewed each run by someone who cannot edit payroll; CFO, next run |
| A deepfake executive orders an urgent wire on a video call | Treasury, CFO | 3 | 5 | 15 | Dual release above $25,000 | Written verification protocol with callbacks and code phrases; drill quarterly; CFO, 45 days |
Notice the last row. Dual release does not lower the score when both releasers believe the request came from the CEO, which is why the response is a verification rule rather than another approver.
Where to start
Book the afternoon before you perfect the method. Pull the five reports, invite the people who run the processes and fill in the register. The vendor bank-change row is often the quickest to fix, and five controls for vendor bank-change fraud sets out the workflow. If your group has UK operations, read how the UK failure-to-prevent-fraud offence treats reasonable prevention procedures. When you want the register tested against the full ledger rather than a sample, a fraud risk assessment adds data analytics and a second reviewer who did no fieldwork.