A published guide shapes the method
We follow the COSO/ACFE Fraud Risk Management Guide, second edition, published in 2023. Its five principles cover fraud risk governance, fraud risk assessment, prevention and detection controls, investigation and corrective action, and monitoring. The assessment sits under the second principle, but a useful one touches all five: who owns fraud risk, what would stop or reveal each scheme, how a report would be investigated and how the assessment stays current. The 2023 edition put more weight on data analytics, which is why we test the highest-rated schemes against your ledger rather than relying on workshop scores alone.
Access, motive and silence score high
Each scheme gets two scores before controls are considered: likelihood and impact. We then map the controls that would prevent or detect it and score what remains. A scheme rates high when three things line up: someone has the access, something gives them a reason, and nothing would reveal it within a quarter. An illustrative extract:
| Scheme | Who could do it | What stops it today | Residual risk |
|---|---|---|---|
| Fictitious vendor paid through AP | AP lead with vendor-setup rights | Nothing before year-end audit | High |
| Revenue pulled into the quarter | Sales leadership and billing | Controller's cutoff review | Medium |
| Bank change by spoofed email | Anyone outside the company | Callback to the number on file | Low |
Your register will use your processes and roles, never individuals' names.
Six UK principles frame the memo
For a US group in scope of the UK offence, the Home Office guidance sets out six principles: top-level commitment, risk assessment, proportionate risk-based prevention procedures, due diligence, communication including training, and monitoring and review. The assessment supplies the evidence for the second principle and shapes the third. Our memo maps your current procedures to all six so that counsel can judge whether they are reasonable. The article on whether the UK offence reaches US companies covers scope in more detail.
DOJ asks for data-informed risk assessment
The DOJ's Evaluation of Corporate Compliance Programs asks whether the risk assessment is updated, whether it draws on operational data and whether it changes where compliance resources go. Under the department-wide Corporate Enforcement Policy of March 2026, companies that self-disclose, cooperate and remediate benefit from a presumption of declination. A risk assessment that names the schemes and tests for them is how a company finds problems first. For the wider program view, see compliance program evaluation.