Fraud Risk Assessment Template (GAO Framework, UK Failure to Prevent Fraud)

Fraud Risk Assessment: [Organisation name] [FYYYYY]

Enterprise fraud risk assessment: scope and associated persons, fraud risk governance, method and scoring scales, fraud risk factors, a fraud scheme inventory (financial reporting fraud, asset misappropriation, corruption, external fraud and payment fraud, plus fraud committed for the benefit of the organisation), inherent likelihood and impact, anti-fraud controls, residual risk against a stated tolerance, management override, data analytics, evidence of reasonable procedures and an action plan. The backbone is the GAO Fraud Risk Management Framework (GAO-15-593SP, July 2015, US public domain) with GAO Green Book 2025 Principle 8. It supports the "reasonable procedures" defence to the UK failure to prevent fraud offence in the Economic Crime and Corporate Transparency Act 2023 (section 199, in force 2025-09-01) and the Home Office guidance on that offence (gov.uk, Open Government Licence v3.0). ISA 240 (Revised) (auditor's responsibilities relating to fraud, periods beginning on or after 2026-12-15) and the COSO/ACFE Fraud Risk Management Guide (2nd edition, 2023) are named only. The example organisation, Corvid Commerce Group, and the bank variant, Fernhollow Bank, are fictional. Replace every [bracketed] value and every row marked Example. Obtain the law, guidance and standards for the normative text and check the consolidated text. This is a documentation format, not legal, accounting or audit advice.

Document control

Approvals

Revision history

Contents

• 1. Scope and associated persons
• 2. Governance and top-level commitment
• 3. Method, scales and tolerance
• 4. Fraud risk factors
• 5. Fraud scheme inventory
• 6. Inherent risk scoring
• 7. Anti-fraud controls
• 8. Residual risk and response
• 9. Management override of controls
• 10. Data analytics and monitoring
• 11. Reasonable procedures evidence
• 12. Fraud response and investigation interface
• 13. Action plan
• 14. Bank variant: Fernhollow Bank
• 15. Reporting and review cadence
• Glossary and references
• Standard and licence note

1. Scope and associated persons

State the legal entities, business lines and processes that this assessment covers, and say why anything is excluded. A group assessment is acceptable when entities share processes and controls, but record entity-specific schemes separately where the local process differs (for example a separate payroll provider or a local bank).

Under ECCTA 2023 section 201, the failure to prevent fraud offence applies to large organisations: in the financial year before the fraud, the organisation met at least two of three conditions (more than 250 employees, more than GBP 36 million turnover, more than GBP 18 million total assets). Section 201 and section 202 explain how group figures and parent undertakings count; read them with the Home Office guidance and record your conclusion below. The offence can reach organisations incorporated outside the UK where the base fraud has a UK connection, so do not limit the analysis to UK entities without legal advice.

Size test conclusion (Example): the group budget for FY2027 shows revenue of EUR 160,000 thousand and 685 FTE in FY2026 (more than 250 employees), so the group meets two of the three section 201 conditions and is treated as a large organisation. Confirm the figures for the financial year that precedes each assessment period.

An associated person under section 199 is an employee, an agent, a subsidiary undertaking or any other person who performs services for or on behalf of the organisation. List categories, not individuals, and name the owner of each relationship. Resellers, introducers, outsourced customer service agents and tax advisers are common blind spots.

2. Governance and top-level commitment

The GAO framework asks management to commit to combating fraud by creating an organisational culture and structure that supports it, including a designated entity that leads fraud risk management with defined responsibilities and enough authority. The Home Office guidance places top-level commitment first among its six principles. Record the structure that exists today, not the one you plan, and put gaps in the action plan.

Describe in a few sentences how leadership communicates its stance: the anti-fraud policy, the code of conduct, the CEO message, consequence management after proven cases and how bonuses treat misconduct. A written commitment matters less than visible consequences; record whether any proven fraud in the last cycle led to discipline, recovery or referral, without naming individuals.

3. Method, scales and tolerance

The method follows the GAO Assess component: plan a regular assessment tailored to the organisation and involve the people who run the controls; identify inherent fraud risks; assess their likelihood and impact; determine fraud risk tolerance; examine the suitability of existing controls and prioritise residual risks; and document the result as a fraud risk profile (sections 5 to 8 of this template). GAO Green Book 2025 Principle 8 sets the same expectation for management to consider the potential for fraud when it assesses risks.

Inherent risk ignores existing anti-fraud controls; residual risk reflects controls that are designed and evidenced as operating. Score both on the same scales. The score is the product of the two ratings:

$S = L \times I$

where $L$ is likelihood (1 to 5) and $I$ is impact (1 to 5), giving a score from 1 to 25. Impact covers money and non-financial effects; take the higher of the two ratings.

Example: the financial thresholds above are illustrative and set by Corvid's audit committee. Calibrate yours to your own materiality and risk appetite; they are not normative.

Scores of 7, 11, 13, 14 and similar cannot occur with a 5 by 5 product, so the band edges are complete. For any scheme tagged FTPF (section 5), rate impact at 4 or higher whatever the financial amount, because prosecution of the organisation is a severe non-financial outcome, and record the rationale for any Low residual rating explicitly.

Record the workshop plan in a short list: dates, entities, attendees by role, and the data reviewed before each session (incident log, speak-up cases, audit findings, chargeback data, supplier master changes). GAO recommends specific tools, methods and sources for gathering fraud information, including data from detection activities; note which you used so the next cycle can repeat them.

4. Fraud risk factors

The Home Office guidance suggests considering opportunity, motive and rationalisation (the fraud triangle) when assessing risk. Describe the factors that apply to the organisation and refer to them by ID in the scheme inventory.

Consider also external factors: economic stress among customers and suppliers, new criminal methods such as impersonation using synthetic voice or video, staff turnover in control roles, and any recent system migration. A migration or reorganisation often weakens segregation of duties for several months.

5. Fraud scheme inventory

Describe each scheme in one sentence that names the actor, the method and the gain. Use the categories below; one scheme belongs to one category. Tag schemes that would be committed by an associated person intending to benefit the organisation (or its clients) as "FTPF", because those are the ones relevant to the section 199 offence. The base offences for that offence are listed in Schedule 13 of the Act; in England, Wales and Northern Ireland they include fraud by false representation, by failing to disclose information and by abuse of position, false accounting, false statements by company directors, fraudulent trading and cheating the public revenue. The organisation is not liable where it is the victim or intended victim.

Bribery schemes (FRA-008, FRA-009) also sit in the anti-bribery management system. Keep the scheme here for completeness of the fraud profile and link the detailed bribery risk assessment in ISO 37001 Anti-Bribery (compliance/iso-37001-anti-bribery) rather than repeating it. The UK guidance for this offence follows the same six principles shape as the guidance on the bribery offence, so the two assessments can share workshops and evidence.

6. Inherent risk scoring

Score each scheme with the scales in section 3. Write the rationale in a short phrase that cites data (incident counts, chargeback rates, peer cases) where you have it. Impact reflects the larger of the financial and non-financial ratings.

Inherent profile (Example): 5 High (FRA-001, FRA-002, FRA-004, FRA-010, FRA-011), 8 Medium and 2 Low, 15 schemes in total.

7. Anti-fraud controls

The GAO Design and Implement component asks for an antifraud strategy that favours preventive controls, weighs the benefits and costs of controls and includes a fraud response plan. List each anti-fraud control with its type and its test status. Where the control is also an ICFR key control, use the same control ID as the Risk and Control Matrix (compliance/risk-control-matrix) so testing is not duplicated.

The rule for control credit: a control that is "Not assessed" gives no credit at residual scoring until it has evidence. Process owners often challenge this rule; hold to it, because a defence of reasonable procedures depends on procedures that actually run.

8. Residual risk and response

Re-rate likelihood and impact with credit only for controls in section 7 that are tested or otherwise evidenced. Preventive controls usually reduce likelihood; detective controls reduce impact by limiting how long a fraud runs. Recompute the score as $L \times I$; do not adjust scores by judgement after the multiplication.

Residual profile (Example): 0 High, 8 Medium (FRA-001, FRA-002, FRA-004, FRA-008, FRA-010, FRA-011, FRA-013, FRA-015) and 7 Low (FRA-003, FRA-005, FRA-006, FRA-007, FRA-009, FRA-012, FRA-014), 15 schemes in total. All 8 Medium schemes are above tolerance and carry an action in section 13. FRA-013 is the priority because it is an FTPF scheme with no evidenced control.

Where you accept a risk above tolerance (for example because the cost of a control exceeds the expected loss), record the decision, the reason, the name and position of the person who approved it and the date. The Home Office guidance expects decisions not to implement a measure to be documented in this way. GAO also asks managers to weigh the benefits and costs of controls; write the comparison in money where you can.

9. Management override of controls

Management override is present in every organisation, because those who design and run controls can also circumvent them. Auditors treat it as a fraud risk in every audit; ISA 240 (Revised), effective for audits of periods beginning on or after 2026-12-15, is the international standard that sets the auditor's side. Read the standard for its requirements; this section records management's own view and responses so that the audit committee and the auditor can rely on it.

Answer these questions in prose for the organisation:

• Which people can post journal entries, change master data, approve their own transactions or instruct payments without an independent check? Name roles, not individuals.
• Which accounting estimates are most sensitive to bias (for example expected credit losses on receivables, capitalised development, provisions for returns, revenue cut-off)? Who sets the assumptions, and who challenges them?
• Which significant transactions fall outside the normal course of business, such as one-off disposals, related-party dealings or year-end deals with unusual terms? How are they approved?
• How does the audit committee meet the external and internal auditors without management present, and how often?

(Example) At Corvid, override risk sits with the CFO, the group controller and two senior accountants in CC-DE who hold posting rights in all ledgers. AFC-02 covers post-close journals; ACT-02 adds a quarterly analytic of journal entries by user, time, round amounts and unusual account combinations, reviewed by internal audit and reported to the audit committee. Estimates with the largest judgement are capitalised development (AFC-03) and the returns provision, which the audit committee will challenge each half-year against actual returns.

10. Data analytics and monitoring

GAO's fourth component asks managers to evaluate outcomes using a risk-based approach and adapt activities to improve fraud risk management, with monitoring and feedback as continuous activities across all four components. Describe the analytics that support detective controls and how results flow back into scheme scores. For real-time customer and payment fraud, the system design belongs in Fraud Detection System Design (system-design/design-fraud-detection); record here only the outcome measures that inform the risk profile.

Track a small set of outcome measures: confirmed fraud losses by category, recovered amounts, time from first indicator to detection, alert closure time and the share of cases found by controls rather than by tip-offs or chance. A falling detection rate is not proof of less fraud; it may mean controls stopped working.

11. Reasonable procedures evidence

Under section 199, it is a defence for the organisation to prove that, when the fraud was committed, it had reasonable fraud prevention procedures in place, or that it was not reasonable in all the circumstances to expect it to have any. The organisation carries the burden of proof. The Home Office guidance under section 204 describes six principles that should inform those procedures. The table records the evidence for each; it is not a substitute for reading the guidance.

Keep the records that show the procedures operated during the year: training completion, due diligence files, control test results, investigations closed and changes made after incidents. The defence is judged at the time of the fraud, so evidence that is assembled after an allegation carries little weight.

12. Fraud response and investigation interface

GAO asks for a fraud response plan as part of the antifraud strategy. Summarise the plan here and keep its procedure in the investigation template. Each allegation that reaches the speak-up channel or a detective control should be triaged within an agreed time, assigned an investigator independent of the area concerned and documented in a Fraud Investigation Report (compliance/fraud-investigation-report).

Decide in advance which events trigger notification to the external auditor, the insurer, the police or a regulator, and which trigger a re-score of the affected scheme. The last step in the diagram is the one most often missed: every proven case should change at least one score, control or analytic in this assessment.

13. Action plan

Report progress quarterly. When an action closes, re-score the scheme with the new evidence; do not lower a score on the strength of a closed action alone. Feed open actions and residual Medium or High schemes into the enterprise Risk Register (compliance/risk-register) under a fraud risk category, so the board sees fraud alongside other principal risks.

14. Bank variant: Fernhollow Bank

A bank uses the same method, scales and sections, but the scheme inventory is wider and customer-facing fraud dominates. Fernhollow Bank, a fictional mid-sized EU credit institution, would add schemes such as those below. Payment fraud reimbursement rules, strong customer authentication and fraud reporting duties come from payment services law and supervisory guidance in each jurisdiction; check the rules that apply to you and record them in the legal basis field of Document control.

Align customer fraud scoring with the AML Business Risk Assessment (compliance/aml-business-risk-assessment), because mule activity is both a fraud and a money laundering risk, and use a single customer risk view where your systems allow. Operational loss events from fraud also feed the bank's operational risk framework (finance/operational-risk-rcsa).

15. Reporting and review cadence

Triggers for an out-of-cycle review (Example): a confirmed fraud above EUR 250 thousand; a new country, product or payment method; an acquisition; a change of ERP or payment provider; new law or guidance; a control rated ineffective in testing. Record each trigger and the resulting change in the revision history.

Provide the audit committee with a one-page summary: inherent and residual profiles, schemes above tolerance, actions overdue, incidents and losses, and the internal audit view. Internal audit plans can draw on this profile; see Internal Audit Charter and Plan (compliance/internal-audit-charter-and-plan).

Glossary and references

References (names and numbers; obtain the official texts):

• Economic Crime and Corporate Transparency Act 2023, sections 199 to 206 and Schedule 13 (legislation.gov.uk); offence in force 2025-09-01.
• Home Office, "Economic Crime and Corporate Transparency Act 2023: Guidance to organisations on the offence of failure to prevent fraud", published 2024-11-06, last updated 2025-10-10 (gov.uk, Open Government Licence v3.0).
• US Government Accountability Office, "A Framework for Managing Fraud Risks in Federal Programs", GAO-15-593SP, July 2015.
• US Government Accountability Office, Standards for Internal Control in the Federal Government (Green Book), 2025 revision, GAO-25-107721, Principle 8.
• IAASB, ISA 240 (Revised), auditor's responsibilities relating to fraud, effective for periods beginning on or after 2026-12-15 (name and number only).
• COSO and ACFE, Fraud Risk Management Guide, 2nd edition, 2023 (name only).
• Related templates: Risk Register (compliance/risk-register), ISO 37001 Anti-Bribery (compliance/iso-37001-anti-bribery), Fraud Investigation Report (compliance/fraud-investigation-report), Fraud Detection System Design (system-design/design-fraud-detection), Whistleblowing Policy (compliance/whistleblowing-policy), Risk and Control Matrix (compliance/risk-control-matrix), Journal Entry Support (finance/journal-entry-support), AML Business Risk Assessment (compliance/aml-business-risk-assessment).

Standard and licence note

Based on the GAO Fraud Risk Management Framework (GAO-15-593SP) and the GAO Green Book 2025 (US government works, not subject to copyright in the United States), the Economic Crime and Corporate Transparency Act 2023 and the Home Office guidance on the failure to prevent fraud offence (Crown copyright, Open Government Licence v3.0), cited by section and principle and described in original wording; no text from these sources is reproduced. ISA 240 (Revised) and the COSO/ACFE Fraud Risk Management Guide are named only; no content from them is used. The template text, structure of the tables, scales and the Corvid Commerce Group and Fernhollow Bank examples are original and fictional. Check the current official versions of the law, guidance and standards before use. This is a documentation format, not legal, accounting or audit advice. Template licence: MIT.