A fraud risk assessment lists the ways fraud could happen in your organisation, rates each one, checks whether a control would stop or catch it, and turns the gaps into audit tests. It is different from a general risk assessment because it asks how a person could deliberately cheat the system, not only how the system could fail by accident.
Last reviewed: 17 October 2026. Facts checked. We searched for the fraud triangle and for the COSO and ACFE Fraud Risk Management Guide. Secondary sources agree that the guide has five principles (governance, risk assessment, control activities, investigation and corrective action, monitoring) and that fraud risk assessment is the principle most tied to internal audit. They disagree on publication dates, so we give no date. We did not open the COSO guide itself. The register and ratings below are our own illustration, not from a standard.
The fraud triangle, in one minute
Fraud usually needs three things together:
- Pressure (or incentive): a personal money problem, or a target that is very hard to hit.
- Opportunity: weak controls, too much access, or no oversight.
- Rationalisation: a story the person tells themselves, such as "I will pay it back."
Auditors cannot change a person's pressure or attitude. They can find and shrink opportunity. That is why controls matter most.
Step 1: Set scope and get the right people in a room
Cover the whole entity or one process, such as procurement or payroll. Include finance, operations, HR, IT and someone who knows the front line. People closest to the work know where shortcuts exist. Keep the session short and the questions plain: "If you wanted to steal from this process, how would you do it?"
Step 2: List fraud schemes
Group them so none is missed.
| Group | Examples |
|---|---|
| Misstatement of financial reports | Early revenue recognition, hiding liabilities, inflating assets |
| Theft of assets | Cash theft, inventory theft, false refunds |
| Payment fraud | Fake vendors, duplicate payments, inflated invoices, ghost employees |
| Corruption | Bribes, kickbacks, conflicts of interest in awards |
| Cyber-enabled fraud | Email impersonation of a supplier, account takeover |
| Management override | Unusual journal entries, overriding controls |
Management override deserves its own row. Controls often assume managers are honest, and the people who can bypass controls are the ones with the most power.
Step 3: Rate each scheme
Use a simple scale. For every scheme, give a rating for likelihood and for impact. Keep your scale in writing so different raters agree. Here is a worked extract.
| Scheme | Likelihood | Impact | Inherent rating |
|---|---|---|---|
| Fake vendor set up and paid | Medium | High | High |
| Duplicate invoice payment | High | Low to medium | Medium |
| Ghost employee on payroll | Low | Medium | Medium |
| Revenue booked early at period end | Medium | High | High |
| Manager overrides approval limit | Low | High | Medium |
The ratings are examples. Yours depend on your business, and should be argued out by the group, not copied.
Step 4: Map existing controls
For each scheme, name the control that should prevent or detect it. Be specific. "Approval" is vague. "Vendor creation needs a second person who checks bank details against a cancelled cheque or bank letter" is a control.
| Scheme | Preventive control | Detective control |
|---|---|---|
| Fake vendor | Independent approval of new vendors | Periodic match of vendor and employee bank accounts and addresses |
| Duplicate payment | System block on repeated invoice number | Data test for duplicates |
| Ghost employee | HR and payroll separation of duties | Payroll to HR headcount reconciliation |
| Early revenue | Cut-off review | Analysis of period-end entries and credit notes after year end |
Step 5: Find the gaps and rate residual risk
If the control does not exist, does not run, or one person can get around it, the residual risk stays high. Mark each scheme as covered, partly covered or not covered. Be honest about controls that exist on paper only.
Step 6: Turn gaps into tests
Link every uncovered or weak scheme to a test.
- Vendor master: compare vendor bank accounts, addresses and phone numbers with the employee master.
- Payments: test for duplicates, round amounts and payments just below approval limits. Our duplicate payment test kit is a starting point.
- Journals: review entries at period end, by unusual users, or at unusual times.
- Payroll: match headcount to HR records and test a sample of new joiners and leavers.
Data analytics helps here because it can test every item, not just a sample. See vendor fraud detection with pattern matching.
Step 7: Report, assign owners and refresh
Share the register with management and the audit committee. Give each gap an owner and a date. Review the assessment at least when the business changes, a fraud is found, or a new process or system goes live. A fraud risk assessment that is not updated becomes a list of last year's risks.
When something is found
If the tests point to possible fraud, stop and follow your policy. Do not confront the person. Preserve evidence, tell the right authority, and consider whether specialist help is needed. Our guide to forensic audit explains the next stage.
Frequently Asked Questions
Is fraud risk assessment the internal auditor's job?
Management owns fraud risk. Internal audit usually facilitates the assessment or reviews management's own, and tests the controls.
How often should we repeat it?
At least on a regular cycle and after major change. We do not state a fixed interval because it depends on your risk.
How is it different from a normal risk assessment?
It focuses on intentional acts and on who could override controls, and uses the fraud triangle to find where opportunity exists.
Can data analytics replace the workshop?
No. Analytics tests the data. The workshop finds the schemes worth testing.
Does this satisfy any legal requirement?
This article does not cover legal duties. For auditor reporting duties on fraud in India, see our guide to Form ADT-4 and Section 143(12).
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error