Fraud Risk Assessment, How to Run One

You can run a useful one in an afternoon. Here is the method.

Start with the fraud triangle

Three conditions are usually present together.

Pressure. A personal financial problem the person cannot discuss. Opportunity. A gap in your process that lets it happen.
Rationalisation. A story where it is not really stealing. A delayed bonus. A loan they intend to repay.

You cannot manage pressure and you cannot manage rationalisation. You can manage opportunity, so that is where the assessment goes.

Step 1. List where money and value move

Not your risks. Your flows.

Supplier payments. Payroll. Customer receipts. Petty cash and expenses. Inventory. Fixed assets. Company cards. Anything with a refund or credit note.

Step 2. For each flow, name who can do what

Three columns. Who can initiate. Who can approve. Who can record.

Then look for any name appearing twice on one row. That is your exposure, written down.

In small businesses one name usually appears in all three columns somewhere. Finding it is the whole point of the exercise.

Step 3. Ask what would have to go wrong

For each flow, describe the specific scheme rather than the category.

Not "payroll fraud". Instead: a leaver is not removed, and their salary continues to an account the payroll clerk controls.

Not "supplier fraud". Instead: a new supplier is created with bank details matching an employee, and invoices below the approval threshold are paid without question.

Specific schemes suggest specific controls. Categories suggest nothing.

Step 4. Check the threshold trick

Look at your approval limits, then look for transactions clustering just underneath them.

A run of invoices at AED 4,800 against a AED 5,000 approval limit is not a coincidence. This is the fastest single test in the whole assessment and you can run it from your ledger this afternoon.

Step 5. Rank by ease, not by size

The instinct is to rank by how much could be lost. Rank instead by how easily it could be done and how long it would take you to notice.

A small scheme running undetected for three years costs more than a large one caught in a week.

How often

Once a year, and again whenever the answer to "who can do what" changes. New finance hire. New system. New location. Someone leaves.

The assessment is only valid for the staffing it was written against.

What comes out of it

A short list of places where one person controls too much of a flow, ranked by how long a problem would go unnoticed.

That list is worth more than any policy document, and it fits on one page.

Where we fit

We run this as a focused review and give you the one-page list. Tell us your headcount and who approves payments.