Anti-Fraud Policy

The policy tells everyone what counts as fraud, who is responsible for preventing and detecting it, how to report a concern, and what the organisation will do in response. Typical contents include a definition, scope covering staff, contractors and third parties, the duties of management, the risk assessment process, rules on investigation and evidence, links to disciplinary and legal action, and the protection of people who report in good faith. Many organisations describe a stance of zero tolerance, but that is a position adopted by the organisation, not a required part of the document. The policy sits above procedures and controls, and it is reinforced by training and communications. Auditors and regulators read it to judge whether the board has set clear expectations. When fraud does occur, investigators compare what staff actually did with what the policy told them to do.

After a procurement scandal at a rival institution, a university issues an anti-fraud policy. It names the finance director as owner, tells staff to report concerns to an independent hotline, and states that investigations will be led by internal audit. The council reviews it yearly. When an employee reports a fake supplier, the case follows the steps in the policy.