Fraud Risk Assessment (FRA)

The work usually starts by listing fraud schemes that could affect each process, such as payroll, procurement, revenue, expenses and customer onboarding. Teams then think about who might commit them and why, drawing on the fraud triangle of pressure, opportunity and rationalisation. Each scheme is scored for likelihood and impact before controls, then again after allowing for the controls in place. The gaps show where controls are missing or weak, and the results shape the anti-fraud plan, audit work and monitoring tests. It differs from a general risk assessment because it assumes intentional deception and collusion, not accident. Most organisations repeat it every year or after major changes such as a new product or acquisition. Internal auditors take the ranked results to plan their testing, and management uses them to decide which gaps to close first.

A hospital group workshops fraud risks in its supply chain. Staff identify that one manager can select suppliers, approve invoices and receive deliveries. Likelihood is rated medium and impact high, and no control compensates. The group splits those duties among three roles and adds a quarterly check of supplier addresses against staff addresses. The next year's assessment rates the same scheme as low.