Fraud Risk Governance Framework

It sets out who is accountable: the board or audit committee for oversight, senior management for ownership, and a named function for coordinating day-to-day work. Typical parts are an anti-fraud policy, regular fraud risk assessments, preventive and detective controls, a reporting and investigation process, training and consequences for offenders. Enterprise fraud risk management applies the same approach on a single, joined-up basis rather than leaving each business line to act alone. A fraud incident database records every case with its method, loss, control failure and action taken, so trends are visible and lessons feed back into controls. The framework is tested by internal audit and reported to the board. Some regulators expect one to be in place. Without it, each department handles fraud its own way and nobody sees the pattern across cases.

A mid-sized insurer creates a fraud steering committee chaired by the chief risk officer and reporting to the audit committee. Every confirmed case is logged in an incident database. After six months the data shows that most losses come from claims in one region, so the committee orders extra checks there. The committee also reports quarterly figures on cases, losses and recoveries to the board.