Fraud Risk Assessment: Method, AS 8001 and Checklist

What a Fraud Risk Assessment Covers

A fraud risk assessment covers specific fraud schemes, their likelihood and consequences, the controls against them and the residual risk after those controls. A fraud and corruption risk assessment also considers misuse of entrusted authority, including conflicts and improper influence over decisions.

Describe the possible act in each risk entry. “Payroll fraud” is too broad to test. “A payroll officer diverts salary by changing an employee’s bank details without independent approval” identifies a process, an actor and a control failure.

Management owns the assessment and the resulting treatments. Assign each risk to a manager with authority over the process, and name the people who operate its controls. The board or accountable authority oversees the system. Internal audit can examine its adequacy and control effectiveness without taking over management’s ownership.

Set the review cycle according to exposure and organisational policy. Review sooner after a proven fraud, a failed control or a new payment system. Changes to staffing, delegations or service delivery can also change the opportunity for fraud.

Commonwealth guidance encourages assessments at least every two years, subject to the entity’s risks. Its statutory requirement is regular assessment and reassessment after substantial organisational change. Commonwealth risk-assessment guidance explains that distinction.

Running the Assessment Step by Step

Run the assessment by following the money through each process and recording how someone could misuse it. Before starting, agree the scope, information access and rating criteria with the assessment sponsor. If an investigation is active, coordinate interviews and document requests with its lead.

1. Define the scope. Record the entities, payment channels and period covered. Include outsourced processes and system interfaces. State which activities sit outside the assessment and who assesses them.
2. List fraud schemes by process. Ask how an insider or external party could obtain money, assets or information through deception. Consider collusion and management override. Map supplier-payment schemes to procurement and payroll schemes to payroll.
3. Rate inherent risk. Assess each scheme’s likelihood and consequence before existing controls. Use the same assessment horizon and descriptors for every process.
4. Map and test controls. Record what each control prevents or detects, who performs it and the evidence of operation. Compare policy requirements with actual payment approvals, access logs or change records.
5. Rate residual risk. Reassess the scheme using controls that operate in practice. Explain why the likelihood or consequence changes. Record a failed test beside the affected control.
6. Assign treatments. Name the action owner and due date. Record the target risk rating, implementation evidence and the person authorised to accept any remaining exposure.

A Simple Rating Matrix

Use a matrix that your organisation approves before the workshop. The example below is fictional and uses a 12-month assessment horizon. It is a teaching example, not an AS 8001 requirement.

Likelihood / consequence	Minor	Moderate	Severe
Unlikely	Low	Low	Medium
Possible	Low	Medium	High
Likely	Medium	High	High

Define “unlikely” as requiring unusual conditions, “possible” as a credible scenario and “likely” as expected under current conditions. Calibrate those descriptions with transaction volumes, incidents and attempted fraud. Do not equate a lack of detected incidents with low likelihood.

Define consequences against your organisation’s financial tolerance and service obligations. Include harm to people, loss of sensitive information or disruption where relevant. Use the highest applicable consequence under the agreed method. Record the reason for the rating so another assessor can follow it.

A proposed control does not reduce today’s residual risk. Record its expected effect as the target rating, then update the residual rating after implementation and testing.

Record the assumptions behind the matrix as well as its result. In a fictional supplier-payment assessment, unrestricted bank-detail changes and a failed approval test support a likely rating. Severe reflects the organisation’s assessed loss exposure and service disruption. If the proposed independent check is untested, the current residual rating stays high.

This fraud risk modelling makes the reasoning visible. It does not calculate a precise probability from the labels or predict which person will offend.

Interviewing Process Owners

Ask process owners to walk through an ordinary payment, then an exception. Ask who can change bank details, release payments or bypass an approval. Request evidence through the agreed channel and compare answers with system records.

When someone is under suspicion, let the investigation lead decide the timing and scope of contact. Obtain process information from unaffected staff where possible. Keep allegation details and investigation evidence out of group workshops. Give an accurate explanation of the assessment’s purpose without disclosing restricted details. Risk workshops must preserve the investigation’s evidence and confidentiality.

If staff describe a control but cannot produce evidence, record it as untested. If two owners apply different ratings to the same scheme, resolve the descriptors before completing the register.

Transaction findings also inform fraud risk in audit. Give the auditor the payment evidence, control failures and unresolved questions so they can assess material misstatement risks. ASA 240 addresses the auditor’s fraud responsibilities. A forensic investigation supplies evidence within its scope. It does not provide a statutory audit opinion.

The Fraud Triangle as a Risk Lens

The fraud triangle describes pressure, perceived opportunity and rationalisation as conditions that can help explain fraud. The Association of Certified Fraud Examiners (ACFE) traces the model to Donald Cressey’s research on people who violated financial trust. ACFE’s fraud explanation describes those origins.

Use each element to challenge a scheme’s assumptions. Pressure can arise from incentives or financial strain. Opportunity concerns access and gaps in controls. Rationalisation concerns the justification a person gives for the act. These are prompts for assessing a process, not grounds for accusing a person.

Opportunity is the element controls can reduce most directly. Independent approval of bank-detail changes reduces the chance that one person can redirect a payment. Review of exception reports can shorten the period before detection. Incentive design and conduct expectations can address pressure or rationalisation, but you cannot read either reliably from a bank statement.

Keep ratings tied to evidence of the scheme and its control environment. Do not add numerical triangle scores to the matrix without an established method. ACFE explains that the model does not explain every fraud.

David Wolfe and Dana Hermanson’s fraud diamond adds capability. It asks whether someone has the position and skills to exploit the opportunity. In a payment process, consider who understands the approval rules and can override them. Neither model replaces evidence-based control testing.

Turning Investigation Findings Into the Risk Register

Turn an investigation finding into a risk entry by naming the payment channel, the failed control and the evidence showing how the gap was used. Separate the established incident from the risk of recurrence. Employee-fraud investigations provide the event evidence. The assessment applies that evidence to the process that remains in operation.

Transaction patterns point to control questions. Payments split below approval limits call for testing whether approvals aggregate related purchases. Changed supplier bank details call for examining independent verification and amendment logs. Round-sum transfers call for matching payments to approved obligations. Out-of-hours payments call for examining access and release permissions.

Each pattern needs context. A round amount can be a legitimate fixed fee. A late payment can be an authorised exception. Describe the control gap established by the supporting records, and keep unresolved transaction questions separate from confirmed failures. Use accounts-payable scheme analysis when examining supplier payments.

A Fictional Payroll Example

Suppose an investigation confirms $300,000 of payroll diversion over a year. Some salary credits went to a second account held by one employee. Payroll records establish that the employee changed destination details and approved the amended payment file. The second account alone would not establish diversion.

The resulting entry can capture the following information.

Register field	Fictional entry
Risk	A payroll officer redirects salary through unauthorised bank-detail changes and releases the amended file.
Channel	Payroll electronic bank payment file.
Failed control	Bank-detail amendment and payment release were performed by the same person.
Evidence	Matched statement credits, payroll amendment logs and payment-file approval records. Restricted evidence index retains source references.
Inherent rating	Likely / severe: high under the illustrative matrix.
Current residual rating	High because the failed approval arrangement remains in place.
Treatment	Separate amendment from approval and release. Verify requested changes through an established employee contact channel.
Owner	Payroll manager, with the finance systems manager responsible for access changes.
Completion test	Attempt a same-user amendment and release in an authorised test setting. The system must prevent release. Check that verification records exist for legitimate changes.
Target rating	Medium, subject to successful testing and management acceptance.
Review	After implementation, then at the scheduled assessment review.

Tracking Treatments Through to Review

Keep the payroll risk open until its treatment has evidence of implementation and a completed control test. For the fictional example, the payroll manager owns the treatment and must finish it within 30 days. Attach the revised access report and verification records to the register’s evidence index.

An independent tester then attempts the prohibited same-user change and release. Record the test result and reassess residual risk using the approved matrix. If the control fails, retain the higher rating and assign corrective work. Management records whether the remaining risk is acceptable and sets the next review date. Track overdue actions at each management review.

Changed Supplier Details and External Fraud

A criminal impersonating a supplier can ask accounts payable to replace genuine bank details with an account the criminal controls. Compare the first payment to the changed account with the amendment log and the original request. The bank entry shows where the payment went, while the supporting records establish how the change was authorised.

The social-engineering control is an independent callback using a known supplier number held before the request. Keep its record separate from the requester’s email. A different authorised person checks the verification and releases the payment. The WA Auditor General’s supplier guidance explains independent verification and approval.

Testing Alleged Revenue Against Receipts

To assess the risk of fraud in revenue recognition, match claimed sales to bank receipts and the debtor ledger. Investigate unmatched or reversed receipts and payments from unexpected parties. A receipt can be a loan or advance, so cash arriving does not establish earned revenue.

Obtain contracts and evidence of delivery to test what the customer owed and when the sale qualified for recognition. Compare debtor records with subsequent receipts. Examine journal entries and their supporting approval records for unsupported sales or adjustments. Record which assertions the bank evidence supports and which need those other records before rating the control gap.

FinTrace saves forensic accountants hours of conversion and statement review when building this evidence base. The service turns supplied PDFs into a searchable ledger and a readable report that flags suspicious transactions. Each finding cites the source PDF filename and page, putting the supporting bank evidence at hand for the risk entry.

Use forensic data analytics to test transaction populations against the controls you expect. A Benford’s law screen can help select unusual amounts for examination when the data suits that test. It does not establish a failed control or prove fraud.

AS 8001:2021 and the Commonwealth Framework

AS 8001:2021 is an Australian benchmark for developing and maintaining a fraud and corruption control system. Standards Australia’s published summary identifies minimum requirements and the responsibilities of governing bodies and senior management. It applies across commercial and not-for-profit organisations.

Its published preview places fraud and corruption risk management alongside control-system documentation, monitoring and review. It also addresses internal controls and pressure testing. Use the assessment to identify the schemes your control system must address, then document how it addresses them.

Set a review interval in the organisation’s policy and reassess when exposure changes. For Commonwealth entities, the regular-assessment requirement and two-year guidance below provide the timing distinction. Do not treat that guidance as a universal statutory deadline for Australian businesses.

The Commonwealth Requirements

The Commonwealth Fraud and Corruption Control Framework 2024 separates binding rules from policy and guidance. The framework guidance explains their coverage. The Fraud and Corruption Rule binds Commonwealth entities under the Public Governance, Performance and Accountability Act 2013. The policy binds non-corporate Commonwealth entities. Corporate Commonwealth entities and Commonwealth companies are encouraged to adopt it as better practice.

Section 10 of the PGPA Rule requires accountable authorities to assess fraud and corruption risks regularly and after substantial changes. They must implement control plans and update them promptly after an assessment. They must also review control effectiveness and record the responsible governance arrangements and officials. The framework’s assessment guidance encourages a cycle of at least every two years, subject to individual risks.

From Assessment to Control Plan

The register explains the risks and ratings. The fraud control plan records the organisation’s response. Carry each risk identifier into the plan and show existing controls, additional treatments and how they reduce exposure. Name control and treatment owners, completion timeframes and the evidence used to monitor progress.

A policy statement alone cannot show whether a payment control operates. Keep test results connected to the risk entry and update the plan when a test requires a treatment.

The Australian National Audit Office’s Fraud and Corruption Control Arrangements in Creative Australia (2025) shows why those connections matter. It found gaps in risk coverage and a control plan that did not connect to assessed risks. It recommended broader risk identification, documented control testing and a plan informed by the assessments. A register must reach the processes where the entity actually makes decisions and payments.

Fraud Risk Assessment Checklist

Use this fraud risk assessment checklist to check whether the register is ready for management sign-off. Keep evidence locators in a restricted record where they contain investigation details.

• Record the scope, assessment period and excluded activities with their responsible owners.
• List the schemes considered for each process, including external fraud, collusion and management override.
• Record the approved likelihood and consequence criteria, assessment horizon and reasons for each inherent rating.
• Name every control and its owner. State which part of the scheme it prevents or detects.
• Retain control-test methods, evidence and results. Identify failed or untested controls.
• Record residual ratings based on operating controls. Separate target ratings for proposed treatments.
• Convert investigation findings into process risks with a payment channel, failed control and evidence locator.
• Assign each treatment an owner, due date and completion test.
• Set the next review date and early-review triggers. Record who monitors overdue treatments.
• Obtain management sign-off and record who accepts residual risks. Give the oversight committee the assessment and treatment status.

Before sign-off, select one high-rated risk and trace it from scheme to test evidence, treatment and control plan. The record must show who will act and what result will demonstrate that the treatment works. If that chain breaks, complete the missing field before closing the assessment.

Separation of Duties in Payment Controls

Separate payment approval, access to funds, supplier maintenance and reconciliation across people with distinct system permissions. The Commonwealth segregation-of-duties guidance explains how dividing tasks reduces opportunities to make and conceal false payments.

In a fictional false-supplier scheme, one employee creates the supplier record and approves its invoice. The same employee releases the bank payment and prepares the reconciliation. That combination lets the employee direct money to their own account and conceal the payment as an ordinary expense.

Assign supplier changes to one person, approval to another and bank release to an authorised person who checks the approval evidence. Give the reconciler direct access to bank records and restrict their ability to alter supplier records or release payments. Test actual permissions, including temporary cover and administrator access, against those assignments.

For a small team, document any duties that cannot be separated and assign compensating independent review. An owner or external reviewer can inspect bank transactions against approvals and examine supplier-change and payment-exception reports. Give that reviewer records obtained independently of the person processing payments. Record exceptions and follow them through to resolution.

Before accepting the residual risk, demonstrate that the reviewer can identify an unsupported supplier change or payment. A role chart records the intended separation. Access tests and completed reviews show whether the controls operate.