Fraud Risk Management and Internal Controls

Introduction

Financial institutions process large transaction volumes, hold sensitive data and operate through interconnected digital channels. These characteristics create opportunities for payment fraud, account takeover, employee misconduct, financial reporting manipulation, money laundering and cyber-enabled crime. Fraud risk cannot be eliminated completely, but it can be reduced to an acceptable level through well-designed and consistently operated internal controls.

An internal control is a policy, procedure, system configuration or human activity designed to provide reasonable assurance that an objective will be achieved. Controls may prevent an event, detect it promptly or correct its consequences. Effective control systems combine people, processes, technology, information and governance rather than relying on a single safeguard.

This chapter explains how to design and evaluate controls involving segregation of duties, authorization, reconciliations, access management, transaction limits, exception reporting and continuous monitoring. It also distinguishes control design effectiveness from operating effectiveness—a central distinction in audit, compliance and fraud risk management.

Learning Objectives

After studying this chapter, students should be able to:

1. Explain the role of internal controls in fraud risk management.
2. Distinguish preventive, detective and corrective controls.
3. Design controls using segregation of duties, authorization, reconciliation, access management and transaction limits.
4. Develop exception reporting and continuous monitoring arrangements.
5. Evaluate control design and operating effectiveness.
6. Apply quantitative and qualitative methods to assess control performance.
7. Recommend proportionate corrective actions for control deficiencies.

1. Fraud Risk and the Internal Control System

Fraud risk is the possibility that an individual or group will intentionally use deception, concealment or abuse of trust to obtain an unlawful or improper benefit. It differs from ordinary operational error because fraud involves intent. However, many controls address both fraud and error because the same weaknesses may enable either outcome.

A useful representation of residual risk is:

This expression is conceptual rather than a literal subtraction of monetary values. Inherent risk is the level of risk before controls; residual risk is the risk remaining after controls. Organizations commonly assess both by combining likelihood and impact ratings, although reputational, legal and systemic effects may not be captured adequately by a single score.

1.1 Objectives of internal control

An internal control system supports three broad objectives:

• Operational objectives: effective and efficient operations, asset protection and business continuity.
• Reporting objectives: complete, accurate, timely and reliable financial and non-financial reporting.
• Compliance objectives: conformity with laws, regulations, contracts and internal policies.

A widely used control framework organizes internal control into five interrelated components:

1. Control environment
2. Risk assessment
3. Control activities
4. Information and communication
5. Monitoring activities

Fraud controls are therefore not isolated procedures. Their effectiveness depends on governance, ethical culture, reliable information, competent staff and management oversight.

2. Preventive, Detective and Corrective Controls

Controls may be classified by when they act relative to a risk event.

A control may serve more than one purpose. For example, real-time transaction monitoring detects suspicious activity and may prevent loss if it automatically pauses payment execution. Classification should therefore reflect the control’s actual operation rather than its label.

Figure: Fraud controls form a continuous cycle of prevention, detection, correction and improvement.

No single control is infallible. Layered controls provide defense in depth: when a preventive control fails, a detective control may identify the event, while a corrective control limits its consequences.

3. Designing a Fraud Control Framework

Control design begins with risk, not with a preferred technology. A disciplined process includes the following stages:

1. Define the process, assets, systems and regulatory obligations in scope.
2. Identify plausible fraud schemes and threat actors.
3. assess likelihood, impact, velocity and duration.
4. Identify existing controls and dependencies.
5. Evaluate control gaps and residual risk.
6. Design additional or modified controls.
7. Assign an accountable control owner.
8. Specify frequency, evidence, escalation and review requirements.
9. Test and improve the control.

3.1 Risk and control matrix

A risk and control matrix links each risk to its objective, control, owner and evidence.

A well-specified control states who performs it, what is performed, when and how often it operates, what evidence is retained, what threshold applies and how exceptions are escalated.

4. Segregation of Duties and Dual Control

Segregation of duties (SoD) distributes incompatible responsibilities among different people so that one person cannot initiate, approve, execute and conceal a fraudulent transaction.

Four commonly separated functions are:

• Authorization: approving a transaction or relationship.
• Custody: holding or transferring assets.
• Recording: entering transactions into accounting records.
• Reconciliation: independently comparing records and resolving differences.

For example, an employee who creates a new supplier should not independently approve payments to that supplier. Similarly, a teller should not reconcile the cash account for which the teller has custody.

4.1 Dual control

Dual control requires two independent, appropriately authorized persons to participate in or approve a sensitive activity. Examples include opening a vault, releasing a high-value transfer or changing a privileged system configuration.

Dual control must not be confused with multi-factor authentication. Multi-factor authentication verifies one user through two or more factor categories, such as a password and biometric. Dual control involves two independent people; multi-factor authentication involves multiple credentials or factors and may authenticate only one person.

4.2 Compensating controls

Small branches may lack sufficient staff for complete segregation. Management may then use compensating controls such as:

• independent supervisory review;
• mandatory leave and job rotation;
• automated transaction alerts;
• periodic surprise cash counts;
• head-office reconciliation; and
• enhanced audit-log monitoring.

A compensating control must address the same risk with comparable rigor. Merely documenting that segregation is impractical does not reduce the risk.

5. Authorization and Approval Controls

Authorization establishes who may perform an activity and under what conditions. Approval is the documented decision to permit a specific transaction or change.

Effective authorization controls should define:

• authorized roles and approval levels;
• financial and non-financial thresholds;
• required supporting evidence;
• prohibited self-approval;
• escalation arrangements;
• validity periods; and
• treatment of emergencies and overrides.

A maker–checker arrangement requires one person to initiate a transaction and another to verify and approve it. The checker must have sufficient information, authority and independence. A rapid click without examining evidence is not an effective approval.

Overrides require particular attention. Legitimate emergencies may justify an override, but every override should be time-limited, logged, justified and reviewed independently.

6. Reconciliations

A reconciliation compares two independently maintained sources to identify omissions, timing differences, errors or unauthorized transactions. Examples include bank-to-ledger, card-network-to-core-system, subsidiary-ledger-to-general-ledger and physical-cash-to-recorded-cash reconciliations.

The general objective is:

The equality is expected only after valid timing items, unrecorded transactions and errors have been identified and correctly adjusted. Reconciliation does not prove that every underlying transaction is legitimate; collusive or consistently falsified entries may appear in both sources.

6.1 Worked bank reconciliation

At month-end, a bank’s internal cash ledger shows an unadjusted balance of 49,100 currency units. The bank statement shows an unadjusted balance of 52,200. Investigation identifies the following:

• Interest credited by the bank but not yet recorded in the ledger: 1,200.
• Service charges not yet recorded in the ledger: 300.
• A customer payment returned unpaid and not yet recorded in the ledger: 300.
• Deposits in transit: 4,000.
• Outstanding cheques: 6,500.

The adjusted ledger balance is:

The adjusted bank-statement balance is:

Thus, 52,200 is the unadjusted bank-statement balance, while 49,700 is the adjusted or reconciled cash balance. Deposits in transit and outstanding cheques explain the bank-side timing difference. Interest, charges and the returned payment require entries in the internal ledger.

An effective reconciliation also requires timely preparation, independent review, evidence of investigation, aging of unresolved items and escalation of unusual differences. A reconciliation signed without examining reconciling items is only a formal control, not a substantively effective one.

7. Access Management

Access management ensures that users and systems receive only the permissions required for legitimate duties. The principle of least privilege limits access to the minimum necessary scope and duration.

7.1 Access life cycle

The access life cycle includes:

• Joiner controls: verify identity and approve initial access.
• Mover controls: revise access when responsibilities change.
• Leaver controls: revoke access promptly when employment ends.
• Periodic recertification: confirm that existing access remains necessary.

Role-based access control assigns permissions according to job roles. Attribute-based access control considers additional characteristics such as location, transaction type or device status. Privileged access management applies enhanced safeguards to administrators and powerful service accounts.

Important controls include multi-factor authentication, password and credential protection, session controls, privileged-session logging, dormant-account removal, segregation of administrative roles and monitoring of service accounts. Shared accounts should generally be prohibited because they weaken accountability.

8. Transaction Limits and Velocity Controls

Transaction limits constrain exposure by value, frequency, geography, channel, customer type or time period. Examples include daily transfer limits, cash-withdrawal limits and limits on the number of beneficiary changes.

Limits should be risk-based rather than arbitrary. A low limit may reduce fraud loss but obstruct legitimate customers; an excessively high limit provides little protection. Tiered limits can reflect customer risk, authentication strength, transaction purpose and historical behavior.

Velocity controls examine cumulative activity. For example, ten transfers of 9,900 may evade a single-transaction threshold of 10,000 but breach a daily aggregate limit. Controls must therefore address transaction splitting and activity across related accounts or channels.

Limit changes should require authorization, produce an audit trail and, for sensitive cases, trigger a cooling-off period. Repeated overrides are indicators of either poor limit design or control circumvention.

9. Exception Reporting and Continuous Monitoring

Exception reporting identifies events that violate rules or differ materially from expected behavior. Useful reports may include:

• transactions above limits;
• dormant-account activity;
• repeated failed access attempts;
• payments just below approval thresholds;
• unusual refunds or reversals;
• employees accessing their own or related-party accounts;
• long-outstanding reconciliation items; and
• privileged activity outside approved change windows.

An exception report becomes a control only when a competent person reviews it, investigates relevant items, documents conclusions and escalates unresolved matters. Excessive report volume can cause alert fatigue.

Continuous monitoring uses automated rules, analytics or models to evaluate transactions and control conditions at or near the time of occurrence. It differs from continuous auditing: monitoring is generally a management responsibility, whereas continuous auditing provides independent assurance.

9.1 Monitoring performance

Where investigated alerts can be classified reliably, two useful metrics are precision and recall:

Here, TP is the number of true-positive alerts, FP is the number of false positives, and FN is the number of fraudulent events missed by the control. Both metrics are dimensionless proportions between 0 and 1.

High precision means that a large proportion of alerts are genuinely relevant. High recall means that the system detects a large proportion of known fraud events. Increasing sensitivity may improve recall while reducing precision. Management must balance customer disruption, investigator capacity and risk appetite.

10. Evaluating Control Effectiveness

Control evaluation has two distinct dimensions.

10.1 Design effectiveness

A control is appropriately designed if, when operated as prescribed by competent people, it can reasonably prevent or detect the relevant risk in time. Design evaluation considers:

• alignment with the identified risk;
• coverage of relevant transactions and systems;
• performer competence and independence;
• frequency and timeliness;
• appropriate thresholds;
• reliable information inputs;
• escalation procedures; and
• dependencies on other controls.

A monthly review cannot be considered well designed to prevent an instant, irreversible transfer if no real-time preventive control exists.

Design can be assessed through inquiry, process walkthroughs, document inspection, system-configuration review and observation. Inquiry alone provides weak evidence.

10.2 Operating effectiveness

A control is operating effectively if it was applied consistently, by authorized and competent persons, throughout the period under review. Testing methods include:

• inspection of approvals and retained evidence;
• observation of control performance;
• reperformance of the control;
• examination of system logs;
• sampling transactions across the period; and
• data analysis of the full population.

A perfectly designed control that is frequently bypassed is not operating effectively. Conversely, a consistently performed control may still be ineffective if its design cannot address the risk.

10.3 Control testing sequence

A logical testing sequence is:

1. State the control objective.
2. Confirm that the control design addresses the risk.
3. Identify the population and period.
4. Select an appropriate testing method and sample.
5. Obtain sufficient, reliable evidence.
6. Record deviations and determine their causes.
7. Assess severity and residual risk.
8. Agree remediation, ownership and deadlines.
9. Retest after remediation.

The observed deviation rate in a tested sample is:

For example, if 4 of 80 approvals lack required evidence, the observed sample deviation rate is:

This rate describes the tested sample; it is not automatically the exact population deviation rate. Statistical inference requires an appropriate sampling method, confidence level and consideration of sampling risk.

11. Economic Evaluation of Controls

Control decisions should consider expected loss, implementation cost and non-financial consequences. Under a simplified frequency–probability–impact model:

where N is the number of relevant attempts per year, p is the probability of loss per attempt, and L is the average monetary loss per successful event. The formula assumes that the estimates are sufficiently stable and that average impact meaningfully represents the loss distribution.

Suppose a bank expects 120 high-risk fraud attempts annually. Without a new control, 8% are expected to succeed, with an average loss of 25,000.

If the control reduces the success probability to 2%:

The expected annual loss reduction is 180,000. If the control costs 110,000 annually, its expected net financial benefit is 70,000. This simplified calculation does not capture regulatory penalties, customer harm, extreme losses or reputational damage; these factors may justify a control even when its estimated direct benefit is lower than its cost.

12. Control Deficiencies and Corrective Action

A control deficiency exists when a control is absent, improperly designed or not operating as intended. Deficiencies should be assessed according to likelihood, potential impact, duration, affected population, detectability and availability of compensating controls.

Root-cause categories may include:

• unclear accountability;
• inadequate training;
• excessive workload;
• poor system configuration;
• unreliable data;
• management override;
• conflicting performance incentives; or
• deliberate circumvention.

Corrective action should address the cause rather than merely the visible exception. If approvals are repeatedly missing because the workflow allows transactions to proceed without them, retraining alone is unlikely to be sufficient. A system-enforced approval gate may be required.

13. Illustrative Case: Controlling Digital Payment Fraud

Background

The following is an illustrative case. Meridian Community Bank introduced instant digital payments. Fraud losses increased after criminals took over customer accounts, added new beneficiaries and rapidly transferred funds to mule accounts.

Problem

The bank relied mainly on password authentication and a high daily transfer limit. Beneficiary creation and payment execution could occur in the same session. Alerts were reviewed the next business day, by which time funds were often unrecoverable. Staff also received so many low-quality alerts that important cases were delayed.

Analysis

A walkthrough identified several weaknesses:

• weak authentication at account login;
• no cooling-off period for new beneficiaries;
• uniform transaction limits for all customers;
• delayed rather than real-time monitoring;
• poor linkage of device, beneficiary and account data;
• no formal escalation deadline; and
• limited quality assurance over alert closure.

The existing controls were not well designed for instant payments because their timing did not match the speed of the risk.

Approach and solution

The bank introduced layered controls:

1. Multi-factor authentication for high-risk sessions.
2. Device and session-risk assessment.
3. Independent customer confirmation for sensitive profile changes.
4. A temporary transfer limit for newly added beneficiaries.
5. Real-time rules for unusual value, velocity and beneficiary patterns.
6. Automatic payment holds for the highest-risk alerts.
7. Dual control by two authorized employees for releasing certain high-value held payments.
8. Case-management deadlines and documented escalation.
9. Weekly quality review of a sample of closed alerts.
10. Monthly monitoring of fraud capture, false positives, customer complaints and override rates.

Outcome

The new architecture reduced the time between suspicious activity and intervention. High-risk payments could be stopped before settlement, while lower-risk transactions continued with limited disruption. During testing, management discovered that some analysts closed alerts without recording sufficient reasons. Additional workflow validation and supervisory review were introduced.

Learning points

The case demonstrates that control timing must match risk velocity, preventive and detective measures should be layered, and automation does not remove the need for human accountability. It also shows the difference between design and operation: the alert workflow was suitably designed, but incomplete investigation records revealed an operating-effectiveness problem.

14. Governance, Ethics and Regulatory Considerations

Boards and senior management remain accountable for an institution’s control environment. Responsibilities should be organized through operational management, independent risk and compliance functions, and internal audit. Internal audit should remain sufficiently independent from the activities it evaluates.

Ethical culture is especially important because senior personnel may override formal controls. Incentive systems that reward transaction volume without considering conduct can encourage circumvention. Whistleblowing channels, protection against retaliation and consistent disciplinary practices strengthen fraud deterrence.

Controls must also respect privacy, data-protection and employment requirements. Employee monitoring should have a legitimate purpose, use proportionate data and restrict access to monitoring results. Automated decisions should be explainable enough to support investigation, customer communication and regulatory review.

15. Technology, Artificial Intelligence and Contemporary Developments

Machine learning can identify complex patterns that fixed rules may miss, including coordinated mule networks and deviations from normal customer behavior. Graph analytics can reveal relationships among devices, accounts, beneficiaries and merchants.

However, analytical controls introduce model risk. Institutions should govern data quality, feature selection, validation, performance drift, explainability and human review. Fraudsters adapt to detection methods, so historical performance may deteriorate. Models should therefore be monitored and periodically recalibrated.

Other developments include behavioral biometrics, real-time payment controls, identity intelligence, automated access certification and continuous control monitoring. Technology improves speed and coverage but may create concentrated dependencies. A configuration error in an automated control can affect an entire transaction population, making change management and independent validation essential.

16. Challenges and Best Practices

Common challenges include alert fatigue, fragmented systems, poor-quality data, staff shortages, collusion, management override and tension between security and customer convenience.

Sound practice includes:

• linking every control to a clearly defined risk and objective;
• using layered preventive, detective and corrective controls;
• maintaining genuine independence in approvals and reconciliations;
• applying least privilege and timely access removal;
• calibrating thresholds using risk and performance data;
• retaining reliable evidence of control execution;
• investigating and aging unresolved exceptions;
• monitoring overrides and manual workarounds;
• testing both design and operating effectiveness; and
• learning from incidents, near misses and control failures.

Chapter Summary

Fraud risk management requires coordinated preventive, detective and corrective controls. Segregation of duties limits the ability of one person to initiate and conceal misconduct, while dual control requires two independent authorized individuals. Authorization, maker–checker arrangements, access restrictions and transaction limits reduce fraud opportunities. Reconciliations, exception reports and continuous monitoring identify omissions, anomalies and unauthorized activity.

Control design effectiveness asks whether a control could address the identified risk if operated as intended. Operating effectiveness asks whether it actually operated consistently and with appropriate evidence. Effective evaluation uses walkthroughs, inspection, observation, reperformance, sampling and data analysis. Quantitative measures can support decisions, but legal, ethical, customer and reputational effects must also be considered. Strong governance, independent assurance and continuous improvement are necessary because fraud methods, technologies and business processes continually change.

Key Terms

Access management: Processes for granting, modifying, reviewing and revoking system access.

Authorization: Formal permission to perform an activity within defined conditions.

Compensating control: An alternative control that addresses a risk when the preferred control is impractical.

Continuous monitoring: Automated or frequent evaluation of transactions and control conditions.

Control deficiency: An absent, poorly designed or inconsistently operated control.

Control owner: The person accountable for a control’s design, operation and evidence.

Corrective control: A measure that contains damage, restores operations or prevents recurrence.

Detective control: A control intended to identify an event that has occurred or is occurring.

Design effectiveness: The extent to which a control, if operated as intended, can address its risk.

Dual control: Participation or approval by two independent authorized persons.

Exception report: A report identifying activity outside established rules or expectations.

Least privilege: Restriction of access to the minimum required for legitimate duties.

Maker–checker control: A process in which one person initiates and another independently verifies an activity.

Multi-factor authentication: Identity verification using factors from two or more authentication categories.

Operating effectiveness: The extent to which a control operates consistently as designed.

Preventive control: A measure intended to stop or reduce the probability of an event.

Reconciliation: Comparison of independent records to identify and resolve differences.

Segregation of duties: Separation of incompatible responsibilities among different people.

Review Questions

Short Answer Questions

1. Distinguish preventive, detective and corrective controls.
2. Why should authorization, custody, recording and reconciliation be separated?
3. How does dual control differ from multi-factor authentication?
4. What is the purpose of a bank reconciliation?
5. Define design effectiveness and operating effectiveness.

Long Answer Questions

1. Explain how a financial institution should construct and use a risk and control matrix.
2. Discuss the design of an effective access-management life cycle for a bank.
3. Evaluate the benefits and limitations of transaction limits and velocity controls.
4. Explain how exception reporting becomes an effective control rather than merely an administrative report.
5. Discuss governance, ethical and privacy considerations in employee and transaction monitoring.

Analytical / Application Questions

1. A branch cannot fully segregate cash handling and reconciliation because it has only two employees. Design a set of compensating controls and justify each control.
2. A bank’s fraud-monitoring system generates many alerts but investigators identify little genuine fraud. Diagnose the problem using precision and recall, and recommend improvements.
3. A control is appropriately designed, but testing finds that required approval evidence is absent in 6 of 60 transactions. Calculate the observed deviation rate, interpret it cautiously and propose corrective actions.

Multiple Choice Questions with Answers

Question 1

Which control most directly prevents one employee from creating a supplier and independently approving payment to that supplier?

A. Segregation of duties

B. Post-payment reconciliation

C. Incident recovery planning

D. Customer complaint analysis

Correct Answer: A. Segregation of duties

Question 2

Which statement correctly distinguishes dual control from multi-factor authentication?

A. Dual control uses two passwords, whereas multi-factor authentication uses one password.

B. Dual control requires two independent authorized persons, whereas multi-factor authentication may authenticate one person using multiple factor categories.

C. Dual control is detective, whereas multi-factor authentication is always corrective.

D. Dual control applies only to physical vaults, whereas multi-factor authentication applies only to payments.

Correct Answer: B. Dual control requires two independent authorized persons, whereas multi-factor authentication may authenticate one person using multiple factor categories.

Question 3

An unadjusted bank statement balance is 52,200. Deposits in transit are 4,000 and outstanding cheques are 6,500. What is the adjusted bank-statement balance?

A. 45,700

B. 49,700

C. 54,700

D. 62,700

Correct Answer: B. 49,700

Question 4

Which statement best describes control design effectiveness?

A. The control operated without any exceptions during the testing period.

B. The control produced a financial benefit greater than its annual cost.

C. The control could reasonably address the identified risk if operated as prescribed.

D. The control was approved by internal audit.

Correct Answer: C. The control could reasonably address the identified risk if operated as prescribed.

Question 5

Four deviations are found in a sample of 80 approvals. What is the observed sample deviation rate?

A. 4%

B. 5%

C. 8%

D. 20%

Correct Answer: B. 5%

Question 6

Which action is a corrective control following confirmed account takeover?

A. Setting a daily payment limit before transactions occur

B. Separating payment initiation from approval

C. Reviewing a weekly exception report

D. Blocking the account and resetting compromised credentials

Correct Answer: D. Blocking the account and resetting compromised credentials

Question 7

Which practice best supports the principle of least privilege?

A. Giving all finance employees administrative access

B. Assigning only permissions necessary for the user’s current duties

C. Allowing permanent emergency access

D. Using shared accounts to simplify operations

Correct Answer: B. Assigning only permissions necessary for the user’s current duties

Question 8

A fraud model identifies 60 true positives and 40 false positives. What is its precision?

A. 40%

B. 50%

C. 60%

D. 100%

Correct Answer: C. 60%

Question 9

Which evidence most strongly supports the operating effectiveness of an automated transaction-limit control?

A. A policy stating that limits should exist

B. A manager’s verbal assurance that the control works

C. System configuration and transaction logs showing consistent enforcement during the period

D. A future plan to test the control

Correct Answer: C. System configuration and transaction logs showing consistent enforcement during the period

Question 10

A bank expects 120 fraud attempts annually, a 2% success probability after control, and an average loss of 25,000 per successful event. What is the residual expected annual loss?

A. 6,000

B. 50,000

C. 60,000

D. 240,000

Correct Answer: C. 60,000