3. Enterprise Fraud Risk Assessment and Control Frameworks

Introduction and context

Insurance fraud is not merely a collection of dishonest claims. It is an enterprise risk that can arise in underwriting, distribution, premium collection, claims settlement, reinsurance, finance, procurement, human resources, and third-party relationships. Fraud may be committed by policyholders, claimants, intermediaries, service providers, employees, organised groups, or combinations of these actors. Its consequences include financial loss, regulatory sanctions, distorted pricing, reputational damage, unfair treatment of genuine customers, and weakened confidence in the insurance institution.

A mature insurer therefore needs more than isolated investigative teams or post-loss controls. It requires a structured fraud risk assessment and a control framework that connects governance, analytics, operational procedures, investigation, disciplinary action, recovery, and organisational learning. The purpose of assessment is not to label every unusual transaction as fraudulent. It is to determine where fraud exposure is greatest, how quickly losses may develop, whether existing controls are adequate, and what management should do about residual risk.

This chapter develops an enterprise approach to fraud risk assessment. It explains how to identify fraud scenarios, evaluate likelihood, impact and velocity, assess control effectiveness, build risk registers and heat maps, define key risk indicators, and organise controls across prevention, detection, response and recovery. The discussion is relevant to life, health, general, commercial and digital insurance operations.

Learning objectives

After studying this chapter, the learner should be able to:

1. Explain fraud risk as an enterprise-wide risk and distinguish inherent from residual risk.

2. Conduct a fraud risk assessment using likelihood, impact, velocity and control-effectiveness measures.

3. Construct a fraud risk register and interpret a risk heat map.

4. Design key risk indicators and a practical control library.

5. Classify controls as preventive, detective, responsive or recovery-oriented.

6. Evaluate governance, accountability, analytics and human judgement in fraud control.

7. Apply the framework to an insurance case and recommend proportionate action.

Fraud risk as an enterprise risk

Fraud risk is the possibility that intentional deception, concealment, misrepresentation or abuse of position will cause loss or unfair benefit. The definition includes attempted fraud, because attempted conduct may reveal vulnerabilities even when no payment has been made. Fraud risk differs from ordinary claims risk. A claim may be incorrect because of misunderstanding, documentation failure or poor service; fraud involves an intentional act or dishonest scheme. In practice, however, intent is often uncertain at the point of detection. Controls should therefore support investigation and fair decision-making rather than assume guilt from an anomaly alone.

Three distinctions are useful. Inherent fraud risk is the exposure that exists before controls are considered. A motor claims process involving cash settlements, external repairers and weak historical data may have high inherent risk. Control effectiveness is the extent to which controls are suitably designed and consistently operated. Residual fraud risk is the exposure remaining after controls operate. A high-risk process can have acceptable residual risk if controls are strong; conversely, a moderate-risk process can become unacceptable where controls are poorly designed or inconsistently applied.

Fraud risk is also dynamic. A new digital channel can increase transaction speed and scale, while a new regulatory requirement, economic shock or organised fraud technique can change the threat profile. Risk assessment must consequently be repeated after major process, product, technology or market changes, rather than treated as a one-time compliance exercise.

Mapping the insurance fraud landscape

Assessment begins with a process and scenario view. The assessor maps the customer journey and identifies points at which information, authority, money or assets change hands. Typical stages include product design, quotation, proposal, underwriting, policy issuance, premium payment, endorsement, claim notification, assessment, settlement, salvage, recovery and closure. Supporting processes such as vendor appointment, commission payment and employee access must also be included.

A fraud scenario describes the actor, method, vulnerable process, intended benefit and possible consequence. For example: “A repair network colludes with claimants to inflate invoices and divide the excess payment.” Other scenarios may involve fabricated policies, identity misuse, staged accidents, duplicate claims, non-disclosure of material facts, premium diversion by intermediaries, manipulation of medical records, internal override of claim rules, or collusive procurement.

Scenario analysis is superior to vague statements such as “claims fraud is high.” It permits a specific assessment of causes, controls, data requirements, owners and responses. It also reveals concentration risk. Several apparently separate schemes may depend on the same weak identity-verification service, employee privilege or vendor relationship.

A risk assessment method for insurers

Establishing the assessment scope

The risk owner defines the business unit, products, period, geography, systems and fraud types under review. The assessment team should include operational managers, fraud specialists, compliance, legal, internal audit, data analysts, information security and, where relevant, representatives of claims, underwriting and distribution. Independence is important: the team should challenge business assumptions without becoming detached from operational reality.

The team collects process maps, loss data, investigation outcomes, audit findings, complaints, whistleblowing reports, regulatory observations, control testing results, access logs and external intelligence. Data limitations should be recorded explicitly. A low number of detected cases may indicate low fraud, weak detection or under-reporting; it should not automatically be interpreted as low exposure.

Rating likelihood

Likelihood estimates the chance that a specified fraud scenario will occur within a defined period. A five-point scale is often practical:

• 1—Rare: exceptional circumstances are required.
• 2—Unlikely: possible but not expected in normal conditions.
• 3—Possible: could occur periodically.
• 4—Likely: expected to occur in many operating periods.
• 5—Almost certain: frequent or persistent occurrence is expected.

Ratings should use evidence where available, including frequency of suspicious events, historical confirmed cases, attempted incidents, exposure volumes, threat intelligence and control gaps. The assessment should distinguish event frequency from detection frequency. A scheme that is difficult to detect may be more serious than its recorded frequency suggests.

Rating impact

Impact includes more than direct financial loss. A balanced assessment may consider:

• direct indemnity, expense, recovery and investigation costs;
• regulatory, legal and contractual consequences;
• customer harm and denial of legitimate claims;
• operational disruption and management time;
• reputational damage and loss of trust; and
• effects on pricing, reserving, capital or solvency assumptions.

Some organisations calculate a composite impact rating; others retain separate financial, customer, regulatory and reputational ratings. The latter approach gives management greater visibility, especially where a low-value incident could create serious customer or regulatory consequences.

Incorporating velocity

Velocity measures how quickly a fraud can develop or how rapidly its consequences become difficult to contain. It is distinct from likelihood. A fraud may be unlikely but high velocity if a compromised digital account can generate thousands of transactions in hours. A five-point velocity scale can range from slow, where losses develop over months and intervention is possible, to very rapid, where losses occur before ordinary review can take place.

Velocity affects control design. High-velocity risks require real-time or near-real-time alerts, transaction limits, automated holds, rapid escalation and pre-payment intervention. Low-velocity risks may be managed through periodic reviews, reconciliations and thematic investigations. Velocity should also influence the frequency of KRI reporting and the time allowed for response.

Assessing control effectiveness

Controls must be evaluated in two dimensions. Design effectiveness asks whether the control, if properly operated, addresses the relevant risk. Operating effectiveness asks whether it actually operates as intended, at the required frequency, with appropriate evidence and follow-up.

A control may be rated strong, satisfactory, weak or ineffective, or on a numerical scale. Assessment should consider coverage, accuracy, timeliness, independence, override arrangements, data quality, documentation and management response. For example, a duplicate-claim rule may be well designed but ineffective if key identifiers are missing, alerts are ignored or staff can override results without justification.

Determining inherent and residual risk

A simple inherent risk score can be calculated as:

Inherent risk score = Likelihood × Impact

Velocity can be shown as a separate dimension or incorporated through a weighted model. For example:

Priority score = Likelihood × Impact × Velocity factor × Control weakness factor

Such formulas are decision aids, not objective truths. Multiplication can create false precision, and a very high velocity may justify urgent action even where the numerical score is moderate. Professional judgement, scenario narratives and escalation thresholds must accompany the numbers.

Residual risk is determined after considering controls. If likelihood or impact is reduced by effective controls, the residual rating may fall. Some controls mainly reduce likelihood; others reduce impact or speed of loss. A payment hold may not prevent attempted fraud but can materially reduce financial impact. The assessment should therefore state the mechanism by which each control affects risk.

The fraud risk register and heat map

The risk register is the central record of assessment and accountability. A useful register normally contains:

| Field | Purpose |

|---|---|

| Risk ID and scenario | Provides a consistent reference and describes the event clearly |

| Process, product and owner | Locates accountability |

| Causes and indicators | Explains how the risk may arise and be observed |

| Inherent likelihood, impact and velocity | Shows exposure before controls |

| Existing controls | Records preventive and detective measures |

| Control design and operating ratings | Assesses control strength |

| Residual risk | Records current exposure |

| Treatment decision | Accept, reduce, transfer or avoid |

| Action, owner and due date | Converts assessment into management action |

| Monitoring and review date | Supports ongoing oversight |

A heat map displays likelihood against impact, usually through colour bands. It is useful for board and management communication, but it should not replace the register. Two risks in the same red cell may require different actions because one is fast-moving and technologically scalable while the other is slow and readily recoverable. A heat map should therefore be supplemented by velocity, control status and risk trend.

Treatment decisions must be explicit. Reduce involves strengthening controls or changing the process. Avoid may involve withdrawing a product feature or channel. Transfer may involve contractual allocation or insurance, although transfer rarely removes reputational or regulatory responsibility. Accept is legitimate only when authorised at the appropriate level and supported by a rationale, monitoring plan and risk appetite statement.

From risk register to control library

A control library is an organised catalogue of controls linked to risks, processes, owners, systems and evidence. It prevents duplicated effort and makes testing more consistent. Each control description should state its objective, activity, frequency, responsible role, required input, evidence, exception process and escalation route.

Controls can be classified in several ways. Preventive controls operate before the event, such as identity verification, segregation of duties, underwriting rules, sanctions screening, vendor due diligence and approval limits. Detective controls identify suspicious conduct during or after an event, such as anomaly models, duplicate-claim checks, reconciliations, whistleblowing channels and post-payment reviews. Responsive controls govern what happens after an alert or allegation, including triage, evidence preservation, investigation, suspension of payment and legal referral. Recovery controls seek to contain or reverse loss through payment recovery, salvage controls, contractual recourse, restitution and lessons learned.

Other useful classifications are manual versus automated, entity-level versus transaction-level, and key versus non-key. No control classification is inherently superior. Automation can provide scale but may be undermined by poor data; manual expertise can interpret context but may be inconsistent. A resilient framework combines both.

Control design should respect segregation of duties. The person who creates a vendor should not independently approve a large payment; an investigator should not determine a claim outcome without appropriate review; and system administrators should not have unrestricted access to amend investigative evidence. Overrides are sometimes necessary, but they should be role-based, time-limited, documented and subject to review.

Key risk indicators and control indicators

Key risk indicators (KRIs) are measures that signal increasing exposure. Examples include the proportion of claims with shared bank accounts, sudden growth in claims from a location or provider, policy cancellations shortly after inception, unusually high override rates, repeated device identifiers, rapid increases in intermediary complaints, and the percentage of claims paid without required documentation.

A useful KRI has a clear definition, data owner, reporting frequency, threshold, escalation route and action. Thresholds may be green, amber and red, but they must be calibrated to product size, seasonality and legitimate business changes. A rising indicator is not proof of fraud; it is a prompt for inquiry. Excessive indicators can create alert fatigue, while poorly defined indicators can encourage gaming.

Control effectiveness indicators (CEIs) complement KRIs. They measure whether controls operate as intended: percentage of alerts reviewed within service levels, proportion of mandatory fields completed, aged unresolved alerts, override rates, successful access recertification, vendor reviews completed on time, and recovery amounts compared with eligible losses. Management needs both kinds of information: risk indicators show exposure, while control indicators show capacity to manage it.

Prevention, detection, response and recovery in practice

Prevention begins with governance and process design. Fraud risk appetite should define unacceptable behaviours, escalation expectations and tolerances for residual risk. Product and process owners should conduct fraud impact reviews before launching new products, payment mechanisms or digital features. Customer and intermediary due diligence, secure authentication, clear authority limits and staff training reduce opportunities for abuse.

Detection combines rules, analytics, intelligence and human judgement. Rules are transparent and useful for known patterns, while statistical and machine-learning models can identify complex combinations of attributes. Network analysis can expose relationships among claimants, addresses, devices, repairers, bank accounts and medical providers. Detection systems should rank alerts by risk and provide explanations sufficient for investigators and governance reviewers.

Response must be timely, proportionate and fair. An alert should be triaged according to severity, velocity, evidence quality and customer impact. Investigators preserve records, document hypotheses, test alternative explanations and maintain chain of custody. Payment suspension, where legally and operationally permissible, should be controlled and reviewed. Cases may be closed as legitimate, referred for further investigation, declined under policy terms, reported to authorities, or escalated for disciplinary action. Decisions should be supported by evidence rather than model scores alone.

Recovery includes stopping further payments, recovering overpayments, pursuing contractual rights, correcting reserves and improving controls. Recovery should not be confused with success in fraud management: a recovered amount does not compensate for customer harm or control failure. Post-incident reviews should identify root causes, update scenarios, retrain models, amend procedures and communicate lessons without disclosing sensitive investigative information.

Governance and accountability

The board or an appropriately delegated committee sets tone, risk appetite and oversight expectations. Senior management allocates resources and ensures that fraud risk is integrated with enterprise risk management. Business owners remain accountable for risks in their processes; a central fraud function provides expertise, coordination, intelligence and challenge. Compliance advises on legal and regulatory obligations, internal audit independently evaluates governance and controls, and information security addresses identity, access and cyber-enabled fraud.

The three-lines model is useful when applied carefully. The first line owns and manages risk; the second line establishes frameworks, monitors and challenges; the third line provides independent assurance. Fraud teams should not become a substitute for business ownership. Nor should internal audit conduct operational investigations in a way that compromises independence.

Ethical practice is essential. Investigations must respect privacy, due process, non-discrimination and proportionality. Data should be collected for legitimate purposes, retained appropriately and protected against unauthorised access. Automated decisions should be explainable enough to support review, and models should be tested for bias against protected or vulnerable groups. Genuine customers must have a route to challenge adverse decisions, and staff who raise concerns in good faith should be protected from retaliation.

Technology and analytics considerations

Digital insurance creates both useful evidence and new attack surfaces. Data warehouses, case-management platforms, graph databases, application programming interfaces and real-time payment monitoring can connect information that was previously fragmented. However, a sophisticated model cannot compensate for inaccurate identity data, inconsistent master records or weak governance.

Model risk should be managed through documented objectives, representative training data, validation, performance monitoring, threshold review, drift detection and human oversight. Important measures include precision, recall, false-positive rates, investigation yield and customer-impact measures. A model that identifies many alerts but produces few confirmed cases may impose excessive operational and fairness costs. Conversely, an apparently accurate model may miss new schemes because fraudsters adapt.

Emerging approaches include privacy-preserving data collaboration, graph-based entity resolution, behavioural biometrics, synthetic identity detection and continuous control monitoring. These tools should be adopted according to business value, legal permissibility, security and explainability—not technological novelty.

Illustrative case study: coordinated motor-claims fraud

Background

A fictional insurer, Meridian General, operates motor insurance through brokers and digital channels. It observes a steady increase in repair costs and bodily-injury claims. Confirmed fraud cases remain modest, and management initially assumes that inflation and repair complexity explain the trend.

Situation and problem

A quarterly assessment identifies a scenario involving claimants, a repair network and medical providers. Several claims contain overlapping phone numbers, bank accounts, vehicle locations and repair invoices. Claims are often reported shortly after policy inception, and some repairers receive a high proportion of cases from the same intermediary. The scheme has high potential impact and high velocity because digital notification permits rapid submission and automated payment recommendations.

Analysis

The team maps the claim journey and rates inherent likelihood as 4, impact as 4 and velocity as 5. Existing controls include a duplicate-claim rule and manual review of selected invoices. Design is satisfactory, but operating effectiveness is weak: the rule uses only claimant name and policy number, while bank-account and device data are not consistently captured. Analysts also observe a high override rate and no formal review of repairer concentration.

The residual risk remains high. The risk register records the scenario, assigns ownership to the claims director, and identifies data quality and vendor governance as root causes. KRIs are defined for shared bank accounts, repeated device identifiers, claims within thirty days of inception, repairer concentration and payment overrides.

Approach and solution

Meridian introduces stronger identity and entity resolution, links claimants to vehicles, devices, addresses, bank accounts and providers, and uses a graph-based alert for connected entities. High-velocity combinations receive pre-payment review. Repairers undergo enhanced due diligence, conflict declarations and periodic performance analysis. Investigators receive a documented triage procedure, while legitimate customers are protected through service-level reviews and an appeal route.

The insurer also separates model alerts from final decisions. Analysts examine contextual evidence, record alternative explanations and escalate only cases meeting defined evidential standards. Management reviews CEIs monthly, including alert ageing, override quality and the proportion of cases closed with documented rationale.

Outcome

The new framework identifies a connected cluster for investigation and prevents several questionable payments. More importantly, the assessment reveals that the original weakness was not simply claimant dishonesty; it was fragmented data, excessive reliance on a narrow rule and inadequate vendor oversight. Some alerts are cleared as legitimate, leading Meridian to refine thresholds and reduce unnecessary customer friction.

Learning points

The case demonstrates that risk assessment should focus on scenarios and relationships rather than isolated claims. Velocity changes the required response time. Control effectiveness must be tested in operation, not inferred from written procedures. Finally, analytics should support professional investigation and fair treatment rather than operate as an automatic fraud verdict.

Challenges and common mistakes

Fraud assessments often fail because they rely on confirmed losses alone, confuse unusual behaviour with fraud, or use numerical scores without definitions. Other weaknesses include assigning risk ownership to a central fraud unit while process managers remain passive; counting policies rather than exposure; ignoring attempted fraud; failing to include third parties; and allowing risk registers to become static documents.

Control proliferation is another problem. Too many overlapping rules increase cost and alert fatigue, while critical controls may lack clear owners. A control that produces large volumes of alerts without timely investigation may create a false sense of security. Conversely, excessive automation can disadvantage customers whose circumstances differ from the majority pattern.

Management should also avoid setting recovery targets that encourage investigators to pursue easy, low-value cases while complex networks remain unaddressed. Performance measures should include prevention, detection quality, timeliness, customer fairness, control improvement and learning—not only money saved.

Best-practice implementation sequence

A practical implementation sequence is to establish governance and risk appetite; map processes and fraud scenarios; gather internal and external intelligence; rate likelihood, impact and velocity; inventory and test controls; record residual risk; assign treatment actions; define KRIs and CEIs; implement technology proportionately; and review outcomes through assurance and incident learning. The cycle should be refreshed after material changes and at a frequency appropriate to the risk.

The strongest programmes share several characteristics: clear ownership, evidence-based assessment, risk-sensitive control design, timely escalation, independent challenge, reliable data, explainable analytics, protected reporting channels and a culture that values both fraud resistance and fair customer treatment.

Chapter Summary

Enterprise fraud risk assessment translates broad concern about fraud into specific scenarios, accountable owners and actionable controls. Assessors distinguish inherent risk from residual risk and evaluate likelihood, impact, velocity and control effectiveness. A risk register provides the detailed record, while a heat map communicates priorities. KRIs indicate changing exposure and control-effectiveness indicators show whether safeguards operate as intended.

An effective control framework combines prevention, detection, response and recovery. Governance allocates responsibility across the board, management, business owners, specialist functions and assurance providers. Analytics, automation and network techniques can improve detection, but they require sound data, validation, human oversight and ethical safeguards. The central managerial task is not to eliminate every risk, which is impossible, but to maintain residual risk within approved tolerance while protecting legitimate customers and continuously learning from incidents.

Key Terms

Fraud risk: The possibility of intentional deception or abuse causing loss or unfair benefit.

Inherent risk: Exposure before considering the effect of controls.

Residual risk: Exposure remaining after controls operate.

Risk appetite: The level and type of risk an organisation is willing to accept.

Likelihood: The estimated chance that a fraud scenario will occur.

Impact: The financial, customer, regulatory, operational or reputational consequence of a risk event.

Velocity: The speed at which fraud or its consequences can develop.

Risk register: A structured record of risks, controls, owners, ratings and treatment actions.

Heat map: A visual display of risk ratings, commonly using likelihood and impact axes.

Control effectiveness: The degree to which a control is suitably designed and operates as intended.

Preventive control: A control designed to stop or reduce an event before it occurs.

Detective control: A control designed to identify unusual or improper activity.

Responsive control: A control governing investigation and action after an alert or allegation.

Recovery control: A control intended to contain, reverse or recover losses.

Key risk indicator: A measure signalling changes in exposure to a defined risk.

Control-effectiveness indicator: A measure of whether a control operates reliably and on time.

Residual risk treatment: The management decision to reduce, avoid, transfer or accept risk.

Model risk: The possibility that an analytical model is unsuitable, incorrectly implemented or misused.

Segregation of duties: Separation of incompatible responsibilities to reduce abuse and error.

Entity resolution: The process of determining when records relate to the same person, organisation or object.

Review Questions

Short Answer Questions

1. Distinguish inherent fraud risk from residual fraud risk.

2. Why should velocity be assessed separately from likelihood?

3. What information should a fraud risk register contain?

4. Differentiate a key risk indicator from a control-effectiveness indicator.

5. State two ethical safeguards for analytics-based fraud detection.

Long Answer Questions

1. Explain a complete method for conducting an enterprise insurance fraud risk assessment.

2. Discuss how preventive, detective, responsive and recovery controls operate as an integrated framework.

3. Analyse the role of governance and the three-lines model in fraud risk management.

4. Explain how heat maps, risk registers and control libraries support managerial decision-making.

5. Discuss the opportunities and limitations of machine learning and network analytics in insurance fraud detection.

Analytical / Application Questions

1. An insurer has a low frequency of detected fraud but a rapidly expanding digital claims channel and frequent payment overrides. Assess the likely risk using likelihood, impact, velocity and control effectiveness, and recommend immediate actions.

2. Construct a risk-register entry for collusion between an intermediary and a medical provider to inflate health claims. Include scenario, causes, ratings, controls, KRIs and treatment.

3. A fraud model generates many alerts involving customers from one geographic community, but investigation yield is low. Analyse possible causes and propose a fair, evidence-based model-governance response.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes residual fraud risk from inherent fraud risk?

A. Residual risk is measured only after a fraud has occurred

B. Residual risk is the exposure remaining after controls are considered

C. Residual risk refers exclusively to reputational damage

D. Residual risk is always lower than the organisation’s risk appetite

Correct Answer: B. Residual risk is the exposure remaining after controls are considered

Question 2

An automated payment scheme can generate thousands of losses within a few hours. Which assessment dimension most directly captures this characteristic?

A. Impact

B. Likelihood

C. Velocity

D. Control ownership

Correct Answer: C. Velocity

Question 3

Which item is most appropriately recorded as a control-effectiveness indicator?

A. Percentage of claims with shared bank accounts

B. Number of claims reported within thirty days of inception

C. Percentage of alerts reviewed within the required service level

D. Number of suspicious devices identified

Correct Answer: C. Percentage of alerts reviewed within the required service level

Question 4

A duplicate-claim rule is well designed, but key identifiers are missing and staff routinely ignore alerts. What does this most clearly demonstrate?

A. Strong operating effectiveness

B. Weak operating effectiveness despite an apparently suitable design

C. Low inherent risk

D. Successful risk transfer

Correct Answer: B. Weak operating effectiveness despite an apparently suitable design

Question 5

Which treatment is most appropriate when management changes a process to lower the probability or effect of a fraud scenario?

A. Risk reduction

B. Risk acceptance

C. Risk avoidance only

D. Risk elimination through reporting

Correct Answer: A. Risk reduction

Question 6

Why should a heat map be supplemented by a risk register?

A. A heat map records all control evidence in detail

B. A heat map cannot display any risk prioritisation

C. The register provides ownership, causes, controls and treatment actions

D. The register replaces the need for management judgement

Correct Answer: C. The register provides ownership, causes, controls and treatment actions

Question 7

Which control is primarily preventive?

A. Post-payment thematic review

B. Whistleblowing investigation

C. Identity verification before policy issuance

D. Recovery of an overpayment

Correct Answer: C. Identity verification before policy issuance

Question 8

An insurer’s fraud model produces many alerts but very few confirmed cases. Which concern is most directly raised?

A. The model may have excessive false positives and create alert fatigue

B. The model has necessarily achieved perfect recall

C. The insurer has no need for human investigation

D. The risk must be transferred to customers

Correct Answer: A. The model may have excessive false positives and create alert fatigue

Question 9

In the illustrative motor-claims case, why was linking devices, bank accounts and providers valuable?

A. It guaranteed that every linked claimant was fraudulent

B. It supported identification of connected entities and possible collusion

C. It removed the need for data protection controls

D. It converted residual risk into zero risk

Correct Answer: B. It supported identification of connected entities and possible collusion

Question 10

Which governance practice best supports fair analytics-based fraud decisions?

A. Automatically rejecting every model-generated alert

B. Keeping model thresholds secret from all reviewers

C. Combining model output with contextual investigation, documentation and appeal

D. Measuring performance only by money recovered

Correct Answer: C. Combining model output with contextual investigation, documentation and appeal