A fraud risk assessment is the document every other anti-fraud measure depends on, yet many organisations still hold one that is little more than a list of headings with “medium” scores. This article explains how to write one that works, and gives a fraud risk assessment template structure you can adapt: the register columns, likelihood and impact scales, and a worked example. It draws on the COSO/ACFE Fraud Risk Management Guide, the Government Counter Fraud Profession’s standards for fraud risk assessment, and the Home Office guidance on the failure to prevent fraud offence, with notes for charities and not-for-profit organisations throughout.
The timing matters. Since 1 September 2025, large organisations have been exposed to the failure to prevent fraud offence, and the Home Office guidance states that it will rarely be considered reasonable not to have even conducted a risk assessment.12 We explain the offence in our practical guide to failure to prevent fraud. For charities in England and Wales, the Charity Commission’s guidance, updated in November 2024, already advises trustees to identify their fraud risks, act to reduce them and check that those actions are working.3
What a fraud risk assessment is for
The COSO/ACFE Fraud Risk Management Guide sets out the purpose clearly in its second principle: the organisation performs comprehensive fraud risk assessments “to identify specific fraud schemes and risks, assess their likelihood and significance, evaluate existing fraud control activities, and implement actions to mitigate residual fraud risks”.4 The guide describes the assessment as a dynamic and iterative process, and it covers fraudulent financial reporting, fraudulent non-financial reporting, asset misappropriation and corruption.4
In practice, a good assessment does four jobs. It tells the board or trustees where the organisation is most exposed. It shows management which controls matter most, so that testing and investment go to the right places. It gives internal audit a basis for planning. And it provides evidence that the organisation took its fraud risks seriously, which is central to the reasonable procedures defence explained in our article on failure to prevent fraud reasonable procedures.
An assessment written today needs to look in two directions. The traditional direction is fraud against the organisation: payment diversion, false invoices, payroll fraud, theft of donations. The second, which the new offence has brought into focus, is fraud committed by people acting for the organisation and intended to benefit it, such as misleading a funder, a customer or a regulator. The offence applies across all sectors, and the Home Office guidance notes that some charities are incorporated and would be in scope if they meet the size test.1 Even where the offence does not apply, the same risks threaten funding, reputation and trustees’ duties.
Identifying fraud schemes relevant to your organisation
The Government Counter Fraud Profession’s standards describe a six-step process: understanding the organisation and its environment; researching known risks and the factors that drive them; identifying, categorising and defining known and hypothetical risks; identifying risk owners and evaluating inherent risk; identifying controls and evaluating residual risk; and prioritising residual risks against appetite.5 The standards were written for central government, but the sequence works for any organisation.
Start with how the organisation actually operates: income streams, payment flows, who acts on its behalf, and where people have discretion with little oversight. Then gather evidence rather than relying on opinion. Useful sources include incident and loss records, whistleblowing reports, internal and external audit findings, complaints, funder and regulator correspondence, and sector alerts. The Charity Commission identifies fraud connected with fundraising, banking, cyber crime, tax and Gift Aid, property and investments, and charities’ identities as common forms in the sector, and notes that it can come from inside, from employees and volunteers, or from outside.3
The fraud triangle is the most useful prompt for workshops. The Home Office guidance uses it directly, asking where there is opportunity (weak or weakened controls, minimal oversight, staff turnover, new technology), motive (targets, bonuses, financial pressure, funding deadlines, time pressure) and rationalisation (a culture that tolerates fraud that appears to win work, or makes it hard to speak up).1 For charities, funding deadlines and pressure to show results to funders deserve particular attention under motive.
Describe each risk precisely. The government standards suggest the form “there is a risk that [event] because [why and how it could happen] leading to [consequence]”, and also refer to an actor, action and outcome model: who commits the fraud, what they do, and the result.5 “Procurement fraud” is a category, not a risk. “A budget holder colludes with a supplier to approve invoices for services not delivered, because one person can raise and approve orders below the tender threshold, leading to financial loss” is a risk you can assess and control.
Rating likelihood and impact
Assess each risk twice. Inherent risk is the exposure before controls; residual risk is what remains once existing controls are taken into account. The Home Office guidance expects inherent risks to be classified by likelihood and impact, with reasons.1 The government standards go further, scoring residual risk on a one to five scale for likelihood and impact, and splitting each into two elements: likelihood covers whether the fraud will occur and how often, and impact covers how long it could go undetected and how material it would be, including reputational harm. The two averages are multiplied to give a score from 1 to 25, banded as priority 1 (16 to 25), priority 2 (9 to 15), priority 3 (5 to 8) and priority 4 (1 to 4).5
The scales below follow that structure in simplified form. The descriptors are examples; set monetary thresholds for your own organisation, for instance relative to income or reserves, and have them approved by the board or trustees.
| Score | Likelihood (example descriptor) | Impact (example descriptor) |
|---|---|---|
| 1 | Unlikely to occur; no known history in the organisation or sector | Minor loss within tolerance; no external visibility; prevented or detected immediately |
| 2 | Could occur occasionally; isolated sector precedents | Small loss; limited internal disruption; detected within the normal reporting cycle |
| 3 | Plausible; has occurred in similar organisations or near misses here | Moderate loss; funder, customer or regulator concern; could go undetected for months |
| 4 | Likely; conditions exist and attempts have been seen | Significant loss; repayment demands, regulatory reporting or adverse media |
| 5 | Expected to occur, possibly repeatedly | Severe loss; threat to funding, licence, operations or public trust; could remain undetected |
Whatever scale you use, write down why each score was chosen. A score with no rationale cannot be challenged or defended, and the government standards specifically call for a narrative explaining each score.5
Mapping existing controls
For each risk, list the controls that address it and be honest about how well they work. The government standards distinguish directive, deterrent, preventative, detective and corrective controls, and note that only preventative and detective controls actually mitigate a risk by stopping or finding fraud. They ask assessors to evaluate each control’s effectiveness, limitations and weaknesses, and to describe residual risk as a narrative of how fraud could still occur, not just a label.5 COSO makes a related point: fraud control activities should be documented with the risk they address, the control designed to mitigate it and who is responsible.4
Three disciplines make this step credible:
- Distinguish design from operation. A policy requiring two signatories is a design. Evidence that both signatories reviewed supporting documents before approving is operation.
- Test the key controls. Agree which controls will be tested as part of the assurance plan, and record the results against the risk.5 An internal controls review can provide this independently.
- Consider override. COSO highlights the board’s role in assessing the risk of management override of controls.4 Ask how each control could be bypassed by someone senior.
Control gaps are common. The Association of Certified Fraud Examiners reported that more than half of the occupational frauds in its 2024 study occurred because of a lack of internal controls or the override of existing controls.6
Fraud risk assessment template structure
The register below is a practical fraud risk assessment template. It combines the elements the government standards expect a fraud risk register to capture, including a unique reference, the risk description, inherent and residual scores, controls and their effectiveness, and a risk owner, with columns that link the assessment to the failure to prevent fraud offence.5 Keep it in a spreadsheet or your risk system, but keep every column populated.
| Column | What to record |
|---|---|
| Reference | Unique identifier, for example by business area |
| Process or area | Where the risk sits: grants, fundraising, procurement, payroll, sales, regulatory reporting |
| Risk statement | “There is a risk that… because… leading to…”, naming the actor, action and outcome |
| Direction | Fraud against the organisation, or fraud by an associated person intended to benefit it |
| Associated person type | Employee, volunteer, agent, contractor, subsidiary, delivery partner |
| Relevant offence | For example fraud by false representation, false accounting, cheating the public revenue |
| Fraud triangle drivers | The specific opportunity, motive and rationalisation factors |
| Inherent likelihood, impact and score | Scores with a short rationale |
| Existing controls | Each control, its type (preventative or detective) and its owner |
| Control evidence and test result | How operation is evidenced; date and outcome of the latest test |
| Residual likelihood, impact and score | Scores with a narrative of how fraud could still occur |
| Priority and appetite | Priority band and whether the residual risk is within appetite |
| Risk owner | A named person senior enough to change controls |
| Response and actions | Actions, action owners and due dates; any decision to accept the risk, with who approved it |
| Review date | Date last reviewed and next review due |
Worked example (illustrative only)
The example below shows one generic scenario completed in the template. It is invented for illustration, does not describe any real organisation, and its scores are not benchmarks.
| Column | Illustrative entry |
|---|---|
| Reference | GR-03 |
| Process or area | Restricted grant reporting to funders |
| Risk statement | There is a risk that a programme manager reports costs to a funder that were not incurred on the funded project, because the same person prepares the cost schedule and the narrative report with limited finance review, leading to the organisation retaining funds it should return, repayment demands and damage to funder relationships |
| Direction | Fraud by an associated person intended to benefit the organisation |
| Associated person type | Employee |
| Relevant offence | Fraud by false representation; false accounting |
| Fraud triangle drivers | Opportunity: limited segregation of duties. Motive: fear of clawback and pressure to show full spend. Rationalisation: “the money is still going to good causes” |
| Inherent score | Likelihood 3 × impact 4 = 12 (priority 2) |
| Existing controls | Finance reconciles grant reports to the ledger before submission (preventative); quarterly budget-to-actual review by the finance lead (detective) |
| Control evidence and test result | Reconciliation sign-off on file; sample testing found two reports submitted before reconciliation was completed |
| Residual score | Likelihood 2 × impact 4 = 8 (priority 3). Fraud could still occur where reports are submitted late in the reporting window and reconciliation is skipped |
| Priority and appetite | Above appetite for funder-facing reporting |
| Risk owner | Director of finance |
| Response and actions | Block submission without recorded finance sign-off; add grant reporting to training for programme staff; include in next year’s internal audit plan |
| Review date | Reviewed at the annual assessment; next review in 12 months or after any funder query |
Keeping the assessment current
A fraud risk assessment goes stale quickly. The Charity Commission advises trustees to review their charity’s fraud risks once a year, or after a fraud or attempted fraud, to discuss fraud risks with the organisations they work with or fund, and to report on risks and how they are managed in the trustees’ annual report.3 The Home Office guidance says assessments are typically carried out annually or once every two years, and that external factors may trigger an earlier or partial review.1 The government standards treat every fraud risk assessment as a living, date-stamped document.5
Triggers for an interim review include:
- a fraud, attempted fraud or significant whistleblowing report;
- a new income stream, funder, programme, market or delivery partner;
- a restructure, merger, system change or loss of key finance staff;
- new incentive schemes, targets or funding conditions;
- internal audit findings or control test failures in a high-risk area.
Report the results properly. The board, audit committee or trustees should see the priority risks, the residual position against appetite, overdue actions and changes since the last review, not the full register. Assign each priority risk to a named owner, track actions to completion, and record decisions to accept a risk and who made them, as the Home Office guidance expects.1 Finally, adopt and promote an anti-fraud policy and a fraud response plan, as the Charity Commission recommends, so that people know what to do when the assessment’s risks materialise.3
How we can help
Our fraud risk management service builds and refreshes fraud risk assessments using the structure above, including the failure to prevent fraud perspective, and our internal controls reviews test whether the key controls in your register work in practice. We work with charities and not-for-profit organisations as well as companies and public bodies. To discuss your assessment, book a free 20-minute call.
This article is general guidance, not legal advice. Take advice on your organisation’s specific circumstances.
Frequently asked questions
What should a fraud risk assessment template include?
At minimum it should include a unique reference, a precise risk statement naming the actor, action and outcome, inherent and residual likelihood and impact scores with reasons, the existing controls and evidence that they work, a risk owner, and actions with owners and dates. Adding columns for the fraud triangle drivers and for whether the fraud would benefit the organisation links the assessment to the failure to prevent fraud offence.
How often should a fraud risk assessment be reviewed?
The Charity Commission advises trustees to review fraud risks once a year, or after a fraud or attempted fraud. The Home Office guidance on failure to prevent fraud says assessments are typically repeated annually or every two years, with earlier reviews when circumstances change. Treat the assessment as a living document and date-stamp each review.
What is the difference between inherent and residual fraud risk?
Inherent risk is the exposure to a fraud before any controls are taken into account. Residual risk is what remains after existing controls are considered. Comparing the two shows how much the controls are doing, and the residual risk should be compared with the organisation's risk appetite to decide whether further action is needed.
References
- Home Office, 6 November 2024. Economic Crime and Corporate Transparency Act 2023: guidance to organisations on the offence of failure to prevent fraud
- legislation.gov.uk (The National Archives), 13 March 2025. The Economic Crime and Corporate Transparency Act 2023 (Commencement No. 4) Regulations 2025 (SI 2025/349)
- The Charity Commission, 27 November 2024. Protect your charity from fraud (part of Internal financial controls for charities: protect your charity from fraud and loss (CC8))
- COSO and the Association of Certified Fraud Examiners, March 2023. Fraud Risk Management Guide, Second Edition: Executive Summary
- Public Sector Fraud Authority (Government Counter Fraud Profession), 27 January 2022 (updated 5 February 2025). Professional standards and guidance for fraud risk assessment in government
- Association of Certified Fraud Examiners, March 2024. The ACFE Releases Occupational Fraud 2024: A Report to the Nations
