Fraud Risk Assessment

How to run a product- and flow-level transaction fraud risk assessment: scheme inventory by money path, likelihood × impact scoring, control evaluation, residual risk, and appetite-based action.

Core components

The money path as the unit of assessment

Assess at the level where decisions happen. A money path is a specific way value enters, moves or leaves:

Money in: card funding, ACH funding, check deposit, wire in, P2P receive, ACATS in, receipt or offer submission, purchase
Money moves: trades, internal transfers, reward accrual, balance conversion
Money out: withdrawal by rail, payout to card or wallet, P2P send, reward redemption, refund, gift card cash-out, ACATS out

Use the Payment Rails Map and Customer Lifecycle Map to build the list. Product-level assessments roll up from money paths.

Steps

Diagram: 1. Scope money paths, 2. Identify schemes per path, 3. Rate inherent risk (L x I), 4. Map & test controls, 5. Rate residual risk, 6. Within appetite?, Monitor, Action plan or formal acceptance

Scope. List money paths, volumes, values and customer segments.
Identify schemes. For each path, list relevant mechanisms by actor type: third-party, first-party, organized ring, insider, victim-authorized (see the vault's mechanism notes and Mechanism to Control Matrix).
Rate inherent risk (before controls): likelihood × impact.
Map controls to each scheme, and assess design and operating effectiveness.
Rate residual risk after controls.
Compare to appetite. Act, accept or monitor.

How to build it

Rating scales (illustrative, calibrate to your organization)

Likelihood

Score	Label	Guidance
5	Almost certain	Actively seen against us now, or against close peers on the same rail
4	Likely	Seen against us in the last 12 months, or widely reported in our sector
3	Possible	Known in industry; we have the exposure; not seen recently
2	Unlikely	Plausible, but requires unusual capability or access
1	Rare	Theoretical for our product

Impact. Score the highest applicable dimension.

Score	Financial (per year, illustrative)	Customer harm	Regulatory / partner	Reputational
5	Above X% of annual fraud budget	Widespread loss of customer funds	Enforcement or partner termination likely	National press
4	Large	Significant losses to many customers	Formal partner or regulator action	Trade press, viral social
3	Moderate	Losses to some customers, remediable	Partner warning, monitoring program	Localized complaints
2	Minor	Inconvenience	Inquiry	Minimal
1	Negligible	None	None	None

Inherent risk = likelihood × impact (1–25). Bands: 15–25 high, 8–14 medium, 1–7 low.

Control effectiveness

Rating	Meaning
Strong	Designed for the scheme; tested; operating as designed; monitored with metrics
Adequate	Designed for the scheme; operating, with minor gaps; some monitoring
Weak	Partially addresses the scheme, or untested, or known gaps
None	No control specifically addresses the scheme

COSO's three-part test is a good discipline. Identify the controls tied to each inherent risk. Confirm they are implemented and working as designed. Judge whether they're adequate for the risk. Evidence for "operating as designed" can come from QA results, rule performance reviews, model monitoring, incident history and sample testing.

Residual risk

A simple matrix:

Inherent \ Control	Strong	Adequate	Weak	None
High	Medium	Medium–High	High	High
Medium	Low	Medium	Medium–High	High
Low	Low	Low	Low–Medium	Medium

Appetite and action

Residual	Default action
High	Action plan with owner and date; or formal acceptance by the executive risk owner, with rationale and a review date
Medium	Action plan or acceptance; monitor KRIs
Low	Monitor; reassess at the next cycle

Express appetite in measurable terms where possible: net loss bps by money path, maximum single-event exposure, maximum good-customer friction rate. See Fraud Metrics and KPIs.

Cadence and triggers

Annual full refresh across all money paths
Triggered reassessment when there is:
- A new product, rail, payout method or promo type (see New Product and Promo Launch Review)
- A material incident (see Fraud Incident Response)
- A significant intel item affecting a money path (see Threat Intelligence and Horizon Scanning)
- A major control change (e.g., vendor swap, model replacement)
- A regulatory or network rule change

Who does what

Step	Fraud strategy	Product owner	Fraud ops	Analytics	Compliance / 2L	Exec risk owner
Scope	A/R	C		C	C	I
Scheme identification	A/R	C	R	C	C
Likelihood and impact	A/R	C	C	R	C (challenge)
Control mapping and testing	A/R	C	R	R	C
Residual rating	A/R	C			C (challenge)	I
Acceptance of residual risk	C	R			C	A
Action plans	A	R	R	R	I	I

Artifacts and templates

Risk register columns (copy)

Column	Example
Risk ID	FRA-WD-03
Money path	Withdrawals: instant push-to-card
Mechanism	Payout Redirection following Account Takeover (ATO)
Actor	Third-party
Scenario	Attacker gains account access, adds a new debit card, withdraws the balance instantly
Likelihood (1–5)	4
Impact (1–5)	4
Inherent	16 (high)
Controls	Step-up on new payout instrument; cooling-off after contact change; withdrawal scoring
Control rating	Adequate
Evidence	Rule review Q3; QA results; incident history
Residual	Medium–High
Appetite status	Outside appetite
Action / acceptance	Add a hold on first push-to-card withdrawal to a new instrument for accounts with recent changes; owner; date
KRIs	Loss bps on instant withdrawals; share of withdrawals within N days of a contact change
Next review	Date

Scheme identification prompts per money path

Who could misuse it: outsider with stolen credentials or instruments, the account holder, a ring, an employee, a deceived customer?
What reversibility gap exists between when we give value and when inbound funds are final?
What multiplies: accounts, devices, instruments, identities, referrals, receipts?
What changes right before money-out: contact details, devices, payout destinations?
What can support override?
What has happened to peers on the same rail or product type?

Assessment report outline

Scope and method
Heat map: residual risk by money path × mechanism
Top 10 residual risks with actions or acceptances
Changes since the last assessment
Control gaps by family (see Controls Index)
Emerging risks to watch
Sign-offs

Metrics

Metric	Why
Money paths with a current assessment (within 12 months)	Coverage
High residual risks without an action plan or acceptance	Governance gap
Action plans past due	Execution
Incidents on risks rated low	Calibration check: was the assessment wrong?
Time from trigger to reassessment	Responsiveness

Pitfalls

Company-level ratings. "Fraud risk: medium" is useless. Assess money paths.
Inherent risk inflated to justify budget, or deflated to avoid work. Calibrate with a second reviewer (see Three Lines of Defense).
Control ratings without evidence. "We have a rule" isn't "the rule works." Use QA and performance data.
Ignoring first-party and victim-authorized actors. Many assessments only model outside attackers.
The annual binder. The risk register goes unopened between refreshes. Connect it to launch review and intel triggers.
Acceptance without a name. Every accepted residual risk needs an owner senior enough to own it, and a review date.

Sources and further reading

COSO/ACFE Fraud Risk Management Guide, 2nd ed., Executive Summary (2023): the risk assessment principle and the three-step evaluation of control effectiveness that identifies residual risk
Forvis Mazars, How to Think About Fraud Risks and What to Do About Them (2023): likelihood and significance as the two assessment factors; action steps for control gaps
GAO-15-593SP Highlights: fraud risk tolerance, the fraud risk profile and prioritizing residual risks
PRAC, Blueprint for Enhanced Program Integrity, Chapter 3: assessing fraud risk before launch, ranking inherent risks, documenting risk tolerance
IIA press release on the COSO Fraud Risk Management Guide 2nd ed. (May 2023): updates on data analytics and the relationship to COSO internal control and ERM