# Fraud Assessment Method: The Four-Week Discovery Sprint That Maps Thirty-Two Attack Scenarios to Product Lines Before You Score a Single Control
Most fraud risk assessment methodology exercises begin with a spreadsheet of controls lifted from a regulatory framework. Teams work through the list, marking each control as implemented, partially implemented or missing, and the result is a gap analysis that tells you which policies to write and which systems to deploy. What it does not tell you is where fraud can actually hit you.
The problem is not the framework. The Saudi Central Bank's Counter-Fraud Framework is comprehensive and well-structured. The problem is sequence. If you score controls before you map threats, you cannot distinguish between a gap that exposes your instant payment channel to account takeover and a gap that affects a dormant product line with ten customers. Both appear as red cells in the same spreadsheet, and both receive the same remediation priority.
A fraud assessment that begins with discovery inverts the sequence. Before you score a single control, you interview product owners, channel managers, operations teams and fraud analysts to build a threat library of thirty-two attack scenarios—internal collusion, account takeover, payment diversion, claims inflation, identity fabrication, refund abuse—mapped to every product line and customer segment. You walk through the customer journey for retail cards, corporate accounts, mada transactions, SARIE transfers, instant payments and digital onboarding. You document where money moves, where approvals happen, where exceptions are granted, and where a motivated insider or external attacker can intervene.
Only then do you score inherent risk, test key controls, calculate residual risk, and map gaps to the SAMA Counter-Fraud Framework. The result is a fraud risk register that tells you exactly which gaps create real exposure and which are theoretical.
This article explains how the assessment is delivered, phase by phase, over four to six weeks.
Phase One: Scope
The assessment begins with a scoping workshop that agrees which products, channels and processes will be examined. This is not a formality. Fraud risk varies sharply by product line, customer segment and transaction type, and a meaningful assessment must draw boundaries that reflect how the institution is actually organized.
The scoping discussion covers retail banking products—current accounts, savings accounts, credit cards, personal loans—and their digital and branch channels. It covers corporate and commercial banking products, including trade finance, letters of credit and corporate cards. It covers payment channels: mada point-of-sale and e-commerce, SARIE transfers, instant payments, bill payments, mobile wallets. It covers account opening and onboarding, whether digital, branch-assisted or remote. It covers claims and disputes, refunds, chargebacks and exception handling.
For each product and channel, the scoping workshop identifies the business owner, the operations manager responsible for processing, the IT system or platform that supports it, and the fraud detection or transaction monitoring controls currently in place. The workshop also identifies any products or channels that are out of scope—legacy systems being decommissioned, pilot services not yet launched, or third-party-managed operations where fraud risk is contractually transferred.
At the end of this phase, the client holds a signed scope document that lists every product, channel and process to be assessed, the business and operations contacts for each, and the timeline for interviews and walkthroughs.
Phase Two: Discover
Discovery is the longest and most important phase. It is where the threat library is built. Over two to three weeks, the assessment team conducts interviews with business, operations and IT stakeholders, walks through end-to-end processes, and reviews documentation, system configurations and historical fraud cases.
Each product line receives a structured interview with its business owner and operations manager. The interview covers the customer journey from onboarding to transaction to dispute. It covers approval workflows, exception processes, manual overrides and segregation of duties. It covers the types of customers served—retail, high-net-worth, small business, corporate—and the risk profile of each segment. It covers transaction limits, velocity rules, geographic restrictions and authentication requirements.
The interview also covers known fraud scenarios. Has the product line experienced account takeover? Payment diversion? Identity theft? Refund fraud? What was the attack vector? How was it detected? What control failed? The answers populate the threat library with real scenarios, not hypothetical ones.
Channel managers are interviewed separately. For digital channels—mobile banking, internet banking, API-based services—the interview covers authentication methods, session management, device fingerprinting, behavioral analytics and bot detection. For branch channels, it covers teller authority limits, dual control requirements, cash handling procedures and video surveillance. For card channels, it covers EMV compliance, 3D Secure implementation, velocity monitoring and card-not-present controls.
Operations teams are interviewed to understand processing workflows, exception queues, manual intervention points and reconciliation procedures. Where does a transaction leave the automated straight-through processing path? Who can approve an exception? What documentation is required? How is segregation of duties enforced? These are the points where internal fraud and collusion occur.
IT teams are interviewed to understand system architecture, access controls, logging and monitoring. Who has privileged access to core banking systems, payment switches and fraud detection platforms? How are access rights provisioned and reviewed? Are database changes logged? Are API calls authenticated and rate-limited?
The assessment team also reviews documentation: fraud policies, transaction monitoring rules, investigation procedures, staff codes of conduct, whistleblower mechanisms, and fraud awareness training materials. Where fraud cases have been investigated, the team reviews case files to understand attack methods, detection lag and control failures.
By the end of discovery, the assessment team has documented thirty-two distinct attack scenarios across the institution's product lines and channels. Each scenario is described in plain language: the attacker's objective, the entry point, the steps of the attack, the control that should prevent or detect it, and the potential financial and reputational impact. Each scenario is mapped to the specific products, channels and customer segments it affects.
At the end of this phase, the client holds a draft threat library and a complete picture of how fraud can occur across the enterprise.
Phase Three: Assess
Assessment is where inherent risk is scored, controls are tested, and residual risk is calculated. For each of the thirty-two attack scenarios, the assessment team scores inherent risk based on likelihood and impact. Likelihood considers the attractiveness of the target, the skill required to execute the attack, the availability of tools or insider access, and the institution's historical experience. Impact considers direct financial loss, regulatory penalties, reputational damage and customer attrition.
Once inherent risk is scored, the team tests the key controls that are supposed to prevent or detect the scenario. Testing is not a tick-box exercise. For a transaction monitoring rule, the team reviews the rule logic, examines recent alerts, and checks whether exceptions are investigated. For a segregation-of-duties control, the team reviews user access rights and tests whether a single user can initiate and approve a high-risk transaction. For an authentication control, the team reviews configuration settings, examines bypass mechanisms, and checks whether step-up authentication is enforced for sensitive operations.
Where a control is found to be effective, residual risk is reduced. Where a control is absent, misconfigured or not enforced, residual risk remains close to inherent risk. The gap between inherent and residual risk becomes the basis for prioritization.
Every risk and control is mapped to the SAMA Counter-Fraud Framework. The framework organizes counter-fraud capabilities into governance, risk assessment, prevention, detection, investigation, reporting and awareness. Each attack scenario is linked to the framework controls that should address it, and each control gap is linked to the framework requirement it violates. This mapping ensures that the assessment can support regulatory submissions and counter-fraud audits.
At the end of this phase, the client holds a fraud risk register with inherent and residual risk scores for every scenario, and a control gap analysis mapped to the SAMA Counter-Fraud Framework.
Phase Four: Report
The final phase consolidates findings into a fraud risk assessment report. The report opens with an executive summary that highlights the highest residual risks and the most critical control gaps. It presents the fraud risk register, organized by product line and channel, with each scenario described, scored and mapped to controls. It presents the control gap analysis, organized by SAMA Counter-Fraud Framework domain, with each gap linked to the scenarios it affects.
The report includes a prioritized remediation plan. Remediation actions are ranked by the residual risk they address, the effort required to implement them, and their alignment with regulatory expectations. High-priority actions address scenarios with high residual risk and can be implemented quickly—reconfiguring a transaction monitoring rule, enforcing an existing approval workflow, or closing a privileged access loophole. Medium-priority actions address moderate risks or require longer implementation—deploying behavioral analytics, redesigning an exception process, or enhancing fraud awareness training. Low-priority actions address theoretical risks or require significant investment.
The report is designed to be actionable. Each remediation action specifies the control to be implemented, the framework requirement it satisfies, the business owner responsible, the estimated effort, and the expected reduction in residual risk. The report can be presented to executive management, submitted to internal audit, or shared with the Saudi Central Bank as evidence of a structured counter-fraud program.
At the end of this phase, the client holds a fraud risk assessment report, a fraud risk register, a control gap analysis, and a prioritized remediation plan.
Deliverables
The fraud assessment produces four core deliverables:
- Fraud risk assessment report — A comprehensive document that presents the methodology, findings, risk scores and recommendations, organized by product line and channel and mapped to the SAMA Counter-Fraud Framework.
- Fraud risk register — A structured register of thirty-two attack scenarios, each with a description, inherent risk score, residual risk score, affected products and channels, and mapped controls.
- Control gap analysis — A detailed analysis of control gaps organized by SAMA Counter-Fraud Framework domain, with each gap linked to the scenarios it affects and the framework requirement it violates.
- Prioritized remediation plan — A ranked list of remediation actions, each specifying the control to be implemented, the business owner, the estimated effort, and the expected risk reduction.
How This Assessment Supports Your Counter-Fraud Program
An enterprise-wide assessment of internal and external fraud risk across products, channels and processes, scored against the SAMA Counter-Fraud Framework, gives you a clear picture of where fraud can hit you before it does. The four-week discovery sprint ensures that the threat library reflects your actual products, channels and customer segments, not a generic checklist. The inherent and residual risk scoring ensures that remediation priorities are driven by real exposure, not regulatory box-ticking. The mapping to the SAMA Counter-Fraud Framework ensures that the assessment supports your regulatory submissions and counter-fraud audits.
If you are planning a SAMA Counter-Fraud Framework assessment or preparing for a counter-fraud audit, this is how the work is done.
