# How We Deliver a SAMA CRFR Assessment in Six Weeks: Discovery to Control-Gap Register
When the Saudi Central Bank (SAMA) published its Counter-Fraud and Cybercrime Resilience Framework, it set a clear expectation: regulated financial institutions must establish comprehensive fraud-prevention, detection, investigation and reporting capabilities. For chief financial officers, chief risk officers and compliance directors at banks, payment firms and finance companies, the immediate question is not whether to comply but how to measure current posture, identify gaps, and build a defensible remediation plan. A SAMA counter fraud framework assessment provides that baseline—and when structured correctly, it delivers a board-ready control-gap register in six weeks.
This article walks through our six-week SAMA CRFR compliance-assessment method. You will see what happens each week, the evidence we request, the workshops we conduct, the client stakeholders involved, and the deliverables you hold at the end. The result is a prioritised gap register, remediation roadmap, and evidence package ready for board presentation and examiner discussion.
Why Six Weeks
SAMA CRFR spans governance, risk assessment, prevention controls, detection systems, investigation procedures, reporting obligations, and training. A thorough assessment must review policy documents, interview process owners, test control evidence, and validate that fraud-risk methodology aligns with the institution's business model and threat landscape. Six weeks provides sufficient time to conduct this work without disrupting operations, while maintaining momentum and stakeholder engagement. Each week focuses on a distinct CRFR domain, allowing compliance and risk teams to prepare evidence in manageable increments.
Week One: Governance and Policy Review
The first week establishes the governance foundation. SAMA CRFR requires a documented fraud-risk-management framework, clear roles and responsibilities, board and senior-management oversight, and policies that define acceptable behaviour and consequences. We begin by reviewing the institution's fraud-risk-management policy, code of conduct, whistleblower policy, and any board or executive committee charters that assign fraud-oversight duties.
Client participants: Chief risk officer, head of compliance, head of internal audit, and the fraud-risk manager (if appointed).
Evidence requested:
- Fraud-risk-management policy and supporting procedures
- Board and executive committee charters
- Organisational charts showing fraud-risk ownership
- Minutes from the most recent board risk-committee meetings where fraud was discussed
- Whistleblower and incident-escalation policies
Workshop: A half-day governance workshop with the CRO and compliance director to map current governance structure against CRFR requirements, confirm escalation paths, and identify any gaps in board reporting or executive accountability.
Deliverable at week end: A governance-gap summary noting missing policies, unclear accountabilities, or insufficient board oversight, with preliminary recommendations.
Week Two: Fraud-Risk-Assessment Methodology
SAMA CRFR mandates a documented, repeatable fraud-risk-assessment process that identifies fraud scenarios relevant to the institution's products, channels and customer segments, evaluates inherent and residual risk, and informs control design. Week two examines whether the institution has conducted a fraud-risk assessment, how scenarios are identified, how likelihood and impact are scored, and whether the assessment is refreshed periodically.
Client participants: Fraud-risk manager, product owners, channel managers (digital banking, cards, payments), and the enterprise-risk team.
Evidence requested:
- Most recent fraud-risk assessment and supporting methodology
- Fraud scenario library or risk register
- Risk-rating criteria (likelihood and impact scales)
- Evidence of annual or event-driven assessment updates
- Link between fraud-risk assessment and control design
Workshop: A full-day risk-assessment workshop where we walk through the institution's fraud scenarios—account takeover, payment fraud, loan fraud, insider fraud—and validate that the methodology captures emerging threats (social engineering, synthetic identity, authorised push payment fraud) and assigns risk ratings that reflect actual exposure.
Deliverable at week end: A fraud-risk-assessment gap analysis highlighting missing scenarios, outdated ratings, or insufficient linkage between risk and controls, plus a recommended scenario library template.
Week Three: Prevention and Detection Controls
Week three shifts to the control environment. SAMA CRFR requires layered fraud-prevention and detection controls: customer due diligence, transaction monitoring, behavioural analytics, device fingerprinting, velocity checks, and segregation of duties. We review control design, test a sample of control evidence, and assess whether monitoring rules are tuned to the institution's risk appetite.
Client participants: Fraud operations manager, transaction-monitoring team, IT security, digital-banking product owner, and card operations.
Evidence requested:
- Transaction-monitoring rules and thresholds
- Alert volumes and dispositioning records for the past quarter
- Customer authentication policies (multi-factor authentication, step-up authentication)
- Device and behavioural analytics configurations
- Segregation-of-duties matrices for payment initiation and approval
- Vendor contracts and service-level agreements for fraud-detection platforms
Workshop: A two-day control-testing workshop. Day one covers prevention controls (authentication, authorisation, segregation). Day two examines detection controls: we review a sample of transaction-monitoring alerts, trace dispositioning decisions, and assess false-positive rates and investigator workload.
Deliverable at week end: A prevention-and-detection control inventory with a gap register noting missing controls (for example, no behavioural analytics for digital channels), misconfigured rules (thresholds set too high), or insufficient alert investigation.
Week Four: Investigation and Reporting Processes
SAMA CRFR requires documented investigation procedures, evidence preservation, timely reporting to SAMA and law enforcement, and recovery efforts. Week four reviews the institution's fraud-investigation playbook, case-management system, evidence-handling protocols, and reporting timelines.
Client participants: Head of fraud investigations, legal counsel, compliance officer responsible for regulatory reporting, and IT forensics (if available).
Evidence requested:
- Fraud-investigation procedures and case-management workflow
- Sample closed investigation case files (sanitised)
- Evidence-preservation and chain-of-custody protocols
- Regulatory reporting log (SAMA notifications, SAFEA referrals)
- Recovery and write-off records
Workshop: A half-day investigation-process workshop where we walk through a recent case from alert to closure, examining how evidence was collected, how root cause was determined, whether the case was reported to SAMA within required timelines, and what corrective actions were taken.
Deliverable at week end: An investigation-and-reporting gap summary identifying procedural weaknesses (for example, no standard interview template, unclear escalation criteria, late regulatory notifications) and recommending process improvements and training.
Week Five: Training and Awareness Verification
SAMA CRFR mandates fraud-awareness training for all staff, specialised training for fraud-risk and investigation teams, and periodic refreshers. Week five verifies that training programs exist, that attendance is tracked, that content is current, and that effectiveness is measured.
Client participants: Head of human resources, learning and development manager, fraud-risk manager, and compliance training coordinator.
Evidence requested:
- Fraud-awareness training curriculum and materials
- Training attendance records and completion rates
- Specialised training for investigators (interview techniques, evidence handling, legal considerations)
- Phishing-simulation or social-engineering test results
- Training-effectiveness assessments (quizzes, post-training surveys)
Workshop: A half-day training-verification session where we review course content against CRFR requirements, examine attendance records, and assess whether training is tailored to role (frontline staff receive different content than investigators or senior management).
Deliverable at week end: A training-gap summary noting missing curricula, low completion rates, outdated materials, or lack of effectiveness measurement, with recommendations for role-based training paths and annual refresh schedules.
Week Six: Gap Prioritisation and Remediation Roadmap
The final week consolidates findings from weeks one through five, prioritises gaps by regulatory risk and implementation effort, and builds a remediation roadmap. We classify each gap as high, medium or low priority based on CRFR criticality, examiner focus areas, and the institution's risk appetite. For each gap, we propose a remediation action, assign an owner, estimate effort, and sequence initiatives into a twelve-month roadmap.
Client participants: Chief risk officer, chief financial officer, head of compliance, fraud-risk manager, and project-management office (if available).
Workshop: A full-day prioritisation workshop where we present the consolidated gap register, discuss remediation options, and agree on priorities and timelines. We also prepare the executive summary and board presentation deck.
Deliverable at week end: The complete assessment package.
What You Receive at the End of Six Weeks
At the conclusion of the engagement, you hold:
- Executive summary suitable for board and senior-management presentation, summarising CRFR compliance posture, high-priority gaps, and recommended next steps.
- Control-gap register listing every identified gap, mapped to the relevant CRFR requirement, classified by priority, with proposed remediation action, owner, and estimated timeline.
- Governance-gap summary from week one, detailing policy and oversight deficiencies.
- Fraud-risk-assessment gap analysis from week two, including a recommended scenario library.
- Prevention-and-detection control inventory from week three, with configuration and tuning recommendations.
- Investigation-and-reporting gap summary from week four, with process-improvement recommendations.
- Training-gap summary from week five, with role-based curriculum recommendations.
- Twelve-month remediation roadmap sequencing initiatives by priority and dependency, ready for project-office execution.
- Evidence index cataloguing all documents reviewed, interviews conducted, and controls tested, providing audit trail for examiners.
This package serves three audiences: the board receives assurance and a clear remediation plan; compliance and risk teams have a detailed work program; and examiners see a structured, evidence-based assessment that demonstrates management's commitment to CRFR compliance.
How This Fits Into Ongoing Compliance Management
A six-week SAMA CRFR assessment establishes your baseline. The control-gap register and remediation roadmap define the work ahead. Executing that roadmap—prioritising gaps, coordinating owners, implementing controls, and building closure evidence—requires sustained program management. Our GRC Advisory retainer provides ongoing governance, risk and compliance expertise to support your team as you close findings, respond to regulatory change, and prepare for examiner visits. Monthly advisory hours, regulatory change briefings, and compliance posture tracking ensure that the momentum from the assessment translates into measurable progress.
For institutions that emerge from the assessment with a substantial remediation backlog, a formal remediation program brings structure and accountability: we prioritise gaps, coordinate owners, implement controls, and build the evidence that closes each finding, from findings to closure with evidence a reviewer will accept.
Whether you are planning your first SAMA counter fraud framework assessment or preparing for an examiner visit, a structured six-week engagement delivers the clarity, evidence and roadmap you need. The result is not a report that sits on a shelf, but a working control-gap register and remediation plan that your board, your examiners, and your risk team can rely on.
