Every year, the audit committee receives the counter-fraud annual report and is asked to approve it. Most such reports describe what happened: the number of cases, the losses, the investigations closed. Far fewer test whether the fraud risk assessment behind the program still reflects the institution's actual exposure. That gap is where compliance theater lives.
This article offers a practical ISO 37001 fraud risk assessment audit committee checklist of three questions. ISO 37001 is an anti-bribery management system standard, but its discipline is useful well beyond bribery: assess risk on a defined basis, reassess when the business changes, assign ownership, and monitor whether controls and corrective actions actually work. The SAMA Counter-Fraud Framework expects regulated institutions to run fraud risk management on similar principles, with clear governance and board oversight.
Why incident summaries are not assurance
An incident count tells you what the institution detected. It does not tell you what it missed, what it has not yet been exposed to, or whether the assessment that drives control investment is current. A quiet year can mean strong controls. It can equally mean a new channel is leaking losses that nobody is measuring.
A committee that approves the report on the strength of incident data alone is approving a description of the past. The three questions below move the conversation to the present and the near future.
Question 1: Which products or channels have launched since the last assessment, and have they been scored?
Fraud exposure changes when the business changes. A new digital onboarding journey, a new payment method, a new partner integration or a change in transaction limits all alter who can attack the institution and how.
Ask management for a list of every product, channel, partner and significant process change since the last risk assessment. Then ask, for each item, whether it was scored and when.
How to read the answer
- Strong: a dated list, each item with an inherent risk score, named control owners, and a record that the assessment was updated before or shortly after launch.
- Weak: a statement that the assessment is "reviewed annually," with no link to launches that happened between reviews.
- Warning sign: the product team and the fraud team give different lists of what launched.
What to fund and measure
Fund a standing trigger: no launch approval without a fraud risk score. Measure the share of launches scored before go-live, and the time between launch and first assessment. A committee should expect that interval to shrink year over year.
Question 2: Which fraud scenarios seen at peer institutions are not modeled in our register?
A fraud risk register built only from the institution's own history is always behind. Attackers reuse methods across banks, insurers, fintechs and payment providers. Scenarios publicly reported in the Kingdom or the region, or raised in industry forums and regulator communications, are a free early warning.
Ask management to show the register next to a list of scenarios observed elsewhere. The point is not that every scenario applies. The point is that each one was considered and a decision was recorded: modeled, accepted, or judged not relevant, with a reason.
How to read the answer
- Strong: a documented horizon-scanning process, a named owner, and register entries that cite external scenarios and show the decision taken.
- Weak: a register that has barely changed from last year apart from updated numbers.
- Warning sign: the answer is "we have not seen that here," offered as the reason for not modeling it.
What to fund and measure
Fund a small, regular scenario review involving fraud, operations, technology and the business. Measure how many external scenarios were reviewed in the period, how many led to a register change, and how many led to a control change. Zero changes across a full year deserves a follow-up question.
Question 3: Which control gaps identified last year remain open?
ISO 37001 expects nonconformities and corrective actions to be tracked to closure. This is the most revealing question because the answer is verifiable. Last year's report, internal audit findings and any regulator observations form the baseline.
Ask for a single table: each gap, its original rating, owner, agreed date, current status, and the reason for any delay. Then check that the table reconciles with internal audit's own tracker.
How to read the answer
- Strong: open items are few, aged honestly, and each has an owner and a revised date approved at the right level.
- Weak: deadlines have been extended repeatedly with no change in resourcing.
- Warning sign: gaps have been closed by reclassifying them, or closed on the basis of a policy being written rather than a control operating.
What to fund and measure
Where a gap is open because of a missing tool, headcount or technical work, the committee should ask for the funding decision to be tabled, not deferred. Measure the age of open items, the number of overdue actions, and the number of closures that internal audit has independently validated.
Putting the three questions together
Each question tests a different thing. The first tests whether the assessment is current. The second tests whether it is outward-looking. The third tests whether the institution acts on what it already knows. A report that answers all three with evidence offers genuine assurance. A report that answers with general statements does not, however polished it appears.
Before the meeting, consider asking management to provide:
- The launch list with risk scores and dates.
- The register alongside the external scenario review.
- The open-gap table reconciled to internal audit.
- A short note on what the committee is being asked to fund.
If the committee cannot get these four items, that itself is the finding. Approval can be conditional, with a dated plan to close the gaps in evidence.
How we can help
If your committee finds that the governance, policies, roles or reporting behind the annual report are not yet where the SAMA Counter-Fraud Framework expects them to be, our SAMA Counter-Fraud Framework Implementation service addresses that. We design and implement the governance, policies, roles, processes and reporting your institution needs to meet the SAMA Counter-Fraud Framework.
The work follows four stages: a baseline gap assessment against the framework, design of governance, policy, operating model and reporting, roll-out with training and process adoption, and a self-assessment that prepares you for regulator review. Deliverables include a counter-fraud strategy and roadmap, a policy and procedure set, a RACI and operating model, and a compliance self-assessment against the framework. Implementation typically takes three to six months, depending on your starting point and size.
