A SAMA CRFR fraud risk register is only useful if each entry describes a scenario specific enough to test. Many institutions still maintain a list of generic fraud categories, scored on a heat map and refreshed once a year. That format is easy to produce and hard to defend when an examiner asks how a score was reached, or what a control actually changes.
This article is for Chief Risk Officers and fraud-risk managers preparing an annual update under the SAMA Counter-Fraud Framework (CRFR). It explains what a scenario-based register should contain, the usual gaps, the inherent-versus-residual calculation, and a sensible order of work. We refer to the register requirement generally rather than to specific wording, so confirm the exact text of the relevant article against the current framework before you finalize.
What the framework expects from a register
SAMA expects regulated institutions to identify, assess and document fraud risk in a structured and repeatable way, and to keep that documentation current. In practice, an examiner reading your register wants to see three things: that risks are described as concrete scenarios, that scoring logic is explicit, and that the controls you claim are linked to the scenarios they are meant to reduce.
For the organization, this changes the register from a reporting artefact into a working record. Fraud, operations, technology and business owners all contribute to it, and the annual update becomes a review of evidence rather than a re-scoring exercise.
The six scenario dimensions
Each register entry should document the following six dimensions. If one is missing, the entry usually cannot be scored consistently.
1. Threat actor
Who carries out the fraud: an external criminal group, an individual customer, an insider, a vendor employee, or collusion between parties. The actor determines the access they start with and the controls that apply.
2. Attack vector
How the fraud is attempted: social engineering, account takeover, forged documents, manipulated payment instructions, abuse of a digital channel, or misuse of privileged access. Name the channel and the method, not just the category.
3. Target asset
What is being attacked: customer accounts, payment flows, credit products, card programs, staff credentials, or data that enables later fraud. Tie the asset to an owner and to a process.
4. Impact type
What the loss looks like: direct financial loss, regulatory exposure, customer harm, reputational damage, or operational disruption. Separate these, because one scenario can carry several and each is measured differently.
5. Likelihood driver
Why the scenario is plausible now: a weakness in onboarding, a new product launch, known activity in the market, previous incidents, or staffing and process pressure. A likelihood score without a stated driver cannot be challenged or updated sensibly.
6. Control layer
Where controls act on the scenario: preventive, detective or corrective, and at which point in the process. Record each control, its owner, and the evidence that it operates.
The inherent-versus-residual calculation
The register should show two scores for every scenario, and the gap between them should be explained.
Inherent risk is the exposure before any control is considered. Score likelihood and impact on your approved scales, assuming the controls in the sixth dimension do not exist.
Residual risk is the exposure after controls, scored on the same scales, using only controls you can evidence as operating.
A workable method:
- Score inherent likelihood and impact using the likelihood driver and impact type you documented.
- List the controls linked to the scenario and classify each by layer.
- Rate each control for design (does it address this vector?) and operation (is there evidence it ran during the period?).
- Reduce likelihood for preventive controls and impact for detective and corrective controls, only as far as the ratings justify.
- Record the residual score and a short written rationale for each reduction.
The test of control effectiveness is the size of the reduction compared with the evidence behind it. If a scenario drops from high to low because a policy exists, but no one has tested the control, that is compliance theatre. If a control is strong on paper but residual risk barely moves, the control may be aimed at the wrong vector.
Common gaps
- Entries written as categories such as "payment fraud" rather than scenarios.
- Residual scores that fall without any testing evidence.
- Controls listed against scenarios they do not address.
- No named owner for the asset or the control.
- Likelihood scores unchanged year to year despite new products, channels or incidents.
- Third-party fraud paths, such as vendor staff with system access, missing from the threat actor dimension.
A sensible order of work
- Confirm your current register structure against the six dimensions and note which fields are absent.
- Rewrite the highest-exposure entries as scenarios first, then the remainder.
- Agree scoring scales and the design-and-operation rating for controls.
- Collect control evidence from owners, and test where evidence is thin.
- Recalculate residual scores and document the rationale.
- Present the results to the risk committee, with the decisions it is expected to take, so the update reaches the board with clear ownership.
How we support this work
Our GRC Advisory service is a 12-month retainer built around SAMA CRFR alongside SAMA CSF, NCA ECC and PDPL. It begins with an onboarding step in which we understand your environment, obligations and priorities, and each quarter we agree the focus and advisory hours.
For a register update, that means policy and document review, with reviewed documents returned with recommendations. It also covers preparation for regulator and audit meetings. We also track your compliance posture and report monthly through an advisory report and a compliance posture dashboard, with a quarterly review.
Where the register exposes unclear ownership, our Cybersecurity Governance & Organization service can help define committees, roles and how decisions reach the board. Where vendor paths drive fraud scenarios, our Third-Party & Supply-Chain Cyber Risk service covers vendor tiering, due diligence and ongoing monitoring.
Next step
If your annual update is approaching, start by testing a few existing entries against the six dimensions. The gaps will show quickly. To discuss how GRC Advisory can support your CRFR submission, contact CISO Consulting.
