Board members at SAMA-regulated financial institutions approve the annual Cyber and Information Security Cybersecurity Framework and Fraud Control Framework compliance report each year. That report includes attestations about fraud investigation capabilities. Yet many directors sign off without understanding whether the institution's fraud investigations actually follow the evidentiary standards that satisfy regulators and protect the institution legally. The difference between a compliant fraud investigation program and a paper exercise becomes visible when you ask the right SAMA CFF fraud investigation board questions.
The Saudi Central Bank's Fraud Control Framework Article 4.3 requires institutions to investigate fraud incidents thoroughly and report findings to appropriate parties. That requirement sounds straightforward until a fraud case goes wrong: evidence is contaminated, witnesses coordinate their stories, or the investigation report cannot support disciplinary action because the chain of custody is broken. At that point, the board discovers that approving the annual compliance report did not mean the institution could actually conduct an investigation that meets regulatory and legal standards.
This article identifies three specific questions about investigation independence, evidence custody and regulatory-reporting alignment that enable board members and audit committee chairs to verify that fraud cases are handled with the rigor SAMA expects. These are not theoretical questions. They reveal whether your institution can defend its investigation process to regulators, auditors and courts.
Question One: Who Conducts the Investigation and How Is Independence Assured?
The first question is about independence. When a fraud allegation arises, who investigates it, and how does the institution ensure that investigator has no conflict of interest, no reporting line to the suspected party, and no stake in the outcome?
Many institutions assign fraud investigations to internal audit, compliance or the fraud-prevention team. That approach works only if the suspected fraud does not involve those functions and if the investigator has the forensic skills the case requires. When the allegation involves senior management, a control failure in the compliance function itself, or a complex scheme requiring transaction analysis and digital forensics, independence and capability both matter.
Independence means the investigator does not report to anyone implicated in the case, has no personal or professional relationship with the subjects, and can follow the evidence wherever it leads without fear of career consequences. It also means the investigator's findings are reported directly to the audit committee or board, not filtered through the management layer under investigation.
Capability means the investigator knows how to preserve evidence, analyze transactions across multiple systems, conduct interviews that produce usable statements, and document findings in a way that satisfies both regulatory and legal standards.
The question to ask is not "Do we investigate fraud?" but "Can you show me the last three fraud investigations, explain who conducted them, and demonstrate that the investigator had no conflict of interest and the necessary forensic skills?" If the answer involves hesitation or assurances that "we follow our policy," the board should ask to see the policy, the investigator's qualifications, and the evidence that independence was maintained.
Question Two: How Is Evidence Preserved and Who Controls the Chain of Custody?
The second question is about evidence. Fraud investigations produce evidence that may be used in disciplinary proceedings, regulatory reports, civil recovery or criminal prosecution. If that evidence is not preserved correctly from the moment the allegation is made, it becomes inadmissible or unreliable.
Evidence preservation begins the moment an institution becomes aware of a potential fraud. Digital records must be secured so they cannot be altered or deleted. Physical documents must be collected and stored. Access to systems and records must be restricted to prevent tampering. Every step must be documented so that anyone reviewing the evidence later can verify it has not been changed.
Chain of custody means every person who touches a piece of evidence is recorded, along with the date, time and reason. If a transaction log is copied from the core banking system, the chain of custody shows who made the copy, when, from which system, and who has accessed it since. If an email is preserved, the chain shows who extracted it, how it was stored, and who has reviewed it. Without this record, the evidence cannot be trusted.
The question to ask is: "When we investigate a fraud case, how do we preserve evidence, and who maintains the chain of custody?" If the answer is that the IT department takes a backup or the fraud team pulls a report, ask: "Is that backup write-protected? Is there a log showing who accessed it? If we had to present this evidence to SAMA or in court, could we prove it has not been altered?"
Many institutions discover too late that their evidence-handling procedures are informal, undocumented or inconsistent. The fraud happened, the investigation found the perpetrator, but the evidence cannot support disciplinary action because the chain of custody is broken.
Independent investigation of suspected fraud includes case scoping and evidence preservation as a first step, ensuring that evidence is handled in a way suitable for disciplinary, regulatory and legal action. Every piece of evidence has a recorded chain of custody, and access is limited to named people.
Question Three: How Do Investigation Findings Align with Regulatory Reporting Obligations?
The third question is about regulatory alignment. SAMA's Fraud Control Framework requires institutions to report fraud incidents and investigation outcomes. The board's role is to ensure that what the institution reports to SAMA matches what the investigation actually found, and that the institution's internal processes connect investigation findings to regulatory reporting without gaps or delays.
Regulatory-reporting alignment means the investigation report contains the information SAMA expects: the nature of the fraud, the amount involved, the control failures that allowed it, the corrective actions taken, and the timeline. It also means the institution has a process to ensure that every fraud investigation triggers a review of reporting obligations, so nothing falls through the cracks.
The question to ask is: "When we complete a fraud investigation, how do we determine whether it must be reported to SAMA, and who ensures the report is accurate and timely?" If the answer is that the compliance team handles it, ask: "Does the compliance team receive the full investigation report, or a summary? How do they verify the facts? Is there a checklist or procedure that connects investigation findings to reporting requirements?"
A common gap is that the investigation team and the regulatory-reporting team work in silos. The investigation concludes, a brief summary is sent to compliance, and the compliance team files a report based on incomplete information. Later, SAMA asks questions the institution cannot answer because the investigation report and the regulatory filing do not align.
The investigation report produced at the conclusion of an independent fraud investigation includes findings, root cause and recommendations to prevent recurrence. That report should be the foundation for any regulatory filing, not a separate document created after the fact.
What These Questions Reveal
These three questions reveal whether your institution's fraud investigation program is designed to satisfy regulatory expectations and protect the institution legally, or whether it is a reactive process that works only when cases are simple and uncontroversial.
Independence ensures the investigation is credible. If the investigator has a conflict of interest or lacks forensic skills, the findings will be questioned by regulators, auditors and courts.
Evidence custody ensures the findings can be used. If evidence is not preserved correctly, the institution may know who committed the fraud but be unable to take disciplinary action or recover losses.
Regulatory alignment ensures the institution meets its obligations. If investigation findings do not flow into regulatory reports accurately and promptly, the institution risks non-compliance even when the investigation itself was thorough.
Board members do not need to become fraud investigators. But they do need to ask questions that verify the institution's fraud investigation process meets the standards SAMA expects. Approving the annual compliance report without asking these questions leaves the institution exposed.
Preparing for the Next Investigation
Fraud investigations are not routine. They happen when something has gone wrong, when time is short, and when the stakes are high. The time to verify that your institution can conduct a compliant investigation is before the next case arises, not during it.
The board should ask management to demonstrate that the institution has access to independent investigators with forensic skills, that evidence-handling procedures are documented and tested, and that investigation findings flow into regulatory reporting without gaps. If any of these elements is missing or unclear, the board should direct management to address the gap before the next fraud case exposes it.
How We Support Fraud Investigations That Meet Regulatory Standards
We conduct independent, evidence-led investigations of suspected internal or external fraud, with evidence handling suitable for disciplinary, regulatory and legal action. The process follows four steps: contain the case by scoping it and preserving evidence, analyze transactions, records and digital evidence, establish facts through interviews and fact-finding, and report findings, root cause and recommendations.
Deliverables include an investigation report, an evidence file, and recommendations to prevent recurrence. The service includes transaction and ledger analysis, interviews and fact-finding, and root-cause and control-failure analysis. We usually start within one to two business days of engagement, faster for urgent cases, and the investigation runs as needed.
If your institution needs to verify that its fraud investigation capabilities meet SAMA Fraud Control Framework standards, or if a case has arisen that requires independent forensic investigation, we can help.
