Governance, risk and compliance

SmartSuite for the Fraud Risk Manager

The Fraud Risk Manager owns the fraud risk assessment and the anti-fraud program: identifying fraud schemes the organization is exposed to, mapping preventive and detective controls, overseeing investigations and reporting fraud losses and trends to the risk and audit committees.

Start free trial

Schedule a demo

Reports to:

Chief Risk Officer

Summarize with

Claude ChatGPT Perplexity Google AI Mode

What you own

Conduct and maintain the enterprise fraud risk assessment
Map fraud schemes to preventive and detective controls
Operate the anti-fraud policy, training and reporting channels
Oversee fraud investigations and case management
Analyze fraud losses, trends and control gaps
Report fraud risk and investigation outcomes to the audit and risk committees

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

risk

Touches

contributes or approves

issues-actions, audit, compliance, policy, reporting

Depends on

consumes its output

third-party

How the GRC processes connect

Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Chief Risk Officer

See the role

Direct reports

Works closely with

How SmartSuite supports this role

Lead

Risk management. Holds the fraud risk assessment as a scored register of schemes, likelihood and impact, linked to the controls that address each one.

Issues and actions. Manages investigations as case records with evidence, tasks and confidential access, and tracks corrective actions to closure.

Internal audit. Shares fraud control results with internal audit so testing and investigations draw on the same records.

Reporting. Produces fraud loss and trend reports for the audit and risk committees from case data.

{"lead":"The Fraud Risk Manager owns the fraud risk assessment and the anti-fraud program, answerable to the Chief Risk Officer and to the audit and risk committees for exposure understood, controls in place and investigations run properly. SmartSuite keeps schemes, controls, cases and losses in one record, so the committees see patterns, not just incidents.","groups":[{"title":"Run the fraud risk assessment and anti-fraud controls","cards":[{"title":"Schemes mapped to preventive and detective controls","body":"Each fraud scheme in the assessment links to the controls that prevent or detect it, so a gap where a scheme has no detective control is visible on the register rather than discovered through a loss.","suite":"enterprise-risk-management"},{"title":"Loss data captured with the case","body":"Confirmed losses, recoveries and root causes are recorded on each case, so loss analysis by scheme, business unit and control gap runs from the data rather than from a spreadsheet kept on the side.","suite":"enterprise-risk-management"},{"title":"Anti-fraud policy with attestation and training","body":"The anti-fraud policy carries review cycles and employee attestations, and training completion is tracked by role, so the governance element the COSO and ACFE guide expects is evidenced rather than described.","suite":"enterprise-risk-management"}]},{"title":"Work with internal audit, financial crime, controls and counsel","cards":[{"title":"Reporting channels that feed the case queue","body":"Reports from the speak-up channel and Complaints Tracking route into your case queue with the category and initial information captured, so allegations arrive in a form you can triage straight away.","suite":"enterprise-risk-management"},{"title":"Control gaps handed to the Internal Controls Manager","body":"A control gap identified in an investigation becomes an action for the Internal Controls Manager, linked to the control and the scheme, so the fix is tracked to retest rather than left as a recommendation in a report.","suite":"audit-management"},{"title":"Shared cases with the Financial Crime Compliance Officer","body":"Where fraud and money laundering overlap, the case links to the Financial Crime Compliance Officer's investigation, so evidence is held once and the General Counsel sees one account of the matter.","suite":"enterprise-risk-management"}]},{"title":"Report fraud risk to the audit and risk committees","cards":[{"title":"Trends by scheme and business unit","body":"Dashboards show case volumes, losses, time to close and control gaps by scheme and business unit, so the committees see where exposure is growing rather than a list of closed cases.","suite":"enterprise-risk-management"},{"title":"Committee updates drafted from the register","body":"The AI Assistant in a SmartDoc field drafts board-level updates and risk summaries from the assessment and case data, so the paper for the audit and risk committees starts from the evidence rather than from last quarter's draft.","suite":"enterprise-risk-management"},{"title":"Access limited to those on the case","body":"Granular permissions and audit logs restrict investigation records to the people assigned, so sensitive allegations stay contained and the Chief Risk Officer can show who accessed what and when.","suite":"enterprise-risk-management"}]}]}

Products this role uses most

Enterprise Risk Management (ERM)

Centralize enterprise risk management with standardized assessments, dashboards, and linked workflows that align risk, controls, and mitigation across your organization.

Explore this product

Risk and Control Self-Assessment (RCSA)

Run risk and control self-assessments with consistent scoring models, evidence on each assessment, and dashboards of risk exposure and control effectiveness.

Explore this product

Issues Management

Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real-time visibility into resolution status.

Explore this product

Internal Audit Management

Plan, execute, and report on audits with complete assurance oversight — linking findings to risks, controls, and remediation actions in a single workspace.

Explore this product

Complaints Tracking

Capture, track, and resolve complaints with case workflows, full traceability, and dashboards on investigations, trends, and outcomes.

Explore this product

Industry reference

The COSO and ACFE Fraud Risk Management Guide (2nd edition, 2023) is the reference: a governance policy, a fraud risk assessment, preventive and detective controls, investigation and monitoring. COSO's 2013 framework makes fraud risk assessment an explicit principle (Principle 8), so SOX programs test it.

Sector rules add teeth. Banks file suspicious activity reports under the Bank Secrecy Act and are examined against FFIEC guidance; healthcare organizations face the False Claims Act and OIG enforcement; US federal programs follow GAO's Fraud Risk Management Framework and the Payment Integrity Information Act; payment and technology firms meet PCI DSS and card-scheme fraud rules.

Related roles

Chief Risk Officer

See the role

DEEPEN YOUR KNOWLEDGE

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

All articles

What's new

What is RCSA?

What is Risk Assessment?

Risk Acceptance in GRC

RCSA vs Risk Assessment vs Control Testing

Risk Appetite vs Risk Tolerance vs Impact Tolerance

Enterprise Risk Management in a Connected GRC Program

Frequently asked questions

What does a Fraud Risk Manager own in the risk function?

The Fraud Risk Manager owns the fraud risk assessment and the anti-fraud program: identifying the fraud schemes the organization is exposed to, mapping each to preventive and detective controls, operating the anti-fraud policy, training and reporting channels, overseeing investigations and case management, analyzing losses, trends and control gaps and reporting fraud risk and investigation outcomes to the audit and risk committees. The COSO and ACFE Fraud Risk Management Guide is the reference, and COSO Principle 8 makes the assessment something SOX programs test.

How does SmartSuite help a Fraud Risk Manager maintain the fraud risk assessment?

Enterprise Risk Management (ERM) holds the fraud risk assessment as a scored register of schemes, each with its likelihood and impact and linked to the controls that address it, so the Fraud Risk Manager can see which schemes are well controlled and which rely on a single detective control. Risk and Control Self-Assessment (RCSA) lets business units assess their own exposure on the same scale, and the Risk Analyst maintains the scoring. New schemes are added as the environment changes rather than at the annual refresh.

How are fraud investigations managed in SmartSuite?

Complaints Tracking manages investigations as case records with evidence, investigation workflows and role-based access, and Issues Management tracks the corrective actions that follow to closure. Each case holds its evidence, the investigation steps, the people involved and the outcome, visible only to those assigned, with the General Counsel brought in where privilege or employment matters arise. Complaints Tracking and the reporting channel feed allegations into the case process. Corrective actions, such as a control change after a confirmed scheme, carry an owner until done.

How does the Fraud Risk Manager share control results with internal audit?

SmartSuite shares fraud control results with internal audit through Internal Audit Management, so testing and investigations draw on the same records: the Internal Auditor can see which anti-fraud controls the Fraud Risk Manager relies on, how they performed and which investigations touched them, and the Fraud Risk Manager can see audit findings against those controls. The Internal Controls Manager works in the same control records, which means a fraud control is tested once and the result is known to all three.

How does a Fraud Risk Manager report losses and trends to the committees?

SmartSuite produces fraud loss and trend reports for the audit and risk committees from the case data, so the report to the Chief Risk Officer or the Chief Compliance Officer shows confirmed losses, case volumes by scheme, time to resolve and the control gaps revealed, all drawn from the investigations themselves. Trends across periods become visible because the cases are structured the same way. The Financial Crime Compliance Officer reads the same cases where fraud and money laundering overlap.

How does an anti-fraud program get started in SmartSuite?

Load the fraud scheme inventory with its scoring and the controls mapped to each scheme, then move open investigations into case records so the confidential access applies from the start. The first assessment cycle run in the system gives the Risk Analyst a baseline, and the case data begins to produce trend reporting after the first few periods. Internal audit and the Financial Crime Compliance Officer join the same records early, because fraud, money laundering and control testing share schemes and controls.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.

Start free trial

Schedule a demo