SmartSuite for the Fraud Risk Manager

Each fraud scheme in the assessment links to the controls that prevent or detect it, so a gap where a scheme has no detective control is visible on the register rather than discovered through a loss.

Confirmed losses, recoveries and root causes are recorded on each case, so loss analysis by scheme, business unit and control gap runs from the data rather than from a spreadsheet kept on the side.

The anti-fraud policy carries review cycles and employee attestations, and training completion is tracked by role, so the governance element the COSO and ACFE guide expects is evidenced rather than described.

Reports from the speak-up channel and Complaints Tracking route into your case queue with the category and initial information captured, so allegations arrive in a form you can triage straight away.

A control gap identified in an investigation becomes an action for the Internal Controls Manager, linked to the control and the scheme, so the fix is tracked to retest rather than left as a recommendation in a report.

Where fraud and money laundering overlap, the case links to the Financial Crime Compliance Officer's investigation, so evidence is held once and the General Counsel sees one account of the matter.

Dashboards show case volumes, losses, time to close and control gaps by scheme and business unit, so the committees see where exposure is growing rather than a list of closed cases.

The AI Assistant in a SmartDoc field drafts board-level updates and risk summaries from the assessment and case data, so the paper for the audit and risk committees starts from the evidence rather than from last quarter's draft.

Granular permissions and audit logs restrict investigation records to the people assigned, so sensitive allegations stay contained and the Chief Risk Officer can show who accessed what and when.

Chief Risk Officer

The Fraud Risk Manager owns the fraud risk assessment and the anti-fraud program: identifying the fraud schemes the organization is exposed to, mapping each to preventive and detective controls, operating the anti-fraud policy, training and reporting channels, overseeing investigations and case management, analyzing losses, trends and control gaps and reporting fraud risk and investigation outcomes to the audit and risk committees. The COSO and ACFE Fraud Risk Management Guide is the reference, and COSO Principle 8 makes the assessment something SOX programs test.

Enterprise Risk Management (ERM) holds the fraud risk assessment as a scored register of schemes, each with its likelihood and impact and linked to the controls that address it, so the Fraud Risk Manager can see which schemes are well controlled and which rely on a single detective control. Risk and Control Self-Assessment (RCSA) lets business units assess their own exposure on the same scale, and the Risk Analyst maintains the scoring. New schemes are added as the environment changes rather than at the annual refresh.

Complaints Tracking manages investigations as case records with evidence, investigation workflows and role-based access, and Issues Management tracks the corrective actions that follow to closure. Each case holds its evidence, the investigation steps, the people involved and the outcome, visible only to those assigned, with the General Counsel brought in where privilege or employment matters arise. Complaints Tracking and the reporting channel feed allegations into the case process. Corrective actions, such as a control change after a confirmed scheme, carry an owner until done.

SmartSuite shares fraud control results with internal audit through Internal Audit Management, so testing and investigations draw on the same records: the Internal Auditor can see which anti-fraud controls the Fraud Risk Manager relies on, how they performed and which investigations touched them, and the Fraud Risk Manager can see audit findings against those controls. The Internal Controls Manager works in the same control records, which means a fraud control is tested once and the result is known to all three.

SmartSuite produces fraud loss and trend reports for the audit and risk committees from the case data, so the report to the Chief Risk Officer or the Chief Compliance Officer shows confirmed losses, case volumes by scheme, time to resolve and the control gaps revealed, all drawn from the investigations themselves. Trends across periods become visible because the cases are structured the same way. The Financial Crime Compliance Officer reads the same cases where fraud and money laundering overlap.

Load the fraud scheme inventory with its scoring and the controls mapped to each scheme, then move open investigations into case records so the confidential access applies from the start. The first assessment cycle run in the system gives the Risk Analyst a baseline, and the case data begins to produce trend reporting after the first few periods. Internal audit and the Financial Crime Compliance Officer join the same records early, because fraud, money laundering and control testing share schemes and controls.