APPENDIX F2: FRAUD RISK MANAGEMENT HIGH-LEVEL ASSESSMENT
This checklist can be used to make an initial, high-level assessment of an
organization’s fraud risk governance policies.
# Question Response
1. Our organization’s board of directors or designated committee is Yes No
actively involved in oversight of our fraud risk management program
and:
a. Reviews and approves written code of business conduct
b. Reviews and approves fraud control policy
c. Reviews fraud risk assessment activities
d. Requires timely notification of investigations relating to fraud and
misconduct
e. Receives updates on status of investigations and resulting
remediation and corrective action
f. Receives updates on ethics and fraud training activities
g. Receives periodic reports on effectiveness of fraud risk
management program, as well as fraud prevention and detection
controls
2. Our organization has a written code of business conduct. Yes No
3. Our organization has a written fraud control policy. Yes No
4. Our code of business conduct and fraud control policy are each Yes No
administered by a process owner who is responsible for its operation.
5. Our personnel read, acknowledge our code of business conduct and Yes No
fraud control policy on an annual basis and disclose any known
conflicts of interest or other code violations.
6. We have a fraud risk management program which includes Yes No
documented internal control activities designed to prevent and detect
fraud.
7. Our organization conducts an annual fraud risk assessment to identify, Yes No
analyze, prioritize and respond to risk arising from fraud and
misconduct.
8. We provide training on the code of business conduct and fraud Yes No
control policy to the board of directors and personnel annually.
9. We have ethics-related metrics incorporated within our performance Yes No
evaluation process.
10. We have one or more mechanisms to report concerns and complaints Yes No
or obtain advice on ethical matters:
a. Hotline (available 24/7/365)
b. Website
c. Electronic mail (“email”) address
-- F2-1 --
# Question Response
d. Letters to board of directors or designated personnel
e. Chain-of-command
f. Open door policy
11. Our policy is never to retaliate against whistleblowers and we hold our Yes No
personnel accountable for this policy requirement.
12. We timely respond to allegations of fraud and misconduct by Yes No
triaging the issue into appropriate response mechanisms:
a. Immediate response (within a few hours)
b. Prompt response (within a few days)
c. It can wait, low or no priority assigned to it
13. We promptly investigate all allegations and report the results Yes No
according to the severity of the issue:
a. Board of Directors
b. Regulatory / law enforcement notification
c. Criminal prosecution
d. Civil litigation
e. Termination of individual(s)
f. No action required
14. We insure that all remediation/corrective actions resulting from our Yes No
investigations are implemented:
a. Asset recovery
b. Insurance claim
c. Internal controls
d. Training
e. Reassignment
f. Probation
g. Restitution
h. No action required
15. We periodically review the fraud risk management program and make Yes No
adjustments to align with our fraud risk profile.
NOTE:
All responses to this questionnaire should be answered yes. If the answer to any of these
questions is no, this indicates a potential weakness in the organization’s control environment.
-- F2-2 --