Skip to main content
Governance Authority
Category: Fraud Risk Management

Fraud Risk Register

Also known as: Fraud and Corruption Risk Register
Simply put

A Fraud Risk Register is a structured document that an organization uses to identify, record, and keep track of the ways it could be exposed to fraud. It brings these fraud risks together in one central place so they can be evaluated and monitored over time. It typically covers fraud risks arising from the organization's various activities and processes, and it is often paired with actions intended to address those risks.

Formal definition

A Fraud Risk Register is a structured tool used to document, evaluate, and monitor fraud-related risks across an organization's activities and processes, typically maintained as part of a broader fraud risk management framework and risk-based approach. It generally aims to capture the organization's identified fraud (and, in some implementations, corruption) risks comprehensively and may be linked to an associated action plan for mitigation and follow-up. Its scope, structure, and methodology vary by organization, sector, and jurisdiction; some registers are built around a defined internal methodology or focus on the risk areas to which the entity is most susceptible. This entry is educational and not legal, audit, or compliance advice; the specific format, ownership, and content of any given register depend on the organization's own framework and professional judgment.

Why it matters

Fraud can arise across many of an organization's activities and processes, and without a structured way to capture and revisit those exposures, individual risks may be identified in isolation, addressed inconsistently, or lost over time. A Fraud Risk Register brings identified fraud risks together in one central place, which supports evaluation and ongoing monitoring rather than one-off assessment. This centralization is generally what allows an organization to take a considered, risk-based view of where it is most exposed and to track whether its responses remain adequate as circumstances change.

The register is typically most useful when it is part of a broader fraud risk management framework rather than a standalone list. Some implementations are built around a defined internal methodology and pair the register with an associated action plan, so that identified risks are linked to specific mitigation and follow-up rather than simply being logged. Others focus on the risk areas to which the entity is most susceptible; a public-sector example prepared for a UK local authority organized its register around the 'top 10' fraud and corruption risk areas the authority considered itself more exposed to, such as theft by employees or outsiders. Approaches of this kind illustrate that the value of a register depends heavily on how it connects identification to response.

Because the format, ownership, and content of any given register depend on the organization's own framework and professional judgment, its usefulness varies by organization, sector, and jurisdiction. A register is a tool to support fraud risk management, not a guarantee against fraud, and the disciplines of evaluating design and testing whether controls actually operate remain distinct activities beyond the register itself.

Who it's relevant to

Chief Compliance and Risk Officers
Those responsible for the organization's fraud risk management framework typically own or oversee the register as a central record of identified fraud risks. They generally use it to support a risk-based approach, to prioritize the areas to which the entity is most susceptible, and to connect identified risks to an action plan for mitigation and follow-up.
Internal Auditors and Assurance Functions
Internal audit and other assurance functions may reference the register when planning risk-based work and when forming a view on how fraud risks are identified, evaluated, and monitored. Their role is generally to provide independent assurance over the framework rather than to own the register or the day-to-day management of the risks it records.
Management and Process Owners
Because fraud risks arise across the organization's activities and processes, managers responsible for those processes are often best placed to help identify relevant risks and to implement mitigating actions. Ownership of specific entries and associated action items typically sits with management rather than with oversight bodies.
Boards and Audit or Risk Committees
Boards and their committees generally exercise oversight of how fraud risk is managed. A register can inform that oversight by providing a consolidated view of identified fraud risks and planned responses, though the board's role is typically to challenge and monitor management's framework rather than to maintain the register itself. The depth of this oversight depends on the entity type, sector, and applicable expectations in the relevant jurisdiction.

Inside Fraud Risk Register

Identified Fraud Risks
A catalogue of specific fraud schemes and scenarios relevant to the entity, typically spanning categories such as asset misappropriation, financial statement fraud, and corruption. The scope generally reflects the organization's own facts, sector, and geographic footprint rather than a universal list.
Risk Assessment Attributes
For each identified scheme, an assessment that generally separates likelihood from impact and distinguishes inherent risk (before controls) from residual risk (after controls). These attributes should not be treated as interchangeable.
Associated Controls
The preventive and detective controls mapped to each fraud risk. Practitioners typically note both control design (whether the control is capable of addressing the risk) and, where assessed, operating effectiveness (whether it functions as intended over time).
Risk Ownership and Accountability
Assignment of a responsible owner for each risk, usually within management under a first- or second-line role. The register clarifies who manages the risk operationally versus who provides oversight, without attributing oversight duties to management or operational duties to the board.
Response and Treatment Plans
Documented actions to mitigate, monitor, transfer, or accept each fraud risk, generally referenced against the organization's stated risk appetite and tolerance where these have been defined.
Status, Monitoring, and Review Cadence
Fields tracking the current state of each risk, remediation progress, and the date and basis of the last review, supporting periodic reassessment as circumstances change.

Common questions

Answers to the questions practitioners most commonly ask about Fraud Risk Register.

Is a fraud risk register the same as an entity's enterprise risk register?
No. A fraud risk register is generally a specialized register focused on fraud and misconduct scenarios, typically covering asset misappropriation, financial statement fraud, and corruption schemes, whereas an enterprise risk register captures a broader universe of strategic, operational, financial, and compliance risks. While the two are related and often cross-reference each other, they usually serve different purposes and may be owned or maintained by different functions. In many organizations the fraud risk register supports a dedicated fraud risk assessment process, and conflating it with the enterprise-wide register can obscure fraud-specific controls and accountability. The precise relationship depends on how a given entity structures its risk governance.
Does maintaining a fraud risk register mean the board is responsible for detecting fraud?
Not in the way the question implies. The board and its committees generally hold an oversight responsibility, challenging management's fraud risk assessment, satisfying themselves that a program exists and is functioning, and receiving reporting, rather than an operational duty to identify or detect specific fraud schemes. Management typically owns the fraud risk register itself: identifying risks, designing and operating anti-fraud controls, and keeping the register current. Assurance functions such as internal audit may independently evaluate the register and the controls it references. Attributing detection responsibility directly to the board conflates oversight with execution; the allocation of these roles can also vary by jurisdiction, entity type, and internal mandate.
What information is typically captured for each entry in a fraud risk register?
Practices vary, but a fraud risk register commonly records a description of the fraud scenario, the accounts, processes, or areas potentially affected, and an assessment of likelihood and impact. Many registers distinguish inherent risk (before controls) from residual risk (after controls), and link each scenario to the specific anti-fraud controls intended to address it, along with a control owner. Some registers also capture potential fraud schemes by category, relevant incentives or pressures, and indicators or red flags. The level of detail generally reflects the entity's size, sector, and risk profile, and there is no single mandated format, the design is a matter of management judgment.
How often should a fraud risk register be reviewed and updated?
There is generally no universally fixed frequency; the cadence depends on the entity's risk environment and any applicable regulatory or listing expectations. Many organizations refresh the register on a periodic basis (for example, in connection with an annual fraud risk assessment) and also update it in response to triggering events such as significant changes in the business, new products or geographies, restructurings, control failures, or actual fraud incidents. The aim is generally to keep the register reflective of current risks rather than to treat it as a static document. The appropriate frequency is a judgment call informed by the organization's facts and circumstances.
Who should own and maintain the fraud risk register within an organization?
Ownership arrangements vary by entity, but the register is typically maintained by management, often within a compliance, risk, finance, or dedicated fraud/ethics function, because those functions design and operate the underlying anti-fraud controls. Under a three-lines model, business process owners in the first line often provide input on risks and controls, while a second-line function may coordinate and consolidate the register. Internal audit, as a third-line assurance function, generally does not own the register but may assess its adequacy independently. Clear assignment of a register owner and individual control owners helps preserve accountability. The specific structure should reflect the organization's governance model.
How does a fraud risk register support the design and testing of anti-fraud controls?
A fraud risk register generally functions as the link between identified fraud scenarios and the controls intended to mitigate them, so it can help demonstrate that each significant risk has an associated control. This mapping can support both control design, highlighting scenarios with no or weak mitigating controls, and control assessment, by giving assurance functions a basis to test whether controls are appropriately designed and operating effectively. It is worth distinguishing control design from operating effectiveness: a register may show a control exists on paper, but separate testing is generally needed to confirm it works in practice. The register itself is a tool to organize this work, not evidence that controls are effective.

Common misconceptions

A fraud risk register is a compliance checklist that, once completed, satisfies the organization's fraud risk obligations.
A register is a tool that supports an ongoing fraud risk management process, not a one-time deliverable. It generally requires periodic reassessment, and its existence does not by itself demonstrate that controls are effective or that any legal or framework expectation has been met.
The board owns and maintains the fraud risk register.
In many governance structures, management owns the day-to-day identification, assessment, and treatment of fraud risks and maintains the register, while the board or an audit/risk committee typically provides oversight and challenge. Conflating these roles misstates where accountability sits.
Listing a control against a risk means the residual risk is low.
Mapping a control does not establish that it is well designed or operating effectively. Residual risk should reflect an assessment of the control's design and operating effectiveness; a documented control that is untested or poorly designed may leave significant residual exposure.

Best practices

Assess and record inherent and residual fraud risk separately, and evaluate likelihood and impact as distinct dimensions rather than a single combined score.
Assign a named owner to each fraud risk within management, and clarify in the register which line of defense manages the risk versus which function provides assurance or oversight.
Map each risk to specific preventive and detective controls, and distinguish control design from tested operating effectiveness so that residual ratings are supportable.
Reference risk responses against a clearly defined and board-approved risk appetite and tolerance, and note where a risk exceeds appetite so escalation can occur.
Establish a regular review cadence and refresh the register when the business, external environment, or fraud landscape changes, rather than treating it as a static document.
Ensure the register feeds into board or committee reporting so oversight bodies receive a clear view of significant fraud risks, changes, and remediation status.