Cultivating an Anti-Fraud Culture

The preceding sections of this publication’s fraud domain have addressed the identification of fraud risks, the detection of fraudulent activity, and the strategic governance of the fraud risk management programme. This section addresses the two disciplines that determine whether the fraud risk management framework delivers sustained effectiveness over time rather than the point-in-time adequacy that deteriorates without the measurement and cultural disciplines that continuous improvement requires. Measuring fraud resistance provides the evidence-based assessment of how well the organisation’s controls, processes, and people are actually performing against the fraud threat. Building an anti-fraud culture creates the organisational conditions in which those controls and processes are genuinely followed rather than nominally observed, and in which the workforce’s collective vigilance provides the distributed fraud detection capability that technical controls alone cannot achieve.

The ISO’s contribution to both disciplines is substantial and distinctive. The security programme’s monitoring infrastructure provides the technical measurement data that fraud resistance assessment requires. The security awareness programme provides the cultural reinforcement vehicle that embeds anti-fraud awareness alongside information security awareness in the workforce’s operational consciousness. And the ISO’s governance authority and cross-functional relationships provide the organisational influence that effective anti-fraud culture embedding demands from the functions whose cooperation it requires.

Measuring Fraud Resistance #

Fraud resistance is the degree to which the organisation can prevent, detect, and respond to fraud through the combination of the controls it maintains, the culture it sustains, and the capabilities it deploys. Its measurement provides the governance intelligence that distinguishes an organisation that knows it has a fraud risk management programme from one that knows how well that programme is working, and the difference between these two states of knowledge is the difference between nominal governance and the genuine management capability that adaptive fraud risk management requires.