Fraud is not a component of the GRC framework. It has its own legal definitions, its own professional disciplines, its own specialist investigators, and its own regulatory and law enforcement ecosystem that operates largely independently of the governance, risk, and compliance structures that this publication has addressed in the preceding sections. The ISO is not a fraud examiner, and the security programme is not designed as an anti-fraud instrument in the way that financial controls, procurement governance, and the internal audit function’s fraud detection mandate are.
Yet the ISO is increasingly drawn into fraud-related work, and the frequency with which this happens reflects a structural reality of the modern fraud landscape rather than a confusion about professional boundaries. The vast majority of significant fraud events in contemporary organisations either originate in, are enabled by, are concealed through, or leave their most recoverable evidence within the digital environment that the ISO is responsible for governing. Fraudulent financial misrepresentation requires access to financial systems. Insider fraud requires the abuse of access privileges that the access management framework governs. External fraud through impersonation, social engineering, and account compromise uses the techniques and exploits the vulnerabilities that the information security programme exists to defend against. And when fraud is suspected or discovered, the digital forensic evidence that establishes what happened, who was responsible, and what the organisation’s liability exposure is resides in the systems, logs, communications, and access records that the ISO’s programme generates and maintains.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
