APPENDIX
F1:
SAMPLE
FRAUD
CONTROL
POLICY
FRAMEWORK
The
information
in
this
appendix
can
serve
as
an
outline
of
the
key
elements
to
be
considered
in
drafting
a
fraud
control
policy.
1. Policy
Statement
A. Management’s
statement
regarding
fraud
tolerance
or
attitude
about
fraud
B. Management’s
commitment
to
ethical
business
practices
2. Definitions
A. Definition
of
fraud
B. Definitions
of
other
referenced
terms
3. Fraud
Control
Strategy
A. Roles
and
responsibilities
i. Board
of
Directors
ii. Executive
or
Senior
Management
a. Fraud
Control
Officer
iii. Legal
Department
iv. Human
Resources
Department
v. Internal
Audit
Department
vi. Other
management
and
employees
B. Elements
of
management’s
fraud
risk
management
program
i. Fraud
risk
governance
ii. Fraud
risk
assessment
iii. Fraud
prevention
and
detection
iv. Fraud
investigations
and
corrective
action
v. Fraud
monitoring
C. Relationship
to
Code
of
Business
Conduct
and
other
relevant
corporate
policies
(i.e.,
employee
handbook,
conflicts
of
interests,
FCPA
/
anti-‐corruption
compliance
policy,
expense
reimbursements,
etc.)
4. Fraud
Risk
Assessment
A. Fraud
risk
assessment
objectives
B. Fraud
risk
assessment
methodology
C. Fraud
risk
assessment
participants
D. Management’s
response
to
fraud
risk
assessment
results
5. Fraud
Prevention
and
Detection
Controls
A. Business
process
control
activities
B. Physical
access
control
activities
C. Logical
access
control
activities
D. Transaction
control
activities
E. Technological
control
activities
-‐-‐
F1-‐1
-‐-‐
F. Conflicts
of
Interest
G. Human
Resource
procedures
i. Pre-‐employment
screening
ii. Periodic
screening
activities
iii. Compensation
and
performance
measures
iv. Training
v. Exit
interviews
H. Segregation
of
duties
I. Authority
and
responsibility
limits
J. Fraud
Detection
procedures
i. Data
analytics
ii. Whistleblower
systems
6. Fraud
Reporting
A. Reporting
requirements
for
management
and
employees
i. Examples
of
types
of
issues
to
be
reported
B. Channels
for
reporting
concerns,
complaints
or
violations
i. Hotline
ii. Website
iii. Electronic
mail
(“email”)
address
iv. Letters
to
board
of
directors
or
designated
personnel
v. Chain-‐of-‐command
vi. Open
door
policy
C. Anonymous
reporting
vs.
confidentiality
reporting
D. Anti-‐retaliation
or
whistleblower
protection
statement
for
personnel
who
report
concerns,
complaints
or
violations
of
fraud
E. Reporting
by
third
parties
7. Fraud
Investigation
Procedures
A. Evaluation
of
reports
B. Escalation
of
reports
C. Retention
of
reports
D. Investigation
resources
E. Investigation
protocols
F. Communicating
investigation
results
G. Disciplinary
action
H. Corrective
action
I. Recovery
and
restitution
J. Evaluation
of
investigation
performance
8. Fraud
Monitoring
Activity
A. Areas
of
fraud
monitoring
evaluation
B. Scope
and
frequency
of
fraud
monitoring
evaluation
activities
C. Fraud
monitoring
evaluation
criteria
-‐-‐
F1-‐2
-‐-‐
D. Sources
of
information
(or
“data
inputs”)
for
fraud
monitoring
evaluation
activities
E. Communicating
results
of
fraud
monitoring
evaluation
activities
-‐-‐
F1-‐3
-‐-‐
