We need to re-think fraud risk management
While there's no shortage of better practice guidance on
risk management, this doesn't mean it's easy or that
organisations do it well.
Most advice includes the usual cycle of risk identification,
evaluation, treatment, monitoring, and feedback. But with fraud,
it's not that simple. The breadth of risks and ever-changing
approaches by fraudsters mean assessing risks can be a detailed
process requiring knowledge of both business processes and fraud
tactics. It's a challenge for many organisations to allocate
the time and resources to do this proactively. Sadly, those
resources become available to many only after an event draws
attention to their vulnerability in the worst possible way.
