In anti-fraud strategy, how should risk assessment be conducted?

• A. It is optional and rarely used.
• B. By comparing to industry benchmarks alone.
• C. It is conducted only after a fraud incident.
• D. It is a systematic process to identify, assess, and prioritize fraud risks to tailor controls.

Answer: (D)

A systematic, proactive risk assessment is the key. In anti-fraud work, this process identifies where fraud could occur, evaluates how likely each risk is and what its impact would be, and then prioritizes them so controls can be tailored to the specific threats. This lets you design and allocate controls where the risk is highest, rather than relying on industry benchmarks alone or waiting for a fraud incident. Benchmarks can provide context, but they don’t capture your organization’s unique processes, data flows, access controls, and known gaps. Conducting the assessment only after a fraud incident misses chances to prevent or quickly detect problems, which can lead to greater losses. So, the best practice is a regular, systematic risk assessment that identifies, assesses, and prioritizes fraud risks to shape the controls you implement.