Which of the following lists the steps in a typical fraud risk assessment in correct order?

• A. Identify risk factors; implement mitigations; monitor and re-evaluate; determine controls; assess likelihood and impact
• B. Determine controls; Identify risk factors; implement mitigations; monitor and re-evaluate; assess likelihood and impact
• C. Identify risk factors; assess likelihood and impact; determine controls; implement mitigations; monitor and re-evaluate
• D. Monitor and re-evaluate; identify risk factors; assess likelihood and impact; determine controls; implement mitigations

Answer: (C)

The main idea is following a logical risk-management flow: first uncover where fraud could occur, then judge how likely it is and how big the impact would be, then decide what controls are needed, put those mitigations in place, and finally keep an eye on them to see if they’re working and adjust as conditions change.

Identifying risk factors means spotting the specific scenarios, processes, or control gaps that could enable fraud. Once you know what could go wrong, you evaluate both how likely those risks are and how severe the consequences would be. This prioritizes where attention is needed. After that, you determine which controls would address those prioritized risks—think policies, segregation of duties, access controls, reconciliations, and other preventive or detective measures. With a plan in place, you implement the chosen mitigations. Finally, you monitor and re-evaluate to confirm the controls are effective, remain appropriate as the business or environment changes, and adjust them if new risks emerge.

Starting with controls or monitoring before you’ve identified and assessed risks would be premature, and attempting to monitor or re-evaluate without having implemented controls wouldn’t yield actionable insight.