Which statement is NOT typically a core component of a robust anti-fraud program?

• A. Tone at the top, strong internal controls, risk assessment, training, investigation capabilities, and monitoring.
• B. Formal whistleblower mechanism and anonymous reporting.
• C. Regular independent evaluations of controls.
• D. Vague policies without concrete procedures.

Answer: (D)

A robust anti-fraud program relies on clear, actionable guidance that translates governance into everyday controls. When policies are vague and lack concrete procedures, they don’t provide the specific steps, roles, thresholds, and escalation paths that employees and managers need to prevent, detect, and respond to fraud. Without that detail, risk assessments can’t drive targeted controls, training isn’t focused where it’s most needed, and investigation and monitoring can’t be reliably executed or measured. The other components—strong tone at the top with visible commitment, solid internal controls and risk assessment, focused training, capable investigation functions, reliable monitoring, a formal whistleblower mechanism with anonymous reporting, and periodic independent evaluations—form a cohesive, proactive framework. They establish accountability, facilitate detection, and provide assurance, whereas vague policies without concrete procedures leave critical gaps that fraudulent activity can slip through.