If a fraud happened tomorrow, could your organisation show that its fraud prevention procedures were reasonable? Since 1 September 2025, the UK offence of failure to prevent fraud (Economic Crime and Corporate Transparency Act 2023, section 199) can make large organisations liable for fraud committed by employees, agents and other associated persons to benefit the organisation or its clients. The defence is having reasonable fraud prevention procedures in place. Outside the UK, boards, audit committees and external auditors expect the same thing: a documented, explainable fraud risk assessment.
The Fraud Risk Assessment Engine delivers that assessment in one workbook, following the approach of the COSO and ACFE Fraud Risk Management Guide.
Scheme library. 81 fraud schemes in five categories: internal fraud, financial reporting fraud, external fraud, fraud by associated persons for the organisation's benefit, and sector-specific schemes. Each scheme lists its typical perpetrator, fraud triangle drivers and red flags. Ten sector defaults switch on the schemes that fit the organisation.
Inherent risk. Likelihood times impact (1 to 25) across financial, regulatory, reputational and operational impact, with fraud triangle prompts that suggest a likelihood and a written rationale required for every active scheme.
Controls and residual risk. 55 controls rated for design and operating effectiveness. Preventive controls lower likelihood, detective controls lower impact, and stale tests are capped. Category scores use the average of the top three schemes, so severe risks are never diluted by minor ones, and a Very High scheme holds the overall rating at High or above. Every category is checked against risk appetite, with breaches shown first.
Reasonable procedures. A self-assessment against the six principles in the UK Home Office guidance of 6 November 2024: top-level commitment, risk assessment, proportionate procedures, due diligence, communication and training, and monitoring and review. 26 questions are scored on a maturity scale with evidence and gaps.
Outputs. A heat map before and after controls, an associated persons register, an action plan that raises gaps automatically with owners and due dates, and a one-page board summary with ratings, change on last year, the top 10 schemes, the top 5 actions and a three-line sign-off.
Six jurisdiction profiles are included: Global, United Kingdom, United States, Canada, Australia and European Union. Every weight and threshold sits on a protected Settings sheet, and the 15 regulatory references are reviewed and dated on their own sheet. The workbook has 17 sheets and 8,613 formulas with zero formula errors, and needs Microsoft Excel 2016 or later. It contains no macros.
The primary document is the full workbook. The secondary document is a ZIP file with a DEMO workbook built on a fictional sample organisation with a guided "Try this" exercise, the User Guide, the Access Keys for the Admin, Risk Lead and Analyst roles, and the Terms of Use. One licence covers one legal entity.
This is a decision-support tool. It records the organisation's own fraud risk assessment and does not give legal advice or guarantee a defence.
Got a question about the product? Email us at support@flevy.com or ask the author directly by using the "Ask the Author a Question" form. If you cannot view the preview above this document description, go here to view the large preview instead.
Source: Best Practices in Compliance, Fraud Excel: Fraud Risk Assessment Engine for Failure to Prevent Fraud Excel (XLSX) Spreadsheet, FinGuard Studio