Run a fraud risk assessment for a business process
Brainstorms realistic fraud schemes for a process, assesses them against existing controls, and recommends prevention and detection fixes.
The prompt
Help me run a fraud risk assessment for a business process.
Process: [e.g. procurement, payroll, expenses, revenue recognition, inventory, customer refunds]
How it works: [KEY steps, roles, systems, approval limits]
Existing controls: [LIST]
Pressures and incentives: [e.g. aggressive targets, bonus structures, cost cuts, staff turnover]
Past incidents or allegations: [SUMMARY or "none known"]
Work through:
1. Fraud schemes - 8-12 realistic schemes for this process across asset misappropriation, corruption, and financial reporting fraud. For each: who could commit it (role), how, and how they would conceal it. Include collusion and management override scenarios.
2. Fraud triangle - for the main schemes, the likely pressure, opportunity, and rationalization.
3. Assessment table - columns: Scheme, Perpetrator role, Likelihood, Impact, Existing controls, Would controls prevent or detect it?, Residual risk.
4. Control gaps - especially segregation of duties, master data changes, manual overrides, and controls performed by the same person they are meant to check.
5. Recommendations - preventive and detective controls, including data analytics tests to run on the full population.
6. Red flags for managers and staff in this process.
Keep it practical, and do not accuse anyone: this assesses where fraud could happen, not who did it. If I describe a suspected live fraud, tell me to preserve evidence and involve legal before investigating.
Highlighted [brackets] are blanks to replace with your own details.
Fill in the blanks and use this promptMore Legal & Compliance prompts
What to fill in
- KEY steps, roles, systems, approval limits
- LIST
- SUMMARY or "none known"
How this prompt is built
This prompt follows the Few-Shot structure (Few-shot prompting). A few-shot prompt includes one or more worked examples of the input and the output you want, so the model can copy the pattern instead of guessing it.
Related prompts
- Check my AI workflow for privacy and data-protection risksMaps the personal and confidential data in an AI-assisted process and flags privacy and compliance risks to fix before launch.
- Write a suspicious activity report (SAR) narrativeA clear, chronological SAR narrative that answers who, what, when, where, why, and how, ready for compliance review.
- Assess subrecipient risk and plan grant monitoringA risk assessment and monitoring plan for organizations you pass grant funds to, scaled to their risk and aligned to your award terms.
- Run a HIPAA security risk assessment for a small practiceA structured security risk analysis covering where ePHI lives, threats, likelihood and impact ratings, and a documented remediation plan.