Fraud control
Fraud control protects the organization's resources and integrity, and it is most tested when a disruption weakens the controls that normally prevent and detect fraud.
This annex is informative. Annex A names the discipline and does not define it. A finding cannot rest on the annex alone. The guidance it supports is clause 5.8, and the evidence on this page is our interpretation of what that support looks like in practice.
What Annex A says
Annex A names fraud control as a supporting discipline; it does not prescribe a framework. In clause 5.8 terms, the contribution is the prevention, detection and response to fraudulent acts by insiders or outsiders. Disruption raises the risk: emergency purchasing, manual payments, remote access and rushed approvals all create openings. The resilience question is whether the controls can be relaxed for speed and then restored, and whether anyone is watching while they are relaxed.
Why it matters
Fraud is an interesting test of resilience because it is both a risk to be managed and a behaviour that flourishes when governance is under strain. A crisis response that bypasses controls without a log creates a future investigation. The discipline supports the governance attribute: the organization needs a way to authorize an exception, record it and review it afterwards. That is not bureaucracy for its own sake. It is how the organization can move fast and still be able to explain what it did.
What good looks like
Identify the controls that would be relaxed in a disruption and the compensating monitoring for each. Define who can approve an exception, how it is logged and when it is reviewed. Include emergency payments and manual procurement in the test. Review the fraud risk assessment when the operating model or the crisis arrangements change. Feed the lessons into the improvement loop.
Evidence a reviewer asks for
There is no ISO certification or accredited assessment scheme for ISO 22316. The assessor here is your internal auditor, a customer assurance team or a consultant.
An assessor will ask how the organization can move fast in a crisis without losing the ability to detect fraud. An exception protocol with a log and a review is stronger than an untested claim that controls always hold.
- Fraud risk assessment The fraud risks, including those created by disruption and emergency authority
- Exception protocol Which controls may be relaxed, who approves, how it is logged and when it is reviewed
- Monitoring evidence The compensating monitoring in place during an exception, with the review
- Investigation lessons Fraud or near-miss cases and the control changes they produced
Where it commonly fails
- Emergency purchasing has no log or retrospective review.
- Controls are either fully enforced or silently abandoned.
- Fraud risk is assessed only in steady-state conditions.
What to do before the second edition
Ask what happened to the last emergency purchase. If no one can trace the approval and the delivery, the exception protocol is missing.