0 / 24

Model 60 of 74 · Risk & Compliance

Fraud & Financial Crime Maturity Assessment

Assess how well your organisation prevents, detects, and responds to fraud, bribery, and financial crime.

Pillars & areas

Assess

Understand the threat

  1. 01Governance & Fraud Risk Assessment
  2. 02Prevention Controls

Prevent

Stop it happening

  1. 03Detection & Monitoring
  2. 04Investigation & Response

Respond

Find and act fast

  1. 05Bribery, Money Laundering & Sanctions
  2. 06Culture, Awareness & Speak-Up

Levels

  1. 1Loss-DiscoveredFound by accident
  2. 2SafeguardedAssessed & controlled
  3. 3Fraud-ResilientDesigned-in & data-led

01 Governance & Fraud Risk Assessment

Is fraud and financial crime risk owned by leadership and assessed systematically?

0/4 answered

GR-1Who is responsible for managing fraud and financial crime risk?

Think about whether a named senior person owns this risk and has the authority and resources to manage it.

GR-2How does your organisation identify and assess its fraud and financial crime risks?

Consider whether you have systematically thought through how someone could defraud the organisation, or use it for financial crime.

GR-3How are fraud and financial crime risks considered when the organisation changes?

Think about new products, systems, suppliers, markets, payment methods or restructures, which often create new opportunities for fraud.

GR-4How does the board receive information about fraud and financial crime?

Consider whether the board knows about losses, near misses, open investigations and the state of key controls.

02 Prevention Controls

Are processes designed to stop the most likely fraud schemes before losses occur?

0/4 answered

PV-1How well are duties separated in financial processes?

Think about whether one person can set up a supplier, approve an invoice and release the payment.

PV-2How are changes to supplier or employee bank details verified?

Payment diversion through fake change-of-bank-details requests is one of the most common frauds. Consider how requests are checked.

PV-3How does your organisation check the third parties it works with?

Consider suppliers, customers, agents, partners and grant recipients — do you know who they really are?

PV-4How does your organisation protect itself against impersonation and cyber-enabled fraud?

Think about invoice fraud, fake executive requests, compromised email accounts and similar scams.

03 Detection & Monitoring

Is suspicious activity spotted quickly through monitoring, analysis and reporting channels?

0/4 answered

DM-1What routine checks help detect fraud?

Consider reconciliations, reviews of exception reports and management checks that might reveal irregularities.

DM-2How does your organisation use data to detect fraud?

Think about whether anyone analyses payment, payroll, expenses or procurement data for duplicates, anomalies or red flags.

DM-3How are high-risk transactions and activities monitored?

Consider large or unusual payments, cash handling, high-risk customers, and transactions in high-risk jurisdictions.

DM-4How does your organisation know whether its detection is effective?

Think about how fraud is typically discovered in your organisation — by controls, by tip-offs, or by accident.

04 Investigation & Response

Are suspected incidents investigated professionally, with losses recovered and lessons learned?

0/4 answered

IR-1What happens when fraud is suspected?

Consider whether there is a plan that sets out who does what when a concern is raised.

IR-2How are investigations carried out?

Think about whether investigators have the right skills and follow proper standards, including fairness to the people involved.

IR-3How does your organisation pursue recovery and accountability?

Consider whether losses are recovered and whether consistent action is taken against those responsible.

IR-4How are lessons from incidents used to strengthen defences?

Think about whether each incident leads to a review of how it happened and what controls failed.

05 Bribery, Money Laundering & Sanctions

Does the organisation prevent bribery and avoid being used for money laundering or sanctions evasion?

0/4 answered

FC-1How does your organisation prevent bribery and corruption?

Consider gifts and hospitality, intermediaries and agents, facilitation payments and conflicts of interest.

FC-2How does your organisation manage money laundering risk?

If you are in a regulated sector, think about your legal obligations. If not, consider how you avoid accepting criminal funds — for example through donations, cash payments or overpayments and refunds.

FC-3How does your organisation comply with financial sanctions?

Consider whether customers, suppliers, partners and payments are screened against sanctions lists.

FC-4How are suspicions reported to the authorities where required?

Think about suspicious activity reports, regulatory notifications and reporting to law enforcement.

06 Culture, Awareness & Speak-Up

Do people understand fraud risks, feel able to raise concerns, and see leaders act on them?

0/4 answered

CS-1How do leaders demonstrate that fraud and dishonesty are not tolerated?

Think about whether leaders talk about fraud risk, follow the rules themselves, and respond consistently to misconduct.

CS-2How are staff made aware of fraud and financial crime risks?

Consider whether training is relevant to people's roles and helps them recognise real schemes.

CS-3How easily can people raise concerns about fraud or wrongdoing?

Think about whether staff, suppliers and others have safe, confidential ways to report concerns, including anonymously.

CS-4How are people who raise concerns treated?

Consider whether people who speak up are protected and thanked, or face negative consequences.

Self-assessment report

Fraud & Financial Crime

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Fraud & Financial Crime maturity model

Fraud and financial crime affect every kind of organisation. Payment diversion scams target small businesses and charities as readily as large corporations, insiders exploit weak controls, suppliers inflate invoices, and criminals use legitimate organisations to move money or evade sanctions. Losses are often discovered by accident, long after the damage is done, and the reputational and legal consequences can far exceed the money lost.

This model assesses fraud and financial crime as an organisational capability rather than a compliance checklist. It looks at whether leaders take ownership, whether risks are understood, whether controls are designed to prevent the most likely schemes, whether suspicious activity is spotted quickly, whether incidents are investigated and learned from, and whether people feel able to speak up. Some questions cover anti-money laundering and sanctions obligations; organisations outside regulated sectors should answer them in terms of how they avoid being used for these crimes by customers, suppliers and partners.

The Fraud & Financial Crime maturity model contains 24 questions across 6 areas: governance and fraud risk assessment, prevention controls, detection and monitoring, investigation and response, financial crime compliance (bribery, money laundering and sanctions), and culture, awareness and speak-up. Each question describes three levels of maturity through concrete practices. It is designed for organisations of all sizes and sectors, from small charities to regulated financial institutions.

Who this assessment is for

  • Finance directors, CFOs and financial controllers
  • Fraud, financial crime and compliance teams, including MLROs where applicable
  • Risk managers and internal auditors
  • Procurement and accounts payable leaders
  • Trustees and board members of charities and smaller organisations

The three maturity levels

  • Level 1 — Loss-Discovered: Fraud and financial crime are not seen as significant risks, and nobody is clearly responsible for managing them. Controls rely on trust and a few individuals, so segregation of duties is weak and supplier or payment changes are rarely verified. Incidents are discovered by accident, often long after losses have occurred, and responses are improvised. Staff are unsure how to report concerns and may fear the consequences.
  • Level 2 — Safeguarded: A named leader owns fraud and financial crime risk, and a risk assessment identifies the most likely schemes. Key preventive controls — segregation of duties, verification of payment changes, due diligence on third parties — are in place and tested. Suspicious activity is reviewed using defined checks, a response plan guides investigations, and staff are trained and know how to report concerns safely.
  • Level 3 — Fraud-Resilient: Preventing fraud and financial crime is designed into how the organisation operates. Risk assessments are refreshed as threats evolve, controls are proportionate and tested against real schemes, and data analysis spots unusual activity quickly. Investigations are professional and lead to recovery, accountability and improved controls. People at every level understand the risks, feel safe speaking up, and see leaders act on concerns.

The 6 areas assessed

1. Governance & Fraud Risk Assessment

The foundations of the organisation's approach to fraud and financial crime. This area covers leadership ownership and policy, the identification and assessment of fraud and financial crime risks, risk appetite, and reporting to the board.

2. Prevention Controls

How the organisation prevents fraud and financial crime. This area looks at segregation of duties and authorisation, verification of payments and changes to bank details, due diligence on third parties, and protections against impersonation and cyber-enabled fraud.

3. Detection & Monitoring

How the organisation detects fraud and financial crime that gets past preventive controls. This area covers routine checks and reconciliations, data analysis, monitoring of high-risk activity, and how detection effectiveness is measured.

4. Investigation & Response

How the organisation responds when fraud or financial crime is suspected. This area covers response planning, investigation standards, recovery and sanctions, and learning from incidents.

5. Bribery, Money Laundering & Sanctions

How the organisation manages wider financial crime obligations. This area covers anti-bribery and corruption controls, anti-money laundering measures proportionate to the organisation's exposure, sanctions screening, and reporting of suspicious activity to authorities where required.

6. Culture, Awareness & Speak-Up

The human side of fraud prevention. This area looks at tone from the top, training and awareness, whistleblowing and speak-up arrangements, and the organisation's response to people who raise concerns.

How this model relates to other frameworks

This is an original, simplified maturity model and is not derived from or intended to replace any of the following. However, organisations that use this assessment may also find value in these established frameworks:

  • COSO / ACFE Fraud Risk Management Guide — guidance on establishing a fraud risk management programme
  • ISO 37001 (Anti-bribery management systems) — an international standard for anti-bribery controls
  • FATF Recommendations — international standards on combating money laundering and terrorist financing
  • UK Bribery Act 2010 and Economic Crime and Corporate Transparency Act 2023 — examples of legislation creating corporate offences for failing to prevent bribery and fraud
  • ISO 37002 (Whistleblowing management systems) — guidelines for effective speak-up arrangements

Frequently asked questions

What is the Fraud & Financial Crime maturity model?

Assess how well your organisation prevents, detects, and responds to fraud, bribery, and financial crime. It is an original, simplified model with three maturity levels (Loss-Discovered, Safeguarded and Fraud-Resilient), assessed through 24 questions across 6 areas: Governance & Fraud Risk Assessment, Prevention Controls, Detection & Monitoring, Investigation & Response, Bribery, Money Laundering & Sanctions and Culture, Awareness & Speak-Up.

How long does the Fraud & Financial Crime assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Loss-Discovered), 2 (Safeguarded) or 3 (Fraud-Resilient). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.