Conduct a fraud risk assessment of the grants acquittal process

What is going on

Two events have unsettled the audit and risk committee: an acquittal irregularity at Wimmera Community Transport where supplier invoices appear duplicated across two grants, and an internal audit finding of undeclared conflicts among regional assessors. The committee has asked for a fresh fraud risk assessment of the grants acquittal process before its October meeting. The fraud and corruption control plan commits the department to verify a sample of acquittals and to introduce payment analytics, but the analytics tool is still in evaluation. Theo Lindqvist, the fraud control officer, wants the process mapped, the risks rated, treatments proposed and the risks entered in the register.

Your brief

Map the acquittal process from final payment to verification, identify where a false or inflated claim could pass undetected, rate each fraud risk before and after existing controls, propose proportionate treatments with owners and dates, enter the risks in the risk register and write a short report the fraud control officer can table at the committee.

Work through it

You do not need to do it all. Doing a few of these will show you what the work is like. Your ticks and notes stay on this device.

• Read the Fraud and Corruption Control Policy and the Fraud and Corruption Control Plan 2026 to 2028 and note the acquittal-related risks and actions already committed.
• Map the acquittal process step by step using the Grant Application Assessment Procedure and the Grants Register, identifying who does what, which records are created and where verification happens.
• Review the Wimmera case RC-26-0198 in the Compliance and Investigations Register and the existing risk entries in the Risk, Incident and Security Register to understand how the irregularity got through.
• Identify fraud risks at each step, such as duplicated invoices, related party suppliers, unverified bank statements and assessor conflicts, and rate likelihood and consequence before and after current controls.
• Propose treatments for each high and medium risk using segregation of duties, verification, analytics and declarations, with an owner, a cost estimate and a due date.
• Enter each risk and treatment in the Risk, Incident and Security Register with the correct category and rating.
• Write a report of no more than four pages for the audit and risk committee summarising the method, the risk ratings, the treatments and what the committee is asked to decide.
• Classify the report under the Security Classification and Sensitive Information Procedure and file it with the working papers.

What someone in this role would produce

• Acquittal process map with control points
• Fraud risk assessment table with ratings before and after controls
• Treatment plan with owners, costs and dates
• Risk register entries
• Committee report