Assessing fraud risks across a UK rail company

Fraud prevention | read time: 3 min

A UK-based rail company engaged GoodCorporation to assess its exposure to fraud risks across its operations and strengthen its approach to fraud prevention. The work was undertaken in preparation for the UK’s failure-to-prevent fraud offence under the Economic Crime and Corporate Transparency Act (ECCTA), which is now in force.

The client wanted a clearer understanding of its fraud risks, including both fraud committed for the benefit of the organisation and fraud committed against it. The assessment also considered relevant activities carried out by third parties on the organisation’s behalf, recognising the potential for these relationships to contribute to its overall fraud exposure.

Our approach

GoodCorporation carried out a fraud risk assessment covering the client’s operations and any relevant activities undertaken on its behalf by third parties. The assessment considered both outward fraud, which is the focus of the ECCTA failure-to-prevent fraud offence, and inward fraud committed against the organisation.

GoodCorporation reviewed relevant documentation and engaged senior managers across the business, and third-party stakeholders, to identify the key fraud risks and understand the extent and effectiveness of any prevention measures.

The findings were consolidated into a fraud risk register covering both inward and outward fraud scenarios. Each risk was assessed according to its inherent risk, the effectiveness of any controls in place and its resulting risk rating and priority. This provided the client with a structured view of where its most significant exposures lay and where existing controls could be strengthened.

The assessment was then used to develop a prioritised action plan, giving the client a practical basis for strengthening its fraud prevention measures and focusing attention on the areas where further action was most needed.

Client outcomes

The assessment gave the client a comprehensive view of its fraud risk profile and a clear basis for prioritising improvements to its prevention measures.

The work provided:

A clear view of fraud exposure, covering both inward and outward fraud

Greater visibility of third-party risks, including those arising from activities undertaken on the organisation’s behalf

A structured assessment of existing controls, identifying where current measures were effective and where further strengthening was required

A prioritised basis for action, helping the client focus attention on its most significant fraud risks

A practical roadmap for fraud prevention, informed by the risks and control weaknesses identified

Considering inward and outward fraud together also enabled the client to identify areas where the same controls could help address different types of fraud risk. Measures such as due diligence, risk assessment and reporting mechanisms can support the prevention of both fraud committed for the benefit of an organisation and fraud perpetrated against it, allowing improvements to be considered more efficiently as part of the broader risk control programme.

Why it matters

The failure-to-prevent fraud offence increases the importance of understanding where fraud risks might arise in an organisation and whether the prevention procedures in place are sufficient in relation to those risks.

For organisations that rely on third parties to carry out important activities, understanding how fraud risks arise through these relationships is particularly important under the ECCTA. Organisations may face liability for fraudulent activity carried out by associated persons, making it important that fraud prevention measures extend beyond the organisation’s direct employees and operations.

Taking a broader view of inward and outward fraud can also help organisations make better use of their existing controls. Rather than treating different fraud risks as separate issues, organisations can identify where common preventative measures can address multiple exposures and where additional controls are needed.

A structured fraud risk assessment provides the basis for doing this. By identifying the most significant risks, assessing the controls in place and prioritising areas for improvement, organisations can move from a general understanding of fraud risk to a more targeted approach to prevention.

How GoodCorporation can help

GoodCorporation helps organisations assess and strengthen their approach to fraud prevention, including in preparation for the UK’s failure-to-prevent fraud requirements. Our assessments consider how fraud risks arise across an organisation’s operations and through relevant third parties, combining document review and stakeholder engagement with structured risk analysis.

Our work can help organisations understand their fraud exposure, assess the effectiveness of existing controls and develop a prioritised programme of action to strengthen fraud prevention.

Find out more about our fraud prevention services or download our Fraud Prevention Framework for a structured approach to assessing and strengthening fraud prevention controls. You can also get in touch with our team to discuss your requirements.

work with us