Fraud Risk Management Program KPIs: 3 Proven Ways to Measure Success

A fraud risk management program is only as valuable as your ability to prove it works. Many companies follow the best practice of implementing a fraud risk management program (FRMP), but not all follow through in a way that leads to improvement over time. The Fraud Magazine article, “Measure and Monitor Your Fraud Risk Management Program Success,” encourages employers to evaluate the effectiveness of their fraud risk management programs using a variety of key performance indicators (KPIs). In doing so, companies are able to justify the importance of their FRMPs, identify overall business improvements, and modify their programs as needed to increase success.

3 Categories of Fraud Risk Management Program KPIs

In the following, we will identify and summarize the categories of KPIs discussed in the article.

Measures of Cost Recoveries and Savings

When evaluating the effectiveness of their fraud risk management program, it is important for companies to consider ways in which the program has improved overall business. The article states, “When it comes to making the business better, finding hidden money, cost recoveries, and dollar savings is quite often the most popular and measurable – especially when your audience is the CFO, COO, business managers and procurement professionals.” The article lists the following examples of KPIs related to these factors:

• Amount of dollars recovered from third parties via your prevention and detection activities.
• Number of fraud risk schemes identified and stopped.
• Reduced investigation and legal time and costs.
• Improved response times for investigations, employee training, reporting and remediation.
• Other ancillary benefits such as improved working capital, vendor optimization, per unit pricing comparisons, and contract compliance.

Measures of Program Acceptance

When assessing the effectiveness of a fraud risk management program, measures of program acceptance and implementation effort across an organization are beneficial. Examples of these KPIs include concrete steps taken to prevent fraud in all company operations and evidence that the program is being monitored and updated on an ongoing basis. According to the article, marketers refer to the measure of user acceptance as the net promoter score (NPS). The article states, “When developing any new fraud risk management solution, program or initiative, it’s always a good idea to ask an NPS question at the end to gauge people’s level of satisfaction at any given time, and over time, to demonstrate continuous program satisfaction by the most important group – your business customer, the end user.”

Risk Avoidance and Remediation KPIs

A third category of KPIs used to assess the effectiveness of a fraud risk management program are those that measure a reduction in litigation and regulatory risks and an increase in business transparency and culture of compliance. The article provides the following examples of KPIs related to these factors:

• Increased business transparency through the use of data analytics to monitor activities around vendors, customers, and employees.
• Improved collaboration and coordination across departments through the sharing of important data and insights.
• Improved culture of compliance based on employee surveys.
• Improved awareness and adherence to corporate policies, as shown by fewer incidents.
• Alignment with regulatory expectations, such as the U.S. Department of Justice (DOJ), U.S. Securities and Exchange Commission (SEC), FINRA, and Serious Fraud Office (SFO).
• Reduction in fines or violations over time.

An anonymous fraud hotline is one of the most practical sources of data for these KPIs. Hotline reports can reveal schemes that controls missed, and tracking those reports in a case management system makes it easier to measure investigation response times, report trends, and remediation outcomes over the life of your fraud risk management program.

3 DOJ Questions Every Fraud Risk Management Program Should Answer

The article closes by listing the following three questions, drawn from the DOJ’s Evaluation of Corporate Compliance Programs (updated March 2023), that companies should be able to answer from reflecting on the effectiveness of their fraud risk management program:

• Is the corporation’s compliance (FRM) program well designed?
• Is the program being applied earnestly and in good faith? In other words, is the program adequately resourced and empowered to function effectively?
• Does the corporation’s compliance program work in practice?

Answering these questions allows companies to identify their programs’ strengths and weaknesses and to set goals for improvement. These goals can then be monitored using the above KPIs. The process of implementing and evaluating the effectiveness of a fraud risk management program is an ongoing cycle. Continued engagement in this process allows for continuous improvements in fraud prevention practices.

Strengthen Your Fraud Risk Management Program with Red Flag Reporting

Red Flag Reporting’s ethics, safety, and fraud hotline gives employees a confidential, anonymous way to raise concerns, and our case management tools help you document every report from intake to resolution, giving your fraud risk management program the data it needs to demonstrate results. With no administrator license fees, it is an affordable way to put measurable fraud prevention in place. Contact us today to request a quote or a demo.

Frequently Asked Questions About Fraud Risk Management Program KPIs

What is a fraud risk management program?

A fraud risk management program is an organization’s structured set of policies, controls, and processes for preventing, detecting, and responding to fraud. The COSO/ACFE Fraud Risk Management Guide organizes an effective program around five principles: fraud risk governance, fraud risk assessment, fraud control activities, fraud investigation and corrective action, and fraud risk management monitoring activities.

Which KPIs should you use to measure a fraud risk management program?

Most fraud risk management program KPIs fall into three categories: cost recoveries and savings (such as dollars recovered and schemes stopped), program acceptance (such as employee adoption and satisfaction), and risk avoidance and remediation (such as fewer incidents, fewer fines, and alignment with regulatory expectations). The right mix depends on how mature your program is and who you are reporting to.

How can a net promoter score measure fraud risk management program acceptance?

A net promoter score asks people how likely they are to recommend something on a scale of 0 to 10, then subtracts the percentage of detractors (0 to 6) from the percentage of promoters (9 or 10). Asking this question after rolling out a new fraud prevention initiative, and again over time, shows whether the employees and managers who use the program actually support it.

How does the DOJ evaluate a fraud risk management program?

When prosecutors assess a company’s compliance program, the DOJ’s Evaluation of Corporate Compliance Programs guides them to ask three fundamental questions: whether the program is well designed, whether it is adequately resourced and empowered to function effectively, and whether it works in practice. Documented KPIs are one of the clearest ways to answer that third question.

How does an ethics hotline support a fraud risk management program?

Tips have consistently been the most common way occupational fraud is detected, according to the ACFE’s research, so a hotline is often the backbone of fraud detection. A hotline also generates measurable data, such as report volume, report types, and time to resolution, that feeds directly into your fraud risk management program KPIs.