Corruption Risk Management

Corruption risk management is the second of the ten components in the Queensland Crime and Corruption Commission's Fraud and Corruption Control Framework. It applies the generic risk management process set out in AS/NZS ISO 31000:2009 specifically to the risks of fraud and corrupt conduct, giving agencies a structured, repeatable method for deciding where to focus limited prevention and detection resources.

1 Establish the context

The process begins by establishing the context in which risk will be assessed: the organisation's strategic objectives, its operating environment, its legislative obligations, and the scope of the assessment itself, whether agency-wide or limited to a particular business unit or function. This step also fixes the risk criteria the organisation will use in later steps, such as the definitions of likelihood and consequence bands, so that assessments carried out in different parts of the organisation, or at different times, remain comparable.

2 Identify the risks

The identification step draws out specific fraud and corruption risks facing the organisation using a range of techniques. Common techniques include maintaining a fraud register that logs past incidents and near misses, mapping business processes as flow charts to expose points of unsupervised discretion or weak separation of duties, conducting SWOT-style analysis of control environments, and running structured scenario analysis workshops in which staff imagine plausible fraud or corruption schemes and trace how they could occur undetected.

The Crime and Misconduct Commission's 2004 survey Profiling the Queensland Public Sector identified recurring areas of elevated corruption risk that remain a reference point for identification exercises: financial functions (such as payroll, accounts payable, and cash handling); construction, development, and planning approvals; regulatory and enforcement functions; licensing; procurement; and, more generally, any function that involves the exercise of significant individual discretion over decisions with financial or commercial consequences for external parties. These categories overlap substantially with the risk areas discussed in Grand and Petty Corruption and with the detection pathways described in Pathways to Corruption Detection.

3 Analyse the risks

Once identified, each risk is analysed using a likelihood-by-impact matrix, with both dimensions typically scored on a five-point scale (for example, from "rare" to "almost certain" for likelihood, and from "insignificant" to "catastrophic" for impact or consequence). Multiplying or combining these two scores produces a raw or inherent risk rating for each identified risk, reflecting its severity before considering existing controls.

4 Evaluate the risks

The evaluation step translates the numerical rating produced by the analysis matrix into a qualitative risk band, commonly labelled Severe, High, Medium, Low, and Very Low. These bands allow the organisation to rank risks against each other and to set thresholds for escalation, for example requiring that any risk rated Severe or High be reported directly to the Audit Committee or Chief Executive as part of the coordination mechanisms established elsewhere in the framework.

5 Treat the risks

The final step selects a treatment strategy for each risk. AS/NZS ISO 31000:2009 identifies several generic treatment options that apply equally to fraud and corruption risk: accepting the risk where it falls within tolerance, reducing the likelihood of the risk occurring (for example, through stronger internal controls), reducing the consequence if the risk does eventuate (for example, through insurance or contractual indemnities), transferring the risk to a third party, or avoiding the risk entirely by ceasing the activity that gives rise to it.

The guide invokes Warren Buffett's often-cited 1991 remarks to staff of Salomon Brothers, made while he was serving as interim chairman during the firm's bond-trading scandal, in which he warned that the firm could afford to lose money, even a great deal of money, but could not afford to lose reputation, even a shred of it. The guide uses this to argue that reputational consequence, not just direct financial loss, must be weighted heavily when evaluating and treating corruption risk in the public sector, where public trust is the underlying asset at stake.

6 The Fraud Risk Register

The output of the risk management process is typically consolidated into a Fraud Risk Register, a standalone document that is treated as more sensitive and subject to tighter access restriction than the general fraud and corruption control plan, since it can itself function as a roadmap to the organisation's weakest points if it falls into the wrong hands. A well-constructed register records, for each identified risk: a description of the risk; the underlying risk factors or vulnerabilities that give rise to it; an inherent likelihood, consequence, and rating (before controls); a residual likelihood, consequence, and rating (after existing controls are taken into account); the risk owner responsible for managing it; and the specific action required to further treat the risk, together with a timeframe and responsible officer.

7 Alternative methodologies

While the guide's core process follows AS/NZS ISO 31000:2009, it also acknowledges the Committee of Sponsoring Organizations of the Treadway Commission's Fraud Risk Management Guide (2016) as a widely used alternative methodology, particularly among organisations already using COSO's broader internal control framework. The COSO guide organises fraud risk management around five principles covering governance, risk assessment, control activities, investigation, and monitoring, and is frequently used in tandem with the internal controls component of the framework, since COSO's internal control model underpins both.

See also: Fraud and Corruption Control Framework, Internal Controls Against Corruption, Measuring Corruption.

References

1. Crime and Corruption Commission (Queensland), Fraud and Corruption Control: Best Practice Guide, March 2018, ISBN 978-1-876986-86-5.
2. Standards Australia / Standards New Zealand, AS/NZS ISO 31000:2009 Risk Management: Principles and Guidelines.
3. Crime and Misconduct Commission (Queensland), Profiling the Queensland Public Sector, 2004.
4. Committee of Sponsoring Organizations of the Treadway Commission (COSO), Fraud Risk Management Guide, 2016.
5. Warren Buffett, remarks to Salomon Brothers staff, 1991.