Fraud and Corruption Control Framework

The Fraud and Corruption Control Framework is a ten-component best-practice model for public sector agencies to prevent, detect, and respond to public corruption and fraud. It was articulated by the Queensland Crime and Corruption Commission (CCC) in its March 2018 publication Fraud and Corruption Control: Best Practice Guide, with a foreword by then Chairperson Alan MacSporran QC. The framework draws heavily on Australian Standard AS 8001:2008 (Fraud and Corruption Control) and AS/NZS ISO 31000:2009 (Risk Management), and is intended to give Queensland public sector agencies a practical, auditable structure for integrity work rather than a purely aspirational statement of values.

1 The integrity framework hierarchy

The CCC situates fraud and corruption control within a broader constitutional and legislative hierarchy specific to Queensland. At the apex sits the Constitution of Queensland 2001, which establishes the basic architecture of government. Beneath it, two parallel legislative streams shape the integrity environment. The first, comprising the Parliament of Queensland Act 2001 and the Public Service Act 2008, governs conduct and discipline within the public service. The second, comprising the Public Sector Ethics Act 1994 (PSE Act) and the Public Interest Disclosure Act 2010 (PID Act), articulates the values underpinning ethical public administration and protects those who report wrongdoing.^[1]

These streams converge in what the guide calls the six components of an integrity framework: legislation, policies, plans, codes of conduct, workplace culture, and the fraud and corruption control framework itself. The fraud and corruption control framework is therefore not a stand-alone compliance exercise but one node in a wider integrity system that also depends on lawful authority, documented policy, operational planning, behavioural standards, and an organisational culture that supports honest conduct.

2 Defining fraud and corruption

The guide draws a deliberate distinction between fraud and corruption, even though the two frequently overlap in practice. Fraud is defined as deliberate deception intended to secure unfair or unlawful gain, typically involving the misappropriation of assets, money, or information belonging to the organisation. Corruption, by contrast, is defined more broadly as a breach of the trust placed in a person by virtue of their official position or duties, whether or not that breach results in direct financial loss. In Queensland, "corrupt conduct" carries a specific statutory meaning under sections 14 to 20 of the Crime and Corruption Act 2001 (CC Act), which sets out the conduct thresholds that trigger the jurisdiction of the state's crime and corruption watchdog. See Grand and Petty Corruption for a discussion of how corruption is further classified by scale and impact.

This dual definition matters operationally: a fraud control plan focused narrowly on financial loss will miss corrupt conduct that produces no immediate monetary harm to the agency, such as misuse of official information, improper exercise of discretion, or conflicts of interest that are never converted into a direct financial benefit.

3 The ten components

The best-practice model comprises ten components, intended to operate as an integrated system rather than as isolated initiatives. Each is treated as a discrete article of practice elsewhere in this wiki.

1. Coordination mechanisms. The governance architecture, policies, and plans that assign clear ownership of fraud and corruption control, including oversight bodies such as audit committees and dedicated fraud control officers. See Coordination Mechanisms.

2. Risk management system. A structured, standards-based process (AS/NZS ISO 31000:2009) for identifying, analysing, evaluating, and treating fraud and corruption risks across the organisation. See Corruption Risk Management.

3. Internal controls. The operational safeguards, such as separation of duties, delegations, and information security controls, that constitute the first line of defence against fraud and corruption. See Internal Controls Against Corruption.

4. Reporting processes. Internal channels and procedures by which staff and managers can report suspected fraud or corruption, feeding into the organisation's investigation processes.

5. Protections for disclosers. Legislative and procedural safeguards, principally under the PID Act, that protect employees who report wrongdoing from reprisal. See Whistleblowers and Disclosers.

6. External reporting. Obligations and mechanisms for referring suspected corrupt conduct to external bodies, including the CCC itself under the CC Act.

7. Investigation management processes. Structured, procedurally fair processes for investigating allegations of fraud and corruption once they are reported. See Conducting a Corruption Investigation and Procedural Fairness.

8. Code of conduct. The behavioural standards binding all employees, anchored in the PSE Act's four ethics principles. See Public Sector Codes of Conduct.

9. Organisational culture change. Deliberate efforts to shape workplace culture through standard-setting, enforcement, and education, recognising that culture determines which rules are actually obeyed. See Organisational Culture Change.

10. Client and community awareness program. Outward-facing communication of the organisation's integrity standards to clients, contractors, and the public, supporting external detection of wrongdoing. See Client and Community Awareness.

4 Review and maintenance

AS 8001:2008 recommends that a fraud and corruption control framework, and the plan that implements it, be formally reviewed at least every two years. The guide frames this not as a bureaucratic formality but as a response to the reality that risk profiles shift as agencies restructure, adopt new technologies, or take on new regulatory functions. A framework that is not periodically revisited risks becoming a static document disconnected from the operational risks the organisation actually faces, undermining risk management credibility and leaving internal controls untested against contemporary threats.

See also: Anti-Corruption Value Chain, Corruption Tolerance, Vienna Principles.

References

1. Crime and Corruption Commission (Queensland), Fraud and Corruption Control: Best Practice Guide, March 2018, ISBN 978-1-876986-86-5, foreword by Alan MacSporran QC.
2. Standards Australia, AS 8001:2008 Fraud and Corruption Control.
3. Standards Australia / Standards New Zealand, AS/NZS ISO 31000:2009 Risk Management: Principles and Guidelines.
4. Crime and Corruption Act 2001 (Qld), ss. 14-20.
5. Public Sector Ethics Act 1994 (Qld).
6. Public Interest Disclosure Act 2010 (Qld).
7. Financial Accountability Act 2009 (Qld).
8. Financial and Performance Management Standard 2009 (Qld).