Fraud risk assessment evidence for ECCTA readiness.

The Home Office guidance names risk assessment as one of the six fraud-prevention principles. For evidence teams, it should be the map that connects fraud scenarios, associated persons, controls, gaps, and reviewer decisions.

A useful risk assessment file records the assessment date, owner, methodology, business units, geographies, associated-person populations, fraud scenarios considered, and the source version of the guidance used.

Each material fraud scenario should link to the prevention procedures relied on, the evidence supporting those procedures, and any unresolved gaps. This avoids a risk register that lists risks but cannot show what evidence was reviewed.

Examples include due-diligence evidence, training records, approval controls, monitoring outputs, remediation actions, whistleblowing or investigation trends, and reviewer notes.

The monitoring and review principle means the file should show when the risk assessment was last reviewed, what changed, and what triggered the update.

Version history matters. A board pack should distinguish current evidence from stale, rejected, superseded, or pending items, and the replacement lineage should explain why the current version changed.

DefenceFile can help turn risk assessment work into gap-map and risk-register views: scenario, control, evidence item, owner, status, review decision, and board-pack blocker.

Those views are workflow support. They do not decide whether procedures are reasonable or whether the organisation has discharged the s.199(4) burden.

The SFO compliance-programme evaluation guidance says policies and controls alone do not show that a compliance programme is effective. Risk assessment evidence should therefore show operation: who reviewed, what evidence was sampled, what issue was found, and what action followed.

The strongest workpaper is candid about what is incomplete. A visible unresolved gap is better than a polished pack that hides uncertainty from reviewers.