Free internal-control risk tool
Internal Fraud Exposure Score
Estimate internal fraud exposure, identify weak preventive and detective controls, and model the financial value potentially exposed before suspicious activity is detected.
Simple internal-fraud screen
0–100 exposure scoreCombine financial exposure with control weakness
Financial activity potentially exposed
Inherent exposure
Control maturity0 Missing / unknown1 Weak2 Partial3 Established4 Strong & evidenced
Preventive & detective controls
ControlWeightMaturity
Segregation of dutiesNo single person controls authorization, custody, recording and reconciliation for the same transaction stream.
14%/4
Approval thresholds & dual authorizationMaterial payments, refunds, journal entries and changes require appropriate independent approval.
10%/4
Vendor onboarding & bank-change verificationNew vendors and payment-detail changes are independently verified.
9%/4
Bank & payment controlsPositive pay, payment limits, callbacks, dual release or equivalent bank controls.
9%/4
Payroll master-file change controlsIndependent review of employee, compensation and bank-account changes.
8%/4
Cards, expenses & reimbursement controlsReceipts, merchant rules, limits, exception review and independent approval.
7%/4
Independent reconciliationsBank, payroll, inventory and key balance-sheet reconciliations are timely and independently reviewed.
11%/4
User access & termination controlsLeast privilege, access review and timely removal after role changes or departures.
8%/4
Inventory / asset custody controlsCounts, restricted access, serial tracking or other custody controls where relevant.
6%/4
Exception monitoring / data analyticsDuplicate payments, unusual vendors, journals, payroll changes and outlier transactions are reviewed.
8%/4
Confidential reporting / whistleblower channelEmployees can report concerns outside the normal chain of command.
5%/4
Management review & conflict-of-interest controlsRelated parties, overrides, unusual adjustments and management exceptions receive independent scrutiny.
5%/4
Simple methodExposure score = 65% remaining control gap + 35% inherent exposure. Base financial scenario = financial flows during the entered detection window × your flow-loss assumption + exposed assets × your asset-loss assumption. The control-adjusted exposure applies a transparent residual factor of 25% + 75% × exposure score, so even very strong controls do not imply zero fraud exposure.
Advanced fraud-exposure model
Scenario-based exposureModel six internal-fraud scenarios separately
Business context
Fraud scenarios
ScenarioAnnual flow / asset valueDetection windowScenario loss rate
Vendor / AP payment fraudFictitious vendors, duplicate/altered invoices, kickbacks or payment-detail manipulation.
$
mo
%
Payroll / ghost-employee fraudUnauthorized employees, pay-rate changes, time manipulation or diverted payroll.
$
mo
%
Expense / purchasing-card abusePersonal purchases, inflated reimbursements, split transactions or policy circumvention.
$
mo
%
Cash / receipts diversionSkimming, lapping, refund abuse or diverted receipts.
$
mo
%
Inventory / asset misappropriationPortable equipment, inventory or other accessible assets.
$
event
%
Management override / reporting manipulationUser-entered direct financial-impact scenario rather than a flow percentage.
$
direct
%
Inherent exposure
Control maturity & evidence
ControlMaturityEvidence confidenceWeight
Segregation of duties
/4
%
%
Approval thresholds & dual authorization
/4
%
%
Vendor onboarding & bank-change verification
/4
%
%
Bank & payment controls
/4
%
%
Payroll master-file change controls
/4
%
%
Cards / expense / reimbursement controls
/4
%
%
Independent reconciliations
/4
%
%
User access & termination controls
/4
%
%
Inventory / asset custody controls
/4
%
%
Exception monitoring / data analytics
/4
%
%
Confidential reporting / whistleblower channel
/4
%
%
Management review & conflict-of-interest controls
/4
%
%
Advanced methodEvidence-adjusted control strength = maturity ÷ 4 × evidence confidence. Overall fraud exposure = 65% control gap + 35% inherent exposure. Each fraud scenario calculates a base loss window from the entered flow, detection period and loss rate; then the scenario is adjusted using the controls most relevant to that fraud type. A 25% residual floor is retained so the model never treats controls as proof of zero exposure.
Fraud-scenario breakdown
Scenario values are planning exposuresFinancial exposure by fraud type
| Scenario | Base scenario exposure | Mapped control strength | Residual factor | Control-adjusted exposure | Share of total |
|---|
Priority controls
Highest impact firstWeak controls ranked by modeled exposure reduction
| Priority | Control | Effective strength | Normalized weight | Potential score improvement |
|---|
Detection-speed sensitivity
Flow-based scenarios scaled togetherFinancial exposure as detection time changes
| Detection-time scale | Gross scenario exposure | Control-adjusted exposure | Exposure / annual flow reference |
|---|
Control-strength sensitivity
All control maturities shifted togetherFinancial exposure as control maturity improves
| Maturity shift | Control strength | Exposure score | Control-adjusted financial exposure |
|---|
Scope
Financial exposure is not a prediction that fraud will occur
This tool is a control-planning screen. It does not estimate the probability of employee fraud, accuse any employee or manager, determine whether fraud has occurred, replace an audit or forensic investigation, or provide legal conclusions. The financial-exposure figures are user-driven scenarios showing value potentially exposed before detection under the selected assumptions.
Research basis: current ACFE occupational-fraud research, COSO Internal Control and Fraud Risk Management guidance, and the GAO Green Book informed the emphasis on prevention, segregation, detection, reporting, monitoring and management override risk. No ACFE loss benchmark is hard-coded into the calculator.