1.1 Welcome: Your Fraud Risk Toolkit (Start Here)

Fraud risk management is the set of steps an organisation takes to understand how it could be defrauded, to prevent and detect fraud, and to respond properly when fraud happens. It is not a single control or a hotline. It is a cycle: assess the risk, design controls, watch for red flags, investigate fairly, recover what you can and fix the gap.

This course is part of the EunoiaData Professional Toolkits series. Its point of difference is the fraud the region actually faces: tender collusion, payroll fraud, cash and mobile money fraud, fuel and stock losses, SIM-swap and agent fraud. Investigations are taught with labour-law due process built in, because a fraud case that ends in an unfair dismissal is a second loss.

What you leave with

Each module ends with a toolkit item, delivered as a table you can copy into Excel or Word and adapt:

Who this course is for

Internal auditors, finance, HR and compliance managers, investigators and board members. Audit basics are assumed (see our Internal Audit Fundamentals course). Money laundering is not taught here; see our AML/CFT course.

Frameworks used in this course

This course explains these frameworks in its own words. It uses their principles; it does not reproduce their text.

• COSO/ACFE Fraud Risk Management Guide, 2nd edition (2023). Its five principles shape the course: fraud risk governance, fraud risk assessment, preventive and detective control activities, investigation and corrective action, and monitoring of the whole programme.
• ACFE occupational fraud classification. The three broad categories of fraud by people inside an organisation, explained in Lesson 1.3.
• COSO Internal Control – Integrated Framework (2013). Its risk assessment component includes a principle that organisations consider the potential for fraud.
• IIA Global Internal Audit Standards (2024). They set out internal audit’s role in evaluating fraud risk and how the organisation manages it.

Product names such as SAP, Sage, Pastel, Microsoft Dynamics, Oracle and Microsoft Excel are trademarks of their owners and are used for identification only; EunoiaData is not affiliated with or endorsed by any software vendor. Framework names belong to their issuing bodies; this course explains them in its own words and is not endorsed by them. The course does not prepare you for any certification exam.

The case company

About the case company: Kuvanya Group, its subsidiaries (Kuvanya Bank, KuvaTel, KuvaPay, Kuvanya Mining Supplies and Kuvanya Shared Services), its client “the Power Authority” and every person named in this course are fictional. They were created by EunoiaData for teaching purposes only. Any resemblance to real organisations or people is coincidental. Countries, laws and regulators are real and are described as they stood in 2026.

Kuvanya Group is a family-founded holding group of about 4,200 staff in Zimbabwe, Zambia, South Africa, Botswana, Kenya and Nigeria. You will meet Joseph Mwale, the Group CEO; Nomsa Dube, Head of Internal Audit, who leads a two-person team; Wanjiru Kamau of KuvaPay; and Pieter van Wyk, who runs the mining supplies depots. Named people make mistakes and run weak controls, as people do. No named person commits fraud. Wrongdoers are described only by role, such as “a stores supervisor”, so that no character is cast as a criminal.

How the three views work

Each teaching lesson closes with three short points: as the auditor (what to assess or test), as the manager (the control you own) and as the board (the question to ask). Each module also gives a two-person team version, because most organisations in the region have no fraud department.

Example: Dr Adaeze Okafor, who chairs Kuvanya’s audit and risk committee, asks a plain question at her first meeting: “If someone were stealing from us today, how would we find out?” Nobody can give a complete answer. This course follows Nomsa as she builds that answer, one tool at a time.

Three views

• As the auditor: agree who owns each part of fraud risk management before you start assessing it.
• As the manager: treat fraud prevention as part of running your process, not as audit’s job.
• As the board: ask how the organisation would detect a fraud happening today, and who would act.

Check before you act: Framework editions here are as at October 2026 and are expected to change. Confirm the current edition with the issuing body (COSO, the ACFE or The IIA) before you rely on it.

Key takeaway

Fraud risk management is a cycle of assessment, prevention, detection, fair investigation and correction; this course gives you a tool for each stage, built around the fraud the region actually faces.