Fraud risk governance assigns decision rights, oversight, and risk appetite so leaders remain accountable for how fraud is handled.
It answers who may accept a risk, who must report losses, and which forum reviews exceptions when policy and practice diverge.
How it works
Governance writes the appetite in plain language, names an executive owner, and sets how often losses and control failures are reported upward.
Policies for refunds, account recovery, and third parties belong here because they state what the organization is willing to allow.
This page is about authority and oversight, not about the sensors that score a live payment and not about the daily case queue.
When governance is thin, detection teams invent their own tolerance and nobody can explain the loss figure to the board.
Concrete examples
- A board committee receives a quarterly pack that compares fraud losses with the written appetite and asks why a gap widened.
- A named executive approves a temporary exception when a partner cannot meet the usual refund evidence rule.
- Internal audit checks that the people who approve appetite are not the same people who close individual fraud cases.
Protective measures
- Name an executive owner for fraud risk and publish that name inside the relevant policy.
- Write the loss appetite in words and numbers that a case analyst can actually apply.
- Require upward reporting of losses and repeated control failures on a fixed calendar.
- Keep oversight independent from the operational team that handles individual fraud cases.
Related articles
How the approved appetite becomes daily controls and case work is described in What is fraud risk management as an ongoing program?.
Estimating likelihood and impact before controls are funded is the subject of What is fraud risk assessment in a security program?.
The signals that notice suspicious live activity are explained in What are fraud risk detection mechanisms during live activity?.