Anti-Fraud Control Regulation in KSA

Anti-Fraud Control Regulation in KSA

Introduction

Fraud is an ongoing risk for any business including the insurance sector. While it cannot be completely eliminated, measures can be taken to minimize this risk. As per the Occupational Fraud 2024: A Report to the Nations (‘The Report’) published by the Association of Certified Fraud Examiners (‘ACFE’), 7% of the fraud cases originated from the MENA region. Additionally, it revealed that 69 insurance-related fraud cases were reported with a median loss of USD 190,000.   

For insurance companies operating in Kingdom of Saudi Arabia (KSA), compliance with the Anti-Fraud Regulation issued by the Saudi Arabian Monetary Authority (SAMA) is essential to effectively address the fraud risk. This regulation is designed to help companies establish strong anti-fraud controls and safeguard their operations, customers, and reputation.

Types of Fraud Risk:

Under this regulation, all insurance companies are required to establish a comprehensive Fraud Risk Management Framework. This framework must address the following types of fraud risks:

1. Internal Frauds – Fraudulent activities committed by employees or insiders within the organization.
2. Policyholder Frauds – Fraudulent claims or misrepresentation made by policyholders.
3. Insurance Service Provider Frauds – Fraudulent actions involving third-party service providers, such as garages, medical providers,brokers, etc.

Key Elements

As per the regulator’s expectations, the Fraud Risk Management Framework should include the following key elements for each identified fraud risk:

• Fraud Detection – Systems and processes to identify potentially fraudulent activities early.
• Fraud Measurement – Methods to assess the severity and impact of fraud risks.
• Fraud Mitigation – Strategies and actions to reduce the likelihood and impact of fraud.
• Fraud Monitoring – Ongoing tracking and review of fraud-related risks and controls to ensure they remain effective.

A strong Fraud Risk Management Framework should address all necessary aspects of governance, fraud prevention, and clearly define the roles and responsibilities across the organization. The framework should incorporate a fraud communication plan, contingency plan, escalation process, and regular reporting mechanisms.

Key Responsibilities in the Fraud Risk Management Framework

Board of Directors

As per the corporate governance code, setting the tone at the top is the Board’s responsibility. This can be achieved by approving the Fraud Risk Management Framework, regularly reviewing the fraud management strategy, and delegating the implementation of this strategy to senior management.The Board should also ensure it receives regular updates and reports from senior management to stay informed on fraud-related issues.

Senior Management

Senior management is responsible for developing and implementing the fraud risk management strategy, including policies and procedures. They should assign specific roles for fraud risk management, establish a committee to address fraud incidents, and ensure timely legal advice to protect the organization’s reputation.

Compliance Department

The compliance department should ensure that the Fraud Risk Management Framework complies with all regulatory requirements. They are also responsible for ensuring timely and accurate periodic and event-based reporting to the regulator.

Internal Audit and Risk Management

Senior management should formally assign the clear responsibility of conducting initial fraud investigations to the Internal Audit department. In cases where external expertise is needed, a formal request should be made to the Fraud Committee for assistance

Fraud Risk Assessment

As per the better industry practices, conducting a comprehensive fraud risk assessment exercise is critical to identifying the potential fraud risk and assessing the exiting controls available to mitigate such risk. This assessment shall also help the institution to proactively identify the need to establish new controls, introducing new systems and add more resources to effectively manage the fraud risk.

Development of Policies and Procedures

Fraud Risk Management Policy

Insurance companies should develop a detailed policies and procedures to manage the fraud risk. The policy should be approved by the Board and inline with the fraud management strategy of the Company. Further, the procedures should be approved by the senior management to ensure compliance with the Board approved policy.

Fraud Risk Registers

To identify the potential fraud threats applicable to the company in accordance with its activities, fraud scenarios should be developed and assessed the exiting controls to manage such risk. The fraud risk register should be developed for all the departments covering all the potential risk relating to internal frauds, external frauds and service-provider frauds.

Whistle Blowing Policy

It is crucial that senior management develops and implements a whistleblowing policy, offering employees, clients and other stakeholders secure and confidential channels to report fraud without fear of retaliation. This encourages a culture of transparency and accountability within the organization.

Employees’ Training and Awareness

Organizations should also ensure that periodic training sessions are conducted to raise awareness among employees about potential fraud risks. Employees should understand how to protect themselves, the institution, and the broader ecosystem by promptly escalating concerns to the appropriate team, rather than making independent decisions.

Conclusion:

Establishing a robust fraud risk management framework is not just a compliance requirement; it is essential for building strong internal controls, regularly assessing the controls, enhancing the quality of services provided to customers and managing a positive relationship with the business partners and stakeholders. By proactively managing fraud risks, organizations can reduce the likelihood of fraud, ultimately protecting the company’s reputation and safeguarding the broader ecosystem, including all stakeholders. According to the Report published by ACFE, 32% of reported fraud cases were attributed to weak internal controls. This highlights the importance of implementing robust internal control systems throughout the organization, along with effective monitoring mechanisms to mitigate fraud risks. Strengthening internal controls not only helps reduce potential fraud losses but also enhances the likelihood of detecting fraudulent activities early.

Note: At Limitless Consulting, we are here to guide you through these complexities, ensuring that
your organization not only meets compliance requirements but thrives in a secure financial
environment.