Why fraud risk still matters in an evolving global risk landscape

Cyber threats and artificial intelligence (AI) risks have understandably risen to the top of the agenda, reflecting the pace of disruption and the scale of potential impact. However, this shift in focus is creating a blind spot. Fraud risk is receiving less attention at a time when it is becoming more sophisticated, more scalable and harder to detect.

BDO’s 2026 Global Risk Landscape report highlights the growing complexity organisations are navigating, from geopolitical instability to rapid technological change and increasing regulatory pressure.

Our report finds that the vast majority of business leaders no longer consider fraud to be a top risk their organisation is unprepared for, and only a limited proportion are actively updating their approach to emerging fraud threats. This does not suggest that fraud has diminished. Rather, it indicates that fraud is increasingly being absorbed into broader risk categories, such as cyber and AI, or overshadowed by more visible risks.

The implication is clear; organisations may be underestimating their exposure, leaving gaps in prevention and response.

A more complex and evolving threat

Fraud is not a standalone or static risk, but increasingly embedded across operations, technology and third-party ecosystems. Advancements in technology are enabling more targeted, scalable and convincing forms of fraud, while digital transformation and increasingly complex operating models are introducing new points of exposure.

As organisations adopt new technologies and expand their reliance on third parties and distributed workforces, the number of potential entry points for fraud continues to grow. At the same time, tools such as AI are being used by threat actors to enhance the speed and sophistication of fraudulent activity.

This convergence means fraud events are no longer isolated incidents. They can trigger financial loss, regulatory scrutiny and reputational damage simultaneously.  For organisations this means treating fraud as a secondary or siloed risk is no longer a viable option.

Overreliance on technology and the risk of complacency

Many organisations are investing in technology to improve fraud detection and prevention. While technology is a critical enabler, it cannot replace the need for robust governance, effective controls and a strong risk culture.

Deferring action in anticipation of future technological solutions can lead to a reactive approach, where organisations respond only after an incident has occurred. This pattern has been observed in other areas of risk, particularly in the early stages of cyber risk management, where investment often followed realised events rather than anticipated threats.

Leading organisations take a different approach by:

• Treating technology as an enabler, not a substitute
• Actively testing controls against emerging fraud scenarios
• Embedding ownership of fraud risks across the business.

By doing this, the focus shifts from reactive detection to proactive risk management within the organisation.

Culture is your earliest warning sign

One of the most effective mechanisms for identifying fraud risk early is often internal. Employees, contractors and third parties are frequently the first to observe behaviours or activities that may indicate misconduct. In fact, 43 per cent of cases were uncovered through tips this way which is three times higher than the next most common method, being internal audit.

The ability to surface these concerns depends on whether individuals feel confident and supported in raising them. This places organisational culture at the centre of effective fraud risk management. While circumstances differ in each case, they underscore the importance of creating an environment where speaking up is both encouraged and protected.

High-performing organisations treat culture as a core risk control, not a Human Resources (HR) initiative. This can look like:

• Actively reinforcing speaking up through leadership behaviour
• Ensuring confidentiality and independence in investigations
• Demonstrating visible follow-through on report issues.

A culture that supports transparency and accountability strengthens an organisation’s ability to respond to risk before it becomes a more significant issue.

From policy to effective implementation

Most organisations have established policies and procedures for reporting misconduct. The challenge lies in ensuring these mechanisms operate effectively in practice and are trusted by those who need to use them.

This requires a consistent focus on:

• Providing clear and confidential reporting channels
• Maintaining independence in the assessment and investigation process
• Ensuring transparency in how matters are handled
• Reinforcing trust through communication and leadership behaviour.

Effective frameworks enable organisations to identify emerging risks and take corrective action before issues escalate into financial, regulatory or reputational events.

Repositioning fraud as a strategic priority

Increasingly we are seeing the need for organisations to move away from siloed approaches to risk management and towards a more integrated, enterprise-wide model. Fraud risk must be part of this shift.

Regulatory expectations continue to increase, with ASIC's enforcement activity focusing on financial crime, governance failures, systemic risk management weaknesses and director accountability. Organisations are expected to demonstrate that fraud and other non-financial risks are actively identified, monitored, escalated and challenged at both board and executive levels. This means moving beyond policy-driven approaches to ones that are:

• Embedded within enterprise risk management frameworks
• Visible in board and executive reporting
• Actively monitored, challenged and continuously improved.

A common issue is fragmentation. Fraud risk often sits across multiple functions (risk, legal, HR and cyber) without clear accountability. This creates gaps, particularly where threats cut across systems, processes and third-party relationships.

Leading organisations address this by:

• Defining clear ownership of fraud risk at an executive level
• Integrating fraud into enterprise-wide risk assessments and reporting
• Regularly stress-testing controls against emerging scenarios, including AI-enabled fraud
• Aligning fraud, conduct and culture risk to provide a more complete view of exposure.

The outcome is a shift from reactive management to proactive oversight — where organisations are better positioned to identify signals early and respond decisively.

Strengthening response capability

An effective response to fraud risk is supported by the right structures, tools and expertise. Independent and well-governed solutions form an important part of this capability, providing a secure and trusted mechanism for individuals to raise concerns.

These solutions help organisations enhance transparency, build trust and identify risks earlier in their lifecycle. They also support a more proactive approach to risk management, aligned with the broader shift outlined in our report.

How BDO can help

BDO’s Forensic Services team supports organisations to strengthen their fraud risk frameworks across prevention, detection and response. This includes assessing existing controls, identifying areas of vulnerability and embedding practical measures that align with evolving risk profiles and operating models.