Fraud risk management is a structured, management-owned programme to prevent, detect and respond to fraud in a public institution.
Across the South African public sector, the accounting officer or accounting authority has to run it actively to eliminate waste and corruption and uphold financial integrity.
Management ownership and the statutory mandate
In South African public administration, fraud risk management is a core operational responsibility owned by executive leadership, not an auxiliary task handed to an external investigator. Under the PFMA as administered by National Treasury, the legislation sets a clear objective to eliminate waste and corruption and to maximise service delivery through the effective use of state assets. To achieve that, Chapters 5 and 6 of the PFMA place an explicit, non-delegable duty on the accounting officer or accounting authority to operate basic financial management systems and internal controls.
Fraud risk management is the structured, continuous mechanism through which leadership meets that duty. It is an institutional commitment to identifying the operational vulnerabilities, embedding the controls, and fostering an ethical culture before financial loss occurs. An executive who treats fraud risk management as an administrative burden, or who assumes external oversight will protect the institution, misreads the legal framework — the statutory responsibility for preventing corruption and protecting public assets rests squarely on the accounting officer or accounting authority.
Preventive controls in the high-risk procurement cycle
Preventing fraud starts with a fraud-risk assessment that systematically finds where a deceptive practice or a governance breakdown could occur. Leadership then implements preventive controls tailored to those vulnerabilities — segregation of duties, clear authorisation thresholds, and an ethical tone from the top.
In a public institution, fraud risk concentrates most heavily in the procurement and payment cycle. That aligns directly with the procurement framework the Preferential Procurement Policy Framework Act (PPPFA) sets, which structures public procurement around an acceptable-tender framework and a preference-point system weighing price and specific goals. The complexity of the bid specification, the preference-point calculation and the contract award creates specific exposure points where a fraudulent misrepresentation can emerge.
So preventive controls should concentrate across demand management, tender evaluation, supplier verification and invoice authorisation — to halt a scheme before a contract is executed or public funds are disbursed.
Detective mechanisms, and the limits of the external audit
Preventive controls are the first line of defence, but a mature programme also needs detective mechanisms to catch what gets past them. Detective controls include continuous exception monitoring, data analytics, internal-control reviews and a secure channel through which staff can report a suspicion safely.
Under the PFMA as administered by National Treasury, the legislation sets a clear objective to eliminate waste and corruption and to maximise service delivery through the effective use of state assets.
— Synthesis of South African regulatory guidance
A dangerous misconception is that the annual external audit will automatically catch internal fraud. The Auditor-General South Africa is explicit about the boundary of its mandate: while a statutory audit may identify indicators of possible fraud during routine testing, detecting fraud is not the main purpose of the audit, which evaluates the financial statements, performance reporting and compliance on a test basis. Relying on the Auditor-General South Africa to uncover internal fraud is itself a governance failure, because an unmonitored scheme can run undetected for a long time. Management has to build its own detective architecture to monitor transactions and surface the irregularity internally.
Response, recovery and statutory accountability
When a detective control or a report reveals evidence of fraud or corrupt activity, management must act immediately and in a structured way — open a formal inquiry, halt the ongoing leakage, preserve the evidence, start disciplinary proceedings, and refer a criminal matter to law enforcement. Under Chapter 10 of the PFMA as administered by National Treasury, financial misconduct is defined alongside mandatory procedures for disciplining an official who breaches a statutory duty, and where the misconduct is gross, Chapter 10 provides for criminal prosecution; similar fiduciary duties and sanctions apply to an accounting authority.
Under the Public Audit Act enforced by the Auditor-General South Africa, fraud and theft expressly constitute a material irregularity when they cause significant financial loss, resource misuse or substantial harm. When the Auditor-General South Africa identifies a material irregularity involving fraud, the accounting officer or accounting authority is formally notified and legally obliged to act — to stop the loss, recover the diverted funds, and enforce consequences against those responsible.
Fraud risk management versus a forensic investigation
Executives must keep a clear distinction between the standing fraud risk management programme and an ad hoc forensic investigation. Fraud risk management is proactive, continuous and management-owned — assessing risk, enforcing preventive controls, monitoring the workflow and embedding ethical standards across the organisation. A forensic investigation is reactive and specialised: a targeted examination triggered by a specific allegation or an identified loss, to establish the facts and gather evidence.
Confusing the two leads to a serious misstep — assuming that commissioning a forensic investigation after a major fraud satisfies the institution's standing duty to maintain internal controls. A forensic investigation addresses past wrongdoing; it does not build the forward-looking preventive architecture the PFMA requires. Leadership has to resource and scope both independently, so the standing prevention-and-detection programme runs continuously alongside the reactive investigative capability.
What good looks like
Excellence in fraud risk management shows up, ultimately, in a sustained clean audit from the Auditor-General South Africa — financial statements free from material misstatement, reliable performance reporting, and full compliance with the key public-finance legislation. In practice it is an institution where the accounting officer, accounting authority and risk leaders actively own fraud prevention, enforce robust controls across the PPPFA procurement lifecycle, and keep a safe reporting channel open.
In that environment, a potential fraud is stopped by preventive design, caught early by internal monitoring, and addressed decisively through the Chapter 10 PFMA disciplinary and recovery process. Effective fraud risk management protects public resources, eliminates the material irregularity, and keeps state assets directed towards the service delivery they are meant to fund.
Related insights
- Public procurement governance: the decisions and records that matter
- Contract management: the controls connecting obligations, performance and payment
- Third-party and supply-chain risk: an institutional oversight agenda
Sources
- Public Finance Management Act: legislation overview — National Treasury
- What we do: fraud, material irregularities and the audit — Auditor-General South Africa
- Preferential Procurement Policy Framework Act — PPPFA
Frequently Asked Questions
What is fraud risk management in the South African public sector?
Fraud risk management is a structured, management-owned programme designed to prevent, detect, and respond to fraud within a public institution. Under the PFMA, it is a core operational responsibility of the accounting officer or accounting authority, aimed at eliminating waste and corruption and upholding financial integrity. This programme is the continuous mechanism through which leadership meets its duty to operate basic financial management systems and internal controls. It involves identifying vulnerabilities, embedding controls, and fostering an ethical culture before financial loss occurs.
Who is responsible for implementing fraud risk management in South African public institutions?
The accounting officer or accounting authority in a South African public institution holds the explicit, non-delegable duty for operating basic financial management systems and internal controls under Chapters 5 and 6 of the PFMA. This means they are responsible for actively running the fraud risk management programme. An executive who treats this as an administrative burden misreads the legal framework, as the statutory responsibility rests squarely on them.
What is the primary focus of preventive controls in fraud risk management within public institutions?
Preventive controls should primarily concentrate across demand management, tender evaluation, supplier verification, and invoice authorisation within the procurement and payment cycle. This focus is crucial because fraud risk concentrates most heavily in this area, aligning with the complexities of the Preferential Procurement Policy Framework Act (PPPFA). The objective is to halt a fraudulent scheme before a contract is executed or public funds are disbursed, protecting state assets and maximising service delivery.
What does effective fraud risk management look like in practice, and what are the consequences of failure?
Effective fraud risk management is realised when the accounting officer, accounting authority, and risk leaders actively own fraud prevention, enforce robust controls across the PPPFA procurement lifecycle, and maintain a safe reporting channel. This leads to a sustained clean audit from the Auditor-General South Africa, with financial statements free from material misstatement and full compliance with key public-finance legislation. Failure to implement this programme can result in unmonitored schemes running undetected, material irregularities identified by the Auditor-General South Africa, and potential disciplinary action or criminal prosecution under Chapter 10 of the PFMA for financial misconduct.
Where do public institutions commonly make mistakes regarding fraud risk management?
Most public institutions err by treating fraud risk management as an administrative burden or assuming external oversight, like the annual external audit, will automatically detect internal fraud. Another common mistake is confusing a standing fraud risk management programme with a reactive forensic investigation, believing the latter satisfies the institution's ongoing duty. This leads to a serious misstep where the proactive, continuous prevention and detection architecture required by the PFMA is not adequately resourced or maintained.