Fraud prevention should not end when an investigation is closed. Organisations need to use every fraud incident to understand what failed, strengthen controls and reduce the likelihood of the same weaknesses being exploited again.
That was one of the central messages to come out of the recent SNG Grant Thornton webinar themed “Beyond detection: Reducing fraud through proactive prevention,” which explored the scale and cost of fraud, its underlying causes, the role of controls and technology, whistleblowing and ethical culture, and practical steps organisations can take to move from reacting to fraud to preventing it.
Speaking at the event, Gert Venter, Associate Director at SNG Grant Thornton, noted that organisations lose an estimated 5% of annual revenue to fraud, while the typical case can run for around 12 months before it is detected. By then, the cost may extend well beyond the financial loss to include reputational damage, weakened trust and disruption to the organisation. He challenged organisations to consider how much time, budget and attention they are currently dedicating to investigating fraud after it occurs compared with their investment into preventing it in the first place.
“Most organisations are still weighted towards the reactive side, investigating fraud after it has happened,” Venter pointed out. “But by the time fraud is detected, the financial, reputational and cultural damage has already been done. A forensic investigation may close the incident, but it does not automatically close the risk. The real opportunity is to learn from what happened, strengthen the control environment and prevent the same weaknesses from being exploited again.”
Moving beyond the investigation
A recurring theme throughout the webinar was the need to turn investigations into institutional learning. Venter cautioned that investigation reports often identify issues such as insufficient oversight, failure to comply with policy or inadequate segregation of duties. While these findings may be correct, they tend to describe symptoms rather than the underlying cause.
Organisations therefore need to look beyond the immediate control failure and understand why it occurred, whether because the control was poorly designed, inadequately resourced, overridden by someone in authority, or simply not monitored effectively. Without answering those questions, simply introducing or reinstating a control may leave the underlying risk intact.
Venter proposed a practical set of minimum post-incident actions organisations should follow after a significant fraud incident. These include completing a documented root-cause analysis, conducting a lessons-learned session, updating the fraud risk register, assigning responsibility and timelines for remediation, independently validating whether corrective actions have been implemented, and reporting progress to the appropriate oversight structure. In this way, he argued, investigation, response and assurance can effectively feed back into prevention rather than operate as separate activities.
The South African context reinforces this point. The webinar speakers referenced recurring weaknesses in procurement, oversight and control environments identified by the Auditor-General and the Zondo Commission, as well as the risks faced by whistleblowers – the key message being that fraud prevention cannot be separated from governance, leadership accountability and the ability of employees to raise concerns safely.
Prevention depends on people as well as controls
Sanmarie Storm, Senior Manager at SNG Grant Thornton, emphasised that effective fraud prevention cannot rely on controls alone – it also requires the right culture. A policy may set the expected standard, but employees will judge how seriously the organisation takes that standard by watching what leaders do in practice. If senior people can bypass procedures or avoid consequences for inappropriate behaviour, the credibility of the wider control environment is weakened.
“Culture is not what you write down; culture is what you do. And employees take their cues from the behaviour organisations reward, tolerate and penalise,” she explained. “Which is why organisations need to embed ethics into everyday business practices through measures such as practical, scenario-based training, actively managed declarations of interest, accessible ethics advice, ethics champions and consistent consequence management.”
Closing the loop
According to Ria Pretorius, Director at SNG Grant Thornton and host of the webinar, a common mistake organisations make is thinking that the fraud prevention challenge has been addressed once controls have been strengthened in response to an incident. She argued that those controls also have to keep pace with the organisation. “As employees move, responsibilities shift and processes and systems change, safeguards such as access controls and segregation of duties can gradually weaken if they are not actively maintained,” she pointed out. “So, organisations can then find themselves having to rebuild a control environment they had already invested in putting in place.”
She noted that this makes continuous oversight as important as the initial remediation, and suggested that technology, including AI, could increasingly support organisations by strengthening routine checks and helping to identify weaknesses earlier.
The webinar ultimately highlighted that identifying what should change is not the biggest problem most businesses face; it’s ensuring that the organisation actually changes. The conversations often stop at the fraud investigation and there is not enough consideration given by leaders to how the findings will be translated into stronger controls, different behaviours and better ways of working. Without that follow-through, remediation risks becoming a point-in-time response rather than a lasting reduction in risk.
The speakers agreed that effective fraud prevention should not be measured by how quickly an incident is closed, or even by whether a new control is introduced, but by whether the organisation absorbs the lesson and keeps adapting as its people, processes and risks evolve. So, the real test of effective fraud mitigation and management is whether the next opportunity for fraud is harder to exploit because of what the organisation learned from the last one.