Strategic Business Leader · Identification, assessment and measurement of risk

Fraud, Reputation and Other Specific Risks in ACCA SBL

Updated 11 October 2026 · Fact-checked

Specific risks are named threats in an SBL case, such as fraud, reputation, technology, ethical and environmental risk. To answer, identify the risk from the scenario, assess likelihood and impact, explain causes and links to other risks, then recommend a response (treat, avoid, transfer or accept) tied to the facts.

Understand Fraud, Reputation and Other Specific Risks

A specific risk is a particular type of threat that the case scenario points to. The usual ones in SBL are fraud, reputation, technology, ethical and environmental risk. Examiners rarely ask you to define them. They ask you to assess them for a named organisation and advise the board.

Fraud risk is the risk of loss from deliberate deception, by staff, managers or outsiders. The fraud triangle helps you explain it: opportunity (weak controls, no segregation of duties), pressure (targets, bonuses, personal debt) and rationalisation ("everyone does it", "the company owes me"). Look in the case for dominant executives, weak internal audit, aggressive targets and poor oversight.

Reputation risk is damage to how stakeholders see the organisation. It is usually a consequence of another risk, such as a data breach, a fraud, a safety failure or an ethical scandal. It affects customers, staff, investors, regulators and suppliers, and it can be slow and costly to repair. Social media makes it spread fast.

Technology risk covers system failure, cyber attack, data loss, obsolete systems, failed IT projects and over-reliance on suppliers. Ethical risk is the risk that the organisation or its people act in ways that break ethical standards, for example bribery, mistreating staff or misleading customers. Environmental risk covers pollution, climate change, resource scarcity, regulation and stakeholder pressure on sustainability.

The key skill is linking. One event often triggers several risks. A cyber attack is a technology risk, then a reputation risk, then a legal and financial risk. Showing these links earns analysis and commercial acumen marks.

Key rules to remember

Fraud triangle: Fraud = Opportunity + Pressure + Rationalisation; Use it to explain why fraud may occur and which controls reduce opportunity. It is a framework, not a calculation.
Risk assessment: Risk exposure = Likelihood × Impact; A qualitative guide. Rate each as high, medium or low. Do not invent figures the case does not give.
Risk responses (TARA): Transfer, Avoid, Reduce, Accept; Choose a response for each risk and justify it using likelihood, impact and cost.

How to solve Fraud, Reputation and Other Specific Risks questions

Use this method for any question on a specific risk in an SBL case.

1Read the requirement. Note the verb (assess, evaluate, advise) and whose viewpoint you take, such as the board or the audit committee.
2Identify the specific risks in the scenario. Quote or refer to the facts that signal each one.
3Explain the cause. For fraud, use opportunity, pressure and rationalisation. For others, name the source, internal or external.
4Assess likelihood and impact for each risk. Say which matters most and why, using the organisation's size, sector and strategy.
5Show links between risks, such as technology failure leading to reputation damage and lost customers.
6Recommend responses and controls (TARA). Make each one practical and linked to the case, with its cost or limit.
7Add the stakeholder, ethical or governance angle if relevant, and close with a clear recommendation to meet professional skills marks.

Quickest way: Risk, Cause, Impact, Response

When to use it: Use it when time is short and the scenario lists several problems at once.

Underline each risk signal in the scenario as you read.
Label each as fraud, reputation, technology, ethical or environmental.
For each, write one line each on cause, impact and response.
Rank them: highest likelihood × impact first.
Write the answer in that order, with one case fact per point.

Common mistakes in Fraud, Reputation and Other Specific Risks

Defining the risk type instead of applying it
Students recall textbook definitions because they feel safe.
Fix: Spend one line on the definition at most. Spend the rest on case facts and consequences.
Treating each risk in isolation
Lists in notes separate the risks, so students answer in the same way.
Fix: State the chain explicitly, for example data breach, then loss of trust, then falling sales and regulatory fines.
Giving generic controls
Students memorise lists like segregation of duties and apply them everywhere.
Fix: Pick the controls that fit the weakness in the case and explain how each closes the gap.
Ignoring the ethical and stakeholder angle
Students focus on money and forget that SBL rewards judgement.
Fix: Ask who is affected and whether the action is right, not just profitable. Mention the public interest where it applies.
Recommending avoidance for everything
Avoiding the risk sounds safest.
Fix: Weigh cost against benefit. Avoiding a risk can also remove the opportunity. Use reduce, transfer or accept where sensible.
Inventing numbers for likelihood or loss
Students want the answer to look precise.
Fix: Use only figures in the case. Otherwise use high, medium and low and justify the rating.

Worked examples

Example 1

Zenith Retail has a dominant chief executive who also chairs the board. Store managers earn large bonuses if monthly sales targets are met. Stock counts are done by the same staff who record stock. Assess the fraud risk and recommend actions.

Show the solution

Opportunity: the same staff count and record stock, so there is no segregation of duties. A dominant CEO who chairs the board weakens oversight and challenge.
Pressure: large bonuses tied to monthly sales targets push managers to manipulate sales or stock figures.
Rationalisation: in a target-driven culture, managers may believe adjustments are minor or expected.
Assessment: likelihood is high because all three elements are present. Impact is high through misstated results, losses and loss of investor confidence.
Links: if fraud emerges, reputation risk and regulatory risk follow.
Responses (reduce): separate counting from recording, use independent stock counts, and rebalance bonuses with non-sales measures. Appoint a separate chair and independent non-executives, and strengthen internal audit.
Recommendation: act first on governance and the stock control weakness, because they are cheap relative to the potential loss.

Answer: Fraud risk is high because opportunity, pressure and rationalisation are all present. Reduce it by segregating duties, independent stock counts, balanced bonus measures, a separate chair and stronger internal audit.

Example 2

Corvo Chemicals is accused by a local newspaper of discharging waste into a river. Social media posts spread the story and a major customer is reviewing its contract. Explain the risks and advise the board.

Show the solution

Identify the risks: environmental (the discharge itself), ethical (acting against the community and the environment), and reputation (loss of trust). There is also legal risk if regulations were breached.
Link them: the environmental failure is the cause. Reputation damage is the consequence, spreading quickly through social media.
Assess: likelihood of further damage is high if the claim is true and no action is taken. Impact is high because a major customer may leave and regulators may act.
Respond (reduce): investigate immediately and independently, stop any discharge, and clean up where needed.
Communicate honestly and promptly with the customer, regulators, staff and the community. Hiding the facts would increase the ethical and reputation damage.
Longer term: improve environmental controls and monitoring, report on environmental performance, and make senior management accountable.
Recommendation: verify the facts first, then act openly. Ethical conduct is the most effective protection of reputation.

Answer: The main risks are environmental, ethical, reputation and legal, linked in a chain. The board should investigate, stop the discharge, communicate openly with stakeholders and strengthen environmental controls.

Exam tips

Quote the case. Every risk you name should have a fact from the scenario beside it.
Show the links between risks. Examiners reward analysis, not lists.
Match responses to the weakness described, and mention cost or practical limits.
When the scenario has an ethical dimension, take a clear position and explain it, as the professional skills marks reward judgement.
Rank risks by importance so your answer shows prioritisation, then give a clear recommendation.

Practice questions from Identification, assessment and measurement of risk

Fraud, Reputation and Other Specific Risks: frequently asked questions

How do I answer a risk question in the SBL exam?

Identify the risks from the case, assess likelihood and impact, explain causes and links, then recommend responses. Use case facts throughout. End with a clear recommendation.

Is reputation risk a separate risk or a result of other risks?

It can be both, but in cases it usually follows another event such as fraud, a data breach or an ethical failure. Show the chain from the cause to the damage to stakeholder trust.

Do I need to calculate anything for these risks?

Usually not. SBL assesses risks qualitatively. Use ratings such as high, medium and low, and use figures only when the case provides them.

What is the best framework for fraud risk?

The fraud triangle is a good start: opportunity, pressure and rationalisation. Apply each to the case and then suggest controls that reduce opportunity and address pressure.