Which of the following steps should be incorporated into an organization’s fraud risk assessment strategy...

An effective fraud risk assessment should identify inherent fraud risks and then assess both the likelihood and significance of those risks. Significance considers the potential impact of the fraud event on the organization, including financial loss, reputational harm, legal exposure, regulatory consequences, employee morale, and operational disruption. Option A is therefore correct. Option B is not a fraud risk assessment step because the purpose is to evaluate risk, not reward low-risk departments. Option C is too narrow and does not address the core assessment process. Option D is incorrect because fraud risk assessments do not require quantifying total fraud losses, and such amounts are often unknown or impossible to measure precisely. The assessment should prioritize risks so management can address the most serious vulnerabilities.