Accountability should sit across finance, risk, product, customer experience, and security, because fraud decisions affect every part of the customer journey. Finance should own the business case, risk should own control quality, and product and CX should own the experience design that determines whether good customers complete the flow.
Shared accountability should reflect the customer journey, not a single team
Balancing fraud prevention with revenue growth is an operating-model decision, not a pure control decision. The right answer is shared accountability with clear decision rights: finance owns the commercial trade-off, risk owns the control standard, and product and customer experience own how those controls feel to legitimate customers. That structure keeps fraud work tied to conversion, abandonment, and loss, instead of optimizing one metric at the expense of the others.
In practice, the accountable group should be the cross-functional leadership that can see both fraud loss and funnel friction. Where that does not exist, one team becomes the de facto owner and usually overcorrects toward either frictionless growth or overly tight controls.
Teams that work only from their local KPI tend to create predictable failure modes. Fraud operations can suppress abuse but slow good customers, while growth teams can remove too much friction and widen exposure. Shared accountability is what forces both sides to be measured against the same customer and revenue outcome.
How to assign ownership without blurring responsibility
Ownership should be split by decision type, not by blame. Finance should own the business case and the economics of loss, approval, and retention. Risk should own control quality, thresholds, and exception criteria. Product should own the onboarding and checkout experience, and customer experience should own the observable impact on good users. Security supports the control environment, but it should not be the sole arbiter of commercial trade-offs.
This model works best when there is one forum that can approve trade-offs and one set of shared metrics that everyone accepts. For example, if a fraud rule reduces fraud but also drops high-value legitimate customers, the decision should be reviewed as a revenue and risk question, not only as a security win.
A useful practical test is whether a team can change a rule, journey step, or verification gate without being able to explain the business effect on both bad actors and real customers. If it cannot, accountability is too narrow.
For related control design, the same principle appears in Segregation of Duties (SoD) Guide, which shows how conflicting objectives need explicit governance rather than informal handoffs. For customer-journey fraud decisions, NHIMG’s Identity Fraud Prevention Guide is useful because it frames fraud controls around lifecycle impacts such as account opening, account takeover, and bot pressure.
What good governance looks like when fraud and growth collide
Good governance uses a single decision framework with multiple signals: fraud loss rate, false positive rate, abandonment rate, approval rate, manual review rate, and customer value by segment. That prevents teams from celebrating a lower fraud number that was bought with a much higher revenue penalty.
It also means exceptions are visible. If growth wants a lower-friction flow for a particular segment, the exception should be explicit, time-bound, and owned by a named business leader. If risk wants tighter controls for a high-loss segment, the expected revenue impact should be part of the decision, not treated as an afterthought.
The most effective organisations treat friction as a cost and fraud as a leakage problem, then optimise both in the same governance forum. That is usually better than asking one team to “balance” the issue privately, because private balancing tends to hide the trade-off rather than resolve it.
External identity and assurance regimes reinforce that cross-functional view. eIDAS 2.0 — EU Digital Identity Framework matters where stronger identity proofing can reduce fraud while preserving digital onboarding, and the FATF Recommendations — AML and KYC Framework show why fraud controls in regulated environments are inseparable from customer due diligence and onboarding design.
Where this breaks down in practice
The common failure is letting the function that feels the pain define the policy. If fraud losses spike, the organisation may over-index on rejection and review. If conversion pressure dominates, it may underinvest in verification and monitoring. Both choices create hidden cost, either through direct fraud or through avoidable customer drop-off.
Another failure is using local metrics that reward the wrong behaviour. A team measured only on fraud losses will likely tighten every gate. A team measured only on growth will likely remove every gate. The accountable model has to make both outcomes visible at once so that one team cannot optimize by exporting harm to another team.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| ISO/IEC 27001:2022 | A.5.2 — Information security roles and responsibilities | Assigns clear ownership for fraud-control trade-offs across business and security roles. |
| Recommendation — Define accountable owners for fraud controls, customer friction, and revenue-impact decisions. | ||
| NIST SP 800-53 Rev 5 | PM-3 — Information Security and Privacy Resources | Supports governance of resources and priorities when fraud controls affect business outcomes. |
| Recommendation — Establish a governance forum that aligns fraud spend with revenue and customer-impact goals. | ||
| CIS Controls v8 | CIS-5 — Account Management | Fraud prevention often depends on how account controls balance access, friction, and misuse. |
| Recommendation — Review account controls for both misuse resistance and legitimate-user completion rates. | ||
| NIST CSF 2.0 | GV.OC-01 — Organizational Context | The question is about who owns the trade-off within business context and objectives. |
| Recommendation — Define fraud and growth objectives in governance so control decisions match business context. | ||
Practitioner Guidance
What to prioritise: Put the revenue, fraud, and customer-impact metrics on the same scorecard before debating control changes. If the organisation cannot show how a rule affects both loss and conversion, it is not ready to own the trade-off responsibly.
Decision rule: If the control change affects approval, onboarding, checkout, or account recovery, require joint sign-off from finance, risk, and the product owner for that journey. If it affects dispute handling or loss recovery, bring in operations as well.
What to verify: Confirm that a named leader can explain who owns the business case, who owns the control quality, and who owns the customer experience impact. If those answers are different people, the governance is healthy; if they are unclear, the organisation is likely to oscillate between overblocking and undercontrolling.
Practitioner takeaway: Fraud prevention and revenue growth stay balanced only when accountability is shared across business, risk, and product functions, with explicit decision rights and shared metrics that capture both loss and friction.
Related resources from NHI Mgmt Group
- Who should own fraud prevention when trust, growth, and revenue protection all overlap in a marketplace?
- How should ecommerce leaders balance fraud prevention with revenue growth?
- Who is accountable when fraud prevention fails in regulated gaming?
- Who is accountable when fraud prevention damages legitimate customers?