MK Fraud Readiness Score

What we have validated against the brief

We have reviewed the brief line by line and validated the product MK is building: an established document-based Fraud Readiness Diagnostic across ten capability domains, delivered as a scalable digital product that organisations complete online to obtain a structured, credible view of their fraud readiness and a 30, 60, and 90-day plan to act on it. Three output levels are designed for from the start: an Instant Snapshot, a Full Self-Assessment Report, and an MK-Validated Report, with the validated level supported by a manual MK workflow at launch.

The risks we manage, and the decisions we need at kickoff

This engagement hands Aveosoft a clear engineering and configuration boundary, which removes the single largest risk on assessment products: a vendor inventing or quietly distorting the scoring model. The residual risk picture concentrates in five places, each with our recommended handling already attached.

From profile capture to a board-grade report

The respondent journey is designed to maximise completion of a long professional assessment while keeping the scoring honest. The organisation profile is captured first, which drives conditional applicability so each respondent only sees questions relevant to their operating model. Responses persist server-side with save-and-return, so no answer is lost if a session is interrupted on a normal South African connection.

The data-flow diagram below shows the end-to-end path from profile capture, through the scoring engine and its trace, to report generation, immutable storage, the MK admin dashboard, and the anonymised benchmark projection. A separate methodology side flow shows MK editing the configuration into a new version, running the test pack, and optionally recomputing history non-destructively.

A custom build, weighed against a configured low-code platform

The real decision is not whether to write code; it is how to host a deterministic, MK-editable scoring engine so it stays transparent, owned, and able to grow. We weighed the recommended custom build against the realistic alternative the brief invites, a configured low-code assessment platform. We recommend Option A.

Why the custom build is recommended. The brief's heaviest, repeated demands are deterministic and traceable scoring with caps and gates and a readiness-versus-exposure separation, MK self-editing without code, total data ownership and zero lock-in, board-grade branded reporting with immutable finals, and an owned dataset for future benchmarking. A configured low-code platform is the cheapest, fastest start, and the brief rightly asks us to weigh it, but it puts a ceiling on exactly what MK ranks highest, and it traps the confidential methodology and the client dataset inside a third party where leaving means a rebuild. The custom build is the only option that scores full on scoring flexibility, reporting, data ownership, lock-in, and handover at once, at a build cost that is reasonable at SME scale.

A custom web application built as a modular monolith

We recommend a custom web application built around a versioned scoring and rules engine and an MK admin console, deployed on a dedicated MK subdomain with every account under MK-controlled credentials. The methodology lives as data, not code. This is deliberately pragmatic engineering for an SME launch: a modular application and one primary database, not an enterprise microservices estate.

The methodology held as versioned, editable data

The data model is the structural answer to the central requirement: everything MK provides becomes rows MK can edit, not code we ship. Domains, questions, response options and values, question and category weights, applicability conditions, critical-control rules, maturity bands and caps, recommendation and strength triggers, and exposure variables all belong to a scoring configuration version with a status of draft, active, or retired.

Deterministic, traceable, version-controlled, and already proven in code

The scoring engine is the heart of the product. It is a pure deterministic function of the active methodology version and the applicable answers, with two separate dimensions, explicit critical-control gating, and a full trace on every run. To prove this is real rather than aspirational, we have built a runnable scoring proof of concept on the proposed Phase 2 stack, so the engine carries directly into the build.

The proof of concept is real, runnable Node code. It implements the exact scoring design specified in this pack: the configuration data model, the two-model readiness and exposure separation, critical-control gating, the score trace, and the test-pack mechanism. It runs on Node with a JSON methodology configuration, mirroring the proposed Node and PostgreSQL stack with zero proprietary rules engine in the path, and ships with a fourteen-case expected-versus-actual test pack (ten scoring cases and four report cases). The methodology values inside it are an illustrative sample; MK provides the real methodology.

Per-domain readiness breakdown from the sample run. The two failed domains, Whistleblowing & Reporting and Data, Analytics & Monitoring, both score 37.5, and the whistleblowing failure is the critical control that drives the maturity cap.

Board-grade reports from controlled MK content

Reports are assembled from MK-approved material only, generated deterministically from the scoring result, the trace, and the organisation profile. There is no unrestricted AI making risk decisions or inventing recommendations. A single HTML and CSS template set drives both the on-screen report and the PDF render, so MK gets full brand fidelity in both surfaces and there is one place to maintain.

A POPIA-aligned security and access design

The Protection of Personal Information Act is the relevant frame, and the platform is designed to it from the start. All production accounts are created under MK-controlled credentials and billing, so MK owns the system and Aveosoft holds working access only.

Low, predictable running cost; lock-in only to open technology

Each third party is a commodity service with a drop-in alternative, configured under MK-owned accounts. The figures below are rough monthly estimates in USD for an SME launch, confirmed during the build phase. The custom architecture carries no mandatory per-seat or per-assessment platform licence.

Vendor lock-in is low by design. The stack is open and standard (React, Node, PostgreSQL, HTML to PDF), with no proprietary runtime holding the methodology or data. Every third party is swappable behind a thin adapter: PostgreSQL is portable across providers, object storage is S3-compatible, and email, payment, and analytics providers are commodities. Full data export of raw responses, scores, traces, reports, and configuration means MK can leave any provider or hand the whole system to another competent developer with the code, schema, scoring configuration, report templates, and test pack in hand. The only lock-in is to open, widely supported technology, which is the desirable kind. A low-code platform, by contrast, would hold the confidential methodology and the client dataset inside a third party where leaving means a rebuild.

A paid Phase 1, then a milestone-funded MVP build

Phase 1 is a standalone, handover-ready deliverable. Phase 2 builds the MVP under milestone acceptance, with the fixed price confirmed at the close of Phase 1 once requirements are validated. Phase 3 enhancements follow by milestone as MK chooses.

Every Section 10 deliverable, and where it is evidenced

This pack evidences the Phase 1 design deliverables. The clickable prototype and the scoring proof of concept are live artifacts delivered alongside this document. The table maps all eighteen items to where each is evidenced.

By the close of Phase 1 MK holds validated requirements, a recommended architecture with diagrams and database structure, the security, recurring-cost, and vendor-lock-in assessments, an implementation roadmap, a fixed-price build proposal, a clickable prototype, and a demonstrated and runnable sample score and report. That pack is valuable on its own and it is the strongest possible basis for the Phase 2 build.