Any actual or attempted fraud incident (however small) must be reported to the appropriate authorities (including the BMA) and followed up. Monitoring systems must be designed to measure fraud patterns that might reveal a series of related fraud incidents.