The ultimate goal of establishing a robust risk management framework in an organization is to facilitate the achievement of the organization's business goals and objectives. A comprehensive risk management framework helps identify, assess, and mitigate risks that could impede the organization's ability to achieve its strategic objectives, ensuring that risks are managed in a way that supports the organization's overall mission and goals.
The IIA Standards: Standard 2120 - Risk Management: "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes." COSO Framework: Emphasizes that the purpose of risk management is to help organizations achieve their objectives and enhance performance through effective risk management practices.

Setting unrealistic targets for staff to achieve is a potential red flag indicating that there may be fraudulent activities occurring within the organization. When senior management sets targets that are unattainable, it can create pressure on employees to engage in unethical or fraudulent behavior to meet these goals. This is one of the elements of the fraud triangle (pressure, opportunity, and rationalization) that can lead to fraudulent activities.
IIA Practice Guide: Fraud and Internal Audit
COSO Fraud Risk Management Guide

The board of directors has the ultimate responsibility for implementing the organization's governance system.
This includes overseeing the strategic direction and accountability mechanisms that align with good governance practices. The board ensures that governance structures and principles are clearly defined and effectively implemented, providing oversight to management activities. References: Corporate governance principles and guidelines, which often highlight the role of the board in setting and maintaining effective governance systems.

An evaluation of the current performance and compensation program would be the most effective control to address the underlying cause of fraudulent behavior described. The pressures from unrealistic targets and aggressive monitoring likely encouraged employees to engage in fraudulent account openings. By evaluating and potentially revising these targets and the associated compensation schemes, the bank could mitigate the pressures that lead to such unethical behaviors.
Standards on the role of internal control systems in preventing and detecting fraud, including guidance on managing performance and compensation to align with ethical standards.

A detective control is designed to identify and correct errors or irregularities that have occurred. A compliance specialist conducting quarterly reviews fits this definition as it involves monitoring and detecting non-compliance issues after they have occurred, allowing for corrective actions to be taken. References:
* COSO Internal Control Framework and the IIA's guidance on types of controls.