A
Aveosoft .
Confidential · For MK Fraud Insights
Solution design proposal · Phased build

MK Fraud Readiness Score Platform

A board-grade fraud-readiness assessment, scoring, and reporting product, built around a deterministic, version-controlled scoring engine that MK owns and edits without a developer.

Prepared for
MK Fraud Insights
Engagement
MK Fraud Readiness Score
Phase 1 fee
USD 2,655 fixed
Date
16 June 2026
How the scoring engine stays transparent, reproducible, and editable by MK

The score is a deterministic function of your methodology, held as data you control.

The MK Fraud Readiness Score is calculated by a rule engine that treats your methodology as configuration, not code. The score is a pure deterministic function of the active methodology version and the applicable answers, so the same answers always produce the same overall score, category scores, maturity band, exposure profile, and recommendations. No generative AI ever participates in the calculation. Every result carries a full trace showing the contribution of each answer, each weight, each critical-control check, and any maturity cap that fired. Questions, weights, maturity bands, critical-control rules, and recommendation content all live in an MK admin console as versioned, editable data, so your team changes the methodology without a developer and without a release. A scoring test pack proves expected equals actual before anything goes live. This is the heart of the product, and it is the first thing this proposal commits to.

This proposal answers all 25 of your Section 13 questions
1 Understanding 2 Recommended architecture 3 Alternative evaluated 4 Custom-built parts 5 Third-party services 6 Once-off + recurring cost 7 Vendor lock-in 8 Scoring engine + testing 9 Conditional reports 10 MK content updates 11 Data protection 12 Reassessment + benchmarking 13 Report versioning 14 Multiple respondents 15 Inputs from MK 16 Assumptions 17 Key risks 18 Delivery phases 19 Timeline 20 Phase 1 fee 21 Phase 2 range 22 Support 23 Documentation + training 24 Who performs the work 25 Work examples
01 What you are building · Question 1

A board-grade fraud-readiness product, not a generic quiz

You have an established, document-based Fraud Readiness Diagnostic across ten capability areas. You want it as a scalable digital product organisations complete online to get a structured, credible view of their fraud readiness, then act on it over a 30, 60, and 90-day horizon. It supports an Instant Snapshot, a Full Self-Assessment Report, and an MK-Validated Report, with the architecture ready for all three even though the validated level is a manual MK workflow at launch.

Fraud leadership and governance
Whistleblowing and reporting culture
Fraud-risk identification
Third-party and supply-chain fraud risk
Operational fraud controls
Digital and identity fraud risk
Fraud-detection capability
Fraud culture and awareness
Fraud-incident response
Continuous improvement and monitoring
Your methodology, our engineering. MK owns and provides the fraud methodology — questions, response options, weights, maturity rules, critical-control rules, interpretations, and recommendation content. Aveosoft translates that into a reliable, configurable, transparent technical system. We do not invent fraud content, interpret maturity, or decide which risks to prioritise. That boundary is yours.
02 Recommended architecture · Questions 2, 4, 5

A custom web app with a configuration-driven scoring engine

We recommend a custom web application built around a versioned scoring and rules engine and an MK admin console. The methodology lives as data, not code, so MK edits it without a developer. This is deliberately pragmatic engineering for an SME launch — a modular application and one primary database, not an enterprise microservices estate.

FE React / Next.js front end

Board-grade, responsive MK-branded interface that loads on normal South African connections, with progress, save-and-return, and conditional logic.

API Node.js / TypeScript, modular

One deployable with clear module seams: assessment, scoring, reporting, admin, payments, comms. Same language end to end keeps the team small and handover simple.

SC In-process scoring engine

Deterministic, testable, traceable. Reads versioned configuration and emits a score plus a full trace. No black box, no model inference.

DB PostgreSQL

Relational integrity for the methodology and results, strong aggregation for the dashboard and the benchmarking dataset, fully portable, easy to export and hand over.

PDF HTML templates to branded PDF

One template path drives both the on-screen report and the PDF, with full MK brand control of fonts, colours, charts, and layout.

SA Region-appropriate hosting

Low operational overhead, scales predictably, every account under MK control. Optional AI assist sits off the scoring path, off by default.

Deployment (Section 7.12). We recommend a dedicated MK subdomain (for example score.mkfraud.co.za), not an embed or a white-labelled platform. It gives full brand control and board-grade feel (branding), an indexable product URL (SEO), a same-root-domain trust signal under MK's certificate (trust), all data in MK's own database (ownership), the best performance (we control the stack and CDN), clean independent deploys (maintenance), and the lowest vendor dependency. A small CTA on www.mkfraud.co.za links across, and the subdomain is the natural base for the future client portal.

Custom-built, owned by MK on payment: the scoring engine and its versioned configuration model, the assessment experience, the MK admin console, the report generator, the data model, the role-based access model, and the anonymised benchmarking structure. Third-party, configured, under MK-owned accounts: hosting, managed PostgreSQL, object storage, transactional email (Postmark / Amazon SES), a South-Africa-suitable payment gateway (PayFast, Yoco, or Peach Payments, with Stripe an option), privacy-respecting analytics, domain and TLS. Each third party is a commodity with a drop-in alternative, which keeps lock-in low.

03 Two approaches compared · Question 3

Custom and configurable, against a low-code platform

Your brief requires at least two realistic approaches across thirteen evaluation areas. The honest alternative is a configured low-code assessment platform — faster and cheaper to start, but weaker where you weight highest. A hybrid is the third reference point. The recommended option is A.

Evaluation areaA · Custom + config (recommended)B · Low-code platformC · Hybrid
Initial costHigher up front, scoped to an SME MVPLowest to startMiddle; two surfaces to wire
Recurring costModest, predictablePer-seat / per-response fees that growPlatform fees plus our infra
User experienceFull board-grade MK brandConstrained by platform templatesGood front, seams in reporting
Scoring flexibilityFull: versioned config, caps/gates, dual model, tracesLimited; often hits a ceilingFull in core; intake constrained
ReportingFull dynamic branded PDF, immutable finalsTemplated, harder to make board-gradeStrong report, data round-trip risk
SecurityWe control hosting, region, encryption, RBACDepends on the platformMixed; data crosses a boundary
Data ownershipTotal: your database, full exportOften partial, platform-shapedSplit across two systems
Vendor lock-inLowest: open stack, portable schemaHighest: methodology trappedMedium; lock-in on intake half
MaintainabilityMK self-admins; any dev can take overEasy until platform limitsTwo skill sets, messier handover
ScalabilitySME to thousands, no rebuildScales, but cost scales tooScales unevenly
IntegrationClean subdomain, open API, webhooksOnly platform connectorsCustom integrates, platform constrains
BenchmarkingOwns the anonymised datasetData lives in the platformSplit data complicates it
HandoverOpen code, schema, config, test packPlatform-specific, tied to its lifeTwo handovers; weakest link wins

Why custom and configurable wins. Your heaviest, repeated requirements — deterministic traceable scoring with critical-control gating and the readiness-vs-exposure separation, MK self-editing without code, total data ownership with no lock-in, board-grade reporting with immutable finals, and an owned dataset for benchmarking — all favour the custom option. A low-code platform is cheaper to start but loses on exactly the axes you weight highest, and it traps your confidential methodology and client data inside a third party. Your brief states the lowest-priced proposal will not necessarily be selected, and this is why.

04 The scoring engine, and how it is tested · Question 8

Deterministic, traceable, version-controlled, proven by a test pack

The scoring engine is the heart of the product and the reason a generic web shop cannot deliver this brief. It is a pure deterministic function of the active methodology version and the applicable answers — the same answers always produce the same result, with no randomness, no time dependence, and no AI in the path.

2 Two separate scores, never merged

Fraud Readiness (capability across ten domains) and Fraud Exposure (inherent opportunity from your operating model, channels, third parties, geography) are scored by two distinct passes and shown side by side — never averaged into one unexplained number.

! Critical controls cannot hide

Critical-control questions are flagged; maturity caps and gates are explicit rules. A failed critical control caps the maturity band regardless of a healthy average, force-lists the gap, and pushes it up the priority ranking.

T Full score trace

Every run shows each answer's value and weight, its contribution to the category, the overall roll-up, the critical-control evaluation, the maturity decision before and after caps, and which questions were excluded as N/A and why. MK views and exports it.

V Versioned configuration

Each methodology set is a version (draft / active / retired). A completed assessment permanently stores the version it was scored under, so old reports never silently change when the methodology evolves.

QA Scoring test pack

Named sample response sets with MK-approved expected results run through the real engine and produce an expected-vs-actual difference report. The launch gate: no production launch until scoring reconciles against the approved test cases.

R Non-destructive recalculation

Approved methodology changes can recompute historical assessments to show movement over time, without ever overwriting an originally issued result.

See it working. A clickable prototype demonstrates the assessment journey, the instant snapshot with separated readiness and exposure scores, the critical-control gap callout, and a board-grade report. Open the live prototype & sample report ↗
05 Conditional reports, versioning, corrections · Questions 9, 13

Board-grade reports from controlled MK content

Reports are assembled from MK-approved material only, generated deterministically from the scoring result, the trace, and the organisation profile. There is no unrestricted AI making risk decisions or inventing recommendations.

Conditional content blocks driven by the same trigger rules as recommendations — a critical-control gaps section appears only when gaps exist.
Score-based interpretation pulled from your interpretation library by maturity band and exposure level, never generated freely.
Dynamic charts, priority ranking, a 30/60/90-day action plan from your pre-approved items, and sector-specific recommendations.
Disclaimers including the mandatory statement that a self-assessed report is based on respondent-supplied information and not independently verified.
Versioning and corrections (Q13). Every report is a versioned artifact labelled draft, final, self-assessed, or MK-validated. Once marked final and issued it is immutable: corrections create a new version with the prior retained and the change recorded, so there are no silent changes to issued finals. Each report stores the methodology version it was generated under, so a reissue can reproduce the original or knowingly regenerate under a newer methodology. Any optional AI assistance is an off-by-default drafting aid for MK-approved commentary, outside the scoring and report-content pipeline, under a no-training agreement, and can never alter a number or invent a recommendation.
06 How MK updates questions, weights, content · Question 10 · 7.9

MK administers the methodology without a developer

Your maintainability requirement is that non-technical MK staff manage ordinary changes without continuous developer dependency. We draw the line explicitly and put it in the admin guide at handover.

MK administers directly · no code release
  • Create, edit, activate, retire questions; group into domains; configure response options and values
  • Allocate question and category weights; flag critical controls and set their rules
  • Define applicability conditions and N/A handling; add help text; create sector modules
  • Manage maturity bands, caps and gates, recommendation and strength triggers, exposure variables
  • Edit the recommendation library, report content blocks, interpretation text, action plans, disclaimers
  • Amend email and communication templates; preview; maintain versions; run the test pack
Requires technical intervention
  • New rule-expression types beyond the configurable builder
  • New question or response types (a new input widget)
  • Net-new report layouts or fundamentally new chart types
  • New third-party integrations, payment providers, or auth changes
  • Schema or engine changes, performance, security patching, upgrades
  • New product levels or workflows not in the data model
Management dashboard (7.9). The same console gives MK an overview dashboard: assessments started and completed, status, organisation details, overall and category scores, maturity and exposure levels, critical-control gaps, report and payment status, dates, reassessment history, and MK review status — with filtering, search, and full data export.
07 Protecting client and respondent data · Question 11 · 7.3

A POPIA-aligned security and access approach

The Protection of Personal Information Act is the relevant frame, and the platform is designed to it.

Hosting in a SA-appropriate region with a defensible POPIA posture, all accounts under MK control
Encryption in transit (TLS 1.2+) and at rest (AES-256) for database, backups, storage
MFA for MK admin/reviewer accounts; respondent access kept light to protect completion
Role-based access (Respondent, Admin, Reviewer, Super Admin), enforced server-side
Automated daily backups, point-in-time recovery, documented restore runbook
Append-only audit trail of security and methodology actions
Configurable retention and account deletion supporting POPIA data-subject rights
Incident handling aligned to POPIA breach-notification duties; full data export any time
Respondent accounts — our recommendation (7.3). For the self-assessment funnel we recommend a low-friction approach: a secure tokenised save-and-return link with minimal contact capture and server-side persistence, so no response is lost if a session is interrupted, rather than a mandatory account at the start, because a forced sign-up step measurably depresses completion on a long professional assessment. Full accounts are reserved where they earn their cost: MK admins and reviewers, and the later portal, multi-respondent, and reassessment use cases.
No public-AI training on your data. The deterministic engine never sends data to any AI service. Sensitive client and methodology information is never used to train public AI models. The only optional AI feature is an off-by-default drafting aid on MK-approved content, under a no-training agreement.
08 Reassessment, benchmarking, multiple respondents · Questions 12, 14 · 7.13

Built to grow without a rebuild

Reassessment & benchmarking (Q12). Each assessment stores its methodology version, so organisations reassess and compare progress fairly over time. On completion we write an anonymised benchmark record (sector, size band, scores, maturity, exposure, critical-control summary — no organisation name or respondent identity), kept separate from client-identifying data. It is the substrate for a future South African Fraud Readiness Index: industry and size comparisons, distributions, percentiles, longitudinal trends — switched on only when MK judges the sample credible. The first release presents no peer benchmark as factual industry data.

Multiple respondents (Q14). Respondent is a first-class entity from day one, designed to scale from one to many even though the MVP uses one. A later section-assignment layer maps domains to contributors (risk, information security, procurement, internal audit, a project owner who submits). Because responses are already keyed per question with a recorded respondent, adding per-section ownership is an additive change, not a rebuild.

Analytics (7.13). The platform captures funnel analytics for MK — assessment starts, completion rates, drop-off points, time per section, report purchases and downloads, conversion to consultation enquiries, and reassessments — always in aggregate and never exposing one client's data to another.

09 Recurring cost and vendor lock-in · Questions 6, 7 · 7.10

Low, predictable running cost; lock-in only to open technology

Rough monthly estimates in USD for an SME launch, confirmed during Phase 1. Every line is under MK-controlled billing — these are MK's direct costs, not pass-through markups. The custom architecture carries no mandatory per-seat or per-assessment platform licence.

LineProvider examplesMonthly (USD est.)
App + database hostingManaged app host + managed PostgreSQL25 – 60
Object / file storageS3-compatible5 – 15
Transactional emailPostmark / Amazon SES10 – 25
Report generationRuns in our application tier0 – 20
AnalyticsPrivacy-respecting analytics0 – 20
Domain, DNS, TLSMK registrar + managed TLS1 – 5
Backups + monitoringAutomated backups, uptime monitoring5 – 20
Indicative total at launchworking figure ~$75 – 120~$50 – 165 / mo

Annual licences are near zero with open-source-leaning choices. Payment fees are per-transaction through MK's own gateway. The platform supports free assessments, paid reports, promo/invitation codes, corporate licences, invoiced enterprise customers, report packages, and future subscriptions without a rebuild (7.10). Vendor lock-in (Q7) is low by design: open standard stack (React, Node, PostgreSQL, HTML-to-PDF), no proprietary runtime holding your methodology or data, every third party swappable behind a thin adapter, and full data export means MK can leave any provider or hand the whole system to another competent developer with the code, schema, scoring config, report templates, and test pack in hand.

10 What we need from MK, and our assumptions · Questions 15, 16

Inputs required and assumptions priced in

From MK (Q15): the methodology pack (questions, response options and scale, profiling fields, weights, maturity bands, critical-control rules, exposure variables, recommendation library, report outline and sample wording, disclaimers), brand assets and website references, sample organisational profiles with expected scoring outcomes for the test pack, a preferred SA payment approach, the deployment preference and DNS or hosting access, and a single MK point of contact. We are ready to sign a confidentiality arrangement before receiving the full methodology pack, and we protect confidential material in access-restricted, MK-controlled storage on a need-to-know basis, never in public repositories or public AI tools (Section 17).

MK provides and owns all fraud content; we build the system that executes it
Scoring is fully deterministic; any AI assist is optional, separated, never alters a score
MVP automates the Snapshot and Self-Assessment Report; MK-Validated is manual at launch
One core framework at launch with a bounded number of sector modules
Reports are MK-branded PDF plus on-screen from approved templates
Payment at MVP is manual/invoiced with codes; an automated gateway can follow
Hosting is SA-appropriate and POPIA-aligned; MK owns and can export all data
All production accounts under MK credentials; Aveosoft holds working access only
No peer benchmarks presented as factual at first release
Section 23 items are out of MVP scope and identified as future opportunities
The Phase 2 fixed price is finalised at the end of Phase 1
MK provides timely inputs and a single point of contact
11 Key risks and mitigations · Question 17

The risks we manage, with mitigations attached

R1 · Methodology still under development.

Some materials may be refined during the design phase, making scope and scoring a moving target. Mitigation: hold the methodology as versioned, externalised configuration so changes never need code edits; lock a baseline version for the prototype; written change control re-tests and re-versions any post-acceptance change.

R2 · Scoring correctness and transparency.

A silent calculation error or untraceable score would destroy the credibility that is the product's value. Mitigation: an expected-vs-actual reconciliation harness from an MK-approved test pack, a per-answer trace, fully deterministic calculation, and a hard launch gate — no launch until scoring reconciles against the approved test cases.

R3 · Critical-control gating misconfigured.

If a failed control does not cap maturity, a weakness hides behind a healthy average. Mitigation: model flags and caps as explicit configurable rules, verified by dedicated test-pack scenarios where each failure must demonstrably cap maturity.

R4 · Data protection, ownership, no public-AI training.

A lapse is both a POPIA exposure and a trust failure. Mitigation: the POPIA-aligned approach above, MK ownership and export of all data, all accounts under MK credentials, and an absolute rule that no client or methodology data trains any public AI and no AI sits in the scoring path.

R5 · Phase 2 award uncertainty and scope creep.

Phase 1 is standalone and MK may appoint a different supplier afterward, while a feature-rich Phase 3 backlog invites MVP inflation. Mitigation: scope and price Phase 1 as a complete, handover-ready deliverable usable by any supplier; restate the out-of-scope list; confirm the MVP automates only the Snapshot and Self-Assessment Report; written change control prices additions separately.

12 Delivery phases and timeline · Questions 18, 19

A paid Phase 1, then a milestone-funded MVP build

Phase 1 · 3 – 4 weeks · USD 2,655

Solution design + prototype

Requirements validation, assumptions and risk register, customer-journey and workflow design, two implementation options and the recommended architecture with diagrams and database structure, security / recurring-cost / vendor-lock-in assessments, implementation roadmap, the fixed-price build proposal, a clickable prototype, and a demonstrated sample score and report.

Phase 2 · ~8 – 12 weeks · USD 15k – 25k

MVP build

Assessment interface, organisation profile, conditional logic, save-and-return, the scoring engine with category and maturity rules, exposure profile, critical-control logic, the admin console, snapshot results, full report generation, email workflows, basic payment / access control, data export, subdomain deployment, analytics, testing, documentation, training, production launch.

Phase 3 · Later, by milestone

Enhancements

Multi-respondent assessments, client accounts and portals, evidence uploads, MK validation workflow, reassessment comparison, benchmarking, dashboards, subscriptions, additional sector modules, API integrations, and the annual Fraud Readiness Index.

Phase 2 milestone (Section 14)Acceptance basisShare
M1 Requirements & architectureMK approval of the validated build spec5%
M2 Prototype & scoring PoCAgreed test responses produce expected scores10%
M3 Assessment & administration buildAgreed functional test cases pass30%
M4 Reporting & commercial workflowReports match approved content and calculations25%
M5 Deployment & testingEnd-to-end customer journey completes15%
M6 Documentation & handoverSuccessful handover, training, credential transfer15%
13 Team, documentation, training, support · Questions 22, 23, 24

Who does the work, and how we hand it over

Engagement lead & single point of contact
Keval Gajjar

Accountable for delivery, communication, and acceptance. Aveosoft is an AI-first engineering company (established 2016, 200+ projects, 50+ engineers) on fixed-price, milestone-based terms.

Senior Architect
Markand Chauhan

Owns the scoring-engine design, the data model, and code review on the critical paths. A full-stack engineer carries the assessment journey, admin console, and report generation; QA owns the scoring test pack.

The same senior people who design the scoring engine in Phase 1 build it in Phase 2 — the strongest continuity guarantee we can offer.

Documentation & training (Q23). Handover is a first-class milestone: source code, configuration, database schema, scoring configuration, report templates, the scoring test pack and scripts, deployment and backup instructions, an administrator guide (including the administer-vs-develop matrix), technical documentation, known limitations, recommended maintenance, a recorded training and handover session, and transfer of all production accounts and credentials. The engagement is not complete until MK or another competent developer could maintain the solution.
Support (Q22)IncludedIndicative (USD est.)
Warranty30 days from acceptance; defects fixed at no extra dev fee; optional 60–90 day extensionincluded
Tier 0 · CareMonitoring, backup verification, security/dependency patching, defect triage, small content/config pool~250 – 400 / mo
Tier 1 · ManagedTier 0 + capped enhancement pool, monthly health review, priority response, methodology-change support~500 – 900 / mo
Tier 2 · PartnerTier 1 + larger pool and scheduled Phase 3 roadmap work under a quarterly plan~1,000+ / mo
14 Relevant experience · Question 25

Assessment, scoring, workflow, and reporting depth — demonstrated

Your brief is explicit that generic website-design portfolios are not sufficient. We lead with capability that maps directly to this product, and we prove it with a working prototype and scoring demonstration rather than a logo wall.

Built for this proposal · Live

MK Fraud Readiness Score — working prototype & scoring demonstration

Assessment journey · deterministic snapshot · readiness vs exposure · board report · MK admin

A clickable, MK-branded prototype that walks the full respondent journey, produces an instant snapshot with readiness and exposure kept separate, flags a critical-control gap, and renders a board-grade report with a 30/60/90-day action plan, alongside an MK admin view showing no-code question and weight configuration. The exact pattern your product needs, demonstrated.

▶  Open the live prototype
Flagship build

Pixally CRM — multi-module platform

30+ module CRM and operations platform · dedicated team of 15

A 30-plus module CRM and operations platform delivered by a dedicated team of 15, with requirement-to-test traceability, structured change control, configurable modules, administration interfaces, and dashboards. The configurable-platform, admin-console, and QA-traceability discipline the MK scoring engine, admin console, and scoring test pack depend on.

30+Modules
15Team
100%Requirement-to-test traceability
ProjectDomainRelevance to the MK Fraud Readiness Score
Bridge MonitoringInspection / scoringComponent-level inspection workflows with rated criteria and generated condition reports — the assessment-to-score-to-report pattern this product requires.
R&B STROBESOversight dashboardOperational oversight dashboards with financial controls and exportable reporting across 3,500+ works, analogous to the MK admin dashboard and data management at scale.
E-SarkarWorkflow / audit trailMulti-tier approval workflows with full audit trails and versioned records, analogous to report versioning, validation status, and change history.

Full client references available on request.

15 Investment · Questions 20, 21

Fixed-price by phase

Phase 1 · Solution design + prototype + scoring proof of concept
$2,655 fixed
Phase 2 · MVP build (indicative)
$15,000 – 25,000  single fixed price confirmed at end of Phase 1

Phase 1 requires no production software development — it is a senior solution-design engagement, priced as an accessible, low-risk fixed discovery fee. The commercial weight sits in the Phase 2 build, which Phase 1 de-risks by producing a fixed-price build proposal. Billing in USD via Upwork escrow; payable as one milestone or split 50% on commencement / 50% on acceptance.

Phase 1 delivers
  • Validated requirements, assumptions & risks
  • Recommended architecture + diagrams + database structure
  • Recurring-cost & vendor-lock-in assessment
  • Implementation roadmap + fixed-price build proposal
  • Clickable prototype + demonstrated sample score and report
Also
  • Recurring platform cost ~$75 – 120 / mo (MK-owned accounts)
  • Annual licences ~$0 – 500 (open-source-leaning)
  • Optional support Tier 0 / 1 / 2 from ~$250 / mo
  • Excluded: fraud methodology authoring, MK brand/legal wording, third-party licence & transaction fees
16 A simple way to begin

Recommended next step

1
Confirm Phase 1

At the fixed fee of USD 2,655 as a standalone paid milestone.

2
Sign the confidentiality arrangement

We are ready to sign so MK can share the full methodology pack.

3
Book a short kickoff call

30 to 45 minutes to confirm the open questions, methodology format and readiness, sector-module count, deployment and payment preferences, and the Phase 1 review cadence.

By the end of Phase 1 MK holds validated requirements, a recommended architecture with diagrams and database structure, recurring-cost and vendor-lock-in assessments, an implementation roadmap, a fixed-price build proposal, a clickable prototype, and a demonstrated sample score and report. That pack is valuable on its own, and it is the strongest possible basis for the Phase 2 build.