It really is about more than what ISO covers. It’s not just about ‘fraud’. The two areas I tend to focus on are the torturous paths of data transfer across multiple systems (been bit by that!) and the transparency and availability of data (huge area of risk).
Most of you know that what I dislike about the standards is that they are a minimal standard and too many organizations try to contract lawyer their way out of good quality as well as the abusive punitive and ignorant auditors that overstep ( no one here of course

). So like everything, ISO is more likely to get it wrong and vaguely over reach on this too….