As a control officer, he should take CFE exam. There are more opportunities now for fraud examiners than traditional auditors and COs. ITControl, Forensic Audit, Operational Risk Mgt are good options. He should seek relevant certifications there and get certified.