Where to focus.
WHAT TO ESTABLISH
Where the business could lose money, information or its standing.
WHAT THE USUAL EXPOSURES ARE
Cash and payments Stock and assets Revenue and collections Payroll Purchasing Data and system access Compliance obligations
WHY CASH AND PAYMENTS FIRST
Money leaving the business is the most direct loss.
HOW TO ASSESS
For each area, ask what could go wrong and what the consequence would be.
WHAT TO CONSIDER
Deliberate misappropriation Honest error Failure to do something required Information that is wrong
WHY HONEST ERROR DESERVES EQUAL ATTENTION
It is more common than fraud and it costs more in aggregate.
WHAT TO RANK BY
Likelihood, and consequence.
WHAT TO CONTROL MOST TIGHTLY
High consequence, whatever the likelihood Anything where one person acts alone Anything where errors would not be noticed
WHY THAT LAST POINT
Undetected problems continue indefinitely.
WHAT TO ASK OF EVERY PROCESS
How would we know if this went wrong.
WHAT TO DO IF THE ANSWER IS THAT YOU WOULD NOT
Add a detective control.
WHAT TO BALANCE
The cost of the control against the exposure.
WHY
Controls that cost more than the risk are not worth having.
WHAT TO ACCEPT
That some risk is retained deliberately.
WHAT TO DOCUMENT
The exposures and what addresses each.
