When something went wrong.
WHAT TO ESTABLISH FIRST
What actually happened and its extent.
WHY EXTENT FIRST
The visible instance is frequently not the whole.
WHAT TO PRESERVE
Records, system access logs and documents.
WHY IMMEDIATELY
They are altered once the matter is known about.
WHAT TO DETERMINE
Whether it was error or deliberate What control should have prevented or detected it Why it did not How long it continued What it cost
WHY THE DURATION QUESTION
Losses discovered are usually a fraction of the total.
WHAT TO DO ABOUT THE PERSON INVOLVED
Follow a proper process.
WHY
Findings reached without fairness are overturned.
WHAT TO ADDRESS
The control gap.
WHY IT MATTERS MOST
The same gap will be used again.
WHAT TO ESTABLISH
Whether the control was absent, or present and not performed, or bypassed.
WHY THAT DISTINCTION
Each requires a different response.
WHAT TO DO ABOUT BYPASSED CONTROLS
Establish who bypassed them and why they could.
WHAT TO CONSIDER
Whether management override was involved.
WHY
It is the most common and least addressed weakness.
WHAT TO REVIEW
Whether similar exposures exist elsewhere.
WHAT TO RECOVER
What can be recovered, through proper process.
WHAT TO REPORT
Where obligations require it.
WHAT TO RECORD
The whole matter, including decisions.
WHAT TO AVOID
Concealing it internally.
WHY
Staff know, and concealment signals that it is tolerated.
