Periodic assessment.
WHAT TO REVIEW ANNUALLY
Your payment approval procedure Who can authorise what Your verification rules Whether staff know them What attempts you have seen
WHAT TO ASK
Has anything changed that creates new exposure? Did any control fail? Is the procedure actually followed?
THAT LAST QUESTION
Ask staff, not yourself.
Procedures frequently bend in practice.
WHAT TO UPDATE
Controls that did not work Thresholds that no longer suit your size Contact details on file
WHAT NEW EXPOSURE LOOKS LIKE
New payment methods New staff with authority New suppliers A new sales channel
WHAT TO TEST
Whether a staff member would verify a request appearing to come from you.
Ask them what they would do.
WHAT TO DOCUMENT
The review, and any changes.
WHY
It demonstrates diligence, and it means the review actually happened.
