Financial Risk Identification: From Exposure to Control Evidence

Describe the event and its financial consequence

A useful financial risk register identifies what could happen, why it could happen and the consequence for cash, reporting or operations. For example: an unauthorised supplier bank-detail change could redirect a payment because record amendments and payment release are not independently checked. That statement points to a process, a financial exposure and a control objective.

Begin with material flows such as customer receipts, supplier payments, payroll and journal entries. Consider concentration, overdue balances, incorrect data, duplicate transactions, access rights and dependence on a single employee or system. Identify the exposure before considering controls, then assess what remains after the controls that actually operate. A likelihood score represents a management judgement; multiplying ordinal scores does not turn it into a measured probability of loss.

Assign operating responsibility and oversight

The IFC Internal Control Handbook describes control as a continuing process that supports operational, reporting and compliance objectives with reasonable assurance. It explains that management retains responsibility when activities are outsourced. Delegating bookkeeping or payment preparation therefore needs an internal owner who understands the output, exceptions and escalation route.

The IIA's refreshed Three Lines statement, published on 8 July 2026, emphasises organisational accountability, coordination and adaptable roles. Its current guidance also protects the independence of internal audit when responsibilities overlap. For a small business, distinguish the person operating a control, the manager monitoring it and any independent assurance. Do not describe a routine management check as an independent audit.

Specify the control so that someone can verify it

ACCA describes approval limits, segregation of duties, reconciliation and management review as common procedures. A useful control description connects one of these procedures to the identified failure. State who acts, when, which records are checked, what exceptions require action and what evidence is retained.

For a fictional supplier-change process, management might require a second authorised person to confirm new payment details through an established contact using previously verified contact information. The retained record could contain the supplier identifier, request date, verification method, verifier, approval and effective date. A signature alone does not demonstrate that the recipient details were confirmed or that the confirmation preceded payment.

Worked example: distinguish exposure from missing evidence

Assume a fictional company's change log contains 18 supplier bank-detail amendments in a month. The scheduled review finds 13 complete verification records and five without the required confirmation evidence. The documented completion rate is 13 divided by 18, or 72.2%. That percentage describes the records examined; it is not a fraud rate or a measure of financial loss.

Suppose two of the five suppliers received payments totalling 78,000 after the amendments. This identifies 78,000 of payments requiring follow-up under the missing-evidence exception. It does not establish that the payments went to an incorrect account. Confirm the recipient through an appropriate established channel, retain the result and escalate uncertainty under the company's authorised process.

Management should also check whether the change log is complete by reconciling it to system amendment records. A review of 18 logged changes cannot establish full coverage if other changes bypassed the log. Determine whether the five gaps reflect work not performed, records not retained, unclear responsibilities or a system problem. The remedy depends on that explanation.

Check both design and operation

Walk one transaction through request, record amendment, approval, payment release and reconciliation. Test an ordinary item and an exception, including absence of the usual approver. Ask where the process would stop an unverified request and which record demonstrates that stop. A post-payment bank reconciliation can identify what left the account, but may arrive too late to prevent a misdirected payment.

A procedure can be well designed and still fail in practice through access overrides, incomplete evidence or late review. If the team is too small to separate every task, assess the specific remaining exposure and document the additional review chosen by management. Avoid assuming that a senior person's involvement compensates for an unchecked transaction when that person also initiated or changed it.

Report the residual issue and verify closure

Produce a compact register containing the risk event, potential consequence, control owner, reviewer, frequency, evidence, observed exception and agreed response. Record an action owner and due date, then verify completion using evidence of the revised process operating. Separate resolved items from overdue actions and accepted residual exposures. Reassess after changes to systems, access, staffing or payment methods; a control conclusion applies to the scope and period actually reviewed.