Why Controls Fail and How This Course Is Built
The real causes of control failure and the route the course takes through them.
11 min
Activities: 0 of 2
Controls rarely fail because nobody wrote them down
Most organisations that suffer a serious loss have policies and procedures. The losses happen because a control was not performed, was performed without thought, was designed around the wrong risk, or was overridden by someone senior. The gap is almost always between the document and what people actually do.
In this course you will move from the framework to practice. You will learn to see a process as a fraudster would, to choose controls that fit the risk, to detect what the controls miss, and to respond properly when something goes wrong. The aim is practical judgement: deciding which control to use, where, and at what cost.
Four reasons controls fail
Example 1: the reconciliation that was "done"
A trading company required monthly bank reconciliations. For eight months, the accounts assistant prepared them and the finance manager signed them. Each reconciliation carried an unexplained difference labelled "timing", which grew from a small amount to a large one. Nobody asked what the timing difference was. When a new manager investigated, the difference turned out to be cash receipts the assistant had diverted.
The control was designed correctly and performed every month. It failed because the reviewer did not challenge the reconciling item. A signature is not a review.
Example 2: the urgent payment
A finance clerk received an email that appeared to come from the managing director, asking for an urgent payment to a new supplier to secure a confidential deal. The clerk knew the normal process required a second approver, but the email said the director was travelling and could not be reached. The clerk released the payment. The email was fake.
The process was sound. It failed because the organisation's culture taught staff that senior requests outrank procedure. A control that can be overridden by a convincing message is only as strong as the confidence of the most junior person to say no.
The route through the course
- 1
Foundations
Framework and objectives
Control objectives, process mapping, fraud risk assessment and the control framework. - 2
Schemes
How fraud works
The main schemes, payment diversion and data analytics for detection. - 3
Processes
Controls in key cycles
Purchasing, sales, payroll, cash and assets. - 4
Response
Investigation
Planning, evidence, interviews and recovery. - 5
Practice
Assurance and cases
Small organisations, monitoring, deficiency reporting and full case studies.
A reviewer signs every monthly reconciliation but never questions a growing "timing" difference. Why did this control fail?
Match the failure to its type
- Reconciliation skipped during year end
- Approver signs invoices without reading them
- Posting is checked but supplier existence is not
- Director orders a payment outside the process