The Control That Looks Good on Paper
A payments company has a control requiring dual approval for any transfer above $50,000. Testing last year found zero exceptions, and the control is rated effective. A new internal audit review discovers that the two approvers are often the same person using a shared login, that the system auto-approves requests older than 24 hours, and that the $50,000 threshold has not been reviewed since the company's volume tripled. Staff say the 24-hour auto-approval exists to prevent payment delays. In the last year, three transfers between $50,000 and $75,000 were later found to be fraudulent, all processed through the auto-approval route. The company processes roughly 4,000 transfers a month, of which about 300 exceed $50,000.
1. Evaluate whether the control is effective and explain the gap between last year's test result and reality.
Read the worked answer
The control is not effective; last year's 'zero exceptions' result is a testing artefact, not evidence of control. Three design and operating failures undermine it. First, dual approval is defeated by shared logins - if the same person can approve twice, the control provides segregation-of-duties in name only. Second, the 24-hour auto-approval is a bypass: it converts a preventive control into an automated override for exactly the transactions that sit in the queue, and three frauds in the $50,000–$75,000 band ran through it. Third, the $50,000 threshold is stale relative to tripled volume, so the control's scope no longer matches the risk. The reason testing passed is that testers likely checked whether approvals were recorded, not whether they were independent, and did not sample the auto-approval population. With ~300 transfers a month above the threshold, the auto-approval route is a material channel. The control must be re-rated ineffective, and the prior test's methodology should itself be reviewed.
2. Recommend a remediation plan that closes the design gaps, not just the symptoms.
Read the worked answer
Remediation should address identity, bypass, and calibration. Identity: eliminate shared logins, enforce unique credentials with maker-checker enforced at the system level so the same user cannot approve their own request, and add periodic access reviews. Bypass: remove or tightly restrict auto-approval - if a time-based escalation is needed for operational reasons, route it to a second independent approver or a supervisor queue, log every auto-approval, and report the count to management monthly. Calibration: re-baseline the threshold against current volume and risk (e.g., risk-tiered thresholds by counterparty and amount), and schedule an annual review. Detection: add post-payment monitoring for the $50,000–$75,000 band and a look-back on the three frauds to identify any others. Testing: redesign the test to sample the auto-approval population and verify approver independence, not just presence of approvals. Finally, assign owners and deadlines, and re-test within one quarter to confirm the control operates as designed.