The Control That Existed Only on Paper
A payments firm suffered a EUR 2.3m loss when a contractor bypassed a dual-approval control on vendor payments. The control was documented in the risk register as 'key - effective', tested annually by self-assessment. Investigation shows: the system allowed single approval for payments under EUR 50,000; the contractor split EUR 2.3m into 48 payments averaging EUR 47,900; the self-assessment was completed by the same team that owned the process; and no independent sample testing had occurred in three years. The firm's operational risk appetite statement says 'low tolerance for fraud'. The head of operations wants to close the incident by disciplining the contractor and updating the procedure document. The board wants to know why the control framework failed and what must change.
1. Diagnose the control failure using a control-framework lens, distinguishing design, operating effectiveness and governance failures.
Read the worked answer
Three distinct failures should be separated, because each needs a different remedy.
Design failure. The threshold structure permitted single approval below EUR 50,000. That is a design weakness: the control was circumventable by structuring, and no aggregation rule detected repeated payments to the same vendor. A well-designed control would aggregate payments by vendor over a rolling period and require dual approval once a cumulative threshold is crossed.
Operating effectiveness failure. The control was never actually tested independently. Annual self-assessment by the process owner is not assurance; it is a declaration. The register's 'effective' rating was therefore unsupported. The 48 payments averaging EUR 47,900 are a textbook structuring pattern that transaction monitoring should have flagged; its absence shows detective controls were not operating.
Governance failure. The same team owned the process, the risk assessment and the assurance. That is a conflict of interest and a breakdown of the three-lines model: the first line assessed itself, the second line did not challenge, and internal audit had not sampled the control in three years. The register rating was never validated.
The appetite statement ('low tolerance for fraud') was not translated into tolerances, thresholds or monitoring metrics, so it had no operational effect.
2. Recommend a remediation plan and explain how you would evidence that the control is now effective.
Read the worked answer
Remediation should address cause, not just the individual. Disciplining the contractor and rewriting the procedure leaves the structuring loophole open and the assurance gap intact.
Recommended actions:
- Redesign: cumulative vendor aggregation with dual approval above a defined threshold; block or alert on payments just below thresholds; segregation of duties between vendor setup, approval and payment release.
- Detective layer: automated monitoring for structuring patterns, duplicate vendors and bank-detail changes, with named alert owners and response times.
- Assurance: move control testing to the second line or internal audit, using independent sample testing at least quarterly for key controls; remove self-assessment as the sole evidence.
- Register integrity: re-rate the control as 'design deficient - not tested' until evidence exists, and record the incident against the risk.
- Appetite translation: define quantitative fraud tolerances and a KRIs dashboard (structuring alerts, override counts, aged exceptions) reported to the board.
Evidencing effectiveness: independent sample testing showing zero unapproved payments above threshold over a defined period; monitoring logs with alerts raised and resolved; a re-performed walkthrough by internal audit; and trend data on KRIs. Effectiveness is demonstrated by independent evidence over time, not by a signed procedure.