CEO Impersonation Wire Fraud and Control Gaps
On 27 March, an AP clerk at Calder Distribution received an email that appeared to come from the CEO. It instructed an urgent $480,000 wire to a new supplier, Ningbo Precision Ltd, before quarter-end. The clerk created the vendor in the master file using bank details in the email. The AP manager, whose approval limit is $250,000, was on leave but approved by mobile phone because the CFO was unreachable. The bank processed the wire. Six days later, during the bank reconciliation, the finance team found that the supplier's address was a residential unit and the email domain was misspelled. The company has a policy requiring call-back verification for new bank details and dual approval above $100,000, but staff say it is not always practical. The audit committee asks for a control-failure analysis and a remediation plan.
1. Identify the control failures in the payment process and classify each as preventive or detective.
Read the worked answer
Preventive failures: the AP clerk could create a new vendor and change bank details without independent verification, so vendor master changes were not segregated from payment initiation; no call-back was made to a known contact before the bank details were used; the AP manager approved $480,000 despite a $250,000 limit, so the approval hierarchy and dual approval above $100,000 were overridden; the CFO was not escalated or contacted through an alternative channel; and there was no fraud risk assessment or training for CEO impersonation and urgent payment requests. These are preventive because they should stop a fraudulent payment before it leaves. Detective failures: the bank reconciliation was performed six days later and was the first control to flag the residential address and misspelled domain, so detection was too late to recall the funds. The policy exception culture also weakened the control environment. The combination allowed one clerk to set up the payee, one manager to exceed authority, and no independent verification before settlement.
2. Recommend a remediation plan with specific controls and monitoring measures.
Read the worked answer
Remediation should be layered. Restrict vendor master creation and bank-detail changes to a separate team, with mandatory evidence of independent verification and a change log. Require call-back to a previously known phone number, not a number in the email, for any new or changed bank detail, and document the call. Enforce approval limits and dual approval in the ERP so a mobile approval cannot bypass them; route exceptions to the CFO and internal audit. Add payment controls such as positive pay, beneficiary account name matching, and a daily exception report for new vendors, urgent payments, and amounts just below approval thresholds. Train staff on CEO impersonation and urgency pressure, and give them a clear escalation route. Monitor with metrics: percentage of bank-detail changes with verified call-backs, number of approval-limit overrides, time to reconcile bank accounts, and exception-report clearance. The audit committee should receive quarterly fraud-risk reporting and track whether policy exceptions are declining.