The Rating and the Job Offer
You are the business analyst on a payments modernisation. Internal audit has rated a finding 'high': the new refund workflow has no secondary authorisation above 10,000, and the legacy control that provided it is being decommissioned at cutover. The product launches to all merchants in three weeks. The executive sponsor asks you to 'reframe it as an observation with a management action', arguing the risk is temporary and that a high rating will trigger a board report that delays the launch. In the same conversation the sponsor offers you the lead analyst role on the follow-on programme, starting in two months. Your line manager says the sponsor 'owns the risk' and that rating decisions are not yours. The audit committee meets in nine days. A confidential whistleblowing line exists, and the firm's code requires escalation of control deficiencies above a defined financial threshold.
1. How do you respond to the request to reclassify the finding?
Read the worked answer
The rating is a function of likelihood, impact and the control environment - not of the launch calendar - and it is not the sponsor's to trade.
- The facts support 'high'. Losing a secondary authorisation above 10,000 while the legacy compensating control is decommissioned at cutover is a control gap with direct loss potential. Nothing about the launch date changes that. 'Temporary' describes an exposure period, and exposure is exactly what a rating measures.
- What I can legitimately do: make sure the finding is factually accurate, supply mitigating context - compensating monitoring, transaction limits, planned remediation date - and ask audit to weigh it. Audit owns the rating; I supply evidence.
- Record the request. A contemporaneous note - date, who asked, what was asked, what I said - protects everyone, including the sponsor.
- Route it. Risk or compliance function, my line manager in writing, and the audit committee if the finding is above the code's escalation threshold. Nine days is enough to do this properly.
- The line manager is half right. The sponsor can accept a risk in writing, with authority and a compensating control; that is risk acceptance. The sponsor cannot re-rate an audit finding to avoid a board report, and I cannot sign a document I believe misstates the position.
- Solve the real problem. If the launch proceeds, propose manual second-line review of payments above 10,000 until the workflow fix lands. That addresses the sponsor's actual concern - delay - without touching the finding.
2. What do you do about the job offer made in the same conversation?
Read the worked answer
Disclose it, in writing, the same day.
- The conflict is structural. A decision about the sponsor's launch also affects my future employment under that sponsor. Even if I would never be influenced, the appearance is enough to compromise the finding's credibility if it later emerges - and it will emerge at the worst possible moment.
- Action. Tell my line manager and compliance or HR in writing before responding to the sponsor. Ask that the offer be paused or handled outside the reporting line until the audit issue is closed, and decline to discuss the role with the sponsor while the finding is live.
- If the role proceeds, recuse from any decision on the rating, have a colleague attend the audit committee discussion, and have the recusal documented.
- Do not silently assume coincidence. An offer made in the same conversation as a request to down-rate a finding is a fact the governance process should know about. State it neutrally; do not characterise the sponsor's motive.
- Keep the two threads separate. The technical position on the control gap does not change because of the offer, in either direction - neither softened to protect the role nor hardened to prove independence.
That is the test: independence has to be demonstrable, not merely felt.
3. Your manager tells you to drop it, and the finding goes to the audit committee without escalation. What is the professional response?
Read the worked answer
If I am overruled, my obligation is to ensure the decision is taken by someone with the authority to take it, on the record, with the facts intact.
- Step 1: ask for the decision in writing - the rationale, the named risk acceptor, the compensating control. A surprising number of reclassifications quietly evaporate at this point.
- Step 2: escalate one level - risk committee, head of audit, or the audit committee directly where the code's threshold is met. Attach the evidence and my note, not an opinion about the sponsor.
- Step 3: make sure the paper does not contain a statement I believe to be false. I can decline to author it; I should not edit it to hide the issue.
- Step 4: if internal routes are exhausted and a genuine control gap is heading into a live payments process, use the whistleblowing channel. That is what it is for and it is protected. Going outside the organisation to a regulator is a much higher step, generally only where there is a legal duty or serious risk to customers, and should be taken with advice.
- Throughout: keep a factual record, stay in the technical register rather than the personal one, and keep doing the job well.
The professional failure mode here is not being overruled. It is being overruled and saying nothing, so that the first record of the concern is the incident report.