Most organizations have procedures for executing routine financial transactions. But what happens when someone requests an exception? This might be an immediate wire transfer, a change in bank details, an expedited vendor setup or an unexpected request for a favor from an executive. Legitimate exceptions may sometimes be necessary. However, routinely bypassing established controls can weaken their effectiveness and create opportunities for fraud. How your organization handles exceptional transactions can make the difference between preventing fraud and incurring losses.
Pressure to act fast
Fraud-prevention controls work best when employees follow existing procedures carefully and consistently. Exceptions can compromise controls, especially when employees feel pressured to act quickly. For example, if asked to update a vendor’s banking information, an employee might normally contact the vendor to independently verify the change.
But what if the request includes a warning that a critical shipment will be delayed unless payment information is updated immediately? Under such pressure, an employee may skip verification.
High-risk transactions
Successful fraudsters often use time-sensitive requests to trigger quick decisions. Many employees are likely to help process urgent requests — even if it means bypassing established procedures — for fear of displeasing customers or their managers. Particularly risky transactions include:
- Emergency payments. Criminals might impersonate executives or vendors and request immediate transfers, citing fabricated emergencies to bypass approval procedures.
- Vendor banking changes. Here, thieves claim a vendor has changed banks and ask employees to redirect legitimate payments to fraudulent accounts.
- Unusual refunds. Fraudsters may request refunds to different payment methods than those used for the original purchases or pressure employees to issue refunds without completing verification procedures.
- Executive overrides. Criminals could impersonate executives through email, text messages or phone calls and exploit employees’ reluctance to challenge authority.
Formal policy
Emergencies are inevitable, and your organization needs the flexibility to respond when they occur. A formal exception policy can help balance that flexibility with appropriate safeguards by closing control gaps. It should specify who can authorize exceptions in what circumstances and what documentation is required. Ensure your policy states which (if any) controls may never be waived by a manager.
A robust policy should instruct employees to verify exception requests independently — every time. You may also want to mandate extra review for large payments and unusual requests. Don’t forget to empower employees to question exception requests. Employees should feel comfortable delaying suspicious transactions, even if requests appear to come from senior management.
Testing controls
Periodically review your exception records to help uncover suspicious patterns, recurring overrides and other control gaps. Also test your controls regularly to confirm they work as intended. For example, do employees know what to do if an urgent payment request arrives near the end of the workday? What if an email that appears to be from your business’s CEO asks them to make a last-minute funds transfer?
Contact us. We can help test your policies and procedures, including your exception controls, and recommend additional protections if warranted. After all, exceptions happen, but fraud losses don’t have to.
___________________________________
We highly recommend you confer with your Miller Kaplan advisor to understand your specific situation and how this may impact you
