Exception reporting

Produce exception reports to identify activities that are different from the standard, normal or expected process and should be further investigated.

This control targets both internal and external fraud risks.

Examples

Examples of this control include:

A lack of exception reporting can lead to:

disorganised or inconsistent practices and decision making
less transparency of actions and outcomes
poor management of fraud and corruption risks
less action and accountability to prevent, detect and respond to fraud and corruption
fraud or corrupt activity going unnoticed or unchallenged.

Methods to evaluate the effectiveness of this control include:

confirming that the exception tolerances or parameters are appropriate
confirming that the exception parameters or thresholds are not widely known
confirming that exception reports are produced and used, and that the process is adequate
confirming that exception reports go to the most appropriate team or employee for review
walking through processes with employees while they review reports and respond to anomalies
reviewing a sample of reports to see if they are clear, relevant to the user and would help to detect fraud
reviewing statistics related to reports, e.g. the quantity and frequency of exceptions that are reported
reviewing who has access to exception reports
confirming that someone cannot manipulate exception reports or the data they are based on.

Other capability, prevention, detection and response controls that can enhance this control’s effectiveness:

Types of behaviour this control is designed to mitigate:

Explore a range of controls that can be put in place to reduce the risk of fraud happening in your organisation.