Disclosure and reporting

Require and support employees and third parties to disclose gifts, benefits, incidents, mistakes, and real or perceived conflicts of interest.

This control targets internal fraud risks.

Examples

Examples of this control include:

requiring employees to declare conflicts of interest
requiring employees to report gifts, benefits and hospitality
creating a process for employees to report accidental unauthorised accesses or disclosures
requiring employees or contractors to report when their circumstances change, e.g. to maintain a security clearance.

Lack of disclosure and reporting processes can lead to or disguise:

employees and third parties failing to disclose gifts, benefits, incidents, mistakes and real or perceived conflicts of interest
fraudulent conduct, dishonest influence or corruption
employees and contractors being coerced to commit fraud for the benefit of another person or organisation.

Methods to evaluate the effectiveness of this control include:

confirming policy and guidance material exists for disclosure or reporting
confirming guidance material is available and easy to access
reviewing guidance material to make sure it is clear and easy to understand
confirming that registers for reporting exist and are easily accessible
asking employees about the disclosure forms, processes or systems to make sure they have a consistent understanding of how to use them
analysing the use of registers, e.g. for gifts, conflicts of interest, or incidents and mistakes.

Other capability, prevention, detection and response controls that can enhance this control’s effectiveness:

Types of behaviour this control is designed to mitigate:

Explore a range of controls that can be put in place to reduce the risk of fraud happening in your organisation.