Recovery and debt management processes

Implement processes that identify and recover debts owed by employees, customers and third parties due to non-compliance.

This control targets both internal and external fraud risks.

Examples

Examples of this control include:

retrieving incorrect or fraudulent payments with the help of financial institutions
recording and recovering debts arising from non-compliance
recording and recovering employee overpayments
obtaining refunds from suppliers if contract obligations are not met
working with the New Zealand Police Financial Crime Group
making a referral to the New Zealand Police Asset Recovery Unit if it is believed that there may be proceeds of crime involved
requiring vendors to provide a rebate if contract obligations are not delivered or fraud occurs
including clawback clauses in contracts and agreements.

A lack of recovery and debt management processes can lead to:

Methods to evaluate the effectiveness of this control include:

confirming the necessary legislation, policy, processes and/or systems exist to support the recovery of stolen funds or fraudulent payments
reviewing debt recovery processes to see if they conform to national guidelines and frameworks
reviewing data on debt recovery
confirming that statistics on debt recovery are captured by reporting
determining the timeframes for recovering stolen funds or fraudulent payments. Consider if delays would reduce the recovery of funds.

Other capability, prevention, detection and response controls that can enhance this control’s effectiveness:

Types of behaviour this control is designed to mitigate:

Explore a range of controls that can be put in place to reduce the risk of fraud happening in your organisation.