Finance ERP Controls, AI Governance, and Risk Management

A finance employee creates suppliers and approves their payments. What risk and control?

Fraud risk → Segregation of Duties → Separate supplier creation and payment approval to prevent unauthorized payments.

Former employees retain ERP access. What risk and control?

Unauthorized access → Automated deprovisioning → Disable employee accounts promptly after termination.

Employees have unrestricted finance-system access. What control?

Excessive permissions → Role-Based Access Control → Limit access to what employees need for their jobs.

A hacker steals an employee's password. What control helps?

Account takeover → Multifactor Authentication → Require another verification factor to reduce unauthorized access.

Managers haven't reviewed user permissions in 18 months. What control?

Outdated permissions → Periodic access reviews → Identify and remove unnecessary access.

Nobody can identify who changed supplier bank details. What control?

Lack of accountability → Audit logging → Record who changed information and when for investigations.

An employee changes supplier banking details without approval. What control?

Payment diversion → Independent change approval → Verify and authorize sensitive supplier changes.

A critical ERP update goes live without testing. What control?

System disruption → Change management → Require testing and approval before deployment.

A developer modifies production code without authorization. What control?

Unauthorized changes → Restricted production access → Prevent unapproved modifications to live systems.

One manager must approve every supplier payment. What improvement?

Approval bottleneck → Delegated approval routing → Use multiple authorized approvers while preserving oversight.

Payments above $100,000 receive no additional review. What control?

High-value fraud risk → Risk-based approval thresholds → Require additional scrutiny for large transactions.

Duplicate invoices are repeatedly paid. What control?

Duplicate payments → Automated duplicate detection → Flag matching invoices before payments are released.

The ERP pays invoices without checking purchase orders. What control?

Invalid payments → Three-way matching → Compare the purchase order, goods receipt, and invoice.

A company migrates ERP data and account balances don't match. What control?

Data integrity risk → Reconciliation → Compare old and new system balances to identify discrepancies.

New customer records contain missing required fields. What control?

Incomplete data → Input validation → Reject or flag records missing essential information.

Sales reports contain inconsistent values across systems. What control?

Reporting errors → Data reconciliation → Compare source records and resolve discrepancies.

Supplier bank information changes unexpectedly before payment. What control?

Payment diversion → Independent callback verification → Confirm banking changes through a trusted contact.

A finance dashboard uses outdated transaction data. What control?

Stale information → Data refresh monitoring → Verify reporting data is updated on schedule.

Employees manually reenter data into three systems. What improvement?

Human error → Validated system integration → Automate data transfers while checking accuracy.

Nobody owns responsibility for customer data quality. What control?

Weak accountability → Data stewardship → Assign owners responsible for data accuracy and governance.

An AI chatbot gives incorrect financial information. What controls?

Misinformation → Output testing and human escalation → Detect inaccurate answers and refer complex cases to employees.

An AI system exposes private customer data in responses. What controls?

Data leakage → Access restrictions and output filtering → Prevent unauthorized disclosure of customer information.

Employees paste confidential client data into public AI tools. What controls?

Confidentiality risk → Approved AI tools and Data Loss Prevention → Restrict sensitive data sharing.

An AI loan model performs poorly for certain customer groups. What controls?

Unfair outcomes → Bias testing and model governance → Identify and address performance disparities.

A bank launches AI without documenting decisions. What control?

Lack of accountability → Model documentation → Record system design, assumptions, decisions, and oversight.

AI automatically approves major financial transactions. What control?

Unreviewed decisions → Human approval thresholds → Require oversight for high-impact transactions.

An AI model becomes less accurate over time. What control?

Model drift → Continuous performance monitoring → Detect declining accuracy and trigger review.

A company trains AI using unreliable customer records. What control?

Poor model inputs → Data quality validation → Check training data for errors and inconsistencies.

Nobody has reviewed an AI vendor's data practices. What control?

Third-party exposure → Vendor due diligence → Assess the provider's privacy and security safeguards.

AI speeds customer service but increases complaints. What should be measured?

Service quality risk → Accuracy and complaint KPIs → Measure customer outcomes alongside efficiency.

A cloud database is accidentally public. What controls?

Data exposure → Cloud configuration reviews and restricted access → Protect confidential records.

Cloud administrators share one privileged account. What controls?

Unaccountable access → Individual administrator accounts and Privileged Access Management → Track and limit sensitive actions.

A cloud provider experiences a major outage. What controls?

Business disruption → Business continuity and disaster recovery plans → Restore essential operations.

A company does not know which cloud data is sensitive. What control?

Unmanaged sensitive data → Data classification → Identify information requiring stronger protection.

Sensitive customer records are stored without encryption. What control?

Data exposure → Encryption and key management → Protect information against unauthorized disclosure.

A vendor breach exposes customers' information. What controls?

Third-party risk → Vendor security assessments and incident response requirements → Improve oversight and response.

A supplier's security certification expired. What control?

Assurance gap → Periodic vendor reviews → Reassess whether security safeguards remain adequate.

A business has no tested ransomware response plan. What controls?

Operational disruption → Incident response and recovery testing → Prepare teams to contain attacks and restore systems.

Security alerts are generated but nobody investigates them. What control?

Undetected incidents → Security monitoring and escalation → Assign responsibility for reviewing suspicious activity.

Unauthorized access to payroll records is discovered. What should happen first?

Possible data breach → Incident response and access containment → Limit exposure and begin investigation.

Security checks are slowing normal customer transactions. What approach?

Operational friction → Risk-based controls → Apply stricter verification to higher-risk activities.

A client has 40 security weaknesses but limited funding. How prioritize?

Competing risks → Likelihood and impact assessment → Address the most severe exposures first.

A client wants proof its access policy works. What test?

Control effectiveness → Sample access approvals → Verify permissions were properly authorized.

A control exists but employees routinely bypass it. What issue?

Operating effectiveness failure → Control testing and enforcement → Ensure safeguards actually function.

All payments stop when one approver is unavailable. What improvement?

Single point of failure → Backup approvers with Segregation of Duties → Maintain controls without unnecessary delays.

An ERP system detects violations but never escalates them. What improvement?

Unresolved violations → Automated alert escalation → Ensure identified issues receive timely investigation.

Management wants proof access security improved. What KPIs?

Track conflicting permissions, overdue access reviews, and time to revoke former employee access.

Fraud remains at zero after new controls. Does this prove success?

No → Test control compliance and monitor exceptions → Fraud counts alone cannot demonstrate control effectiveness.

An ERP project exceeds its budget due to repeated requirement changes. What process?

Implementation inefficiency → Requirements governance and change control → Reduce unnecessary rework.

A client asks whether expensive automation is worthwhile. What approach?

Cost-benefit analysis → Compare implementation costs, labor savings, risk reduction, and operational trade-offs.