vaayaa Inclusive Education
Professional risk assessment

Accounting, Audit and Financial Compliance Risk Assessment: Controls, Fraud and Reporting Risks

A worked example of how a small finance function finds, scores and controls the risks that threaten accurate accounts, from reconciliation errors and fraud to access, filing duties and cash exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: High to Medium
See the Accounting, Audit and Financial Compliance course

Executive summary

This assessment shows how a small finance function can find, rate and control the risks that matter most to the accuracy of its accounts and the trust placed in them. Eight risks were chosen because they are plausible in everyday accounting, audit and compliance work. Errors in entries and reconciliations are the most likely, while fraud and weak access control are less likely but cause the most harm. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but fraud and cyber exposure stay at Medium because the impact stays serious. The first actions are a dated close checklist, a split of duties for payments, call back checks on bank changes and a tested backup. The business is a teaching example, so every score illustrates method, not a real organization.

Focus area
Accounting, audit and financial compliance
Setting
Finance function of a small to mid-sized trading business with an annual audit
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the finance function of a small to mid-sized trading business, from daily transactions and month-end close to reporting, audit and compliance duties. It looks at risks to accuracy, assets, legal duties and trust. It does not cover investment advice or the tax position of any real business. Jurisdiction, size and systems are assumptions made for teaching.

Context

The business has a financial controller, two accountants, an accounts payable clerk and an IT manager who supports the accounting system. Transactions are recorded in accounting software, with spreadsheets used for forecasts and some reconciliations. An external auditor reviews the accounts each year and a board receives quarterly figures. Each risk is scored before controls to show its natural level, then again after the existing controls and the controls that should be added.

Objectives, assets and stakeholders

The objective is to produce accurate and timely accounts, protect cash and records, meet filing and audit duties, and keep the confidence of owners, lenders and regulators. The assets in scope are cash and bank accounts, the ledgers and supporting records, customer and supplier data, the accounting system and the reputation of the finance team. Stakeholders include the finance staff, management and the board, the external auditor, lenders, suppliers, customers and the tax and corporate authorities. Clear roles matter: every risk has one owner role, and the financial controller keeps the register current and reports to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 4, score 16, high: H01 H05
3 Possible Likelihood 3, impact 3, score 9, medium: H08 Likelihood 3, impact 4, score 12, high: H04 H07 Likelihood 3, impact 5, score 15, high: H02 H03
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H07
2 Unlikely Likelihood 2, impact 2, score 4, low: H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H04 H05 H06 Likelihood 2, impact 4, score 8, medium: H03
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Misstatement from transaction and reconciliation errors 16 High 6 Medium Financial controller
H02 Weak access control and segregation of duties 15 High 6 Medium Head of finance
H03 Fraud and misappropriation of funds 15 High 8 Medium Internal auditor
H04 Tax, reporting and governance failures 12 High 6 Medium Company secretary
H05 Data quality and cyber exposure 16 High 6 Medium IT manager
H06 Conflicts of interest and professional conduct 10 High 6 Medium Compliance officer
H07 Credit, liquidity and counterparty exposure 12 High 6 Medium Treasury lead
H08 Valuation and forecasting uncertainty 9 Medium 4 Low Financial controller
H01

Misstatement from transaction and reconciliation errors

Financial Before 16 After 6

Entries are posted to the wrong account or period, and bank, ledger and sub-ledger balances are not reconciled on time, so the financial statements carry errors.

Who or what is affected: Finance team, management and users of the accounts

Causes

Manual entry, heavy month-end workload and reconciliations that depend on one person.

Consequences

Wrong statements, restated figures, delayed reporting and loss of confidence.

Existing controls

  • The ledger is reconciled to the bank each month.
  • A second person reviews journal entries above a set value.

Control gaps

The review of small entries is skipped, and unreconciled items can sit for months.

Additional controls

  • Prevent: Use a month-end close checklist with dated sign-off for every reconciliation.
  • Detect: Run exception reports for unusual entries, late postings and unreconciled items.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Financial controller Target: Within 45 days Early warning: Reconciling items older than 30 days on any account.
H02

Weak access control and segregation of duties

Financial Before 15 After 6

One person can create a supplier, approve an invoice and release payment, or has wider system access than the role needs, so errors and misuse go unseen.

Who or what is affected: Finance team, owners and suppliers

Causes

Small teams, shared passwords, rights that are added and never removed.

Consequences

Undetected error or misuse, loss of funds and failed audit findings.

Existing controls

  • Users sign in with individual accounts.
  • Payments above a limit need a second approval.

Control gaps

Access rights are reviewed only when someone complains or leaves.

Additional controls

  • Prevent: Map roles to permissions and remove any combination that lets one person start and approve a payment.
  • Detect: Review user access and approval logs each quarter and record the outcome.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Head of finance Target: Within 60 days Early warning: A user who holds both entry and approval rights for payments.
H03

Fraud and misappropriation of funds

Financial Before 15 After 8

Fake suppliers, altered bank details, inflated expenses or diverted receipts take money from the business, often over a long period and in small amounts.

Who or what is affected: Owners, lenders and employees

Causes

Trust placed in one person, pressure to hit targets and weak checks on supplier changes.

Consequences

Direct loss, legal action, loss of reputation and a breakdown in trust.

Existing controls

  • Supplier bank detail changes are confirmed by phone.
  • Expense claims need a manager approval.

Control gaps

Matching is done on a sample, so small repeated payments can pass unnoticed.

Additional controls

  • Prevent: Verify new suppliers and bank detail changes through a call to a known contact before payment.
  • Detect: Match payments to orders and receipts and review duplicate or round-sum payments.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 45 days Early warning: A supplier bank detail change that is not confirmed by a call back.
H04

Tax, reporting and governance failures

Legal and compliance Before 12 After 6

Filing deadlines, disclosure rules or tax treatments are missed or misapplied, and the board does not see the information needed to oversee the accounts.

Who or what is affected: Management, board and regulators

Causes

Rules that change by country, a small team and filings prepared at the last minute.

Consequences

Penalties, interest, restated accounts and loss of regulator trust.

Existing controls

  • A calendar lists the main filing dates.
  • The accounts are shared with the board each quarter.

Control gaps

Jurisdiction is assumed, and no one confirms current rules before a filing.

Additional controls

  • Prevent: Keep a compliance calendar with an owner and a backup owner for every duty, checked each month.
  • Detect: Ask a qualified reviewer to test a sample of filings against the rules that apply.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Company secretary Target: Within 30 days Early warning: A filing due within 10 days that has no preparer or reviewer named.
H05

Data quality and cyber exposure

Technology and data Before 16 After 6

Weak passwords, phishing and unprotected spreadsheets expose financial records, while poor master data and manual transfers between systems create errors in reports.

Who or what is affected: Finance team, clients and suppliers

Causes

Phishing, reused passwords and spreadsheets copied between people.

Consequences

Stolen data, false payments, report errors and a regulator notice.

Existing controls

  • Accounting software needs a password and is backed up daily.
  • Staff are told not to share files by public links.

Control gaps

Spreadsheets used for key figures sit outside the access controls.

Additional controls

  • Prevent: Enable multi-factor sign in and train staff to spot payment request scams each year.
  • Recover: Test restoring the ledger from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: A finance mailbox that reports repeated payment request scams.
H06

Conflicts of interest and professional conduct

Reputational Before 10 After 6

A preparer or auditor has a personal or business link to a party being reviewed, or feels pressure to soften findings, which weakens independence and trust in the numbers.

Who or what is affected: Auditors, management and the public

Causes

Long relationships with clients, fee pressure and unclear rules on gifts.

Consequences

Loss of independence, disciplinary action and damage to professional standing.

Existing controls

  • A code of conduct is signed each year.
  • Staff declare outside interests when they join.

Control gaps

Declarations are collected but never compared against current engagements.

Additional controls

  • Prevent: Require a written independence check before each engagement and an annual conflicts declaration.
  • Respond: Provide a confidential route to raise concerns and record how each one was handled.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest that is linked to an open engagement.
H07

Credit, liquidity and counterparty exposure

Financial Before 12 After 6

Customers pay late or fail, a lender withdraws support or a key supplier fails, and the business cannot meet its payments when they fall due.

Who or what is affected: Owners, lenders and employees

Causes

Concentration in a few customers, long payment terms and forecasts that are rarely updated.

Consequences

Cash shortage, missed payments, higher borrowing cost and loss of supplier trust.

Existing controls

  • Cash is reviewed weekly by the finance lead.
  • Customer terms are agreed in writing.

Control gaps

The forecast is checked against actual cash only once a quarter.

Additional controls

  • Prevent: Set credit limits and a collection routine and update a rolling cash forecast each week.
  • Respond: Agree a standby funding plan and contact order for a cash shortfall.
Likelihood 3 x impact 4 before; 3 x 2 after Owner: Treasury lead Target: Within 60 days Early warning: Customer invoices overdue by more than 60 days.
H08

Valuation and forecasting uncertainty

Strategic Before 9 After 4

Estimates for stock, receivables, assets and future income rest on assumptions that may be optimistic, so balances and decisions are wrong when conditions change.

Who or what is affected: Management, investors and auditors

Causes

Reliance on one source, pressure for good results and assumptions that are not revisited.

Consequences

Overstated assets or profit, poor decisions and later write-downs.

Existing controls

  • Estimates are reviewed by the finance lead at year end.
  • Major assumptions are written in the working papers.

Control gaps

Past estimates are never compared with outcomes, so bias goes unseen.

Additional controls

  • Prevent: Document each key assumption with its evidence and test a low and a high case.
  • Detect: Compare past estimates with actual results and report the differences.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Financial controller Target: Within 90 days Early warning: A write-off or adjustment above the usual level for the same balance.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls. Impact is judged on money lost, time to correct, the effect on reported results and harm to trust, and a financial or compliance risk is never rated down only because it has not yet happened. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. The people who do the work should challenge the ratings, and they are reviewed whenever an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Reconciling items older than 30 days on any account.Escalate to the financial controller when any item is older than 30 days, and to the head of finance after 60 days.
Payment changes made without a call back to a known contact.Escalate to the internal auditor at once, and hold the payment until it is confirmed.
Users who hold both entry and approval rights for payments.Escalate to the head of finance when any such user is found, and remove one right within a week.
Days of cash cover and customer invoices overdue by more than 60 days.Escalate to the treasury lead when cover falls below the agreed floor, and to the board if it stays low for a month.
Filings due within 10 days with no named preparer or reviewer.Escalate to the company secretary at once, and to the head of finance if still open after 3 days.

Contingency arrangements

If a serious event occurs, such as a confirmed fraud, a data breach or a filing that cannot be made on time, the financial controller stops related payments, preserves records and informs the board. The IT manager isolates affected accounts and restores data from the latest tested backup. Legal, audit and regulator contacts are made through the head of finance as required in the relevant jurisdiction. Cash is protected by a standby funding plan, and staff and customers are told what they need to know early and plainly.

Prioritized action plan

  1. Introduce a dated month-end close checklist with sign-off, owner financial controller, within 45 days.
  2. Split entry and approval of payments and review user access, owner head of finance, within 60 days.
  3. Confirm supplier bank changes by call back and review duplicate payments, owner internal auditor, within 45 days.
  4. Enable multi-factor sign in and test a restore from backup, owner IT manager, within 30 days.
  5. Set up a compliance calendar with a backup owner for each filing, owner company secretary, within 30 days.

Conclusion

Reliable accounts depend on a few steady habits: dated reconciliations, split duties, checks on every change to payment details, tested backups and a calendar for each filing. The highest scores sit with posting errors, fraud and cyber exposure, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real accounting, audit, tax or legal question.

Assumptions and limitations

Assumptions

  • The business reports under one recognized accounting framework and is audited each year by an independent firm.
  • Staff are trained accountants who use common accounting software on managed computers.
  • Jurisdiction is not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real business or audit.
  • Accounting, tax and audit rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not financial, tax or legal advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls

Professional Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Accounting, Audit and Financial Compliance course Read the best practices for this course

More Professional risk assessments

Hourly Active: 40,959 Learners