vaayaa Inclusive Education
Finance risk assessment

Accounts Receivable Management Risk Assessment: Billing, Cash Collection and Fraud Controls

A worked example of how a finance team finds, scores and controls the risks that stop customer invoices becoming cash, from billing errors and bad debt to fraud, weak access and data exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Accounts Receivable Management course

Executive summary

This assessment shows how a finance team can find, rate and control the risks that stop customer invoices becoming cash. Eight risks were chosen because they are plausible in everyday receivables work, from billing and cash matching to fraud, data exposure and reporting. Fraudulent bank detail changes carry the highest inherent score because the impact is direct loss of cash. Most risks fall to Medium or Low once the added controls are in place, but the fraud and data risks stay Medium because the harm would still be serious. The first actions are a locked price list, a weekly suspense review, a call back rule for bank changes and a split of credit note rights. The business is a teaching example, so every score illustrates method rather than describing a real organization.

Focus area
Accounts receivable, credit control and cash collection
Setting
Finance function of a mid-sized service business that invoices customers on credit terms and collects payment by bank transfer
Method
Five by five likelihood and impact risk register

Scope

This assessment covers accounts receivable from customer onboarding and credit approval through invoicing, cash application, collection, dispute handling, write-off and reporting. It looks at risks to accurate balances, cash flow, customer data, legal duties and trust. It does not give credit, legal or tax advice for any real customer or business. Assumptions: the jurisdiction is not specified, the business uses a standard accounting package, and customers are offered thirty day payment terms for teaching purposes.

Context

The business has an accounts receivable manager, two credit controllers, a billing clerk, a financial controller and an IT security lead who supports the accounting system. Invoices are raised in the accounting package from signed contracts and time records, and customers pay by bank transfer or card through a payment provider. Cash is matched to invoices by hand when remittance details are unclear. An external auditor reviews receivables and the year end allowance for doubtful debts each year. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to bill accurately, collect cash on time, keep bad debt within agreed limits, meet reporting duties and protect the confidence of owners, lenders and customers. The assets in scope are customer balances, cash received, credit limits, customer and payment data, the accounting package and the reputation of the finance team. Stakeholders include the finance staff, management and the board, the external auditor, lenders, customers, the payment provider and the tax and corporate authorities. Clear roles matter: every risk has one owner role, and the financial controller keeps the register current and reports to the board each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H01 H02 Likelihood 4, impact 4, score 16, high: H06 Likelihood 4, impact 5, score 20, critical: H04
3 Possible Likelihood 3, impact 4, score 12, high: H03 H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H07 Likelihood 2, impact 5, score 10, high: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H02 Likelihood 2, impact 3, score 6, medium: H01 H05 H08 Likelihood 2, impact 4, score 8, medium: H04 H06
1 Rare Likelihood 1, impact 4, score 4, low: H07
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Billing errors and invoice disputes 12 High 6 Medium Accounts receivable manager
H02 Unapplied cash and reconciliation gaps 12 High 4 Low Financial controller
H03 Customer credit exposure and bad debt 12 High 6 Medium Credit controller
H04 Fraudulent bank detail changes and diverted receipts 20 Critical 8 Medium Internal auditor
H05 Weak access control and segregation of duties 12 High 6 Medium Head of finance
H06 Customer data exposure and payment system compromise 16 High 8 Medium IT security lead
H07 Misstated allowance and reporting duties 8 Medium 4 Low Financial controller
H08 Conflicts of interest in credit and write-off decisions 10 High 6 Medium Compliance officer
H01

Billing errors and invoice disputes

Operational Before 12 After 6

Invoices are raised with wrong prices, quantities, tax rates or customer details, or are sent late, so customers dispute or delay payment and balances are misstated.

Who or what is affected: Billing staff, customers and the finance team

Causes

Manual keying, frequent price changes and orders that arrive without complete details.

Consequences

Delayed cash, customer dissatisfaction, credit notes and restated revenue.

Existing controls

  • Invoices are checked against the signed order by the billing clerk.
  • Disputed invoices are logged in a shared spreadsheet.

Control gaps

Spot checks are made on a sample, and credit notes are not reviewed for cause.

Additional controls

  • Prevent: Lock price lists in the accounting package and require approval for any manual price change.
  • Detect: Run a weekly exception report of credit notes and invoices raised without a matching order.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Accounts receivable manager Target: Within 45 days Early warning: Credit notes above a set share of invoices raised in the same month.
H02

Unapplied cash and reconciliation gaps

Financial Before 12 After 4

Customer payments are received but not matched to the right invoices, or bank receipts are not reconciled to the ledger on time, so balances, aging and cash reports are wrong.

Who or what is affected: Finance team, lenders and the board

Causes

Customers pay in bulk, omit references or pay part of several invoices at once.

Consequences

Customers chased for paid invoices, wrong aging figures and reporting errors.

Existing controls

  • The ledger is reconciled to the bank each month.
  • Unmatched receipts are listed on a suspense report.

Control gaps

The suspense report is reviewed only at month end, so old items remain unnoticed.

Additional controls

  • Prevent: Require remittance references on every customer payment and reject receipts without a usable reference.
  • Detect: Review the suspense account weekly and clear items older than fourteen days.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Financial controller Target: Within 45 days Early warning: Unapplied receipts older than fourteen days in the suspense account.
H03

Customer credit exposure and bad debt

Financial Before 12 After 6

Customers are granted credit above their ability to pay, or pay late and then fail, leaving debts that are unlikely to be collected and reducing cash available to the business.

Who or what is affected: Owners, lenders, employees and suppliers

Causes

Competitive pressure to win customers, concentration in a few large accounts and limited financial information.

Consequences

Bad debt write-offs, cash shortage and higher borrowing cost.

Existing controls

  • Credit limits are set for new customers by the credit controller.
  • Overdue accounts are reviewed in a weekly collections meeting.

Control gaps

Limits are not reviewed when a customer changes its order pattern or its payments slow.

Additional controls

  • Prevent: Check each new customer against trade references and set a limit before the first order.
  • Respond: Stop new orders for any account over its limit or more than sixty days overdue.
Likelihood 3 x impact 4 before; 3 x 2 after Owner: Credit controller Target: Within 60 days Early warning: Customer invoices overdue by more than sixty days.
H04

Fraudulent bank detail changes and diverted receipts

Financial Before 20 After 8

Someone impersonates a customer and asks for payment details to be changed, or a staff member diverts receipts or issues false credit notes, so money is paid to the wrong account or lost.

Who or what is affected: Owners, customers, employees and lenders

Causes

Trust placed in one person, urgent requests from fake email addresses and weak checks on refunds.

Consequences

Direct loss, customer complaints, legal claims and damage to reputation.

Existing controls

  • Changes to customer bank details are confirmed by phone.
  • Credit notes above a set value need a manager approval.

Control gaps

Call backs use numbers supplied in the same email, and small credit notes are not reviewed.

Additional controls

  • Prevent: Verify any change to customer payment details through a call to a contact already on file before it is used.
  • Detect: Compare credit note and refund totals by user each month and review any refund to a new account.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 30 days Early warning: A request to change payment details that is not confirmed by a call back to a known contact.
H05

Weak access control and segregation of duties

Operational Before 12 After 6

One person can create a customer, raise an invoice, approve a credit note and record the receipt, or has wider system rights than the role needs, so errors and misuse go unseen.

Who or what is affected: Finance team, auditors and customers

Causes

Small teams, shared logins and rights that are added but never removed.

Consequences

Undetected error or misuse, fictitious customers and failed audit testing.

Existing controls

  • Users sign in with individual accounts.
  • Write off requests need a second signature.

Control gaps

Access is reviewed only when someone leaves or complains.

Additional controls

  • Prevent: Map roles to permissions and remove any combination that lets one person create a customer and approve a credit note.
  • Detect: Review user access and audit logs each quarter and record the outcome in the register.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Head of finance Target: Within 60 days Early warning: A user who holds both customer creation and credit note approval rights.
H06

Customer data exposure and payment system compromise

Technology and data Before 16 After 8

Phishing, weak passwords or an unprotected spreadsheet expose customer names, bank details and card references, and attackers redirect invoices or payments.

Who or what is affected: Customers, finance staff and the payment provider

Causes

Phishing emails, reused passwords and spreadsheets copied between people.

Consequences

Stolen customer data, redirected payments, regulator notice and loss of trust.

Existing controls

  • Accounting software needs a password and is backed up daily.
  • Staff are told not to send card or bank details by email.

Control gaps

Exported aging reports sit in shared folders outside the access controls.

Additional controls

  • Prevent: Enable multi-factor sign in for finance systems and restrict customer data exports to named roles.
  • Recover: Test restoring the receivables ledger from backup and keep a written recovery plan.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: IT security lead Target: Within 30 days Early warning: Repeated failed sign in attempts or a finance mailbox reporting payment request scams.
H07

Misstated allowance and reporting duties

Legal and compliance Before 8 After 4

The allowance for doubtful debts, revenue timing or disclosure of receivables is wrong or late, so reported results and statutory filings do not reflect the real position.

Who or what is affected: Management, board, auditors and regulators

Causes

Judgement on recoverability, pressure for good results and rules that differ by jurisdiction.

Consequences

Overstated assets, restated accounts, penalties and loss of regulator trust.

Existing controls

  • The allowance is reviewed by the financial controller at each period end.
  • Aging reports are sent to the board each quarter.

Control gaps

Allowance estimates are not tested against outcomes, so bias goes unseen.

Additional controls

  • Prevent: Apply a written allowance policy that sets the basis for each aging band and needs sign off.
  • Detect: Compare past allowances with actual write-offs and report any large difference to the board.
Likelihood 2 x impact 4 before; 1 x 4 after Owner: Financial controller Target: Within 90 days Early warning: An allowance change or write-off above the usual level for the same aging band.
H08

Conflicts of interest in credit and write-off decisions

People Before 10 After 6

A credit controller or sales lead has a personal or business link to a customer and approves limits, extensions or write-offs that favor that customer, weakening independence and trust in the ledger.

Who or what is affected: Owners, auditors, lenders and fellow staff

Causes

Long relationships with customers, sales targets and unclear rules on gifts and hospitality.

Consequences

Unfair credit decisions, losses hidden in the ledger, disciplinary action and damage to reputation.

Existing controls

  • A code of conduct is signed each year.
  • Staff declare outside interests when they join.

Control gaps

Declarations are collected but never compared with the customer list.

Additional controls

  • Prevent: Require a written conflict check before any limit increase, payment plan or write-off for a named customer.
  • Respond: Provide a confidential route to raise concerns and record how each concern was handled.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest that links a staff member to a customer with an open balance.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score guides the order of work and is not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls, and it must never be higher than the inherent score. Impact is judged on money lost, time to correct, the effect on reported results and harm to trust, and a risk is never rated down only because it has not yet happened. Anything still High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. The people who do the work should challenge the ratings, and the ratings are reviewed whenever an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Unapplied receipts older than fourteen days in the suspense account.Escalate to the financial controller when any item is older than fourteen days, and to the head of finance after thirty days.
Changes to customer payment details made without a call back to a known contact.Escalate to the internal auditor at once, and hold any payment to the changed account until it is confirmed.
Users who hold both customer creation and credit note approval rights.Escalate to the head of finance when any such user is found, and remove one right within a week.
Customer invoices overdue by more than sixty days, as a share of total receivables.Escalate to the credit controller when the share rises above the agreed level, and to the board if it stays high for a quarter.
Credit notes above a set share of invoices raised in the same month.Escalate to the accounts receivable manager when the share rises, and to the financial controller if it stays high for two months.

Contingency arrangements

If a serious event occurs, such as a confirmed payment fraud, a data breach or a bad debt that threatens cash, the financial controller stops related refunds and payment changes, preserves records and informs the board. The IT security lead isolates affected accounts and restores data from the latest tested backup. Legal, audit and customer contacts are made through the head of finance as required in the relevant jurisdiction. Cash is protected by a standby funding plan, and affected customers are told what they need to know early and plainly.

Prioritized action plan

  1. Verify every change to customer bank details by call back to a known contact, owner internal auditor, within 30 days.
  2. Enable multi-factor sign in and restrict customer data exports, owner IT security lead, within 30 days.
  3. Split customer creation, invoice approval and credit note rights, owner head of finance, within 60 days.
  4. Introduce a locked price list and a weekly suspense account review, owner accounts receivable manager, within 45 days.
  5. Set a written allowance policy and credit limit review routine, owner financial controller, within 90 days.

Conclusion

Healthy receivables depend on a few steady habits: accurate invoices, matched cash, checked credit limits, verified bank changes, split duties and a reviewed allowance. The highest scores sit with bank detail fraud, billing errors and cash matching, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real credit, legal, tax or privacy question.

Assumptions and limitations

Assumptions

  • The business reports under one recognized accounting framework and is audited each year by an independent firm.
  • Customer credit terms are set in writing and invoices are raised from signed contracts or approved orders.
  • Jurisdiction is not specified, so legal and tax duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real customer, business or audit.
  • Credit, debt collection, privacy and tax rules differ by country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or licensed legal or financial advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Accounts Receivable Management course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,047 Learners