vaayaa Inclusive Education
Finance risk assessment

Financial Accounting and Bookkeeping Risk Assessment: Records, Controls and Reporting Risks

A worked example of how a small bookkeeping and accounting function identifies, scores and controls risks to accurate records, tax filings, cash and trust in the financial statements, from posting errors to fraud and cyber exposure.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Financial Accounting and Bookkeeping course

Executive summary

This assessment shows how a small bookkeeping and accounting function can find, rate and control the risks that matter most to accurate records and trust in the accounts. Eight risks were selected because they are plausible in everyday bookkeeping, reporting, tax and payment work. Cyber intrusion and weak access control carry the highest inherent scores, while posting errors, tax deadlines and fraud follow closely behind. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but cyber exposure and fraud keep a residual score that needs close watch because their impact stays serious. The first actions are a dated close checklist, a split of payment duties, call back checks on bank changes and a tested restore from backup. The business is a teaching example, so every score illustrates method rather than a real organization.

Focus area
Financial accounting and bookkeeping
Setting
Bookkeeping and accounting function of a small to mid-sized trading business
Method
Five by five likelihood and impact risk register

Scope

This assessment covers day to day bookkeeping, month-end close, financial statement preparation, tax and filing duties, supplier payments, cash management and the systems that hold financial records. It considers risks to accuracy, assets, legal duties and trust in the accounts. Assumptions are labeled: the jurisdiction, tax regime, accounting framework, size of the business and software are not specified and are treated as teaching assumptions. The assessment does not give tax, legal or accounting advice for any real business.

Context

The business has a bookkeeper, a staff accountant, a financial controller, an IT manager who supports the accounting software and an external accountant who reviews the year end accounts. Transactions are recorded in accounting software, with spreadsheets used for forecasts, estimates and some reconciliations. Owners receive management accounts each quarter. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added. The scores are examples meant to show method, so they should be read as a structure for judgment rather than fixed measurements.

Objectives, assets and stakeholders

The objective is to produce accurate and timely records, protect cash and financial data, meet tax and filing duties, and keep the confidence of owners, lenders and regulators. The assets in scope are bank accounts and cash, the general ledger and supporting records, supplier and customer data, the accounting software and the reputation of the finance team. Stakeholders include the bookkeepers and accountants, management and owners, the external accountant, lenders, suppliers, customers and the tax authorities. Each risk has one owner role, and the financial controller keeps the register current and reports to owners each quarter.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H01 Likelihood 4, impact 4, score 16, high: H04 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 3, score 9, medium: H02 Likelihood 3, impact 4, score 12, high: H03 H07 Likelihood 3, impact 5, score 15, high: H05
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H07
2 Unlikely Likelihood 2, impact 2, score 4, low: H01 H02 Likelihood 2, impact 3, score 6, medium: H03 H04 Likelihood 2, impact 4, score 8, medium: H05 H06
1 Rare Likelihood 1, impact 3, score 3, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Posting errors and unreconciled balances 12 High 4 Low Financial controller
H02 Estimates and valuation uncertainty in the accounts 9 Medium 4 Low Financial controller
H03 Missed or misapplied tax and filing duties 12 High 6 Medium Tax and compliance lead
H04 Weak access control and segregation of duties 16 High 6 Medium Financial controller
H05 Fraud and misappropriation of funds 15 High 8 Medium Internal auditor
H06 Cyber intrusion and unreliable financial data 20 Critical 8 Medium IT manager
H07 Cash shortfall from late receivables and forecasting gaps 12 High 6 Medium Treasury lead
H08 Conflicts of interest and conduct in preparing accounts 8 Medium 3 Low Head of finance
H01

Posting errors and unreconciled balances

Operational Before 12 After 4

Transactions are posted to the wrong account, period or amount, and bank, supplier and customer balances are not reconciled on time, so the ledgers and reports carry errors that spread into later figures.

Who or what is affected: Bookkeepers, management and users of the reports

Causes

Manual entry, high volume at month end and reconciliations that depend on one person.

Consequences

Misstated reports, rework, delayed closing and lost confidence from owners and lenders.

Existing controls

  • Bank accounts are reconciled to statements each month.
  • A second person reviews manual journals above a set value.

Control gaps

Review of small journals is skipped, and old unreconciled items can sit for months without escalation.

Additional controls

  • Prevent: Use posting rules and standard journal templates for recurring entries.
  • Detect: Run exception reports for unusual, late or unreconciled items each week.
Likelihood 4 x impact 3 before; 2 x 2 after Owner: Financial controller Target: Within 45 days Early warning: Reconciling items older than 30 days on any bank or control account.
H02

Estimates and valuation uncertainty in the accounts

Financial Before 9 After 4

Estimates for stock, doubtful debts, depreciation and accruals rest on assumptions that may be optimistic or out of date, so balances in the statements are wrong when conditions change.

Who or what is affected: Management, owners, lenders and reviewing accountants

Causes

Reliance on one source, pressure for strong results and assumptions that are never revisited.

Consequences

Overstated assets or profit, poor decisions and later write downs.

Existing controls

  • Year end estimates are reviewed by the financial controller.
  • Key assumptions are noted in the close file each period.

Control gaps

Past estimates are not compared with outcomes, so bias goes unseen.

Additional controls

  • Prevent: Document each material estimate with its source and test a low and a high case.
  • Detect: Compare prior period estimates with actual outcomes and report differences to management.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Financial controller Target: Within 90 days Early warning: An adjustment above the usual level for the same balance in two consecutive periods.
H03

Missed or misapplied tax and filing duties

Legal and compliance Before 12 After 6

Tax returns, payroll filings or statutory reports are late, incomplete or wrongly treated because rules change, the calendar is weak or the preparer lacks training in the rules that apply.

Who or what is affected: Owners, management, employees and tax authorities

Causes

Rules that differ by place and change over time, a small team and filings prepared at the last minute.

Consequences

Penalties, interest, restated accounts and loss of regulator trust.

Existing controls

  • A filing calendar lists the main deadlines for the year.
  • Returns are checked by a second person before submission.

Control gaps

Applicable rules are assumed rather than confirmed before each filing, and the calendar is not checked against actual submissions.

Additional controls

  • Prevent: Keep a compliance calendar with an owner and backup owner for every filing.
  • Respond: Engage a qualified tax adviser to review any unusual treatment before filing.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Tax and compliance lead Target: Within 30 days Early warning: A filing due within 10 days with no preparer or reviewer named.
H04

Weak access control and segregation of duties

Operational Before 16 After 6

One person can create a supplier, enter an invoice and release a payment, or keeps system rights the role no longer needs, so errors and misuse can pass unseen.

Who or what is affected: Finance team, owners and suppliers

Causes

Small teams, shared passwords and access rights that are added but never removed.

Consequences

Undetected error or misuse, loss of funds and audit findings.

Existing controls

  • Each user signs in with an individual account.
  • Payments above a set limit need a second approval.

Control gaps

Access is reviewed only when someone leaves or complains.

Additional controls

  • Prevent: Map roles to permissions and remove any combination that lets one person start and approve a payment.
  • Detect: Review user access and approval logs each quarter and record the outcome.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Financial controller Target: Within 60 days Early warning: A user who holds both entry and approval rights for payments.
H05

Fraud and misappropriation of funds

Financial Before 15 After 8

Fake suppliers, altered bank details, inflated expense claims or diverted receipts take money from the business, often in small amounts over a long period.

Who or what is affected: Owners, lenders and employees

Causes

Trust placed in one person, pressure to meet targets and weak checks on supplier changes.

Consequences

Direct loss, legal action, reputational harm and a breakdown in trust.

Existing controls

  • Changes to supplier bank details are confirmed by phone.
  • Expense claims need a manager approval before payment.

Control gaps

Matching is done on a sample, so small repeated payments can pass unnoticed.

Additional controls

  • Prevent: Confirm new suppliers and bank detail changes through a call to a known contact before any payment.
  • Detect: Match payments to approved invoices and review duplicate or round sum payments each month.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 45 days Early warning: A supplier bank detail change that is not confirmed by a call back.
H06

Cyber intrusion and unreliable financial data

Technology and data Before 20 After 8

Phishing, reused passwords and unprotected spreadsheets expose ledgers and bank details, while manual copying between systems and poor master data introduce errors into reports.

Who or what is affected: Finance team, clients, suppliers and owners

Causes

Phishing emails, reused passwords and spreadsheets copied between people.

Consequences

Stolen data, false payments, unreliable reports and regulator notices.

Existing controls

  • Accounting software requires a password and is backed up daily.
  • Staff are told not to send financial files through public links.

Control gaps

Spreadsheets used for key figures sit outside the access controls, and backups are not restored in tests.

Additional controls

  • Prevent: Enable multi-factor sign in for all finance accounts and train staff on payment request scams.
  • Recover: Test restoring the ledger from backup each quarter and keep a written recovery plan.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: IT manager Target: Within 30 days Early warning: Repeated payment request scams reported to the finance mailbox.
H07

Cash shortfall from late receivables and forecasting gaps

Financial Before 12 After 6

Customers pay late or fail, a lender withdraws support or forecasts are out of date, so the business cannot meet its payments when they fall due.

Who or what is affected: Owners, lenders, suppliers and employees

Causes

Reliance on a few customers, long payment terms and forecasts that are rarely updated.

Consequences

Missed supplier payments, higher borrowing cost and loss of supplier trust.

Existing controls

  • Cash balances are reviewed weekly by the finance lead.
  • Customer terms are agreed in writing before goods are supplied.

Control gaps

The cash forecast is checked against actual results only once a quarter.

Additional controls

  • Prevent: Set credit limits for customers and a collection routine for overdue invoices.
  • Respond: Agree a standby funding plan and a contact order for any cash shortfall.
Likelihood 3 x impact 4 before; 3 x 2 after Owner: Treasury lead Target: Within 60 days Early warning: Customer invoices overdue by more than 60 days.
H08

Conflicts of interest and conduct in preparing accounts

Reputational Before 8 After 3

A bookkeeper or accountant has a personal or business link to a party whose transactions they record, or feels pressure to adjust figures, which weakens independence and trust in the numbers.

Who or what is affected: Management, owners, lenders and the public

Causes

Close personal ties with suppliers or customers, pressure to meet targets and unclear rules on gifts.

Consequences

Loss of independence, disciplinary action and damage to professional standing.

Existing controls

  • A code of conduct is signed when staff join and each year.
  • Staff declare outside interests on joining.

Control gaps

Declarations are collected but not compared with the parties recorded in the ledgers.

Additional controls

  • Prevent: Require a written conflict check before a person handles a related party transaction.
  • Respond: Provide a confidential route to raise concerns and record how each concern was handled.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Head of finance Target: Within 60 days Early warning: A related party transaction recorded without a declared interest.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. A Critical band means the risk needs senior attention at once. A High band needs a dated plan with a named owner. A Medium band needs routine controls and periodic review, and a Low band is accepted and watched. Inherent risk is the score before any controls. Residual risk is the score after the existing and added controls, and it must always be lower than the inherent score when the inherent score is 10 or more. Impact is judged on money lost, time to correct, the effect on reported results and harm to trust. A risk is never rated down only because it has not yet happened. Ratings are challenged by the people who do the work, by a second reviewer and by the internal auditor, and each rating is revisited when an indicator reaches its escalation threshold or when the business changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Reconciling items older than 30 days on any bank or control account.Escalate to the financial controller when any item passes 30 days, and to the head of finance after 60 days.
Supplier bank detail changes made without a call back to a known contact.Escalate to the internal auditor at once, and hold the payment until the change is confirmed.
Users who hold both entry and approval rights for payments.Escalate to the head of finance when any such user is found, and remove one right within a week.
Customer invoices overdue by more than 60 days, as a share of receivables.Escalate to the treasury lead when the overdue balance rises for two consecutive weeks, and to the board if cash cover falls below the agreed floor.
Filings due within 10 days with no named preparer or reviewer.Escalate to the tax and compliance lead at once, and to the head of finance if still open after 3 days.

Contingency arrangements

If a serious event occurs, such as confirmed fraud, a ransomware attack or a filing that cannot be made on time, the financial controller stops related payments, preserves records and informs owners. The IT manager isolates affected accounts and restores data from the latest tested backup. Tax, legal and regulator contacts are made through the head of finance, using qualified advisers for the rules that apply. Cash is protected by a standby funding plan, and staff, lenders and customers are told what they need to know early and plainly.

Prioritized action plan

  1. Introduce a dated month-end close checklist with sign-off, owner financial controller, within 45 days.
  2. Split entry and approval of payments and review user access, owner head of finance, within 60 days.
  3. Confirm supplier bank changes by call back and review duplicate payments, owner internal auditor, within 45 days.
  4. Enable multi-factor sign in and test a restore from backup, owner IT manager, within 30 days.
  5. Set up a compliance calendar with a backup owner for each filing, owner tax and compliance lead, within 30 days.

Conclusion

Accurate books depend on a few steady habits: dated reconciliations, split duties, checks on every change to payment details, tested backups and a calendar for every filing. The highest scores sit with cyber exposure, access control and fraud, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real tax, accounting or legal question.

Assumptions and limitations

Assumptions

  • The business keeps its books on standard accounting software and prepares accounts under one recognized reporting framework.
  • Staff are trained bookkeepers or accountants who use managed computers and shared finance mailboxes.
  • Jurisdiction, tax regime and size of the business are not specified, so legal duties are described in general terms only.

Limitations

  • The scores are examples for learning and do not describe any real business, ledger or audit.
  • Tax, accounting and reporting rules differ by place and change over time, so specialist review is needed.
  • This is educational content and is not tax, legal, accounting or financial advice.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Double entry bookkeeping and reconciliation procedures

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Financial Accounting and Bookkeeping course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners