Safety Norms: Budgeting, Forecasting and Cost Management

1Purpose, Scope, and Safety Principles

These norms protect the organization from financial harm that arises during budgeting, forecasting and cost management. Financial harm includes unauthorized commitments, inaccurate plans that trigger wrong decisions, misappropriation, fraud, leakage of confidential pay or pricing data, and reporting errors that breach internal policy or external obligations. The norms apply to anyone who builds, reviews, approves or uses budgets, forecasts or cost reports, including contractors and temporary staff.

This is educational guidance. It does not replace approved finance policies, delegations of authority, formal training, or advice from qualified accountants, auditors, legal counsel or tax professionals. Where a rule conflicts with local policy, the stricter requirement applies until clarified in writing.

• Mandatory: no spending commitment is made without an approved budget line and documented authorization.
• Mandatory: financial and personnel data is handled only in approved systems and locations.
• Recommendation: challenge assumptions before numbers are finalized, not after they are published.
• Principle: no single person controls a financial transaction from request to recording to reconciliation.

2Roles, Competence, and Accountability

Clear accountability prevents gaps where each person assumes someone else checked a figure. Budget owners are accountable for spending in their cost centers. Finance business partners challenge assumptions and confirm consistency with strategic plans. The finance controller owns general ledger mapping, the close process and control evidence. Executives approve budgets within delegated limits.

Competence matters because forecast models and cost allocations can look credible while being wrong. Users must be trained on the systems and controls they operate. Access to approval rights, bank portals, payroll data or pricing models requires written authorization and periodic review.

• Each budget line has one named owner recorded in the planning tool.
• Budget owners may not approve their own expense claims, vendor payments or headcount changes.
• Only staff with documented authority may release payments or post journal entries above the approved threshold.
• Every forecast model has a named model owner and a reviewer who did not build the model.
• Users receive system and control training before they receive edit access.
• Contractors sign confidentiality terms before they receive financial data.

3Course-Specific Hazards and Risk Assessment

The hazards in this subject are financial and informational rather than physical, but they can be severe. Typical activities include collecting departmental submissions, building headcount plans, running variance analysis, forecasting revenue and cash flow, allocating overhead, approving purchase requests and reporting cost performance. Common tools include spreadsheets, budgeting software, enterprise resource planning modules, shared drives, email and dashboards. The decisions affected include hiring, pricing, capital spending, cost reduction and external guidance.

Risk should be rated using likelihood and impact under the organization's risk framework. A simple scale of low, medium, high and critical is sufficient for most teams. Consider both one-off errors and repeated exposures, and record the rating and the control that reduces it.

• Unauthorized spending: commitments made outside approved budget, usually where approvals are informal. Impact is high.
• Spreadsheet error: broken links, overwritten formulas, hidden rows or wrong ranges. Impact is high when plans feed external reporting.
• Payment fraud: fictitious vendors, changed bank details or inflated invoices. Impact is critical.
• Forecast bias: optimism or sandbagging to meet targets. Impact is high when it drives hiring or investment.
• Data exposure: salary bands, pending restructuring or pricing held in shared folders or personal email. Impact is high.
• Cost misallocation: overhead assigned to the wrong cost centers, distorting product margins and performance reviews.
• Model manipulation: assumptions changed without version control or independent review. Impact is high.
• Conflict of interest: an approver with a personal or family link to a vendor or contractor. Impact is high.

4Preventive Controls and Safe Work Practices

Controls must work when people are busy or under pressure. Preventive controls reduce the chance of an error or misuse before it happens. Detective controls find problems afterward, such as reconciliations and variance reviews. Both are needed, and neither replaces the other.

Safe practices are the routines staff follow every reporting cycle. They should be written into the budget calendar, the close checklist and local procedures, and reviewed whenever systems, structures or delegations change.

• Segregation of duties: the person who requests a payment, the person who approves it, the person who records it and the person who reconciles the bank must be different where practical. If staffing is too small for full separation, a documented compensating review by an independent manager is mandatory.
• Vendor bank changes: verify any new vendor or changed bank details by callback to a contact already held on file, never to a number supplied in the request. Two people must approve the change before the vendor record is updated.
• Budget loading: only the planning team loads or changes budget values. Changes after approval require a written change request stating the reason and the approver.
• Commitment check: no purchase order is released until budget availability is confirmed in the system.
• Override control: no one bypasses a system check, such as a budget limit, without documented approval from the budget owner and the controller.
• Assumption register: every forecast keeps a list of key assumptions, their source, their owner and a version reference.
• Forecast review: forecasts are compared with actuals and prior forecasts. Variances above the threshold in local policy require a written explanation.
• Cost allocation: allocation keys are documented and approved. Any change to a key requires approval from the controller and a note of the expected effect on margins.
• Personal accounts: company financial data is never stored in personal bank accounts, personal messaging apps or personal cloud storage.
• Recommendation: use a range of scenarios rather than a single estimate for uncertain items, and disclose the range used.
• Recommendation: hold a short challenge meeting before finalizing high-impact forecasts, with someone outside the team present.

5Systems, Data, and Protective Safeguards

The equipment and environment in this field are mostly digital. The main protective safeguards are access control, logging, backup, secure workspace practices and disciplined handling of printed material. Information safeguards protect the confidentiality, integrity and availability of budget and cost data.

Privacy obligations apply when budgets include employee compensation, personal identifiers or customer information. These obligations depend on jurisdiction and contract terms and should be confirmed with the privacy officer and legal counsel.

• Access is role-based and reviewed at each planning cycle. Removing access when a person changes role or leaves is mandatory and must occur on the day of the change.
• Multi-factor authentication is required for financial systems where the organization's security standard requires it.
• Workstations are locked when unattended. Printed reports with salary or pricing detail are kept in locked storage and shredded when no longer needed.
• Shared financial files are stored only in approved repositories with restricted permissions.
• Personnel data is aggregated unless the recipient has a documented need to know.
• Spreadsheets with macros from unknown sources are not opened. Macro changes to budget models require review before use.
• Files containing financial data are not sent to external parties without approval and encryption where the organization requires it.
• Backups and version history are maintained. Model versions are saved with a reference and the name of the approver.
• Recommendation: review passwords and shared access lists regularly, and remove dormant accounts promptly.

6Incident Reporting, Escalation, and Emergency Response

Relevant incidents include suspected fraud, unauthorized payments, data leaks, lost devices holding financial files, system outages that affect the close, and material forecast errors found late. Near misses, such as an invoice stopped by a reviewer because the bank details looked wrong, must also be reported because they reveal control weaknesses.

Escalation should not depend on certainty. Staff are not expected to investigate alone, and they must not confront suspected individuals, alter records or delete evidence. Emergency services are rarely the right first step for financial incidents, but any threat to personal safety, such as coercion linked to a payment, must be reported immediately to security or local police.

• Report suspected fraud or misconduct through the designated channel. Anonymous reporting should be available where local policy and law permit.
• Report the issue the same working day it is identified.
• Preserve evidence: keep original invoices, emails, files and system logs unchanged.
• Do not discuss the suspicion with the person involved or with staff who have no need to know.
• Hold a payment only if procedure gives you authority to do so. Otherwise escalate to the controller at once.
• Report suspected data breaches to the information security team and privacy officer immediately. They decide notification duties, which vary by jurisdiction.
• Forecast errors that could change external guidance or board decisions go to the finance director for assessment before any communication.
• Record each incident in the incident log with the timeline, actions taken, and the name of the person who approved closure.

7Records, Training, Inspection, and Review

Records show that controls operated as designed. Budget approvals, change requests, assumption registers, reconciliations and review sign-offs must be retained under the organization's records schedule and any applicable legal retention rules. Retention rules vary by jurisdiction and must be confirmed with qualified advisers.

Training keeps competence current, and review tests whether controls still match real activity. Continuous improvement means lessons from variances, incidents and audit findings lead to changed procedures and retrained staff.

• Maintain an approval log for budget and forecast changes, showing reason, requester, approver and version.
• Reconcile loaded budget values to the approved budget document before release.
• Complete control self-assessments at each close and report exceptions to the controller.
• Provide training on budgeting systems, segregation of duties and fraud reporting before access is granted.
• Refresh training when systems or policies change, and keep attendance records.
• Test approvals and vendor bank changes on a risk basis, using samples selected by someone independent of the process.
• Track forecast accuracy and review large misses with the model owner.
• Update these norms when governance or systems change, and assign a named owner to each update.

Implementation checklist

• Confirm an approved budget line and documented authorization before any commitment.
• Verify vendor bank changes by callback to a contact already on file before payment.
• Confirm segregation of duties, or a documented independent review where full separation is not possible.
• Log every budget and forecast change with reason, requester, approver and version.
• Store financial and personnel data only in approved systems and restricted folders.
• Remove system access the day a person changes role or leaves.
• Document key forecast assumptions and obtain review by someone who did not build the model.
• Report suspected fraud, data leaks or control overrides the same working day.
• Preserve evidence and do not confront or question suspected individuals yourself.
• Verify applicable laws, accounting frameworks and internal policies with qualified professionals.