hard20 pts · first answer countsinternal-controlsrisk-control-matrixprocure-to-pay

A control mapped to the wrong risk

In an RCM, the risk "paying for goods that were never received" is mapped only to the control "purchase orders above ₹2 lakh are approved by the department head". Why is this mapping weak?

A.PO approval is a detective control and cannot address payment risksB.The ₹2 lakh threshold is too high for any approval control to be usefulC.Department heads are first line and cannot perform key controlsD.PO approval shows the purchase was authorised, not that the goods actually arrived

Discussion 0

Join free to post in the discussion.

A control mapped to the wrong risk

Discussion 0

Related questions