Payment run release and reconciliation sign-off

The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels. Points of focus: Integrates with risk assessment; Considers entity-specific factors; Determines relevant business processes; Evaluates a mix of control activity types; Considers at what level activities are applied; Addresses segregation of duties. Control activities are selected and developed integrated with the risk assessment, considering entity-specific factors (environment, complexity, nature, scope), the relevant business processes, a mix of control activity types (preventive and detective, manual and automated), the level at which activities are applied, and segregation of duties where practical, with alternative controls where not.

Split conflicting duties so no single person can run a sensitive process end to end unchecked.

Requires the organization to identify and document the individual duties that must be kept apart to limit malevolent activity without collusion, and to define system access authorizations so that those duties cannot be exercised by one person.

Business roles, responsibilities, levels of authority and segregation of duties supporting the process objectives are managed, and access to all information assets related to business processes is authorised: roles and responsibilities follow approved job descriptions and process activities; levels of authority for approving transactions, transaction limits and other decisions follow approved job roles; sensitive activities are allocated so that duties are clearly segregated; access rights and privileges are the minimum needed for predefined job roles, removed or revised immediately on role change or termination; regular awareness and training cover roles, responsibilities, the importance of controls and the security, integrity, confidentiality and privacy of information; administrative privileges are secured, tracked and controlled to prevent misuse; and access control definitions, logs and exception reports are periodically reviewed so that privileges remain valid and aligned with current staff and roles.

The execution of business process activities and related controls is operated on enterprise risk so that information processing is valid, complete, accurate, timely and secure, reflecting legitimate and authorised business use: the originator of transactions is authenticated and their authority verified; duties are segregated between origination and approval; transactions are verified as accurate, complete and valid through controls such as sequence, limit, range, validity, reasonableness, table look-ups, existence, key verification, check digit, completeness, duplicate and logical relationship checks and time edits, with validation rules and criteria reviewed periodically; erroneously input data are corrected and resubmitted without compromising original authorisation levels, retaining original source documents for reconstruction; data integrity and validity are maintained through the processing cycle with erroneous transactions not disrupting valid ones; output is handled in an authorised manner, delivered to the right recipient, protected in transmission and verified for accuracy and completeness; data integrity is maintained through unexpected interruptions and confirmed after failures; and transaction data passed between applications and functions inside or outside the enterprise are checked for proper addressing, authenticity of origin and integrity of content, with authentication and integrity protection in transit.