How are supplier bank-detail changes and new beneficiaries verified? 1. How are supplier bank-detail changes and new beneficiaries verified?
We usually accept the change if the email or message looks genuine. We sometimes call back, but not always on a number from our own records. Every change is verified by a call-back to a known number from our records and logged.
Who can add a new beneficiary and release a payment to it? 2. Who can add a new beneficiary and release a payment to it?
One person can do both without any check. A second person approves large payments, but beneficiary changes are not separately checked. Adding a beneficiary and releasing payment need two different people, with bank-level controls where available.
If a fraudulent payment were sent today, how quickly would your team act? 3. If a fraudulent payment were sent today, how quickly would your team act?
Staff would not know what to do or might wait to be sure. Some people know to call the bank, but there is no written plan. A written plan lists the bank’s fraud number, 1930, cybercrime.gov.in and who to inform, and staff know where it is.
How are the email accounts used for payments and purchasing protected? 4. How are the email accounts used for payments and purchasing protected?
Passwords only, and nobody checks for forwarding rules or unusual sign-ins. MFA is on for some accounts, but not all payment-related mailboxes. MFA is on for all payment and purchasing mailboxes and someone periodically checks forwarding rules and sign-ins.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered