Internal Audit Risk Register

Core Sector Risk Category
Support services Administration Operational



Support services Administration Compliance

Support services Finance Operational



Support services Finance Compliance













Support services Finance Strategic



Support services Finance Financial & Reporting











Operations Health, Safety & Enviro Operational






Operations Health, Safety & Enviro Compliance





Operations Health, Safety & Enviro Compliance

Support services HR & Payroll Operational

Support services HR & Payroll Strategic



Support services HR & Payroll Compliance
Support services HR & Payroll Strategic














Support services Legal Operational
Support services Legal Compliance
Support services Insurance Operational








Operations Administration Operational





Support services Finance Strategic

Support services General Procurement Operational



Support services General Procurement Compliance





Process Decomposed process
Accommodation Operations
Accommodation Polices and Procedures

Accommodation Repair & Maintenance


Cash & Bank ManaCash and Bank Management
Cash & Bank ManaPhysical controls
Cash & Bank ManaCash flow Projections




Company Vehicles Vehicle Addition & Disposals

Company Vehicles Vehicle Management









Corporate credit carCorporate credit card
Creditor ManagemeCredit Management
Creditor ManagemeMonitoring and Reporting
Creditor ManagemeMonitoring and Reporting

Debtor ManagementMonitoring and Reporting
Debtor ManagementCustomer Onboarding and KYC
Debtor ManagementClient Collaterals

Debtor ManagementCollection & Recovery

Document ManagemDocument control
Document ManagemPhysical Controls & Destruction

Document ManagemDocument Classification
Document ManagemDocument Classification
Document ManagemDocument Indexing
Document ManagemDocument Indexing

Financial AccountinAccounting System Maintenance
Financial AccountinAdvances, Deposits & prepayments

Financial AccountinCommon Cost Split


Financial AccountinFinancial Accounting & Reporting



Fixed Asset Manag Capital Planning and Budgeting
Fixed Asset Manag Capital Work in Progress
Fixed Asset Manag Capital Work in Progress

Fixed Asset Manag Depreciation
Fixed Asset Manag Fixed Asset Management and Control




HSE Monitoring and Reporting
HSE Workplace and Waste Management




HSE Machinery, Equipment and Tools




HSE PPEs and First Aid




HR & Payroll Compensation and Benefits




HR & Payroll Training and Staff Development

HR & Payroll HR Planning, Onboarding and Separat

HR & Payroll Government Relations



HR & Payroll Policies and Procedures
HR & Payroll Payroll Posting and Reconciliation







Leased Facilities Contract Management

Leased Facilities Security Deposit
Leased Facilities Sourcing and Selection
Leased Facilities Sub-leasing

Licensing & Legal Statutory Compliance
Licensing & Legal Monitoring and Reporting
PAR & Money InsurContract Management
PAR & Money InsurInsurance Management

PAR & Money InsurMIS Reporting
PAR & Money InsurMIS Reporting

PAR & Money InsurSourcing and Selection
Planning, BudgetingPreparation, Review and Approval


Planning, BudgetingMonitoring and Reporting

Service Providers Monitoring and Reporting
Service Providers Onboarding and Contract Managemen



Taxation Withholding Tax
Tools Management Back-charging

Tools Management Loss reporting

Tools Management Loss reporting
Tools Management Record keeping

Tools Management Status Management

Tools Management Status Management
Treasury ManagemeBanking Facilities

Treasury ManagemeDebt Management
Treasury ManagemeForeign Currency Management

Treasury ManagemeOff Balance Sheet items
Treasury ManagemeUtilization of Surplus Funds
Capex & non-capexOrdering and Receiving
Capex & non-capexVendor and Contract Management




Capex & non-capexInvoicing
Capex & non-capexSourcing & Contracting




Risk Description
Accommodation facilities might be used for storage purposes which may poses the residents to physical risks.
Employee in the accommodation may be entitled for housing allowance leading to additional cost being borne by
company.
No feasibility studies may be conducted on hiring camps/accommodations leading to non exploring of better rates
terms.
No practice might be in place to request from residents in Camp to sign acknowledgement of receiving rooms’ con
Pest control contract may not be signed with any third party which impact the hygiene standards.
Unauthorized access to the company accommodation facilities exposing the residents and facility to risks.
Unfair allocation of the residents may result in employee dissatisfaction.
Absence of Housing Rules circulated among the accommodation residents may lead to unclear guidelines on acce
behavior.
Accommodation may be unclean and untidy which affect the residents satisfaction.
Lack of preventive maintenance procedures for the AC, water filters, etc. conducted at the accommodation leading
provision of below standard facilities.
No process might be established to report repair and maintenance issues by residents in the company’s accommod
Tracking records may not be maintained to ensure compliance with replacement of bedding.
No process might be established to measure the employees satisfaction with respect to the services provided in the
accommodation. Furthermore, no complaints or suggested boxes may be available leading to staff dissatisfaction.
Non-compliance with the legal requirements stipulated in the relevant laws and regulations (WAPR Workers
accommodation Planning regulation & Ministerial decree 18/2014) for building structure(e.g. recreation facilities)
Facility Management, Medical and First Aid (e.g. Centre with designated nurse for >X residents.), Safety (e.g. sep
kitchen) and Security, and Sleeping Quarters (e.g. Min. space/ person required).
Cancelled cheques may not be stamped with "Cancelled" stamp to avoid unauthorized transactions.
Lack of physical controls (fire and water resistant safe box, assigned custodian, CCTV, etc.) over collected cheque
and customer/ client collaterals may expose the same to physical risks and misuse.
Bank payments may be incorrectly applied for clients invoices which may result in inaccurate recording of client/
customer payments.
Cheques used to pay suppliers and other parties may be issued without being crossed (A.C payee) which may resu
fraud and misuse.
Cash position and cash flow projections may not be periodically prepared, reviewed and approved resulting in wo
capital challenges for operations and capital expansions.
Daily cash sales and cash receipt may not be reconciled with the related cash deposits and POS bank transactions
may lead to cash misappropriation not being detected on timely fashion.
Cash submissions to the main cashier/ accountant may not be tracked / no log maintained leading to non availabili
Audit trail.
No records maintained for submission of cash to messengers/collection agents leading to lack of Audit trail.
Cash collections, cheques and PDC may not be deposited in a timely manner resulting in delayed financial recordi
Cash and bank reconciliations may not be performed, reviewed and approved leading to delay in detecting any un-
wrongly posted transactions.
Petty cash fund amount may be in excess to the operational needs which may lead to working capital blockage.
Petty cash fund amount may not be adequate for meeting the operational sudden expenses which may lead to oper
disruption.
Cash purchases are not frequently reviewed (e.g. nature, sources/ vendors, etc.) leading to more reliance on cash
purchases.
"Paid" stamp may not be affixed on settled payment voucher leading to duplicate payments.
Cash in hand held may be above the limits as per the insurance policies leading to losses in case of any mis-happe
Cash may be used for payment which are not to be paid in cash (e.g. employees compensation, fixed assists, etc.)
to non compliance with policies.
Cash safe duplicate key may not be kept in sealed envelope leading to lack of trail in case of emergency usage.
Cash safe duplicate key might be with the same custodian leading to weak internal controls.
Cash safe might not have duplicate keys resulting in issues in case of the master key being misplaced.
Inappropriate physical controls might be placed over cash which may result in theft or misappropriation of cash.
IOU - Cash payment vouchers may not be approved, dated or acknowledged by the receiver leading to misuses.
Payment vouchers may not be substantiated with original invoices leading to misuses.
Random surprise verification of cash may not be performed leading to non detection of misuses.
Cash may not be kept in a secure place like a safe locker which is not attached with a wall or floor leading to weak
physical controls over cash storage.
Counterfeit bills detector may not be available at cash collection desks which may lead to fake currency notes bein
received by the company leading to financial losses.
Employee using company vehicle may be entitled to transportation allowance leading to additional cost being paid
company.
Ineligible employee might be assigned company vehicle which may result in excess cost being charged to the com
Company vehicles may be scrapped without being cancelled in the traffic dept. which may result in legal responsi
the company.
Company vehicles subject to scrapping may be sold to unauthorized scrappier which may result in legal responsib
the company.
No handover documentation available for company vehicles sold as scrap to confirm transferring the vehicle risks
rewards to the buyer.
Technical opinion on vehicle functionality may not be pursued prior deciding on scrapping it which may lead to fi
losses.
Excess / deductible charges against insurance claims may not be charged back to the employees leading to financi
Expired insurance policy may not be timely renewed leading to process inefficiency and lack of insurance compen
in case of theft / accidents.
Insurance policy may not be timely cancelled / transferred in case of disposal of company vehicle leading to undue
exposure for the company.
Newly purchased vehicle may not be timely insured leading to lack of insurance compensation in case of accident
Company vehicle may be assigned to employee with no / expired license which may lead to legal risk in case of ac
and insurance claims.
Clear guidelines may not be provided by the Admin Department to the user regarding maintenance of vehicle whi
lead to inconsistency in vehicle maintenance and decrease in resale value.
Maintenance of vehicles may not be timely carried out and monitored by the Admin department which will effect
market value of company assets.
Service log may not be maintained by the user leading to lack of audit trail on the maintenance of vehicle.
Warranty coverage may not be considered for parts / services under warranty leading to additional repair and main
cost of vehicle.
Traffic violation may not be monitored and back-charged to the assigned driver leading to financial loss.
Vehicle registration may not be timely transferred in case of disposal which may lead to legal exposure in case of
/ theft.
Vehicle Registration (Istimarah) may not be timely renewed leading to late payment fines.
Vehicle log book may not be maintained for pool cars/ unassigned cars which lead to usage of company cars for p
purposes.
Vehicle log books may not be reviewed by the admin department which may lead to unauthorized travel on compa
cars.
Lack of coordination between different fleet owners in the group to maximize the fleet utilization may lead to exce
reliance of the company on rental equipment and underutilization of group assets.
Criteria of handing over of vehicle between one custodian to another/ to the company may not be defined which m
disputes during handing over.
Change in custodianship of vehicles may not be updated in the register leading to inaccurate MIS and process
ineffectiveness.
Disposal of vehicles may not be removed from the vehicle register leading to inaccurate MIS.
Incomplete / inaccurate records may be entered in the register (e.g. Identification number, Year of purchase, Mode
Present Location / user) leading to incomplete audit trail and process ineffectiveness.
Lack of regular reconciliation between company vehicles list and traffic department list which may result in legal
Regular review of reconciliation of vehicle log and physical custodianship may not be conducted which may lead
inaccurate record and lack of control over company assets.
Status of company vehicle such as (idle, in-use, under-repair, beyond economic repair etc.) may not be defined &
by the admin department for fleet management which will lead to incomplete record keeping.
Users / custodians of company vehicles may not be updated in fixed asset register leading to incomplete MIS and
audit trail.
Criteria for vehicle budgeting such as increase in head count may not be considered while preparing the CAPEX b
resulting in inconsistent practice being followed by the company.
Vehicle addition may not be planned during the budgeting setting process which may result in regular procuremen
unbudgeted assets and cash flows.
Company vehicles may be purchased without performing due economic analysis (e.g. rent vs buy / lease) which m
result in higher cost being paid by company.
Cash may be paid to employees against fuel expense in addition of the fuel cards which may lead to financial loss
Company vehicles may not be enrolled in WOQODe program and fuel may be reimbursed from petty cash which
weakens the monitoring of the company vehicles fuel consumption and may lead to fuel bills misappropriation.
Fake bills may be submitted to companies against fuel expenses which may be lead to cash embezzlement.
Fuel consumption per vehicle is not being tracked and analyzed and fuel bills may be inconsistent with the standar
leading to additional cost being charged to the company.
Lack of defined limit of fuel consumption (based on reimbursement or WOQODe bills) per job title which may le
excessive fuel consumption.
Standard consumption may not be compared with the actual consumption to validate the expense charged to the co
which may lead over usage/ overcharging not being detected.
Standard consumption range may not be defined for vehicles which may lead to process ineffectiveness.
Vehicles maintenance/ running cost may not be analyzed on regular basis to identify vehicles due for replacement
disposal.
Corporate Credit Card custodian may not be assigned and documented leading to misuse.
Corporate Credit Card may not be required or balance of the Corporate Credit Card may not be aligned with the re
need leading to blockage of the company bank facilities.
Corporate Credit Card transactions may not be properly monitored resulting in usage of credit card for personal ex
Credit days may not be agreed with the vendor at procurement stage or may not be followed at the time of paymen
leading to early / delayed payments.
Vendor ageing may not be prepared, reviewed and approved at appropriate level leading to delayed payments to v
and impact on market reputation of company.
Vendor balances may not be reconciled on a periodic basis leading to misstatement of vendor balances and additio
being paid by the company.
Vendors may be paid by the company which are defaulted in other subsidiaries which may lead to credit control w
at group level.
Vendors may be paid prior to the due dates resulting in inefficient and ineffective working capital management.
Same party may be acting as a vendor and client/ customer and outstanding balances may not be adjusted while m
payments leading to ineffective working capital management.
Vendors providing discounts for prompt payments may not be considered while planning for payments leading to
cost being paid by the company.
Credit may be extended to client/ customer without considering the previous outstanding balance leading to intern
control weakness.
Customer/ client ageing may not be prepared, reviewed and approved at appropriate level leading to recoverability
and timely obtaining legal recourses resulting in financial losses to the company.
Customer/ client balances may be written-off without obtaining approvals from competent authority resulting in in
control weakness and lack of management oversight.
No proper processes for write-off, off-setting or restructuring (escalation, review for possible collection, authoriza
approval etc. which may lead to inaccurate financial and management reporting and delayed decision for obtaining
recourses.
Adequate provisioning may not be taken in the books of accounts against doubtful debts resulting in non-complian
financial reporting standards and MIS may not reflect true debtor position to the management.
Credit policy may not be defined or inadequately defined to cover all aspects of credit management which may lea
inconsistent and ineffective credit management in the company.
Clients/ customers PDCs may not be timely deposited to bank accounts after the legal prescription period leading
inability to raise criminal case to expedite the collection and litigation process.
Collaterals collected from customers/ clients as security may not be properly monitored and safeguarded (e.g. wat
proof safe box) which may lead to legal risk in case of misplacement of collaterals.
Collaterals received from customers/ clients may not be timely returned to the customers with proper documentat
the retention period which may lead to unnecessary exposure of customer documentation retention.
Customers/ clients collateral requirements may not be defined in policy resulting in inconsistent collateral requirem
from clients and credit risk exposure may be increased.
Customers/ clients collaterals may have expired without being timely reviewed resulting in process inefficiency a
ineffectiveness.
Delay in handling and resolving customers/ clients disputes related to collections including liaising with Operation
supporting documents
Collection strategy (follow-up & escalation) may not be developed and implemented consistently which may lead
increase in the possibility of non-recoverability of outstanding balances and consequently increasing the bad debts
adverse effect on profits and cash flow.
Adequate, timely and consistent customers/ clients due diligence practices (e.g. call verification, site visit, financia
statement analysis, trade reference, proof of business, etc.) may not be ensured to enhance credit decision making
and minimize possible bad debts.
Credit limits may not be properly authorized, recorded/updated in the system and reviewed on a periodic basis bas
the customer/ client's risk profile and current operational demands which may lead to extended credit risk exposur
company.
Credit background checks may not be performed / inadequately performed on new customers/ clients leading to in
credit limits being approved by the company resulting in increased credit risk exposure.
Lack of communications between the collections and credit functions to identify and mark the blacklisted custome
clients in order to avoid future dealings with them which will increase the credit risk.
No process established to identify and freeze the customers/ clients abounded deposits/ advance payments e.g. not
for more than 6 months. These payments may be misused to settle other customers dues.
A proper filing and retention of customers/ clients credit & legal documentations (e.g. bank statements, credit faci
agreements, CR, TL, CC) may not be established. This may lead to risk of fraudulent and missing customer/ clien
documentations, difficulty in monitoring compliance with the credit policies/company procedures and assigning
accountability.
Incentives on early / timely payments may not be given to customers/ clients leading to recoverability issues and p
cash flow problems.
Collections from shared customers/ clients (within the group) may not be coordinated which may lead to process
inefficiency resulting from duplicate efforts or lack of exercising control as a group to impose effective credit reco
mechanism.
KYC forms may not be designed / inadequately designed to capture all customers/ clients credit related informatio
may result in inaccurate decision making and customer credit approvals.
KYC policy may not be documented to adopt a standard process for performing KYC checks on customers/ client
resulting in inconsistent practice being followed by the company.
Balances may not be reconciled and confirmed with the customers/ clients on a periodic basis leading to misstatem
financial records.
Formal process of periodic reconciliation might be devised and is not reviewed at appropriate levels leading to
inconsistent balances in sub-leger and GL balances and inaccurate financial records.
Clients/ customers due payments may not be monitored leading to increased risk of irrecoverability.
Documents may not be archived in a central location leading to loss of important information.
Central location for document archival may be subject to unauthorized access leading to loss or damage to the info
being stored.
Access of storing, viewing and deleting the document in central location may not be defined against each access le
unauthorized changes in the company’s documents.
Access levels may not be reviewed on a periodic basis to monitor the rights given to each employee leading to irre
access not revoked in a timely manner.
Archival and retention period of documents may not be agreed with the legal department and compliance with the
statutory guidelines (e.g. document prescription period) may not be adhered to leading to fines, penalties and legal
exposure.
Destruction of documents may not be conducted in a timely and effective manner leading to leakage of company's
information and resulting in fines, penalties and legal exposure of the company.
Documents may not be classified in terms of its confidentiality level such as Private, Confidential etc. leading to le
of company's documents and information.
Authority and access level of documents may not be defined and adhered to leading to unauthorized access of con
documents resulting in fines, penalties and reputational risk.
Responsibility and Job Description of Document Controller may not be defined and monitored which may lead to
clarity on responsibility and resultant accountability.
Unauthorized documents/formats (e.g. Manual invoice, quotation, DN, etc.) may be used leading to lack of audit t
possible misuses.
Documents may not be indexed in terms of their classification and sequential issuance leading to lack of complete
check on the issued documents.
Document indexing record may not be updated and reviewed on a periodic basis leading to inaccurate and incomp
record and MIS.
Physical documents may not be stored in a central location and the storage area may have inadequate controls (e.g
restricted access, water and fire proofing system, CCTVs etc.) leading to loss, damage and theft of company's imp
information and records.
Documents destruction process may not be approved by legal department & senior management leading to loss of
documents which may be required in ongoing or potential litigations/ claims.
Documents destruction may be conducted improperly or by unauthorized party compromising the confidentiality.
Manual documentation booklets (e.g. cash receipt vouchers etc.) may not be maintained in safe custody and filled
may not be retained / reconciled with cash deposited in bank leading to cash embezzlements and fraud.
Manual documentation booklets (e.g. cash receipts, DN, Gate Passes, invoices) may not be sequentially numbered
ensuring the completeness of transactions leading to difficulties in audit trail and reconciliation of transactions e.g
received and deposited in bank.
GL Master data may not be accurately maintained (e.g. duplicate GLs, sub-ledgers etc.) which may effect the MIS
reporting and posting of transactions in incorrect GLs.
Unauthorized changes to General Ledger master records (including creation or deletion of accounts) may go unde
resulting in weak internal controls being exercised over the GL maintenance.
Lack of segregation of duties for changes in the accounting (e.g. GL, Sub GL, etc.) master files maintaining the
accounting records may result in control weaknesses.
Advance may be given to foreign vendors instead of opening an LC through bank which may lead to difficulties in
working capital management and may result in financial losses due to non recoverability.
Advance to vendors may not be properly monitored and long outstanding advances may be not be followed up wit
procurement department leading to non-recoverability of advances.
Criteria may not be established for issuing advance to vendors which may result in financial losses due to non
recoverability and inconsistent practices being followed within the company.
Prepaid expenses may not be periodically adjusted resulting in inaccurate accounting and financial reporting.
Common costs may not be correctly allocated to corresponding units / cost centers which may result in wrong cha
common cost and inaccurate financial reporting.
Adoption of accounting treatments may not be documented, discussed and approved at an appropriate level within
Company resulting in future financials restatement.
A central database may not be in place or is not accessible to internal stakeholders which is used to store, update a
retrieve information on accounting, internal accounting controls, or audit matters which may lead to information b
outdated or omitted due to errors.
A standardized IFRS Group Accounting Manual may not be defined and signed off by the Central Finance depart
and communicated to all subsidiary units which may lead to inconsistent subsidiary financial reporting and difficu
consolidating financial statements.
A regular process to update the Accounting Manual may not exist which may lead to outdated accounting manual
misaligned with the changes in IFRSs.
Any complex accounting matters arising from changes in IFRSs or business operations may not be discussed with
qualified persons leading to lack of subject matter experts guidelines on financial accounting and reporting.
A communication channels or central node between Group Accounting and the reporting units may not exist whic
responsible for providing an insight into accounting practice in the subsidiaries and ensuring compliance with the
Accounting Manual which may lead to inconsistent financial reporting by subsidiaries and holding company.
A standardized process for checking quarterly, half-yearly and annual financial statements (under IFRS) may not e
which may lead to inaccurate financial reporting.
Structure and reports of management reporting package may not include budgeted figures which may result in ine
oversight over company's performance against defined budgets.
Regular reporting meetings with the subsidiaries may not be conducted to help ensure compliance with the Accou
Manual which may lead to ineffective control and oversight by central financial node / central finance department
Training programs may not conducted for subsidiaries finance function on changes in the group accounting manua
updates / changes in accounting standards which may lead to outdated financial knowledge and inaccurate financi
accounting & reporting.
Discussion and decision on financial statements with the board may not be documented leading to lack of audit tra
GL closing activity might not take place in a timely manner resulting in transactions being posted in closed financ
period leading to distortion of historical financial information.
Chart of accounts might be incomplete or inaccurate and inappropriate sub-ledgers are mapped with the GL codes
resulting in financial statements classification errors.
General Ledger and other financial information may be incomplete for the purposes of compiling the financial stat
resulting in financial statements errors.
GL/ accounting documents may not be assigned a unique sequential number which may make it difficult to ensure
completeness of information.
Periodic reconciliation of sub ledgers and the general ledger may not be periodically performed leading to unreliab
financial records.
Accounting entries might not be approved at appropriate levels and checker and maker concept may not be follow
leading to errors in financial records.
Changes and reversals of posted journal entries may not be validated at appropriate level resulting in inaccurate fin
transactions.
Journal entries can be directly posted in GLs without valid approvals which may lead to errors, omissions in finan
records.
Recurring / routine month-end journal/ adjustment entries may be inaccurate or can be omitted resulting in miss-st
of financial balances.
Unauthorized personnel may have access to post journal entries which may lead to recording of non-validated fina
transactions.
Incorrect opening balances may be entered or fetched from the system resulting in inaccurate financial reporting in
subsequent period.
Inter-company transactions may be inaccurately recorded / recorded with delay resulting in inaccurate financial re
and reporting as well as it hinder the consolidation process.
Inter-company transactions may not be recorded at an arms length basis leading to non-compliance with financial
reporting standards.
Specialty accounts such as advances, prepayments and other receivables may not be timely recorded in the GL res
incorrect financial reporting.
Credit notes may not be approved and substantiated with supporting leading to misappropriation.
Debit / Credit notes may be issued by unauthorized person leading to dispute with vendors & customers/ clients an
reconciled sub-ledgers.
Debit notes may not be raised for all collectible spends/recoveries from vendor leading to financial losses.
Post close entries / adjusting entries are not properly reviewed and approved at appropriate levels resulting in inac
financial statements.
Accuracy might not be maintained in GL balances which may result in misclassification of expenses.
Trial balances might be inaccurate or mismatched resulting in financial statements errors and omissions.
Related parties transactions may not be recorded in accordance with the IFRSs on arms-length basis which may le
financial reporting non-compliances.
Related party transactions may not be reconciled periodically leading to difficulties in group consolidation and ov
under stated stand-alone balances.
Financial statements may be inaccurate or incomplete and the published financial statements (in print and electron
may not be free from publishing, printing or electronic-conversion errors resulting in inaccurate financial statemen
the readers and users.
Financial results and any significant issues or events might not be regularly communicated to the Audit Committe
of Directors, etc.) as appropriate resulting in lack of governance and oversight controls.
Internal and external financial reporting requirements and deadlines may not be identified, updated and communic
a timely basis resulting in delayed management reporting and lack of governance and oversight controls.
Budgets may not be properly embedded in system resulting in lack of budgetary controls and monitoring.
Assets under construction may be completed and placed in service without the creation of related fixed asset recor
leading to inaccurate fixed asset recording and depreciation charging.
Inappropriate creation or modification of construction-in-process (CIP) asset master records and categories may re
inaccurate accounting for fixed assets and depreciation expense.
Depreciation expense may be misstated due to inappropriate configuration of in-service dates.
Depreciation expense may be wrongly calculated and posted in the accounting records resulting in inaccurate fina
data.
Inconsistency in depreciation rate applied for the different assets within the same category resulting in wrong depr
calculation and assets NBV.
Unauthorized individuals may run the depreciation calculation program resulting in inaccurate and untimely postin
fixed asset and depreciation accounting entries.
Useful life of the assets may be not aligned with the assets nature leading to over/ under depreciation and consequ
affecting the financial results.
Fixed asset balances may include assets that have been disposed or otherwise retired leading to overstatement of f
asset balances.
Incorrect asset gain and loss postings may be recorded leading to inaccurate financial reporting.
Good quality assets may be sold or disposed off before the end of their useful life without compelling business rea
resulting in loss to the company.
Assets which are no longer required for business operations are not sold or disposed off in a timely manner. This c
result in underutilization of assets and decreased realizable value at the time of actual disposal.
Retirement of assets by unauthorized users may result in premature retirement of assets.
Assets may be sold at substandard prices due to inadequate market knowledge or intentionally to favor a particula
resulting in financial loss to the company.
Assets may be inappropriately transferred between companies without valid approvals and documents leading to
ineffective physical controls over assets.
Assets may not be properly transferred and may be incorrectly reported in the financials leading to inaccurate fina
reporting.
FAR may not be maintained and updated leading to non identification of Assets.
Regular physical count for fixed assets may not performed. This may forego the opportunity to detect any un-post
wrongly posted transactions, as well as to identify lost/stolen assets in a timely manner.
Lack of physical controls over fixed assets (e.g. tags, locations assignment, accessibility, etc.) resulting in
misappropriation of assets.
Accident records may not be maintained for rectification plan and to avoid re-occurrence.
Near miss & good catch events may not be reported and timely corrective actions may not be taken leading to pote
HSE incidents.
Loss Time Injury may not be recorded and communicated to management on a timely basis leading to inappropria
reporting mechanism and lack of oversight on staff efficiency.
Fire extinguishers/detectors may not be available, insufficient or not strategically placed exposing to high risk in c
any unforeseen incidents.
Fire extinguishers may not be timely refilled leading to inadequate control measures being taken in case of any un
incident.
Unauthorized party/ person may be allowed to enter the premises which may lead to damage, theft, security breach
misappropriation of assets.
Emergency doors may not be linked with the alarm system which may lead to lack of awareness for the other emp
to respond in any emergency situation.
Manufacturer/ principal standards may not be maintained regarding workplace quality resulting in no compliance.
Customers/ clients standards may not be maintained regarding workplace quality resulting in client dissatisfaction
business loss.
Lack of Safety hazards awareness (e.g. Toolbox Talks, Trainings, HIRA (HAZARD IDENTIFICATION & RISK
ASSESSMENT) for each activity), PPE, HSE inspection, work site signage, Edge protection, and Barricading tha
worker accidents and injuries.
Staff may not be aware of their defined roles and responsibilities in HSE incidents and required responses leading
inadequate response in emergency situation.
Self audits might not have taken place on a regular basis. The company may not conduct audits of HSE activities a
facilities.
HSE trainings may not be provided to employees at the time of induction which includes through review of any ha
job which may lead to lack of staff knowledge and orientation.
Periodic trainings may not be provided to employees with regards to first aid and fire fighting resulting in lack of s
awareness in emergency situations.
Special trainings may not be provided to employees to handle specialized equipment resulting in accident or injury
Complete record may not be maintained of the trainings delivered to employees resulting in lack of audit trail.
HSE training plan may not be in line with the specific requirements of project sites leading to inadequate training
facing HSE hazards during execution of work leading to project execution delay.
CCTV cameras may not be installed/ not installed at the critical locations (e.g. exits, entries, cash desk, etc..) leadi
inefficient security & safety measures.
Timely follow up of HSE issues and corrective actions might not be taken leading to internal control weakness.
Unavailability of Crisis Management Plan to deal with situations (e.g. boycott and Pandemic) that could threaten
company's ability to sustain safe operations, provide essential services, and/or recover operating costs.
Emergency power supply may not be available in case of power breakdown.
Wires and electrical cords may not be properly insulated and enclosed leading to power failure and staff injury.
Circuit boards, switches, breakers etc. may not be properly closed and highlighted leading to electrical incident.
Lock out and tag out procedures may not be followed during electric maintenance leading to staff injury.
Emergency exits may not be clearly marked and illuminated leading to inadequate response guidelines over emerg
incidents
Emergency exits may not have easy access and may be blocked in any way or emergency doors may not open out
leading to inadequate response to emergency situations.
Sufficient resources e.g. trained manpower may not be available for timely emergency response leading to injuries
untimely response.
Non availability of documented and publicly available evacuation procedures making evacuation difficult in case
unforeseen incidents.
Fire response plan/ evacuation plan for the facility may not be prepared, approved and posted at visible places lead
lack of guidance for staff in response to fire incidents.
Fire drills may not held regularly resulting in lack of knowledge in response to fire incident.
Fire fighting equipment may not be installed at all appropriate locations and may not be easily accessible.
Fire fighting equipment may not be regularly monitored and inspected.
Smoke alarms and water sprinkler system may not be in place to overcome fire incidents.
Fire extinguishers may not be of appropriate type leading to inadequate control measures taken in case of fire inci
Records of visitor, material movement, etc. may not be maintained at gate office which may lead to incomplete au
Hazardous material may not be placed in separately marked designated space with fire extinguisher installed in clo
proximity leading to fire incident.
Approved containers may not be used and containers might not be regularly checked for any leakages leading to m
losses.
Complete list of hazardous materials and Material Safety Data Sheet (MSDS) may not be available with the stores
production departments.
Containers may not have correct labelling resulting in wrong usage of material by error.
Audit carried out by different rating agencies such as ISO, OSHAS etc. might give a qualified report leading to no
compliances and stakeholders' distrust.
ISO certification may not be obtained or renewed with delay which may affect stakeholders' trust and non-qualific
from bidding procedure for potential business opportunities.
Regular third party Audits not conducted to ensure adherence with best practices which can increase the severity o
such as casualties & financial.
Machine calibrations may not be periodically conducted which may lead to inaccurate results of the machines resu
process inefficiency.
Material Handling equipment may not be licensed and operated by licensed operators which may lead to legal and
risk to the company.
Equipment e.g. forklifts, cranes, trucks may not be properly maintained and may not have safety equipment install
them leading to accident or staff injury.
Lack of Inspection Measurement and Test Instruments procedure resulting in business interruptions stemming from
technological failures, equipment failures, or other events cause an unfavorable impact on operations.
No records available for equipment subject to calibration may result in inconsistent calibration or overlooking of
equipment subject to calibration affecting the measurement accuracy.
Unavailable or outdated equipment's calibration may lead to malfunctioning and errors in measurements.
Materials may not be appropriately stored in a proper manner (stacked) and may be haphazardly placed leading to
misplacement of material.
Materials may not be stored in a proper and secure way with safe clearance through aisles.
Staff may not have been trained to lift properly which may lead to accident due to fall during loading.
Racking collapse due to non defining of maximum weight in warehouse leading to overloading & collapse causing
to people/damaging goods.
Liaison with trained emergency personnel may not be in place leading to lack of delegated responsibility in emerg
incidents.
First aid kits may not be readily available to staff and may not be regularly verified (expiry, contents and quantitie
resulting in lack of appropriate response for minor injuries.
Protective equipment may not be made available or may not be in working condition leading to lack of appropriate
protective measures.
Regular maintenance of protective equipment may not be carried out.
Harmful chemicals or gases discharged in to the environment may threaten the health and safety of the community
Waste management procedure may be ineffective and government requirements may not be properly complied wi
may lead to attracting fines and penalties.
Ventilation system may not be available / inadequately available which may lead to poor HSE conditions and resu
staff health deterioration.
Spilled materials and liquids may not be cleaned up immediately resulting in minor injuries.
Floor may not be free of protruding nails, splinters, holes and loose boards resulting in staff injuries and accidents
Racks & Aisles may collapse which may lead to minor or major injury to staff & damage of goods.
Aisles and passageways may not be kept clear of obstructions and clearly marked.
The level of light may not be adequate for safe and comfortable performance of work.
Regular noise surveys may not be conducted regularly resulting in injuries, fines and penalties.
Noisy machinery may not be isolated from the rest of the operation to avoid noise pollution and hearing issues for
Sufficient resources may not in place to deal with weather extremes resulting in lack of emergency response due to
weather.
Clean drinking water may not be easily available for employees leading to legal and statutory non compliance.
Working surfaces may not be clean and dry leading to accidents due to unhygienic condition and slippage.
Washing and toilet facilities may not be in place or regularly cleaned leading to unhygienic environment resulting
and penalties.
Cafeteria facilities may not be away from toxic materials and toilets leading to fines and penalties by government
authorities.
Dust, noise or vibration may cause complaints from neighborhood and can cause business interruptions.
Payroll distributions may not be accurate and payroll data may not be uploaded completely and accurately leading
inaccurate or delayed disbursement of payroll.
Payroll errors or unauthorized transactions may not be detected prior to payroll distribution leading to financial los
company.
Salary may be paid to the wrong personal / wrong bank account either due to error or due to unintentional/ unauth
changes in bank account details.
Air tickets may be granted to employees under family sponsorship with labor card instead of Travel Compensation
may result in incurrence of unnecessary costs related to Travel Compensation.
Air tickets may be processed not in accordance benefits structure (eligibility, class, no. of dependents, etc.) leading
additional cost being borne by the company.
Inconsistent air ticket benefits (# of dependents, class, etc.) may be applied to employees within the same grade/ le
which may negatively affect employee morals leading to dissatisfaction.
Employee absences may not be monitored, reviewed and adjusted against payroll due to un-availability of attenda
system and process leading to undetected or unauthorized absences and tardiness leading to non-deduction or
overpayments to employees and unnecessary costs.
Business trips may not be properly documented, justified, and authorized leading unnecessary additional costs.
Employee designated for business trips may not be entitled to a representation allowance (Per Diem) covering the
expenses of accommodation, meals, transport, etc. leading to employees dissatisfaction.
No report submitted for business trip results after employee return to ensure achievement of the business trip obje
Unclear guidelines on business trip ticket class eligibility of an employee accompanying the customers/ vendors le
additional cost incurred by the company.
Employee may avail married status benefits without having resident dependents, this may lead to obtain unauthori
benefits(i.e. full accommodation allowance, dependents medical insurance, dependents air tickets and dependents
residence fees).
Benefits structure is not consistently followed/ applied among the employees which affects the moral of the emplo
and lead to dissatisfaction.
Employees grades may not be defined across the company leading to inconsistent benefits offered to the employee
Positions of the employees may not be mapped to the grades, leading to inconsistent benefits offered to the emplo
and employees dissatisfaction.
Unavailability of clear benefits structure to define the eligibility of each grade/ level of employees which may neg
affect employee morals and leading to dissatisfaction.
Failure to align the compensation and pay incentive plans with the business strategy, human resources strategy, an
organizational culture may result in employee dissatisfaction and demotivation.
Annual leave balances may be incorrect or not updated, and related provisions not accrued leading to inaccurate fi
records.
Employees leaves may not be documented and supported by relevant application or certificate (e.g. annual leave:
approved leave application, sick leave & maternity leave: medical certificate, bereavement leave: death certificate
marriage leave: marriage certificate).
Lack of reconciliation between employees leaves records and ministry of interior exit report that could discover ea
departure and late return.
Leave plan for employees may not be prepared in advance and submitted for manager approval which may result
disruption in operations.
Sick leave and maternity Leave limits (max days) may not be properly monitored leading to inaccurate leave mana
record.
Unauthorized/unnecessary leave encashment may be processed resulting in additional staff costs.
Accommodation allowance (including camp accommodation) granted to the employees may not be in line with th
approved benefits structure.
Delegation allowance may not be provided to an employee delegated to carry out the duties of the vacant superior
as a temporary replacement of another employee, this may negatively affect employee morals leading to dissatisfa
Education allowance may be paid based on non-authenticated school invoices leading to financial losses.
Education allowance may be paid to non-entitled employees, exceeding the total amount per child, exceeding the n
child, or for child's above the max age limit leading to incurrence of unnecessary cost.
Inconsistent education allowance may be applied to employees within the same grade/ level which may negatively
employee morals leading to dissatisfaction.
Medical insurance may not be granted to employees in accordance with the HR policy (upgrade, downgrade, exce
dependents).
Non-compliance with Qatar Labor law on personal loans and salary advances deductions limit leading to penalties
Overpaid delegation allowance exposes the company to unnecessary additional costs.
Excessive overtime may be claimed by employee in violation to the applicable laws and regulation.
Lack of overtime preapproval process may result in budget overrun.
Overtime payments may be unsupported by attendance substantiate the eligibility to payment.
Regular overtime might be used to compensate the employees out of the company payroll process and salary scale
Wong calculation of overtime may lead to employees dissatisfaction or incurring additional costs.
Employees’ pay scale may not reflect a fair, transparent and competitive reward strategy that attracts high perform
compensates them on the basis of job responsibilities and individual performance which may lead to affect employ
morale and can lead to employee dissatisfaction and high turnover.
Failure to benchmark the salaries against the market and competition may result in dissatisfaction of employees an
inability to attract competent resources.
Pay scale may not be defined for the employee grads leading personal judgment, inconsistent payout and employe
dissatisfaction.
Transportation allowance may not be consistent (in terms of vehicle utilization, job assignments, etc.); this may le
incurrence of unnecessary cost.
Employees satisfaction surveys may not be adapted to compute the ESI at different locations resulting into staff
dissatisfaction.
Fake employee records may be maintained in employee master data for misappropriating payments.
Inappropriate users may have the ability to access, change, and delete employee personal data leading to unauthor
changes in the master data.
Separated employees status may not be updated (i.e. inactive) impacting the MIS reports and resulting in payroll p
for ineligible party.
Unauthorized personnel may have access to the employee files may lead to loss of data and data privacy comprom
Formal exit permit guidelines (based on priority of critical positions, multiple exits, maximum validity, etc.) may n
established, this may lead to risk of unauthorized exit of staff with critical job positions and those with unauthoriz
leaves.
Regular reconciliation of exit permit list may not be undertaken to consider the separated staff, new joiners and an
organizational changes.
Unavailable system reports to track residency permit & labor cards renewal, expiry or cancellation leading to fines
penalties.
Inconsistent process and authorization levels regarding sponsoring of third parties (e.g. ex-employees, related part
employees, etc.) may expose the company to unnecessary fines and penalties.
Business visa may be issued for personal purposes which may expose the company to compliance risks.
Employee may join the company prior sponsorship transfer this may expose the company to low violation that cou
attracting fine and penalties.
Lack of regular reconciliation between the active employees master data and sponsorship list may lead to unautho
personal under the company sponsorship not being detected on timely fashion.
Unauthorized usage of the sponsor card (ID) which may expose the company to compliance risks.
Visa occupations may not be matched with the current job title or position of the employee in the company, this m
to suspension of/ delay in RPs renewal due to unavailable attested and matched educational certificates and Emplo
restrictions to government visa & licensing services (e.g. family visa or driving license) due to inaccurate occupati
QID.
Formal and consistent guidelines may not be established to process Residence Permit (RP) renewals and family vi
reimbursements for employees and their eligible dependents.
Job analysis and evaluation may not be performed for all positions in the company. Accordingly, human resource
requirements estimated for various functions/ departments may be in excess of / short of optimum requirements, w
may result in overstaffing or understaffing of various functions.
No practice in place to develop manpower plan for the different departments based on the forecasted requirements
vision. This may lead to inefficient recruitment process.
Failure to prevent unauthorized access to the payroll records may result in unauthorized changes to employees’
information and disclosing their confidential information.
Duty resumption may not be required to be submitted and authorized by the direct manager which increase the cha
payroll being posted for absent employee.
Employees' complaints related to any errors or mistakes in calculation and processing system of payroll may not b
into consideration leading to employee dissatisfaction.
Inaccurate duty resumption dates may be captured and recorded leading to inaccurate payroll calculation and paym
Manual payroll preparation and calculation is subject to clerical and intentional mistakes.
Payroll expenses may not be distributed to the appropriate general ledger accounts and cost centers accurately and
completely.
Performance appraisal results may not be discussed with and acknowledged by the concerned employees which m
to dissatisfaction.
Yearly performance appraisal may not be conducted to identify the points of weakness and strength , this may affe
development and improvement plans and expose the company to subjective employee rewards systems (e.g. prom
bonus, increments, etc.).
Status Change i.e. promotions, increments and allowance changes may not be in line with the applicable policy an
supported by a properly approved Staff Status Change Request documents, this may lead to unqualified employee
be granted increment or promoted which affect productivity and may have negative impact of the other employees
and unsupported allowance change may result in unnecessary costs to the company.
Lack of disciplinary actions records may result in deficiency in application of the Disciplinary actions list.
Non-dissemination of the approved Disciplinary actions list constitutes non-compliance with the applicable Labor
which can result fines and difficulty of enforcement of penalties to violating employees.
Unavailability of Disciplinary actions list would result in inconsistent practice and personal judgment.
Job Descriptions (JDs) may not be documented for all existing job titles/positions and new roles created due to
organizational changes, this may result to employees may not be clear about their roles, authorities and responsibi
and hence, accountability may not be clearly established.
Employees' KPIs may not be realistic resulting in staff demotivation and non-achievement of company's goals and
objectives.
Rules for company level requirements for remuneration of top executive management may not be documented wh
lead to inconsistent remuneration designed for company's top executives in comparison to the group guidelines.
Formal mechanism for staff development may not be devised leading to lack of staff training and development res
staff demotivation.
Process for assessing staff and executives may not defined and goals and objectives are not set for top executives
including assessment of integrity and ethical values leading to lack of executives periodic performance appraisal a
given targets.
Competency skills matrix may not be defined and approved by the management resulting in lack of documented
guidelines for appointing key staff personnel.
Competency skills matrix may not be complied with for hiring key staff members resulting in non-compliance wit
matrix.
Lack of onboarding and orientation programs for new joiners may create inconsistency or confusion on their assi
duties/responsibilities and unfamiliarity with their entitlements and companies structure , hierarchy and policies.
Unapproved org. structure may lead to inaccurate manpower budgets for variance reporting and controlling purpo
creates conflict in reporting lines and hierarchy.
Employment contract may not aligned with the applicable salary scale and benefits structure leading to non-compl
with the applicable policy and procedures.
Unavailability and improper dissemination of policies & procedures may lead to inconsistencies, inefficiencies, pe
judgment and employees dissatisfaction.
Employees files and records may not be properly maintained or incomplete, this weakens the audit trail for future
and may result in retaining unqualified employees.
Ineffective recruitment process may lead to hiring of unqualified staff and entail unnecessary costs.
Unauthorized recruitment agencies may be selected, this may constitute non-compliance with applicable labor law
Lack of succession plan may increase the likelihood of disrupting some processes when one or more key personne
the company.
Benefits availed by the employee (accommodation, medical insurance, etc..) may not be cancelled upon separation
Controls may not be established to ensure complete, timely and consistent separation procedures before final settle
payment and residency transfer or repatriation process, this may expose the company to legal risk in case of future
related to final settlement and employee might be cleared without returning assets or company belonging.
Employees EOS benefits may be incorrectly calculated which distorts the accuracy of the financial records and ma
in dispute with the separated employee.
Formal guidelines on employee training bond agreements may not be established (cost, tenure, location, etc.).
Training and Development plans for employees may not be prepared which may affect the employee capabilities t
perform his job duties.
Contracts may not be reviewed by the legal team which may lead to unfavorable clauses and responsibilities being
accepted leading to legal and contractual exposures.
Contracts may not be signed by the relevant authorities (authorized representatives) which may lead to legal risk.
Rental agreement terms and conditions may be breached (insurance requirement, sublease, etc.) which may result
dispute with the landlord.
Noncompliance with the terms and condition (reporting, insurance, etc.) of the rental agreement signed with 3rd p
(property lease agreement, power generator, fuel tanks, etc.) which may lead to breach of agreement and related le
consequences.
Lifts and elevators may not be maintained regularly, which may expose the users to risks due to the lift/ elevator
breakdown.
Valid Contracts may not be concluded prior property handover which may compromise the company position in c
disputes.
Undocumented detailed receiving of the leased facility from the landlord may result in conflict and disputes at the
vacation phase.
Security deposits stipulated in the lease agreement and paid for utilities may not be claimed after the end of tenure
to financial loss.
Leased facility utilities connection may not be cleared with the relevant authorities upon lease termination leading
future financial losses.
Follow up on the utility bills may be inadequate / ineffective which may lead to suspension of services from the re
authorities leading to disruption in business operations.
Facility requirements (e.g. space, usage, location, period, layout, licenses, etc.) may not be clearly defined prior to
into lease agreement may lead to operational and legal complications.
Rented premises may be subleased which may be in violation to the rental agreement which may result in violatio
agreement and conducting of business activity not in line with the approvals from government authorities.
Closed branches may not be cancelled in the relevant CR which add unnecessary cost to the company.
Company may be engaged in activities which are not consistent with the land contract, CR, or trade license activit
resulting into violation.
Licensed activities in CR & TL are not part of the companies activities, which add unnecessary cost to the compan
Separated employees are not removed from the authorized signatories list in CR or computer card who may act on
of the company.
Failure to create and deploy adequate business partners data privacy management as per the law # 13/2016 may le
non-compliance with the law and may expose to fines, penalties and suspension.
Dispute management process may not be established which may lead to inconsistent disputes management practic
resulting in process inefficiency and ineffectiveness.
A proper liquidation process may not be followed for discontinued operations, this may lead to CR renewal fees o
inactive branches/ companies accumulated which result in incurring unnecessary costs and exposes the company t
claims related to inactive companies.
Applicable laws may not be properly identified which may lead to imposition of penalties and claims due to lack o
knowledge.
Disputed cases transferred to legal department may not periodically reconciled leading to inaccurate MIS on open
litigations being reported to management and lack of obtaining legal recourse subsequently resulting in financial l
No licenses (CR, TL, Fire, advertising, chemical material, etc.) are available for the company to operate which ma
in attracting fines and penalties.
Delay in renewing the licenses and permits by the company may cause operational complications and may attract
fines and penalties.
Brand names or logos may be presented on the different channels (website, mobile service vehicle, signage, etc.) w
getting the required permits from the principals may expose the company to legal and regulatory non-compliance.
Insurance policy contractual clauses may be breached resulting into contractual exposure and legal and financial
implications.
Insurance Contracts and related documentation may not be signed by the relevant authorities (authorized represent
which may lead to legal risk.
Insurance contracts may not be reviewed by the legal team which may lead to unfavorable clauses and responsibil
being accepted leading to legal and contractual exposures.
Delay in amending insurance polices coverage for any addition or reduction insured that may result in under/ over
coverage.
Insurance coverage may be insufficient, inflated or does not cover insurable risks which may result in unnecessary
under coverage of insurance.
A proper follow up may not be performed over pending insurance claims with insurance companies.
Inaccurate / incomplete information may be provided to the insurance provider that could lead to future claim reje
No regular review of the insurance coverage conducted (e.g. inventory balances, fixed assets values, money in tran
needs, money in safe, etc.) may result in under/ over coverage.
Reconciliations may not be prepared against invoices received from insurance companies leading to additional am
being paid.
Insurance cover may be obtained at a premium higher than the industry standard resulting in additional insurance
No process established for selection and evaluation of insurance provider, this may lead to services being procured
through unqualified insurance providers.
Selection of Insurance providers may not be finalized after considering all relevant quotations and factors leading
operational challenges.
Budgeting technique (e.g. zero based budgeting, roll forward budgeting) may not be established for different cost
which may lead to inconsistent practice and process inefficiency.
Budgeting technique may not be consistently followed over the period resulting in ineffective budgeting.
No process established for supplementary budget to define the process and authorities required to cater the unbud
expenses which may result in inconsistent practices being followed within the company.
Forecasting may not be updated on periodic basis resulting in process ineffectiveness and inefficiency which may
over / under incurring of cost.
Unauthorized changes can be made in the budget / forecast resulting in ineffective budgetary controls.
Annual sales plan may not be established for individual segments / products resulting in lack of segment monitorin
terms of business and profitability.
Annual sales plan may not be prepared by the sales team which may lead to ineffectiveness of relevant budget hea
procurement, manpower etc.).
Clear guidelines may not be defined for preparation of departmental budgets which may lead to inconsistency in b
preparation.
Departmental budgets may not be based on forecasted changes in the coming period resulting into inaccuracy of b
Departmental budgets may not be reviewed and approved at appropriate level resulting into lack of ownership and
accountability of department heads.
Budget may be established without appropriate authorization resulting in lack of governance and oversight contro
Budgets may be subject to additional / unauthorized changes resulting in inaccurate budgetary controls over financ
transactions.
Delay in budget preparation whereas budgets may not be established prior to the applicable fiscal period leading to
ineffective budgetary controls.
Relevance and linkage between sales budgets and procurement & manpower plans may not be established resultin
significant variations in actual results or the working capital may not be available to support the business operation
Actual budgets may not be periodically compared with the budgeted figures and variance analysis may not be perf
and presented to the management leading to lack of budgetary controls and oversight.
Systems may not accurately collate, sum, and report related budget information and financial performance resultin
inaccurate management reporting.
Service providor's staff may not be adequately monitored and controlled which may lead to ghost employees being
charged to the company leading to financial losses.
Service providor's staff attendance may not be corroborated with any biometric / retina scan system which may lea
excessive reliance on manual controls.
Service providor's staff attendance may not be signed off by the Admin Department which may lead to disputes w
Service Provider and financial losses.
Timesheets may not be obtained from Service Provider and signed off by the Authorized member of Admin team
to booking of unapproved invoices and resulting in financial losses.
Service Provider invoices may not be backed by adequate supporting documents such as approved timesheets from
relevant department which may result in booking of unapproved invoices.
Service Provider invoices may not be paid in a timely manner leading to vendor dissatisfaction and reputational da
Service Provider invoices and timesheet may not be reconciled against the internal timesheet and attendance repor
to excessive payment to Service Provider.
Contracts with Service Provider may not be reviewed by the legal department to evaluate the legal exposure which
increase the company's legal risk profile.
Legal exposures related to contracts may not be mitigated in the form of insurance coverage which may lead to inc
company's risk profiles.
Service Provider contracts may not be timely renewed and signed off by the company which may leading to receiv
services without valid contract.
Service Provider may not be communicated to provide employee IDs to their staff for monitoring purposes which
lead to unauthorized personnel allowed on company's premises.
Service providor's staff IDs may not be periodically checked for their validity and a reconciliation may not be mad
between staff provided by the Service Provider and actual staff deployed at company premises which may lead to
unauthorized personnel's presence on company's premises.
Legal requirements may not be taken into account (such as relevant and valid licensing etc.) while awarding of ser
which may lead to any unforeseen incident such as theft being countered by the staff who may be not be licensed t
counter such incident.
Licenses may not be monitored for timely renewal or a check and balance mechanism may not be maintained to m
that only those staff are providing services to the company who have a valid license for providing the relevant serv
Proposals may not be compared to evaluate the service providers in terms of quality, staff availability and strength
and credit period which may lead to engagement of service providers not in the best interest of the company.
Adequate transparency mechanism may not be devised to ensure that the only those service providers are awarded
the contract which are in the best interest to the company which may lead to biased procurement of services, mark
reputational loss and financial losses.
Service delivery may not be of the agreed efficiency which may lead to difficulties in payment to Service Provider
inadequate services and financial losses.
Service providor's staff may not be trained and supervised to monitor the quality of services being provided by the
Provider.
Response time on company's complaints/ requests may not be documented and agreed with the Service Provider w
may lead to delayed response and quality of service received.
KPIs agreed with the Service Provider may not be monitored leading to process inefficiency and ineffectiveness.
Unrealistic KPIs may be agreed with the Service Provider which may lead to disputes with Service Provider and S
Provider dissatisfaction.
Agreed KPIs may not be communicated to the Service providor's staff for monitoring purposes which may lead to
inefficiency and ineffectiveness.
Tax may not be withheld while making payments which may lead to non-compliance with the taxation law.
Withholding tax may not be timely deposited by the company which can expose the company to possible penalties
litigation by regulatory bodies.
Withholding tax paid by the company may fall short of statutory requirements which can expose the company to p
penalties and litigation by regulatory bodies.
Necessary documents for transfer pricing may not be filed in case of service provided from related parties. This m
in legal actions by regulatory bodies.
Failure of the company to identify tax reporting requirements and deadline may lead to noncompliance resulting in
actions by the authorities.
Lost tools not reported and approved by the relevant authority may not be back-charged to the employees resulting
financial losses to the company.
Follow up on tools may not be made resulting in process inefficiency and ineffectiveness.
Defected tools may be disposed off without the approval of relevant authority may lead to process inefficiency and
ineffectiveness.
Mechanism for loss reporting of tools and equipment may not be devised leading to inadequate loss reporting and
over tools.
Reported loss may not be authorized by the relevant authority and not updated in the risk register which may lead
process inefficiency and ineffectiveness.
Tools may not recorded in the form of a register with the date of issuance and return which may lead to loss of com
tools and equipment.
Issuance and return of tools may not be entered in the tools register leading to process inefficiency and ineffective
Tools may not be recorded against employee IDs leading to incomplete record of possession and ownership of too
Tools and equipment may not be provided with a status such as (under repair, beyond repair, available, issued etc.
to delayed replenishment of tools and additional requirement assessment.
Status may not be timely updated in the tools register leading to inaccurate MIS being reported to the managemen
Bank charges and interest may not be recalculated and verified against the signed facilities agreements resulting in
overcharging by the bank and financial loss to the company.
Bank accounts opening may not be authorized which may result in process inefficiency and ineffectiveness.
Banking facilities may be inefficiently / over utilized which may result in excessive finance charges.
Dormant bank accounts may not be timely closed by the company resulting in lack of monitoring over active bank
accounts.
Absence of clear financing strategy and formalized banking arrangements could lead to future cash flow and expa
problems.
Company's exposures with a particular bank may be excessive which can lead to credit concentration and related r
such as failure of such banks may result in significant loss of company's assets.
High interest bearing facilities such as overdraft instead of medium / long term loan may be used resulting in addi
finance charges being paid by the company.
Unauthorized debt transactions may be entered which may not be aligned with company objectives resulting in un
financial exposure for the company.
Inability to meet debt repayment terms with banks due to poor planning or forecasting may have serious repercuss
the operations, shareholder value and may require efforts to reschedule debt payments.
Non-compliance of bank covenants, liens and markings may result in default and may lead to pay off the loans to
banks immediately resulting in process inefficiency and ineffectiveness.
Lack of procedures to mitigate/ manage the foreign currency exposures which may increase the foreign currency e
risks.
Foreign currency translations may not be properly recorded and exchange gain & losses may not be accurately ref
the books of accounts on reporting dates leading to inaccurate financial reporting.
No / inadequate hedging techniques may be applied on foreign currency translation risk resulting into excessive ri
exposure in foreign currency transactions.
Hedge funds may not be monitored for foreign currency movements and timely actions may not be taken leading t
ineffective monitoring of foreign currency risk.
FX hedging value date may be mismatched with the commitment due date resulting in exposure to FX risks.
Off balance sheet items such as LCs & LGs may not be properly recorded and monitored which may lead to finan
losses to the company.
Excess funds may be inefficiently/ under utilized by the management which may result in opportunity losses for th
company.
Advance payments to vendors may not be backed by any collateral (e.g. Advance payment guarantee) resulting in
financial risk in cases of non-delivery of goods / services or required quality.
Authority to deviate (e.g. waive, reduce, change the payment mode, etc.) from the collateral (advance payment gu
may not be defined, which may result in assuming credit risk beyond the acceptable level.
Significant price deviation analysis may not be performed on a periodic basis to measure the price fluctuation for
frequently procured products/ services.
Outstanding Requisitions, Purchase Orders might not be reviewed at regular intervals to confirm open commitmen
follow up on not fulfilled requirements.
Lack of legal and commercial review of the sourcing contract may result in scope creep and quality failure of the c
due to legal/ technical errors, omissions of important terms and conditions.
Contracts may not be reviewed by Finance department in regards to terms of payment that may affect the cash
management plan of the company.
No agreement concluded with the vendors/ service providers to govern the arrangement and define the terms and
conditions applied to each party, which may weakens the company position in case of any legal dispute.
Recurring purchases may not be subject to long term contracts/ or periodic bids, may result in delays due to the fre
processing of similar purchase orders and inefficiencies on part of procurement officers by doing the repetitive tas
Also, paying higher prices for urgent requirement of goods/services.
No mechanism adopted to confirm the vendor acceptance of the Purchase Order (e.g. signed off, communication,
resulting in lack of binding agreement between vendor and the company.
Delay in Purchase Order approval process resulting in the process inefficiency.
Failure to consult the technical relevant dept. (e.g. IT, Finance, etc.) in procurement process of assets (e.g. IT equi
etc.) or services (e.g. Insurance, etc.) which may result in procurement not in the best interest of the company.
Inability of management to bound the vendors for delivery of goods on time etc. due to inappropriate terms and co
in the POs.
Lack of financial review of the issued POs to ensure proper classification (e.g. expense type, capex, etc.) this may
the accuracy of the financial records and expose the assets to the physical risks due to insufficient tracking.
Material available in stock may be procured that may resulting in working capital blockage and potential wastage.
Non-Compliance with authority matrix may result in unauthorized Purchase Orders issued without the required ap
Purchase Order issued based on expired quotation may result in disagreement with vendors and may lead to delay
supply.
Purchase Orders may be created without Purchase Requisition supporting and justify the requirements.
Purchase Orders might be issued with incorrect/ incomplete details (e.g. products/ service description, qty, rates, e
which could result in wrong or under/ over procurement.
Rush order (such as cash procurement or transactions performed through bypassing the normal purchase cycle) m
be identified and analyzed which may forgo the opportunity to improve the procurement planning process.
Vendor invoice being validated by the procured products/ service receiver which may lead to conceal undelivered
delivered products/ services.
Duplicate invoices might be booked in system resulting into overstatement of payable balance and subsequent fina
loss to the company.
Invoices are processed for unapproved purchases or in excess of amounts approved which might result in overstat
vendor payable.
Invoices may be booked against wrong vendor code resulting into discrepancies in the payable balance and wrong
payments to vendors.
Lack of supervisory review over the vendor invoice validation process i.e. initiate and approve which may result i
inaccurate transactions being posted.
Three ways match (LPO, Vendor Invoice, GRN) may not be performed prior to the invoice validation which may
excessive payment to the vendor.
Incomplete purchase requisitions details may result in additional effort (clarifications, follow-up, etc.) during the
procurement process which might result in process inefficiency.
Unprocessed purchase requisitions may result in supply shortages causing business disruption.
Modifications to Purchase Requisition may not be properly authorized before the order is placed.
Purchase requisitions created or maintained by unauthorized users may result in the unnecessary or inappropriate
procurement of goods and/or services.
Purchase requisitions might be split to avoid the authority limits and bypass the internal controls upon approval w
may result in lack of approval hierarchy being followed.
Vendors may be engaged who might have not cleared the vendor review process resulting into placement of orde
vendors with whom due diligence has not been concluded.
Lack of regular review and follow up on outstanding purchase requisitions may result in over / outdated procurem
unnecessary products and services as well as inability to meet the requisitioned demand.
Purchase information records (e.g. on hand, under requisition) are not maintained may result in purchases above th
optimal demand.
Unauthorized personnel may confirm receiving the procured products/ services which may lead to dispute with the
vendor.
Lack of updated material order status reports (e.g. showing deliveries made) for follow up for outstanding items m
result in operational challenges and business disruption.
Goods received are either unrequested or significantly exceeds the ordered quantity which may be ultimately paid
resulting in acceptance of goods above the required demand which may lead to working capital blockage and expi
products.
A threshold may not be defined to accept material over and above the ordered quantity leading to process inefficie
ineffectiveness.
Lack of inspection process of the products received may lead to acceptance of products of unsatisfactory quality.
Late returns/ claim may not be honored by the vendor which may lead to a potential claim rejection.
Lack of clear sourcing instructions to the qualified vendors during the procurement process may result in acceptin
quotes/ bids beyond the defined timeframe which might affect the process efficiency and effectiveness.
Request for quotations might not be similar floated among all vendors or may not be in line with the requisitioned
requirements resulting in ineffective bidding process.
Comparative Analysis is not reviewed and approved by the authorized persons resulting in procurement of goods
services at a higher rate resulting in financial loss to the company
Goods and services might be procured at a price higher than industry standard resulting into financial loss to the
Company.
Lack of documented quotations' technical and commercial comparison that justifies the quotation disqualification/
qualification which may result in personal judgment and preferences.
Non-segregation between the commercial and technical comparison of the quotations or conducting the commerci
evaluation prior the technical qualification may result in accepting offers based on commercial factors without bei
technically qualified.
Purchasing department may not be involved in the vendor selection process whereas purchases are decided by the
and processed by purchasing department which may result in procurement not in the best interest of the company.
No clear criteria developed to define the procurement mode (# of quotations, bidding, etc.) and minimum requirem
based on the threshold resulting procurement process ineffectiveness.
Quotation might be addressed to the end user or dated prior the PR date may indicate wrong practice and collision
vendor.
Vendors providing discounts for prompt payments may not be considered during the vendor selection and contrac
process which could result in financial benefits being foregone by the company.
Budgetary controls may be override by utilizing different materials category / group in the system.
Lack of coordination between the procurement function and internal stakeholders (production, warehouse etc.) on
goods / services requirement may preclude the proper procurement planning process and consequently may result
in procuring material or service that could affect the business disruption and failure to meet deadlines and millston
Budgetary controls may not be established to ensure compliance to the approved financial plan/ budget. This may
inability to finance the required items due to improper planning which may impact the business operations or lead
unauthorized acquisitions.
Extensive reliance may be placed on single vendor which may lead to purchasing above economical prices and low
quality material than what is available in the market.
Single source of supply (monopolized vendors) may not be identified in order to develop alternative supply chain
business disruption.
Criteria for periodic vendor evaluation is not maintained or not followed consistently to identify top tier vendors w
may result in biased procurement from low performing vendors.
Vendors' supply capabilities might not be taken into account when enlisting the vendor which may result in delaye
delivery of goods/ rendering services and subsequently create business disruption..
Supply requirements might not be clearly forecasted which may result in lack of strategic sourcing / bulk buying w
may result in non-competitive buying.
End user feedback may not be pursued to measure the vendor service quality i.e. vendor responsiveness, communi
quality of product/ service, etc.
Inactive vendors may not be timely blocked in the system which may lead to increased chances of misappropriatio
inadvertent payments.
Incomplete or incorrect vendor information might be available in master data which may affect incomplete / inacc
MIS being generated for management's analysis and decision making.
Log for changes in vendor master data may not be generated, approved and reviewed which may result in lack of
monitoring over unauthorized changes in master data.
Segregation of duties might not be maintained for vendor master data management (creation, update, edit) and
authorizing/ requesting change of the same which may result in errors or creation of duplicate vendors.
Unauthorized changes to the vendor list/system may create inconsistent data and could result in selection of a less
optimal vendor
Vendor payment terms may not be consistent with company terms and policies which may result in working capit
constraints.
Criteria of vendor selection may not be defined which may result in biased vendor selection and in noncompetitive
buying.
Key vendors may no longer be supplying essential materials/ services due to delay in payments resulting in jeopar
the relationship with vendor.
Legal status and proof of business of the vendor (valid CR, Trade License, etc.) may not be verified and documen
which may lead to enlistment of illegal or fictitious vendors.
Vendor selection criteria may not be consistently applied for vendors which may result in biased vendor selection
in competitive buying.
No authority limits/ threshold defined for procurement may result in unauthorized purchase leading to lack of
authorization controls over transactions.
Warranty may be supplied by the vendor and may not be used by the company resulting in additional cost being in
on the repair / replacement of parts.
Inherent Risk Score
4
4
4
4
4
4
4
4
6
6
6
6
4
4
12
4
4
9
6
6
6
6
6
6
6
6
6
6
6
6
6
6
9
2
2
6
4
6
6
4
4
4
4
4
6
6
6
6
6
6
9
6
4
6
6
6
6
4
6
6
6
6
9
6
4
6
6
9
6
9
9
4
4
6
6
4
6
6
9
6
4
4
6
4
4
4
4
4
4
4
8
6
12
8
6
4
4
6
6
8
8
4
8
4
9
12
12
6
6
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
6
4
4
4
4
4
4
4
4
4
4
8
8
6
9
4
4
4
8
4
4
6
4
4
4
4
4
4
4
4
6
6
6
6
6
6
4
4
4
4
4
4
4
4
4
6
6
6
6
6
4
4
4
4
4
4
8
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
2
6
6
4
4
4
9
6
6
9
6
6
6
9
4
4
4
4
4
6
9
4
6
4
3
4
12
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
4
6
6
6
6
6
4
6
12
12
9
9
12
4
9
6
9
9
4
3
9
4
9
6
6
4
9
4
4
12
4
6
6

Internal Audit Risk Register

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Internal Audit Risk Register

Uploaded by

Copyright:

Available Formats

Core Sector Risk Category

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Compliance

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Compliance

Support services Finance Operational

Support services Finance Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Administration Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Operational

Support services Finance Compliance