Operational Risk: Financial Controls and Process Safeguards
Operational risk is the potential for losses from inadequate processes, systems, people, or external events. Unlike market or credit risk, operational risk often manifests suddenly—a fraud discovered, a system failure, a key person departure. This guide covers how to build controls that prevent and detect operational failures.
Operational risk doesn't get the same attention as financial risks, but it's often more damaging. A single embezzlement scheme can cost hundreds of thousands of dollars. A system failure can halt operations for days. A key employee departure can leave critical processes without oversight.
The good news is that operational risk is manageable. Strong internal controls, properly designed processes, and appropriate oversight prevent most operational failures. The key is building these controls before problems occur, not after.
Types of Operational Risk
Process Risk
Process risk arises from inadequate or failed business processes—errors, inefficiencies, or breakdowns that lead to financial loss.
- Payment errors: duplicate payments, wrong amounts, wrong vendors
- Billing errors: missed billing, incorrect pricing, revenue leakage
- Compliance failures: missed filings, regulatory violations
- Reconciliation failures: undetected errors in financial records
People Risk
People risk includes fraud, errors, and key person dependencies that threaten operational continuity.
- Fraud: embezzlement, theft, financial statement manipulation
- Errors: mistakes due to inadequate training or oversight
- Key person risk: critical knowledge held by few individuals
- Turnover: loss of institutional knowledge and capability
System Risk
System risk encompasses IT failures, security breaches, and technology-related losses.
- System outages: downtime that halts operations
- Cyber attacks: ransomware, data breaches, business disruption
- Data loss: loss of critical information without backup
- Integration failures: errors at system interfaces
External Risk
External risks arise from events outside your control that disrupt operations.
- Natural disasters: facilities damage, supply chain disruption
- Vendor failures: critical supplier bankruptcy or service interruption
- Regulatory changes: new requirements affecting operations
- Pandemic/crisis: workforce disruption, demand changes
Building an Internal Controls Framework
Internal controls are policies and procedures designed to provide reasonable assurance that business objectives are met and risks are managed. For growing companies, controls should be right-sized—strong enough to prevent significant losses, not so burdensome that they slow the business.
Control Types
- Preventive controls: Stop problems before they occur (approvals, access restrictions)
- Detective controls: Identify problems that have occurred (reconciliations, reviews)
- Corrective controls: Fix problems after detection (error correction procedures)
Control Environment Elements
| Element | Description | Examples |
|---|---|---|
| Authorization | Defined approval levels | Expense approvals, PO authority |
| Segregation | Separate incompatible duties | Approve vs. pay, record vs. custody |
| Reconciliation | Verify records match reality | Bank recs, AR/AP subledger |
| Physical | Protect assets and information | Locked checks, restricted access |
| IT controls | System access and security | User access, backup, audit trails |
Right-Size Your Controls
Controls should match risk. A $500 expense doesn't need CEO approval; a $50,000 capital purchase does. Focus strong controls on high-risk areas: cash disbursements, payroll, vendor master changes, access to financial systems.
Segregation of Duties
Segregation of duties (SoD) ensures that no single person controls a transaction from initiation to completion. It's the most important fraud prevention control—most fraud requires collusion when proper segregation exists.
Key Segregation Requirements
- Authorize vs. Execute: Person approving transactions shouldn't execute them
- Custody vs. Record: Person holding assets shouldn't record transactions
- Execute vs. Review: Person processing shouldn't review their own work
Critical Segregation Points
| Process | Functions to Separate |
|---|---|
| Accounts Payable | Vendor setup ↔ Invoice entry ↔ Payment approval ↔ Check signing |
| Payroll | Employee setup ↔ Time entry ↔ Payroll processing ↔ Disbursement |
| Cash receipts | Mail opening ↔ Deposit prep ↔ Cash recording ↔ Bank reconciliation |
| Purchasing | Requisition ↔ PO issuance ↔ Receiving ↔ Invoice matching |
Small Company Challenge
Small teams can't always achieve full segregation. Compensating controls help: owner reviews all checks, bank reconciliations done by someone outside accounting, surprise audits. The goal is that no single person can perpetrate and conceal a fraud.
Fraud Prevention and Detection
Most fraud is committed by trusted employees. The fraud triangle explains why: opportunity (weak controls), pressure (financial need), and rationalization (they deserve it, they'll pay it back). Strong controls reduce opportunity.
High-Risk Fraud Areas
- Vendor payments: Fake vendors, inflated invoices, duplicate payments
- Payroll: Ghost employees, inflated hours, unauthorized raises
- Expense reports: Personal expenses, inflated amounts, fictitious receipts
- Cash receipts: Skimming, lapping, theft of deposits
- Procurement: Kickbacks, bid rigging, personal purchases
Fraud Prevention Controls
- Segregate duties as discussed above
- Require dual signatures on checks above threshold (e.g., $5,000)
- Review vendor master file changes monthly
- Match invoices to POs and receiving documents
- Review all payroll changes (new employees, rate changes)
- Owner/CFO review of bank statements before reconciliation
Fraud Detection Techniques
- Bank reconciliation by someone outside daily cash handling
- Surprise audits of cash, inventory, expense reports
- Data analytics: duplicate payments, round-number invoices, vendor anomalies
- Anonymous hotline for reporting concerns
- Review of journal entries, especially month-end
The Tone at the Top
Controls matter, but culture matters more. When leadership demonstrates ethical behavior, enforces policies consistently, and takes fraud seriously, employees are less likely to rationalize misconduct. Conversely, when leaders bend rules, employees notice.
Key Person Risk
Key person risk exists when critical knowledge, relationships, or capabilities are concentrated in one or few individuals. What happens if your controller quits? Your sales director has a health crisis? Your founder is unavailable?
Identifying Key Person Dependencies
- Who knows how to do each critical process?
- Which customer relationships depend on specific individuals?
- What vendor relationships are managed by single points of contact?
- Where is institutional knowledge undocumented?
Mitigation Strategies
- Documentation: Create process documentation for all critical functions
- Cross-training: Ensure at least two people can perform critical tasks
- Succession planning: Identify and develop backup candidates for key roles
- Key person insurance: For truly irreplaceable individuals
- Employment agreements: Non-competes, notice periods, transition support
Business Continuity Planning
Business continuity planning prepares for major disruptions—natural disasters, cyber attacks, facility losses, pandemic. The goal is to maintain critical operations and recover quickly.
Key Elements
- Critical process identification: What must continue to operate?
- Recovery priorities: What order do you restore functions?
- Alternative capabilities: How do you operate if primary systems/facilities are unavailable?
- Communication plan: How do you reach employees, customers, vendors?
- Testing: Verify plans work before you need them
IT Recovery Essentials
- Regular backups with offsite/cloud storage
- Tested restore procedures
- Documented recovery steps and contacts
- Alternative access methods (VPN, remote systems)
Need Help with Internal Controls?
Eagle Rock CFO helps growing companies assess operational risks and build appropriate controls. We implement practical frameworks that protect the business without creating unnecessary bureaucracy.
Strengthen Your Controls