vaayaa Inclusive Education
Finance risk assessment

Budgeting, Forecasting and Cost Management Risk Assessment: Model, Spending and Cost Control Risks

A worked example of how a finance team identifies, scores and controls the risks that threaten budgets, forecasts and cost control, from model errors and unapproved changes to late cost capture and weak planning data.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Budgeting, Forecasting and Cost Management course

Executive summary

This assessment shows how a finance team can find, rate and control the risks that affect budgets, forecasts and cost management. Eight risks were chosen because they are plausible in everyday planning work. Unapproved budget changes and weak segregation of duties carry the highest inherent score, because one person could move money without review. Forecast model errors and late cost capture are also likely and would mislead decisions. Most risks fall to Medium or Low once added controls are in place, but the spending authority risk stays at Medium because its impact remains serious. The first actions are a locked and reviewed model, a dated cost cut off, a clear approval matrix for budget changes and a security check on planning files. The organization is a teaching example, so every score illustrates method, not a real budget.

Focus area
Budgeting, forecasting and cost management
Setting
Finance and planning function of a mid-sized organization with several departments that hold budgets
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the budgeting, forecasting and cost management cycle, from annual budget build and monthly forecast updates to cost capture, variance reporting and cash planning. It looks at risks to accuracy, control of spending, data, cash and governance. Jurisdiction, sector, size and planning system are assumptions made for teaching. Tax and reporting duties are considered only where they depend on budget and cost data.

Context

The organization has a finance business partner for each department, a central planning team of three analysts, an accounts payable team and a finance manager who signs off the budget. Budgets and forecasts are built in spreadsheets linked to a shared planning tool, with actual costs pulled from the ledger each month. Departments submit change requests when spending needs to move between cost centres. The board reviews the budget at approval and receives variance reports quarterly. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to set realistic budgets, produce reliable forecasts, control spending within approved limits and report costs accurately to managers and the board. The assets in scope are the budget and forecast models, cost centre data, the ledger and supporting invoices, cash plans, supplier relationships and the credibility of the planning team. Stakeholders include department heads, the finance manager, the board, the external auditor, lenders, suppliers and staff who spend against budgets. Every risk has one owner role. The finance manager keeps the register current and reports to the board each quarter, and budget owners confirm their own spending data each month.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 Likelihood 4, impact 5, score 20, critical: H03
3 Possible Likelihood 3, impact 3, score 9, medium: H04 H08 Likelihood 3, impact 4, score 12, high: H05 H07
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H04 H08 Likelihood 2, impact 3, score 6, medium: H01 H02 H03 H05 H06 H07
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Forecast model and formula errors 16 High 6 Medium Central planning lead
H02 Late or missed cost capture 12 High 6 Medium Management accountant
H03 Unapproved budget changes and weak segregation of duties 20 Critical 6 Medium Finance manager
H04 Cost code and master data errors 9 Medium 4 Low Financial systems administrator
H05 Cyber exposure of planning files and tools 12 High 6 Medium IT manager
H06 Conflicts of interest in cost approval and supplier choice 10 High 6 Medium Compliance officer
H07 Liquidity shortfall from a forecast miss 12 High 6 Medium Treasury lead
H08 Cost estimate and assumption uncertainty 9 Medium 4 Low Head of financial planning
H01

Forecast model and formula errors

Operational Before 16 After 6

Formulas are broken, overwritten or linked to the wrong ranges in budget and forecast models, so totals and projections mislead the people who make spending decisions.

Who or what is affected: Budget owners, board members and lenders

Causes

Manual links, copied sheets and large models built and extended over several years.

Consequences

Overspending against approved budgets, poor hiring decisions and loss of trust in forecasts.

Existing controls

  • Model totals are checked against the ledger each month.
  • Each model is built by an analyst from a standard template.

Control gaps

Model changes are not logged, and no second person checks structural edits.

Additional controls

  • Prevent: Lock formula cells and protect the template so only the planning lead can change its structure.
  • Detect: Run a formula audit and compare key totals with an independent calculation each quarter.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Central planning lead Target: Within 45 days Early warning: A forecast total that moves by more than 5 percent with no recorded change to its inputs.
H02

Late or missed cost capture

Financial Before 12 After 6

Invoices, accruals and staff costs are recorded late or in the wrong period, so actual spend looks lower than it is and variance reports understate overruns.

Who or what is affected: Budget owners, finance managers and suppliers

Causes

Invoices arriving late, informal orders placed outside the system and weak links between purchasing and the ledger.

Consequences

Hidden overruns, surprise year-end adjustments and poor decisions about spending.

Existing controls

  • Purchase orders are raised for goods and services above a set value.
  • Month-end accruals are reviewed by the management accountant.

Control gaps

Orders placed without a purchase order are not picked up until the invoice arrives.

Additional controls

  • Prevent: Set a dated cut off for supplier invoices and require goods received notes before payment.
  • Detect: Compare open purchase orders with posted costs each month and list every gap for follow up.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Management accountant Target: Within 30 days Early warning: Invoices received more than 30 days after the goods or services were delivered.
H03

Unapproved budget changes and weak segregation of duties

Operational Before 20 After 6

One person can request, approve and release a budget transfer or spending increase, so funds move between cost centres without independent review or a recorded reason.

Who or what is affected: Budget owners, the board and staff whose budgets are reduced

Causes

Shared logins, access rights added over time and pressure to fund urgent spending quickly.

Consequences

Money spent without authority, distorted budgets and failed audit findings.

Existing controls

  • Budget transfers above a set value need finance manager sign off.
  • Users sign in with individual accounts.

Control gaps

Change logs are not reviewed, and approval limits are not linked to user rights in the planning tool.

Additional controls

  • Prevent: Set a written approval matrix and remove any user who holds both request and approval rights.
  • Detect: Review budget change logs each month and report unusual transfers to the finance manager.
  • Respond: Reverse any unapproved transfer within five working days and record the reason.
Likelihood 4 x impact 5 before; 2 x 3 after Owner: Finance manager Target: Within 30 days Early warning: A budget change approved by the same person who requested it.
H04

Cost code and master data errors

Technology and data Before 9 After 4

Cost codes, cost centre hierarchies and supplier records are wrong or duplicated, so spend is assigned to the wrong budget and reports do not match the ledger.

Who or what is affected: Budget owners, analysts and the board

Causes

Manual data entry, a fast-changing organization structure and old codes left open after reorganization.

Consequences

Spend reported against the wrong budgets and poor cost decisions.

Existing controls

  • New cost codes need approval from the planning team.
  • Master data is reviewed once a year.

Control gaps

The annual review misses codes created during the year.

Additional controls

  • Prevent: Restrict who can create cost codes and keep a controlled list with a named owner for each code.
  • Detect: Run a monthly report of unmapped or unused cost codes and clear the list with owners.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Financial systems administrator Target: Within 60 days Early warning: A cost code created in the year with no approving owner recorded against it.
H05

Cyber exposure of planning files and tools

Technology and data Before 12 After 6

Budget files and planning tools are reached through phishing, shared links or weak passwords, exposing pay, pricing and supplier data or allowing forecasts to be altered.

Who or what is affected: Planning staff, employees whose pay data is held and suppliers

Causes

Phishing emails, reused passwords and planning files sent as attachments.

Consequences

Stolen pay and pricing data, altered forecasts and a reportable data incident.

Existing controls

  • Planning files are stored on a shared drive with restricted folders.
  • Staff complete a yearly security awareness session.

Control gaps

Files sent to personal email for offline work are not tracked or removed.

Additional controls

  • Prevent: Enable multi-factor sign in for all planning tools and remove any shared passwords.
  • Recover: Test restoring the planning model from backup each quarter and keep a written recovery plan.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: IT manager Target: Within 30 days Early warning: An unusual sign in to a planning tool from an unknown location or device.
H06

Conflicts of interest in cost approval and supplier choice

Legal and compliance Before 10 After 6

A budget holder approves spend with a supplier linked to them personally, or accepts gifts that influence which costs are approved and at what price.

Who or what is affected: Budget owners, suppliers, the board and the organization's reputation

Causes

Long supplier relationships, pressure to deliver quickly and unclear rules on gifts.

Consequences

Overpaid contracts, disciplinary action and loss of reputation.

Existing controls

  • A gifts and hospitality register is kept.
  • Staff declare outside interests when they join.

Control gaps

Declarations are collected but are not compared with the supplier list each year.

Additional controls

  • Prevent: Require a written conflict check before any supplier above a set value is approved.
  • Respond: Provide a confidential route to raise concerns and record how each one was handled.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest that matches a supplier approved by the person who declared it.
H07

Liquidity shortfall from a forecast miss

Financial Before 12 After 6

Forecasts understate outflows or overstate receipts, so the organization cannot meet payments when they fall due and borrowing or supplier terms tighten.

Who or what is affected: Owners, lenders, suppliers and employees

Causes

Heavy reliance on a few customers, long payment terms and forecasts that are not revised when trading changes.

Consequences

Missed payments, higher borrowing cost and loss of supplier trust.

Existing controls

  • Cash is forecast weekly by the treasury lead.
  • Customer payment terms are agreed in writing.

Control gaps

The forecast is compared with actual cash only once a quarter.

Additional controls

  • Prevent: Keep a rolling cash forecast and test expected receipts against a conservative case.
  • Respond: Agree a standby funding route and a contact order for any cash shortfall.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Treasury lead Target: Within 45 days Early warning: Customer invoices overdue by more than 60 days.
H08

Cost estimate and assumption uncertainty

Strategic Before 9 After 4

Cost estimates for projects and future spend rest on optimistic assumptions, so budgets are too low and overruns are built in from the start.

Who or what is affected: Project sponsors, department heads and the board

Causes

Pressure to win approval, reliance on a single supplier quote and assumptions that are never revisited.

Consequences

Overspend, delayed projects and poor priorities across the portfolio.

Existing controls

  • Major estimates are reviewed by the finance manager before approval.
  • Key assumptions are written into the budget pack.

Control gaps

The accuracy of past estimates is never measured, so bias goes unseen.

Additional controls

  • Prevent: Add a contingency based on assessed uncertainty and test a low and a high cost case.
  • Detect: Compare past estimates with actual costs for completed projects and report the gap.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Head of financial planning Target: Within 90 days Early warning: A project forecast at completion that rises by more than 10 percent above the approved budget.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing and additional controls, and the residual score is never higher than the inherent score. Impact is judged on money lost or misdirected, time to correct, effect on decisions and harm to trust, and a budget or cost risk is never rated down only because it has not yet happened. Critical and High risks need senior attention and a dated plan, Medium risks need routine controls with a named owner, and Low risks are accepted and watched. Budget owners and analysts should challenge the ratings at each review, and the register is reviewed sooner whenever an indicator reaches its threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Budget changes approved by the same person who requested them.Escalate to the finance manager at once, and to the board treasurer if the change exceeds the agreed limit.
Forecast variance from actual spend above the agreed tolerance for two consecutive months.Escalate to the central planning lead when variance exceeds tolerance, and to the finance manager if it persists into a second month.
Invoices received more than 30 days after the goods or services were delivered.Escalate to the management accountant when any invoice is late, and to the cost centre owner after 60 days.
Supplier bank detail changes not confirmed by a call back to a known contact.Escalate to the internal auditor at once and hold the payment until the change is confirmed.
Cost centres that have spent more than 90 percent of budget before three quarters of the year have passed.Escalate to the budget owner for a recovery plan, and to the finance manager if no plan is filed within 10 working days.

Contingency arrangements

If a serious event occurs, such as an unapproved transfer, a forecast error that exposes cash or a confirmed loss through a supplier, the finance manager freezes related payments and budget changes and preserves records. The IT manager restricts access and restores planning files from the latest tested backup. The head of financial planning informs the board and, where a duty applies, the auditor or regulator through the proper route in the relevant jurisdiction. A standby cash plan is activated, and budget owners are told what they need to know early and plainly.

Prioritized action plan

  1. Set a written approval matrix for budget changes and remove any user who can both request and approve a change, owner finance manager, within 30 days.
  2. Lock and review the forecast model with a second reviewer for each formula change, owner central planning lead, within 45 days.
  3. Introduce a dated cost cut off each month and chase late invoices, owner management accountant, within 30 days.
  4. Confirm supplier bank changes by call back and review duplicate or round-sum payments, owner internal auditor, within 45 days.
  5. Enable multi-factor sign in for planning tools and test a restore from backup, owner IT manager, within 30 days.

Conclusion

Reliable budgets depend on a few steady habits: locked and reviewed models, dated cost capture, clear approval limits, checks on every change to supplier details and tested backups. The highest scores sit with spending authority and forecast errors, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified advice for any real tax, audit, legal or financial decision.

Assumptions and limitations

Assumptions

  • The organization follows one internal budget approval policy and reports actuals from a single general ledger.
  • Planning staff are trained finance users who work on managed computers with individual accounts.
  • Jurisdiction and sector are not specified, so legal and tax duties are described in general terms only.
  • Forecasts are prepared monthly and cover the current year and the following year.

Limitations

  • The scores are examples for learning and do not describe any real organization or budget.
  • Budgeting and costing practice varies by sector and country, so specialist review is needed for any real decision.
  • This is educational content and is not financial, tax or legal advice, and it does not replace a formal site-specific assessment.

Related frameworks to study

  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls
  • Rolling forecast and variance analysis techniques

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Budgeting, Forecasting and Cost Management course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners