vaayaa Inclusive Education
Finance risk assessment

Financial Accounting and Reporting Standards (IFRS/GAAP) Risk Assessment: Misstatement, Controls and Reporting Risks

A worked example of how a reporting team finds, scores and controls the risks that threaten accurate financial statements under IFRS or GAAP, from judgment errors and fraud to system access, valuation and disclosure duties.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Financial Accounting and Reporting Standards (IFRS/GAAP) course

Executive summary

This assessment shows how a reporting team can identify, rate and control the risks that affect whether its financial statements follow the chosen accounting framework. Eight hazards were selected because they are plausible in everyday preparation, review and disclosure work. Access weaknesses, inconsistent policy application and transaction errors carry the highest inherent scores, while fraud and liquidity exposure matter because they can cause serious harm. Each hazard is scored before controls and again after existing and added controls. Most fall to Medium or Low once added controls are in place, although access control stays at Medium because its impact remains serious. The first actions are a central policy register, a dated close checklist, split duties for journal approval and a quarterly access review. The scenario is an illustration, so every score teaches method rather than describing a real organization.

Focus area
Financial accounting and reporting standards
Setting
Reporting function of a mid-sized organization preparing general purpose financial statements for external users
Method
Five by five likelihood and impact risk register

Scope

This assessment covers the preparation of general purpose financial statements under IFRS or US GAAP, from transaction recording and accounting judgments through to disclosure and governance. It looks at risks to accuracy, asset protection, legal duties and stakeholder trust. It does not provide accounting advice on any real transaction. Jurisdiction, reporting framework, entity size and systems are assumptions made for teaching and are not specified.

Context

The reporting function has a chief financial officer, a financial controller, technical accountants who interpret standards, an accounts payable team and an IT team that supports the ledger and consolidation tools. Transactions are recorded in an accounting system, with spreadsheets used for estimates, leases, provisions and some reconciliations. An external auditor reviews the statements each year, and the audit committee reviews interim results. Each hazard is scored before controls to show its natural level, then again after existing controls and proposed additional controls.

Objectives, assets and stakeholders

The objective is to produce accurate and timely financial statements that follow the applicable framework, protect cash and records, meet disclosure duties and keep the confidence of owners, lenders, regulators and the public. The assets in scope are the ledgers and supporting records, cash and bank accounts, estimates and judgments documented in working papers, the accounting and consolidation systems, and the reputation of the reporting team. Stakeholders include finance staff, management, the board and audit committee, the external auditor, lenders, investors, suppliers, customers and regulators. Each hazard has one owner role, and the chief financial officer receives a quarterly summary of open actions and escalated indicators.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain Likelihood 5, impact 4, score 20, critical: H03
4 Likely Likelihood 4, impact 3, score 12, high: H02 Likelihood 4, impact 4, score 16, high: H01 H08
3 Possible Likelihood 3, impact 3, score 9, medium: H05 Likelihood 3, impact 4, score 12, high: H07 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 5, score 10, high: H06
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H08 Likelihood 3, impact 3, score 9, medium: H03
2 Unlikely Likelihood 2, impact 2, score 4, low: H05 Likelihood 2, impact 3, score 6, medium: H01 H02 H06 H07 Likelihood 2, impact 4, score 8, medium: H04
1 Rare
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Inconsistent application of accounting standards 16 High 6 Medium Head of financial reporting
H02 Transaction processing and reconciliation errors 12 High 6 Medium Financial controller
H03 Weak access control and segregation of duties 20 Critical 9 Medium IT manager
H04 Fraud and misappropriation of funds 15 High 8 Medium Internal auditor
H05 Valuation and forecasting uncertainty 9 Medium 4 Low Head of financial reporting
H06 Conflicts of interest and professional conduct 10 High 6 Medium Compliance officer
H07 Tax, reporting and governance duties missed 12 High 6 Medium Company secretary
H08 Credit, liquidity and counterparty exposure 16 High 6 Medium Treasury lead
H01

Inconsistent application of accounting standards

Financial Before 16 After 6

Judgments on recognition, measurement or disclosure are applied differently across periods or business units, so the statements do not follow the chosen framework consistently and comparatives become unreliable.

Who or what is affected: Management, auditors and users of the statements

Causes

Complex standards, local practices that differ from group policy and rapid changes in transactions.

Consequences

Restated comparatives, qualified audit opinions and loss of user confidence.

Existing controls

  • An accounting policy manual is kept and updated each year.
  • Technical accounting memos are written for significant new transactions.

Control gaps

Policy decisions made by local teams are not recorded centrally or reviewed for consistency.

Additional controls

  • Prevent: Maintain a central register of accounting policy decisions with the evidence and approver for each one.
  • Detect: Compare key ratios and policy choices across periods and units and explain every unexpected change.
Likelihood 4 x impact 4 before; 2 x 3 after Owner: Head of financial reporting Target: Within 60 days Early warning: A policy choice changed in one period without a recorded technical memo.
H02

Transaction processing and reconciliation errors

Operational Before 12 After 6

Transactions are posted to the wrong account, period or entity, and balances in the ledger, sub-ledgers and bank are not reconciled on time, so reported figures carry errors that build up across the close.

Who or what is affected: Finance team, management and external users of the statements

Causes

Manual entries, heavy close workload and reconciliations that depend on one person.

Consequences

Misstated results, delayed reporting and rework during audit.

Existing controls

  • Bank accounts are reconciled to the ledger each month.
  • Journal entries above a set value need a second reviewer.

Control gaps

Small journal entries are not reviewed, and unreconciled items can sit for long periods.

Additional controls

  • Prevent: Use a dated month-end close checklist with sign-off for every reconciliation and intercompany balance.
  • Detect: Run exception reports for late postings, unusual entries and reconciling items older than thirty days.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Financial controller Target: Within 45 days Early warning: Reconciling items older than thirty days on any account.
H03

Weak access control and segregation of duties

Technology and data Before 20 After 9

One person can create a supplier or journal, approve it and release the posting, or holds wider system access than the role needs, so errors, changes to figures and misuse go unseen by the reviewer.

Who or what is affected: Finance team, auditors and owners of the records

Causes

Small teams, shared logins, and access rights that are added during projects and never removed.

Consequences

Undetected error or misuse, altered records and failed audit testing of controls.

Existing controls

  • Users sign in with individual accounts and passwords.
  • Changes to master data are logged by the accounting system.

Control gaps

Access rights are reviewed only when someone changes role or leaves the organization.

Additional controls

  • Prevent: Map roles to permissions and remove any combination that lets one person create and approve the same entry.
  • Detect: Review user access and change logs each quarter and record the outcome with the reviewer name.
Likelihood 5 x impact 4 before; 3 x 3 after Owner: IT manager Target: Within 30 days Early warning: A user who holds both entry and approval rights for the same journal type.
H04

Fraud and misappropriation of funds

Financial Before 15 After 8

Fictitious suppliers, altered bank details, inflated expenses or manipulated revenue cut-off take money from the business or misstate results, often over a long period and in small amounts.

Who or what is affected: Owners, lenders, employees and investors

Causes

Trust placed in one person, pressure to meet reporting targets and weak checks on master data changes.

Consequences

Direct loss, misstated accounts, legal action and damage to reputation.

Existing controls

  • Changes to supplier bank details are confirmed by phone.
  • Expense claims need manager approval before payment.

Control gaps

Matching is performed on a sample, so small repeated payments can pass unnoticed.

Additional controls

  • Prevent: Verify new suppliers and bank detail changes through a call to a known contact before any payment is released.
  • Detect: Match payments to approved orders and receipts and review duplicate or round-sum payments each month.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Internal auditor Target: Within 45 days Early warning: A supplier bank detail change that has not been confirmed by a call back.
H05

Valuation and forecasting uncertainty

Strategic Before 9 After 4

Estimates for impairment, provisions, fair values and expected credit losses rest on forecasts that may be optimistic, so balances and disclosures are wrong when conditions change.

Who or what is affected: Management, investors and auditors

Causes

Reliance on a single forecast source, pressure for favorable results and assumptions that are not revisited.

Consequences

Overstated assets or profit, poor decisions and later write-downs.

Existing controls

  • Key estimates are reviewed by the financial controller at each year end.
  • Major assumptions are recorded in the working papers.

Control gaps

Past estimates are not compared with outcomes, so bias in judgments goes unseen.

Additional controls

  • Prevent: Document each key assumption with its evidence and test low and high cases before approval.
  • Detect: Compare past estimates with actual outcomes and report the differences to the audit committee.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Head of financial reporting Target: Within 90 days Early warning: An adjustment to the same estimate that is larger than usual from one period to the next.
H06

Conflicts of interest and professional conduct

People Before 10 After 6

A preparer or reviewer has a personal or business link to a party whose transactions are being recorded, or feels pressure to accept a favorable treatment, which weakens independence and trust in the numbers.

Who or what is affected: Auditors, management, staff and the public

Causes

Long relationships with counterparties, pressure to meet targets and unclear rules on gifts and hospitality.

Consequences

Loss of independence, disciplinary action and damage to professional standing.

Existing controls

  • A code of conduct is signed each year.
  • Staff declare outside interests when they join.

Control gaps

Declarations are collected but are not compared against current transactions and counterparties.

Additional controls

  • Prevent: Require a written independence and interest check before each significant transaction is approved.
  • Respond: Provide a confidential route to raise concerns and record how each concern was handled and closed.
Likelihood 2 x impact 5 before; 2 x 3 after Owner: Compliance officer Target: Within 60 days Early warning: A declared interest linked to a counterparty in an open transaction.
H07

Tax, reporting and governance duties missed

Legal and compliance Before 12 After 6

Filing deadlines, disclosure requirements or tax treatments are missed or misapplied, and the board does not receive the information needed to oversee the statements and the related judgments.

Who or what is affected: Management, board members and regulators

Causes

Requirements that vary by jurisdiction, a small team and disclosures prepared close to the deadline.

Consequences

Penalties, restated accounts and loss of confidence from regulators and lenders.

Existing controls

  • A calendar lists the main filing and disclosure dates.
  • Interim results are shared with the audit committee each quarter.

Control gaps

The applicable jurisdiction is assumed, and no one confirms current requirements before a filing.

Additional controls

  • Prevent: Keep a disclosure and filing calendar with an owner and backup for each duty, checked monthly.
  • Detect: Ask a qualified reviewer to test a sample of disclosures against the requirements that apply.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Company secretary Target: Within 30 days Early warning: A filing due within ten days that has no preparer or reviewer named.
H08

Credit, liquidity and counterparty exposure

Financial Before 16 After 6

Customers pay late or fail, a lender withdraws support or a key counterparty defaults, and the entity cannot meet payments as they fall due, which affects going concern judgments and disclosures.

Who or what is affected: Owners, lenders and employees

Causes

Concentration in a few customers, long payment terms and forecasts that are rarely updated.

Consequences

Cash shortfall, missed payments, higher borrowing cost and questions about going concern.

Existing controls

  • Cash position is reviewed weekly by the treasury lead.
  • Customer credit terms are agreed in writing.

Control gaps

Forecasts are checked against actual cash only once a quarter.

Additional controls

  • Prevent: Set credit limits by customer and update a rolling cash forecast each week.
  • Respond: Agree a standby funding plan and a contact order for a cash shortfall.
Likelihood 4 x impact 4 before; 3 x 2 after Owner: Treasury lead Target: Within 60 days Early warning: Customer invoices overdue by more than sixty days.

Rating method and evaluation

Each hazard is rated on two five-point scales. Likelihood runs from rare to almost certain, and impact runs from minor to severe. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a precise measurement. Inherent risk is the score before any controls. Residual risk is the score after existing and added controls, and it must never be higher than the inherent score. Impact is judged on misstatement size, effect on users, time to correct, legal exposure and harm to trust, and a risk is not rated down only because it has not yet happened. Any hazard still High needs senior attention and a dated plan, any Medium needs routine controls with a named owner, and any Low is accepted and watched. Owners and reviewers should challenge every rating, and the register is reopened whenever an indicator reaches its threshold or the framework changes.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Reconciling items older than thirty days on any account.Escalate to the financial controller when any item is older than thirty days, and to the chief financial officer after sixty days.
Users who hold both creation and approval rights for the same journal type.Escalate to the IT manager when any such user is found, and remove one right within one week.
Policy choices changed between periods without a recorded technical memo.Escalate to the head of financial reporting at once, and to the audit committee if the change affects comparatives.
Estimate adjustments larger than the usual range for the same balance.Escalate to the financial controller for review, and to the audit committee when the change exceeds the agreed threshold.
Customer invoices overdue by more than sixty days or cash cover below the agreed floor.Escalate to the treasury lead when cover falls below the floor, and to the chief financial officer if it stays low for a month.

Contingency arrangements

If a serious event occurs, such as confirmed fraud, a material error found after release or a filing that cannot be made on time, the chief financial officer suspends related payments, preserves records and informs the audit committee. The IT manager isolates affected accounts and restores data from the latest tested backup. Contact with the external auditor, legal advisers and regulators is made through the head of finance as the relevant jurisdiction requires. Cash is protected by the standby funding plan, and affected stakeholders are told what they need to know early and in plain language.

Prioritized action plan

  1. Restrict journal creation and approval rights so no one holds both, owner IT manager, within 30 days.
  2. Create a central register of accounting policy decisions with approvers, owner head of financial reporting, within 60 days.
  3. Introduce a dated month-end close checklist with sign-off, owner financial controller, within 45 days.
  4. Confirm supplier bank changes by call back and review duplicate payments, owner internal auditor, within 45 days.
  5. Set up a disclosure calendar with a backup owner for each filing, owner company secretary, within 30 days.

Conclusion

Reliable financial statements depend on a few steady habits: a documented policy for every significant judgment, dated reconciliations, split duties, challenged estimates, controlled access and a calendar for each filing. The highest scores sit with access, policy consistency and transaction processing, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle and seek qualified technical advice for any real accounting, audit, tax or legal question.

Assumptions and limitations

Assumptions

  • The entity prepares annual financial statements under one recognized framework and is audited by an independent firm.
  • Staff are qualified accountants who use standard accounting software on managed computers.
  • Jurisdiction and reporting framework details are not specified, so duties are described only in general terms.

Limitations

  • The scores are examples for learning and do not describe any real entity or audit.
  • Standards are complex and change over time, so specialist technical review is needed for any real judgment.
  • This is educational content and is not accounting, tax or legal advice.

Related frameworks to study

  • Conceptual framework for financial reporting
  • Internal control framework with control activities and monitoring
  • Three lines model of risk ownership
  • Hierarchy of controls

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Financial Accounting and Reporting Standards (IFRS/GAAP) course Read the best practices for this course

More Finance risk assessments

Hourly Active: 39,499 Learners