Safety Norms: Accounting, Audit and Financial Compliance

1Purpose, Scope, and Safety Principles

These norms protect the organization, its clients, and staff from harm caused by error, fraud, unauthorized disclosure, and non-compliance. They apply to accountants, bookkeepers, auditors, finance managers, compliance officers, and contractors who prepare, approve, or review ledgers, financial statements, tax filings, payroll, payments, and audit working papers.

The governing principles are least privilege, segregation of duties, professional skepticism, and documented evidence. Every control in this document exists because a specific failure has been seen in practice. Where a norm and a local policy conflict, follow the stricter rule and escalate the conflict to the finance director or compliance officer.

• Mandatory: work only within the systems, accounts, and roles you have been formally granted.
• Mandatory: do not perform any task you are not authorized or trained to perform.
• Recommended: treat every unexplained variance as a possible error or fraud indicator until evidence shows otherwise.

2Roles, Competence, and Accountability

The chief financial officer or finance director owns the control environment and approves the delegation matrix. Department managers assign system access, confirm role changes, and review exceptions. Preparers create entries and attach supporting evidence. Reviewers check accuracy, completeness, and authorization. Internal audit provides independent assurance. Compliance officers track regulatory obligations and receive concerns. Each person is accountable for the controls within their role.

Competence is a safety matter. Staff may not sign off on tax positions, audit conclusions, or regulatory returns until their qualifications, supervision, and experience meet the requirements of the relevant professional body and employer. Staff who lack experience must work under supervision and must not be left to make judgments alone. No one may override a control because a senior person asks for it.

• Mandatory: confirm licensing or professional membership requirements with the relevant regulator or professional body before assigning signing or attestation authority.
• Mandatory: complete onboarding training on the code of conduct, confidentiality obligations, and the reporting channel before receiving system access.
• Mandatory: auditors must assess and document independence threats, including financial, personal, and familial relationships, before accepting or continuing an engagement.
• Recommended: maintain a current delegation matrix showing who may initiate, approve, pay, reconcile, and administer each system.

3Course-Specific Hazards and Risk Assessment

The hazards in this field are rarely sudden physical events. The principal physical risks are eye strain, musculoskeletal strain, and fatigue during long reconciliation, close, and audit fieldwork periods. These are controlled through workstation setup, scheduled breaks, and realistic workload planning. The larger risks are financial and legal. Assets can be misappropriated through fictitious vendors or altered payroll records. Results can be misstated through premature revenue recognition, unsupported accruals, or cut-off errors. Personal and client data can leak. Filings can be wrong or late. Audit evidence can be weakened through pressure or conflicts of interest.

Risk should be rated by likelihood and impact using the organization's approved scale. Each high-rated risk needs a named owner, a documented control, and a review trigger. Risk ratings below are illustrative and must be calibrated locally.

• Payment fraud: fictitious vendors, changed bank details, and duplicate invoices. Risk level: high wherever payment authority is concentrated in one person.
• Financial misstatement: premature revenue, unsupported accruals, and cut-off errors. Risk level: high near the end of reporting periods.
• Data exposure: client files on unencrypted drives, spreadsheets sent to personal email, and printed statements left on desks. Risk level: high for remote and shared-space work.
• Regulatory breach: missed filings, incorrect tax treatment, and incomplete audit documentation. Risk level: medium to high, depending on jurisdiction and client type.
• Conflicts of interest: reviewing the work of relatives, former employers, or close associates. Risk level: medium, with high impact on independence.
• Pressure and override: requests from senior staff to post, delay, or omit entries. Risk level: medium to high.
• Recommended: maintain a risk register with named owners and review it at each reporting cycle.

4Preventive Controls and Safe Work Practices

Preventive controls work best when built into systems and routines rather than left to memory. Segregation of duties separates the functions of authorization, recording, custody, payment, and reconciliation. Where a small team cannot fully separate these functions, compensating controls must be documented and approved. Examples include independent review of bank statements by a person outside the payment process and management sign-off on exception reports. Access should follow least privilege, with user rights reviewed at the frequency set by policy and whenever a person changes role or leaves.

Safe working practice also means slowing down at the points where fraud and error cluster. These include new vendor setup, bank detail changes, manual journal entries, period-end adjustments, year-end estimates, and urgent payment requests made outside normal channels. Urgent requests from executives are a known fraud method and must be verified through the normal control process, not waved through.

• Mandatory: no single person may create a vendor, approve its first invoice, and release payment to that vendor.
• Mandatory: changes to bank account details must be verified by callback to a known contact held independently of the request, never using contact details supplied in the request itself.
• Mandatory: manual journal entries above the approved threshold require documented review by a second person who did not prepare them.
• Mandatory: system administrators must use separate privileged accounts and may not approve or post business transactions with them.
• Mandatory: auditors must not approve their own work, and must escalate any finding that management resists without documented justification.
• Mandatory: do not share passwords, allow colleagues to use your session, or leave a session unlocked when away from your workstation.
• Recommended: run exception reports for duplicate payments, round-sum entries, weekend postings, and entries to dormant accounts, reviewed by someone outside the posting team.
• Recommended: prepare account reconciliations with preparer and reviewer sign-off fields, and resolve reconciling items within the period set by policy.
• Recommended: corroborate management explanations with independent evidence such as bank confirmations, third-party documents, or system logs.

5Equipment, Environment, Information, and Protective Safeguards

The tools in this work include accounting software, enterprise resource planning systems, spreadsheets, bank portals, payroll platforms, tax filing tools, and audit analytics software. Spreadsheets are a frequent source of undetected error and unauthorized change, so critical models should be locked, version-controlled, and independently reviewed. Work takes place at office desks, shared finance areas, client sites, and remote locations. Each setting creates different exposure to observation, theft, and unauthorized access.

Information safeguards protect payroll records, personal data, banking details, tax information, and client confidential material. Confidentiality obligations apply inside the organization as well as outside it. Staff should share client information only with people who have a business need to know. Data protection and privacy laws vary by jurisdiction, so the legal requirements that apply to your organization must be confirmed with a privacy officer or legal counsel.

• Mandatory: use multi-factor authentication for finance systems and remote access wherever the system supports it.
• Mandatory: store client and employee data only on organization-approved devices and encrypted storage. Do not forward files to personal email or consumer file sharing services.
• Mandatory: do not discuss client or employer financial results in public spaces, on open calls, or on social media.
• Mandatory: clear printed financial data from desks at the end of each working session, and destroy sensitive paper using the approved shredding method.
• Recommended: use privacy screens in shared offices and avoid working on public networks without the approved secure connection.
• Recommended: protect formulas and lock structure in key workbooks, and keep an unaltered copy of source data for comparison.
• Recommended: set workstations so the screen sits at eye level, the keyboard allows relaxed wrists, and staff take short breaks from screen work.

6Incident Reporting, Emergency Response, and Escalation

Incidents in this field include suspected fraud, unauthorized system access, lost or stolen devices, misdirected payments, data breaches, and near misses. Early reporting limits financial loss and supports legal and contractual obligations. Do not investigate suspected fraud alone, alter or delete evidence, or alert the person under suspicion. Preserve the relevant records, note what you observed and when, and escalate through the designated channel.

Emergency situations are uncommon but possible, for example when a colleague or third party makes threats or coerces someone into making a payment. In such cases personal safety comes first. Contact local emergency services, then notify management and security. Regulatory reporting duties may apply to certain findings. Consult legal counsel before any external disclosure unless a mandatory rule or law requires it.

• Mandatory: report suspected fraud or misconduct to the designated channel, such as the compliance officer, internal audit, or an independent reporting line, within the time set by policy.
• Mandatory: report lost or stolen devices and suspected data breaches to the information security team immediately. Do not attempt remote wipe or other technical steps unless instructed.
• Mandatory: if a payment may have gone to a fraudulent account, notify the bank and the finance director at once so a recall can be attempted.
• Mandatory: where there is an immediate threat to personal safety, contact local emergency services first.
• Mandatory: do not retaliate against anyone who reports concerns in good faith. Protection of reporters follows policy and applicable law, which vary by jurisdiction.
• Recommended: record near misses, such as a fake invoice caught before payment, so controls can be strengthened and shared.

7Records, Training, Inspection, and Review

Accurate records are the primary output of this work and the main evidence that controls operate. Records must be complete, traceable, and retained according to the retention schedule approved by the organization and required by applicable law. Training keeps people current as systems, accounting standards, tax rules, and professional expectations change. Records of training completion are themselves evidence of control.

Inspection and review turn these norms into a living system. Control self-assessments, sample testing, and independent review show whether controls work in practice, not just on paper. Findings should be tracked to closure with named owners and deadlines set by policy.

• Mandatory: every manual entry must have a clear description, supporting evidence, the preparer's identity, and the reviewer's approval.
• Mandatory: do not backdate entries or alter records after review except through a documented correction trail that shows the original and the reason for change.
• Mandatory: retain evidence of completion for confidentiality, anti-fraud, and system-use training.
• Recommended: perform control self-assessments and test a sample of key controls at each reporting cycle.
• Recommended: use internal audit or peer review to test whether segregation of duties works in practice, including access that has drifted from approved roles.
• Recommended: review this document whenever systems, laws, professional standards, or significant incidents change the risk picture.

8Practical Checklist and Conclusion

These norms should be converted into locally approved procedures with named owners and review points. Confirm applicable accounting standards, auditing standards, tax rules, privacy requirements, and professional conduct rules with competent authorities, regulators, or qualified professionals, because they vary by jurisdiction and change over time. This guidance does not replace professional qualification, formal training, supervision, or employer-approved procedures. When in doubt, stop, document the question, and escalate before acting.

Implementation checklist

• Confirm your system access matches your approved role and report any access you do not need.
• Verify every bank detail change by callback to a known, independently held contact.
• Obtain second-person review before posting or releasing any manual journal entry.
• Store client and employee files only in approved, encrypted locations.
• Lock your screen and clear printed financial data before leaving your workspace.
• Document and escalate any override request or unexplained variance rather than resolving it alone.
• Report suspected fraud or data breaches through the designated channel without investigating on your own.
• Keep working papers complete, traceable, and free of unapproved edits.
• Complete required training and confirm your licensing obligations with your regulator or professional body.