Safety Norms: Financial Accounting and Reporting Standards (IFRS/GAAP)

1Purpose, Scope, and Safety Principles

These norms apply to anyone who records transactions, estimates balances, prepares financial statements, reviews work, approves journal entries, or uses reported figures for lending, investment, tax, or management decisions. Within this subject, safety means reliable reporting: accurate records, protected information, controlled access to ledgers and systems, and timely escalation when something looks wrong.

Mandatory norms are rules that must be followed under employer policy or applicable law. Recommended practices improve reliability and should be adopted unless a documented reason exists. The reference points are the standards themselves, including IFRS issued by the International Accounting Standards Board and US GAAP established through the Financial Accounting Standards Board framework. Their current versions, adoption status, and local modifications must be verified with competent authorities, listing bodies, and qualified professionals.

• Mandatory: no one records or approves a transaction they cannot support with evidence.
• Mandatory: confidential financial information is shared only on a documented need-to-know basis.
• Recommended: prepare a written accounting policy memo for every significant judgment.

2Roles, Competence, and Accountability

The governing body and senior management approve the internal control framework and set the tone for ethical reporting. The chief financial officer or equivalent owns accounting policies, the close process, and disclosures. Controllers and reporting managers maintain the ledger, review reconciliations, and confirm that estimates are supportable. Staff preparers record transactions and document their basis. Internal audit, where it exists, tests controls independently. External auditors provide an independent opinion where required, but they do not replace internal controls.

• Mandatory: assign a named owner to every account reconciliation, estimate, and recurring journal entry category.
• Mandatory: only individuals with documented competence and system authorization may post entries or change master data.
• Mandatory: staff must disclose conflicts of interest, such as holdings in a client or vendor, before accepting related work.
• Recommended: maintain a competency matrix covering topics such as revenue recognition, leases, and impairment, with review when standards or policies change.

3Hazards and Risk Assessment

The main hazards in financial reporting are not physical, but they can cause serious harm. Misstatement can mislead investors, lenders, regulators, and employees. Fraud, whether through management override, employee theft, or external manipulation, can cause loss and legal exposure. Confidentiality breaches expose personal and commercially sensitive data. Non-compliance may lead to penalties, restatements, or loss of market access, depending on jurisdiction.

Each activity should be rated for likelihood and impact on a three-level scale of low, medium, and high. Ratings are recorded in a risk register owned by the controller and reviewed at least once each reporting cycle. Judgment areas need particular attention because the standards require estimates and interpretation.

• High: manual journal entries posted near period end without support, including round-sum entries or vague descriptions.
• High: management estimates such as expected credit losses, provisions, impairment, and fair value measurements where small assumption changes move results materially.
• High: revenue recognition on multiple-element arrangements, variable consideration, or side agreements.
• High: one person able to create vendors, approve payments, and reconcile the related bank account.
• Medium: lease classification and discount rate selection under IFRS 16 or ASC 842, where inputs often conflict across systems.
• Medium: currency translation and hedge accounting documentation.
• Medium: spreadsheet models with hard-coded values, broken links, or undocumented formulas.
• Low: routine bank reconciliation with complete statements and independent review.

4Preventive Controls and Safe Work Practices

Preventive controls stop errors and misconduct before they reach reported figures. The most effective controls combine segregation of duties, system permissions, documented review, and reconciliation. Controls should be designed so that no single person can initiate, approve, record, and conceal a transaction.

Segregation of duties is mandatory where practical. Separate authorizing transactions, recording them, safeguarding assets, and reconciling accounts. In small teams where full separation is impossible, compensating controls such as independent review of bank statements, dual approval above defined thresholds, and periodic review by a senior person must be documented and approved by the controller or audit committee.

Manual journal entries require particular discipline. Each entry needs a preparer, a reviewer who is not the preparer, a clear description, supporting evidence, and a reversal date where applicable. Entries that are unusual, posted outside normal working hours, posted to rarely used accounts, or made just before reporting deadlines must be flagged for specific review.

• Mandatory: no user may approve their own journal entry, payment, vendor creation, or payroll change.
• Mandatory: system access is granted by role, reviewed at least once each reporting cycle, and removed on the same working day a person leaves or changes role.
• Mandatory: bank and intercompany reconciliations are prepared and reviewed within the close calendar deadline, with unreconciled items aged and explained in writing.
• Mandatory: management estimates are supported by a memo stating the basis, key assumptions, sources, sensitivity, and the accountable owner.
• Mandatory: accounting policy elections and changes are approved in writing before use and disclosed as the relevant standard requires.
• Mandatory: never override a system warning, such as a duplicate invoice alert, without documented approval from a designated reviewer.
• Mandatory: do not backdate entries or documents to change a period result. Corrections are posted in the period identified, with a written explanation.
• Recommended: perform analytical review, comparing margins, receivable days, and inventory turnover with prior periods and budgets, and investigate variances above a threshold set in advance.
• Recommended: use locked, version-controlled templates for models, with inputs separated from formulas and a change log.
• Recommended: perform rotating surprise sample tests of supporting documents, selected by someone outside the preparing team.

5Systems, Data, Environment, and Safeguards

Financial information is held in enterprise resource planning systems, general ledgers, spreadsheets, payroll platforms, banking portals, and cloud document stores. Safeguards protect confidentiality, integrity, and availability. Personal data of employees and customers is also subject to privacy law, which varies by jurisdiction and should be verified with a qualified privacy professional.

Finance work often occurs during long close periods, which increases fatigue and error risk. Managers should schedule close tasks so that no critical reconciliation depends on a single person. Paper records must be stored in locked areas, and sensitive documents must be destroyed through approved secure disposal methods.

• Mandatory: use multi-factor authentication for ledger, banking, payroll, and tax portals where the system supports it.
• Mandatory: do not send account numbers, tax identifiers, payroll data, or unpublished results by personal email or unapproved messaging apps.
• Mandatory: store working papers only in approved, access-controlled repositories with audit trails.
• Mandatory: lock screens when away from a workstation and do not leave printed statements or draft reports at shared printers or desks.
• Recommended: mask or minimize sensitive data in test environments and extracts.
• Recommended: test backup restoration for accounting systems at a frequency set by the system owner.

6Incident Reporting, Escalation, and Response

An incident includes suspected fraud, unauthorized access, lost or misdirected data, a material error found after issue, a near miss where a mistake was caught late, or pressure to record an entry without support. Near misses must be reported because they reveal control weaknesses before harm occurs.

Anyone who identifies suspicious activity must not investigate alone, confront the person involved, alter evidence, or discuss the matter with that person. Preserve relevant records, note observations with times and sources in a secure location, and escalate promptly. If the concern involves senior management or the normal reporting line is compromised, use the audit committee or an independent whistleblowing channel where one exists. Retaliation against good-faith reporters is prohibited.

• Mandatory: where a person is threatened or injured, call local emergency services first, then notify management.
• Mandatory: report suspected fraud, data breach, or material error to the controller and internal audit within one working day, or immediately if assets or personal data are at active risk.
• Mandatory: notify the information security function immediately for suspected account compromise, fraudulent payment instructions, or data exposure.
• Mandatory: do not reverse, delete, or overwrite suspicious entries until the review authority has agreed how evidence will be preserved.
• Recommended: maintain an escalation matrix with named contacts, deputies, and after-hours contact methods.
• Where legal reporting obligations apply, the finance leader and legal counsel decide timing and content under the applicable framework and local law.

7Records, Training, Monitoring, and Review

Records must be complete, retrievable, and sufficient for an independent reviewer to understand each reported figure. Retention periods depend on tax, corporate, and employment law and must be verified locally. Training ensures staff understand both the standards and the controls that protect them.

Controls are reviewed at least once each year and after significant events such as system changes, acquisitions, restatements, or control failures. Reviews must result in updated norms, not only a signed checklist. Lessons learned are shared without blame so that people report problems early.

• Mandatory: maintain an audit trail for each entry showing preparer, reviewer, source, approval, and supporting evidence.
• Mandatory: complete training on the applicable framework, internal controls, fraud awareness, and data protection before receiving posting or approval rights.
• Recommended: deliver refresher training when standards are amended or the entity changes its policies.
• Recommended: track control performance through measures such as late reconciliations, post-close adjustments, and open audit findings.

Implementation checklist

• Confirm your role, approval limits, and system permissions are documented and current.
• Verify that you never approve an entry, payment, or master data change you prepared.
• Attach support and a clear description to every manual journal entry.
• Document key estimates with assumptions, sources, and an accountable owner.
• Confirm reconciliations are prepared and independently reviewed on schedule.
• Verify changes to vendor bank details with a callback to a known number before paying.
• Store confidential files only in approved repositories and never send them to personal accounts.
• Report suspected fraud, data exposure, or material error promptly through the escalation path.
• Preserve evidence and do not alter or delete suspicious records.
• Verify current IFRS, GAAP, and local requirements with competent authorities or qualified professionals.