A lender moves its payment controls from quarterly to daily
An internal audit team tested vendor payments and disbursements once a quarter, on a sample. Moving the same controls onto every transaction, every day, found issues while they could still be stopped.
An illustrative scenario. The company is fictional and the figures show how the method works; they are not a client result.
The situation
A non-bank lender with a large branch network makes thousands of payments a day: loan disbursements, vendor payments, branch expenses and staff reimbursements. Internal audit tested them each quarter on a sample. By the time an exception was found, the money had long gone.
What we looked at
- Disbursements and the loan applications behind them
- Vendor payments and the vendor master, including bank detail changes
- Branch expense claims
- User access and approval logs
The controls we put on every transaction
| Control | What it flags |
|---|---|
| Disbursement to an account linked to staff | Possible conflict or fraud |
| Vendor bank change followed by a payment within days | Payment diversion risk |
| Duplicate or split vendor invoices | Overpayment or limit avoidance |
| Expenses claimed twice across branches | Duplicate reimbursement |
| Approvals by users outside their limit | Control breakdown |
What happened
In the first month, the system raised far more exceptions than the team could review. Tuning thresholds and adding known exceptions brought that down to a daily list each owner could clear. From then on, most exceptions were reviewed within days of the transaction, not months.
What changed
- From sample to population. Every transaction is tested every day.
- From audit to owners. Exceptions go to the business owner first; audit reviews how they are closed.
- From findings to value. The audit committee sees what was stopped and what it was worth, not just how many tests ran.
Products and services
CompliBear runs the controls and routes each exception. Read Continuous controls monitoring: a buyer’s guide, or see continuous controls monitoring.