Evaluate acceptable risk levels for the specific organization to address according to the risk appetite.

Risk (What Could Go Wrong?)

The credit manager fails to follow management's policies for establishing credit limits (e.g., provides greater amounts of credit than prescribed by the policy).

Shipping terms are incorrectly entered into the customer database for customers (e.g., "FOB Destination" is entered in error instead of "FOB Shipping Point").

Sales process employees violate established segregation of duties (e.g., deficient ITGC access controls allowed a sales employee in a Canadian location to inappropriately lower the pricing for a particular customer in exchange for an illicit payment sale).

Incorrect pricing is shown in the pricing database from erroneous direct data access, price changes that are not detected in a timely manner, or price changes that are not detected at all. The ERP software logs such accesses, but the reports detailing such access are not reviewed or resolved (potential for errors or fraud).

Unauthorized changes are made to the pricing list (templates).

The sales order process application (SOPA) fails to process a customer's order.

The sales order process application (SOPA) fails to identify new customers who need credit approvals or existing customers whose order will cause the balance to exceed the approved credit limit and creates a sales order without approval.

Sales process employees violate established segregation of duties (e.g., deficient ITGC access controls allowed a sales employee in a Canadian location to inappropriately lower the pricing for a particular customer in exchange for an illicit payment. Sales employees will have certain access to the sales application, but appropriate segregation of duties would not allow them access to the pricing module.).

The sales order process application (SOPA) fails to correctly interface with the shipping process application (SPA), resulting in orders that are not shipped.

Customer data is incorrect in the customer database.