Role-playing Game Level 2 (Risk Analyses)

Decision Points	Segregation of Duties (SOD) & CARE	Risk(s) if Missing the SOD	How does the SOD Mitigate the Risk(s)?
Creating purchase requisition	C: Inventory (INV) A: Purchasing (PUR)	If the purchasing department creates a purchase requisition, then the purchasing department may order an excessive amount of inventory that exceeds the capacity of the warehouse.	The inventory clerk safeguards the inventory and creates a purchase requisition by specifying inventory items and quantities. The purchasing department then interacts with the vendor and creates a purchase order.
Creating purchase order
Receiving goods
Processing invoice
Processing payment

Instructions about finishing the risk-analyses table:

1. The first row is a template for you to follow.
2. The Segregation of Duties (SOD) & CARE column might include more than two departments (e.g., the three-way match control has three parties).
3. The Risks if Missing the SOD may contain either fraud risks or non-fraud risks.
4. The How does the SOD Mitigate the Risks(s)? column has a limited scope that students can only discuss the SOD controls. Controls other than SODs (e.g., password control for employees or data input controls ) are beyond the scope.