“The supplier has changed its bank account. Please update today’s payment.” A short message can trigger a much larger accounting problem if the finance team treats an email as sufficient authority. An ACCA student investigating controls in a UAE trading-company scenario should follow the change from request to approval, system update and eventual payment.
This is a fictional learning case. It does not allege a weakness in any named UAE business and does not describe a local legal requirement. Its purpose is to make an audit recommendation precise enough that another person could test whether the control operated.
Reconstruct the process before judging it
Imagine a distributor whose accounts-payable clerk can create a supplier, amend its bank details and prepare the payment file. A purchasing manager approves invoices but sees only the supplier’s name and invoice amount. The payment authoriser assumes that master-data changes have already been checked.
The weakness is not simply “poor security”. The same employee can alter where money will go and prepare the transaction that sends it there. Approval of a valid invoice may therefore coexist with payment to an unauthorised destination.
Draw the sequence on one sheet: request received, identity verified, change approved, master record amended, exception reviewed, payment released. Place a named role beside every step. Where the diagram jumps from an email directly to a bank-field change, the missing decision becomes visible.
Define a control that addresses the actual risk
A stronger proposed process restricts supplier-master amendments to authorised staff who do not release payments. A second person verifies changed instructions using contact information established independently of the change request. The evidence should record what was checked, by whom and when.
Using the new telephone number supplied in the suspicious email would not be an independent check. Nor would forwarding the same attachment to a colleague and asking whether it looks genuine. The weakness concerns the authority behind the instruction, not whether the form looks professional.
A change report can help a reviewer identify amendments before the next payment run. It needs an owner, a review deadline and a record of how exceptions were resolved. Producing a report without somebody acting on it does little to prevent an incorrect payment.
Keep a control recommendation separate from its audit test
The recommendation describes what the company should do. A test of control asks whether that process actually operated. For a sample of supplier-bank changes, an auditor could inspect the approval trail, evidence of independent verification and the timing of the review relative to payment release.
If a staff member explains the policy confidently, that is not the same as evidence that it was followed for the sampled change. Likewise, a screenshot of current access rights does not by itself prove who had those rights during the earlier payment run.
Prepare a short answer that earns its conclusion
Use four connected sentences: identify the precise weakness; explain how it could lead to a misdirected payment; recommend an achievable control; describe the evidence needed to test operation. Avoid listing unrelated controls such as stock counts or customer credit limits just because they are familiar.
For further practice, change the scenario to a very small team that cannot separate every role. Propose a compensating independent review by an appropriate manager, explain its limits and identify the records that must survive. The answer should acknowledge resource constraints while still addressing the payment-destination risk.
Sources and further study
Explore ASA ACCA courses for your next paper, and check the course page for its current teaching language, syllabus coverage and access terms.