ACCA SBL Diagnostic

The present process concentrates supplier creation, payment release and reconciliation under one senior officer. This creates an opportunity for a fictitious supplier to be created, paid and concealed during reconciliation. The board should separate supplier approval, payment authorisation and reconciliation. Procurement should verify new suppliers, two authorised signatories should approve material payments, and an employee independent of payment processing should complete the reconciliation. A monthly exception report covering new suppliers, unusual bank-detail changes and overridden controls should be reviewed by the audit committee. These measures should be implemented first because transaction volume is increasing as the company grows, increasing the likelihood that fraud or error remains undetected.

The incident exposes weaknesses in both operational resilience and board oversight. Untested backups cannot be assumed to support recovery, while annual reporting prevents directors from monitoring a rapidly changing risk. During the first 30 days, management should isolate affected systems, preserve evidence, confirm legal and customer-notification duties and test restoration from clean backups. By day 60, the chief information security officer should complete a root-cause review, remove unsupported access and implement multi-factor authentication for privileged accounts. By day 90, the risk committee should receive a cyber dashboard covering recovery time, critical vulnerabilities, backup-test success and overdue remediation. The board should also run a scenario exercise. These actions convert cyber risk from an annual compliance discussion into a monitored resilience programme.

A joint venture is initially preferable because it provides local regulatory knowledge, distribution relationships and shared investment while limiting the manufacturer’s exposure. An acquisition would provide greater control, but the company’s limited international management experience increases integration and compliance risk. Approval should be conditional on due diligence over the partner’s ownership, reputation, licences and financial position; reserved decisions over brand, product safety and major capital expenditure; and clear exit, deadlock and intellectual-property provisions. The board should require a staged investment linked to regulatory approval, pilot-market performance and supply-chain quality measures. This approach preserves strategic flexibility and allows the company to build local capability before considering full ownership.

Delaying valid refunds would intentionally overstate current performance and undermine the integrity of management information used by the board. The request creates self-interest and intimidation threats because the divisional director benefits from the bonus and is pressuring the finance team. The finance director should refuse the adjustment, ensure refunds are recorded in the correct period and preserve the supporting communication. The matter should be reported through the organisation’s escalation process to the audit committee or those charged with governance. The bonus calculation should be reviewed and controls introduced so that material manual adjustments require independent approval. Protecting accurate reporting is more important than meeting a short-term target, particularly because distorted information could lead to poor pricing, cash-flow and investment decisions.

The six-week launch creates a material implementation risk because supervisors are untrained and employees do not understand how roles will change. Management should first confirm the business case, affected processes and measures of success, then identify stakeholder concerns through supervisor workshops and employee consultation. A pilot should be run in one warehouse before wider deployment, with parallel manual scheduling retained until accuracy and service levels are stable. Supervisors require role-based training and clear escalation procedures. Employees should receive honest information on role redesign, retraining and any workforce reductions rather than general reassurance. Weekly measures should cover schedule accuracy, delivery delays, overtime, safety incidents and user adoption. A staged launch is preferable to meeting an arbitrary date and disrupting customer service.

Customer growth alone is misleading because it measures acquisition without showing whether customers remain profitable. Rising cancellations may mean headline growth is being purchased through discounts while underlying value deteriorates. The board should receive customer acquisition cost, churn by cohort, net revenue retention, average revenue per user, contribution margin and lifetime value alongside gross additions. Measures should be segmented by channel and promotion so directors can distinguish sustainable growth from short-term volume. Definitions, data ownership and reconciliation to financial records should be documented, with exceptions investigated before reporting. The dashboard should also show trends and targets rather than isolated monthly figures. This would allow the board to evaluate both the quality and financial return of growth.