Prevent Misconduct at the Vulnerable Step

The principle

Integrity risk assessment asks where a process could be diverted from its legitimate purpose. Examine incentives, discretion, information gaps, and opportunities for concealment. Controls should address a plausible mechanism, rather than creating paperwork unrelated to the risk. Consider both likelihood and consequences, and assign an owner to the response.

Worked example

A fictional sports club reimburses travel expenses. One person can submit, approve, and pay their own claim, with no supporting record. The club separates approval from submission, requires proportionate documentation, and reviews unusual claims. The control targets a specific opportunity for misuse. Requiring every volunteer to sign a general honesty statement would be less directly connected to the vulnerable step.

Limits and judgment

Controls have costs and can create new problems if they are too burdensome or easily bypassed. A tiny routine purchase and a large unusual payment may warrant different review. Monitor whether the control operates and whether people find shortcuts around it. Risk assessment is a continuing conversation about how the actual process works, not a prediction that every identified risk will occur.

RETRIEVE. REASON. REMEMBER.

Knowledge check.

Choose one answer for each question, then check your reasoning.