Skip to main content
← All controls
AT-2 / A.6.3 / CIS-14.2 NIST SP 800-53 Rev 5

Are invoice / payment fraud awareness habits in place for whoever handles money?

Demonstrate that all personnel with invoice approval or payment authorization authority have received documented training on invoice and payment fraud tactics, and that verification procedures are understood and practiced.

Description

What this control does

This control ensures that personnel authorized to process invoices, approve payments, or initiate wire transfers receive targeted training on common fraud tactics such as business email compromise (BEC), vendor impersonation, invoice manipulation, and social engineering techniques used to divert funds. Training emphasizes verification procedures including multi-channel confirmation of payment changes, scrutiny of sender domains and email headers, and escalation protocols for unusual requests. Effective fraud awareness directly reduces financial losses from increasingly sophisticated payment diversion schemes that exploit human trust and process gaps.

Control objective

What auditing this proves

Demonstrate that all personnel with invoice approval or payment authorization authority have received documented training on invoice and payment fraud tactics, and that verification procedures are understood and practiced.

Associated risks

Risks this control addresses

  • Business email compromise attacks that impersonate executives or vendors to redirect wire transfers to attacker-controlled accounts
  • Invoice manipulation where attackers submit fraudulent invoices for goods or services never rendered, exploiting weak verification controls
  • Vendor impersonation schemes where attackers pose as legitimate suppliers with altered banking details in otherwise authentic-looking correspondence
  • Spear phishing campaigns targeting accounts payable staff with urgent payment requests designed to bypass normal approval workflows
  • Compromise of legitimate vendor email accounts used to send fraudulent payment change notifications that appear genuine
  • Social engineering attacks that create artificial urgency or authority pressure to process payments without standard verification steps
  • Insider fraud where personnel exploit insufficient segregation of duties or oversight to process unauthorized payments for personal gain

Testing procedure

How an auditor verifies this control

  1. Obtain the current roster of all personnel with invoice approval authority, payment processing privileges, or wire transfer initiation rights from HR and the finance department
  2. Request training records showing completion dates, curriculum content, and attendance for fraud awareness training specific to payment and invoice fraud within the last 12 months
  3. Review the fraud awareness training materials to verify they include concrete examples of BEC attacks, invoice manipulation tactics, vendor impersonation techniques, and verification procedures
  4. Interview a representative sample of at least three personnel from different roles (e.g., accounts payable clerk, finance manager, executive with payment authority) to assess their understanding of fraud indicators and verification protocols
  5. Examine documented procedures for payment processing to confirm they include multi-channel verification requirements for payment changes, domain verification steps, and escalation paths for suspicious requests
  6. Request evidence of recent real-world verification actions, such as call logs, email chains, or incident reports where staff questioned or verified suspicious payment requests
  7. Test whether personnel can identify fraud indicators by presenting sanitized examples of fraudulent invoices or BEC emails and observing their response process
  8. Verify that refresher training is scheduled at defined intervals and that new hires with financial authority receive fraud awareness training during onboarding before gaining payment privileges
Evidence required Training completion records including dates, attendee names, and course content showing fraud awareness topics; policy documents or standard operating procedures detailing payment verification requirements and multi-channel confirmation steps; interview notes demonstrating staff knowledge of BEC tactics, vendor verification protocols, and escalation procedures; examples of verification actions taken such as call logs or email confirmations for payment changes; simulation or phishing exercise results if available.
Pass criteria All current personnel with invoice approval or payment authority have completed documented fraud awareness training within the past 12 months that covers BEC, invoice manipulation, and vendor impersonation, and interviewed staff can articulate specific verification steps they perform when processing payments or encountering unusual requests.