Before the Keys Change Hands: Five Fraud-Control Checks for Departing Finance and Compliance Staff

Compliance risk is rarely contained entirely in a policy library. A significant part of it sits in the working memory of the compliance lead, the data protection officer, the finance controller or the head of financial crime. They know why a control was designed in a particular way, which regulator query remains open, which exception was tolerated and where the supporting evidence can be found. When they leave, the organisation may retain the system but lose the context that makes the system defensible.

For UK businesses, the risk is not limited to a gap in the organisational chart. A departing finance or compliance officer can take with them the practical ownership of fraud-critical controls: dual payment approvals, supplier master data changes, expense analytics, whistleblowing triage, customer due diligence and sanctions screening. The result is often an ownerless control, a stale risk acceptance or an evidence trail that no one else can reconstruct.

Why the departure moment deserves a control test

A standard exit checklist confirms that laptops are returned and access is disabled. It does not confirm that the organisation can still operate its controls, respond to a regulator or evidence a decision. That is a different test. It should be triggered when notice is received, not when the leaving date is announced, and it should involve compliance, finance, HR, IT and internal audit.

The aim is continuity, not blame. The question is whether a competent successor could step into the role and run the control, answer the regulator and prove what happened. If the answer depends on asking the departing person one more question, the organisation has a handover gap.

1. Test the decision log, not just the procedure

Most controls have a written procedure. Fewer have a decision log explaining why the control exists in its current form, what alternatives were rejected and which risks were accepted. Check whether the organisation can identify, for each material control, the date of the last design decision, the approver, the rationale and the next review date.

Fraud prevention is particularly exposed here. A tolerance for manual payments, a temporary waiver of secondary approval or an exception for a long-standing supplier may have been accepted verbally. If those decisions are not recorded, the successor inherits the risk without the reasoning. Before the departure date, reconstruct material decisions into a dated log and have them approved by the appropriate committee or senior manager. Link each decision to the relevant fraud risk assessment and control testing record.

2. Reconcile regulator correspondence and open commitments

Regulatory contact is often held in a shared mailbox, a case management system or, less helpfully, in a personal inbox. Departing staff may be the only people who know that an information request was answered informally, that a follow-up was promised or that a supervisory letter required a board update.

A continuity test should sample open and recently closed correspondence with regulators such as the FCA, PRA, ICO, HMRC or Companies House, as relevant to the firm. For each item, confirm the reference, the responsible owner, the deadline, the response sent, any commitment made and the evidence retained. Anything still open should be reassigned to a named successor before the last working day, with legal or compliance oversight where appropriate. The test should also confirm that the board or risk committee has been told about material supervisory themes, rather than discovering them after the handover.

3. Identify ownerless controls and single-person dependencies

Map fraud-critical controls to roles rather than names. This distinction matters. If a control is owned by 'the finance controller' but only one person knows how to operate it, the organisation has a single-person dependency. If the control is owned by 'the head of compliance' and that post is vacant, the control may be ownerless.

Priority areas include payment approvals and bank mandate changes, supplier onboarding and master data amendments, expense and payroll anomaly reviews, whistleblowing triage, customer due diligence, sanctions screening and fraud risk assessment updates. For each, record the current owner, the backup, the evidence produced and the escalation route. Where a gap exists, appoint an interim owner, document the procedure and arrange shadowing before the departure date. The board should see a short list of controls that will remain fragile after the handover.

4. Hand over access beyond the IT ticket

Access handover is not complete when an account is disabled. Regulators, banks, payment providers and case management systems often use shared portals, role-based mailboxes and privileged accounts that sit outside standard joiners and leavers processes. A departing officer may be the only administrator for a regulator portal, the only approver on a bank mandate or the only subscriber to a supervisory update service.

Before the final day, confirm the transfer of portal administration, shared mailbox ownership, payment platform permissions, evidence repositories and alert subscriptions. Check that the successor has the right level of access, not merely a read-only account. Record the change, remove orphaned credentials and update the access register. Where segregation of duties is required, ensure the handover does not create a temporary concentration of access that weakens fraud controls.

5. Prove the evidence trail can survive the departure

A control that cannot be evidenced is difficult to defend to an auditor, a regulator or a board. Test a small sample of recent control activity and ask a successor to locate the approval, the review, the exception and the escalation. If the answer is 'the departing officer would know where that is', the evidence trail is person-dependent.

Check naming conventions, retention periods and repository permissions. UK GDPR and the Data Protection Act 2018 impose limits on retention, while sector rules may require longer periods for financial crime records. The test should confirm that evidence is retained for the required period, accessible to the right people and not stored solely in a personal drive or inbox. A short evidence index for each critical control is usually more useful than a large unstructured archive.

Running the test before the next resignation

Use notice periods as a trigger for a focused continuity review. A simple red-amber-green rating can show which controls are safe, which need shadowing and which will be ownerless on day one. Assign a continuity owner in compliance or finance, report the result to the risk committee and repeat the test after reorganisations, long-term absences and changes to outsourced arrangements.

The most useful outcome is not a lengthy report. It is a named successor, a dated decision log, a reconciled regulator file, a mapped set of controls, a completed access transfer and a sample of evidence that someone else can find. That is the practical difference between a documented compliance system and one that still works when the keys change hands.