How does your business handle urgent payment or access requests that seem to come from leaders? 1. How does your business handle urgent payment or access requests that seem to come from leaders?
We usually act on them if the voice or message seems genuine. Some people call back to check, but there is no agreed rule. There is a written rule: verify through a known channel, use a code word and follow normal approval.
Do leaders and payment staff have an agreed code word or equivalent check for urgent requests? 2. Do leaders and payment staff have an agreed code word or equivalent check for urgent requests?
No, we have never discussed it. We have talked about it, but it is not in use. Yes, it was agreed in person, is used for urgent requests and is changed when needed.
Is there guidance on what staff may and may not put into AI tools? 3. Is there guidance on what staff may and may not put into AI tools?
No guidance; people use whatever tools they like. People have been told informally to be careful. A short written AI-use policy lists approved tools, a “never paste” list and who reviews output.
When someone receives a suspected deepfake or AI-assisted scam, what happens? 4. When someone receives a suspected deepfake or AI-assisted scam, what happens?
It is usually ignored or deleted if nothing was lost. Sometimes it is mentioned to a manager. It is reported to a known contact, details are kept safely and the lesson is shared without blame.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered