Do staff know exactly who to report suspicious emails, SMS, calls or chats to? 1. Do staff know exactly who to report suspicious emails, SMS, calls or chats to?
No clear contact. People decide for themselves. Most people would tell someone, but there is no agreed route. There is a named contact and simple route, and staff are thanked for reporting.
How are urgent payment or bank-detail change requests verified? 2. How are urgent payment or bank-detail change requests verified?
They are processed if they look genuine. Sometimes someone calls to check, but it depends on who is handling it. Always by a call to a known number plus a second approval, with no exceptions for urgency.
Does your team discuss real-world scam patterns, such as fake KYC, courier or job-offer messages? 3. Does your team discuss real-world scam patterns, such as fake KYC, courier or job-offer messages?
Rarely or never. Occasionally, when someone receives one. Regularly, with short examples shared in team meetings or a staff group.
If someone clicks a bad link or shares details by mistake, how quickly would it be raised? 4. If someone clicks a bad link or shares details by mistake, how quickly would it be raised?
Probably not at all, for fear of blame. Eventually, once something goes wrong. Immediately, because staff know honest reports are welcomed and acted on.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered