Internal Controls, Risk and Fraud Prevention

Introduction and Context

Payroll is often treated as a routine administrative process, yet it is one of an organization’s most financially sensitive and legally exposed systems. It converts employment records into recurring payments, tax withholdings, benefit deductions, accounting entries, and statutory reports. A small data error may affect one employee; a weak control environment can affect thousands of employees and create substantial financial, regulatory, reputational, and employee-relations consequences.

Payroll risk is not limited to deliberate fraud. It also arises from inaccurate master data, unauthorized pay-rate changes, duplicate payments, incorrect termination processing, excessive access privileges, poor interface controls, and failure to reconcile payroll with the general ledger and bank statement. Effective payroll administration therefore requires a control system that is preventive, detective, corrective, documented, proportionate to risk, and capable of producing reliable evidence.

Internal control is the organized set of policies, procedures, responsibilities, systems, and monitoring activities designed to provide reasonable—not absolute—assurance that objectives will be achieved. In payroll, those objectives normally include:

• paying the correct person;
• paying the correct amount at the correct time;
• complying with employment, tax, social-security, pension, and benefits requirements;
• protecting confidential employee information;
• recording payroll completely and accurately; and
• preventing, detecting, investigating, and correcting irregular activity.

The strategic importance of payroll controls lies in the relationship between operational reliability and organizational trust. Employees interpret payroll accuracy as evidence of managerial competence and fairness. Regulators and auditors interpret control quality as evidence of governance maturity. Senior management therefore should view payroll controls as an enterprise risk-management responsibility rather than merely a payroll-office concern.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Explain the purpose and limitations of internal control in payroll administration.
2. Design segregation-of-duties arrangements for payroll activities.
3. Apply authorization controls to employee master data, time, pay rates, deductions, and payments.
4. Explain how audit trails, reconciliations, exception reporting, and access controls reduce payroll risk.
5. Use a risk-based control model to assess ghost employees, unauthorized payments, errors, and cyber-related threats.
6. Evaluate a payroll-control failure and recommend proportionate corrective action.
7. Discuss ethical, governance, regulatory, and technological implications of payroll control design.

1. The Internal-Control Architecture of Payroll

A useful payroll control architecture can be understood through five connected components: control environment, risk assessment, control activities, information and communication, and monitoring. This structure is consistent with widely used internal-control frameworks, including the COSO model, although organizations may use different terminology or formal standards.

1.1 Control environment

The control environment establishes expectations about integrity, accountability, competence, and responsible use of authority. It includes the board’s oversight, management’s attitude toward control, organizational structure, ethical standards, job descriptions, disciplinary practices, and the independence of payroll review.

A technically sophisticated payroll system cannot compensate for a weak control environment. If managers routinely approve their own changes, ignore unexplained exceptions, or pressure payroll staff to bypass procedures, formal controls become symbolic. Conversely, a strong environment makes control compliance part of normal professional conduct.

Important environmental features include:

• a documented payroll policy;
• clearly assigned process ownership;
• mandatory training in payroll confidentiality and fraud awareness;
• a confidential reporting channel for suspected misconduct;
• defined consequences for control violations; and
• periodic independent review by internal audit, compliance, or an equivalent function.

1.2 Risk assessment

Risk assessment identifies what could go wrong, how likely it is, what impact it could have, and which controls are appropriate. Payroll risk assessment should consider both inherent risk and residual risk.

Inherent risk is the exposure before controls are applied. Residual risk is the exposure that remains after controls operate. A simple prioritization model may use a risk score:

where R is the risk score, L is the assessed likelihood, and I is the assessed impact. If both dimensions are scored from 1 to 5, the resulting score ranges from 1 to 25. This is a prioritization device, not a probability calculation. It assumes that the organization uses a consistent ordinal scale and understands that multiplying ordinal ratings does not produce a precise monetary expectation.

For decisions involving expected financial loss, a different model may be more appropriate:

where EL is expected loss in monetary units, p is the estimated probability of an event during a defined period, and E is the financial exposure if it occurs. This model is useful only when probability and exposure estimates are meaningful and refer to the same time period and event definition.

Payroll risk assessment should also consider velocity: how quickly a loss can accumulate. A fraudulent employee record that generates a payment every pay period may have moderate individual impact but high cumulative exposure because it repeats automatically.

1.3 Control activities

Control activities are the specific actions that address risk. They may be preventive, detective, or corrective.

A strong control system uses several types together. A preventive control may fail because an authorized user acts improperly; a detective control may identify the issue; and a corrective control may limit the damage.

1.4 Information, communication, and monitoring

Payroll information must reach the people who need it without exposing confidential data unnecessarily. Reports should be accurate, timely, understandable, and traceable to source records. Employees should know how to report suspected errors or retaliation, while managers should understand their approval responsibilities.

Monitoring determines whether controls continue to operate effectively. It may be continuous, such as automated exception reporting, or periodic, such as an annual access review. Monitoring should distinguish between a control’s design effectiveness—whether it could address the risk—and operating effectiveness—whether it actually operated as intended.

2. Segregation of Duties

Segregation of duties is the separation of incompatible responsibilities so that one person cannot initiate, approve, execute, and conceal an unauthorized transaction. In payroll, the central incompatible functions are:

1. maintaining employee and pay data;
2. approving employment, compensation, time, and deductions;
3. processing payroll calculations;
4. releasing payment;
5. reconciling payroll and bank activity; and
6. reviewing exceptions and investigating irregularities.

A typical arrangement separates human resources, line management, payroll, treasury, accounting, and internal audit. The precise allocation depends on organizational size and system design.

The key principle is not that every activity must have a different person, but that no individual should control a complete transaction path without independent review. In a small organization, full segregation may be impractical. Compensating controls may include owner review of the payroll register, direct bank-statement review, employee confirmation reports, mandatory leave, and independent review of master-file changes.

A segregation-of-duties matrix can identify conflicts. For example, a user who can create employees and release payments presents a high-risk combination, particularly if that user can also modify bank-account information. Access should be analyzed by actual system capability, not merely by job title.

3. Authorization Controls

Authorization controls establish who may approve an action, under what conditions, and with what evidence. Payroll authorization should be specific, documented, timely, and linked to the underlying business event.

3.1 Employee master data

The employee master file is a high-risk asset because it determines who is eligible to receive payment and where payment is sent. New records should be supported by approved hiring documentation, a unique employee identifier, employment status, start date, position, pay basis, work location, tax information, and bank details obtained through a controlled process.

Changes should be supported by an authorized personnel action, such as a promotion, approved salary review, transfer, change in working hours, or legal deduction order. Verbal instructions and informal email requests should not be sufficient for high-impact changes.

3.2 Time, attendance, and variable pay

Time records, overtime, commissions, bonuses, allowances, and expense reimbursements should be approved by someone with direct knowledge of the underlying activity. Approval should occur before payroll cutoff and should include review of unusual amounts, missing records, and conflicts of interest.

A manager should not approve their own overtime or variable compensation. Where the system permits self-approval, an exception report should identify it automatically.

3.3 Payment authorization

The final payroll register should be approved before the payment file is transmitted. Approval should cover total gross pay, deductions, employer liabilities, net pay, number of employees, significant changes from the prior period, and unresolved exceptions. Bank-file release should normally require two authorized individuals or a formally documented equivalent.

Authorization does not mean merely clicking a button. The approver must have sufficient information, competence, time, and independence to exercise informed judgment. A control becomes weak when approvals are routine, retrospective, or unsupported by evidence.

4. Audit Trails and Evidence

An audit trail is the chronological record of transactions, changes, approvals, system events, and supporting documentation. It enables an investigator to answer five questions: who acted, what changed, when it changed, why it changed, and who approved it.

A reliable audit trail should capture:

• original and revised values;
• user identity, not merely a shared account;
• date and time, preferably synchronized to a reliable clock;
• approval status and approving user;
• source document or workflow reference;
• interface or batch identifier; and
• reversal, correction, or deletion history.

Audit logs must be protected from unauthorized alteration. Payroll administrators should not be able to erase their own activity records. Log retention should reflect legal, tax, audit, and organizational requirements, with attention to privacy and data minimization.

The absence of an audit trail is itself a control deficiency. It does not prove fraud, but it limits accountability and makes error investigation more difficult. Organizations should avoid relying on screenshots as the primary evidence of approval because screenshots can omit metadata and are difficult to validate. System-generated records linked to source documents are generally stronger evidence.

5. Reconciliations and Exception Monitoring

Reconciliation compares two independently generated records and investigates differences. It is one of the most important detective controls in payroll.

5.1 Core payroll reconciliations

A complete payroll-control program normally includes:

• payroll register to general ledger;
• payroll register to bank payment file;
• bank payment file to bank statement;
• employee master file to HR records;
• current-period headcount to approved employment records;
• statutory deductions to remittance reports;
• benefit deductions to provider invoices;
• payroll liability balances to subsequent settlements; and
• current-period results to prior-period results.

Reconciliation should be performed by a person who did not prepare the underlying transaction, where feasible. Every difference should be classified as expected, timing-related, or unexplained. Unexplained differences require documented investigation and resolution.

5.2 Illustrative reconciliation

Assume a payroll register shows net pay of $482,600. The approved bank file totals $481,900, and the bank statement shows $481,900. The $700 difference between the register and bank file may represent a legitimate held payment, but it cannot be ignored. The reviewer should identify the employee, document the reason, confirm that the payment was not improperly removed, and ensure that the accounting entry and subsequent payment are correct.

A reconciliation is not effective merely because two totals are compared. It must be timely, independently prepared, supported by evidence, and followed through to resolution.

5.3 Exception reporting

Exception reports direct attention toward unusual events. Examples include:

• duplicate bank-account numbers;
• employees sharing addresses or bank accounts without a documented reason;
• payments after termination date;
• unusually large overtime or bonus amounts;
• manual checks and off-cycle payments;
• changes immediately before payroll cutoff;
• inactive employees receiving pay;
• negative net pay or unusual deductions;
• repeated rounding or adjustment entries; and
• users changing and approving the same record.

An exception is not proof of misconduct. It is a signal requiring risk-based review. Poorly designed exception reports generate excessive false positives, causing reviewers to ignore them. Effective analytics combine thresholds, peer comparisons, historical patterns, and business context.

6. Ghost Employees and Unauthorized Payments

A ghost employee is a fictitious person or an invalid employee record maintained so that payments can be diverted or improperly retained. Ghost employees may be created by an insider, arise from incomplete termination processing, or result from duplicate records.

Common indicators include:

• no corresponding employment documentation;
• no manager, department, work location, or attendance record;
• bank or address details shared with another employee;
• payments continuing after termination;
• repeated manual adjustments;
• employee records created by payroll users rather than HR; and
• unusual concentration of records under one administrator.

Prevention begins with controlled onboarding. HR should create or initiate the record, management should confirm the position and start date, and payroll should process payment only after required fields and approvals are complete. Periodic employee existence verification can include manager certifications, comparison with access-card or scheduling data, and confirmation of active employment status.

These methods must be used carefully. Biometric or location data may create privacy, discrimination, and data-security risks. Verification should be proportionate, transparent, legally permitted, and limited to legitimate purposes.

Unauthorized payments may also result from bank-account substitution, duplicate payroll, fabricated overtime, false bonuses, excessive deductions, or manipulation of payment files. Strong controls therefore protect both the employee master file and the payment transmission process.

7. Technology, Access, and Cybersecurity

Modern payroll environments typically include HR information systems, time-and-attendance applications, payroll engines, banking platforms, cloud services, and interfaces to accounting and benefits systems. Each interface introduces risk.

Access should follow least privilege: users receive only the permissions necessary for their responsibilities. Role-based access should be reviewed at onboarding, transfer, and termination, and periodically thereafter. Privileged access should be limited, monitored, and preferably protected by multifactor authentication.

Important technology controls include:

• unique user IDs and prohibition of shared accounts;
• multifactor authentication for sensitive functions;
• automated approval workflows;
• interface validation and rejected-record reports;
• encryption in transit and at rest where appropriate;
• backup, recovery, and business-continuity procedures;
• change management for payroll rules and software;
• vulnerability and patch management; and
• independent review of privileged activity.

Artificial intelligence and anomaly detection can help identify unusual payment patterns, but they do not replace governance. A model may reproduce biased assumptions, generate false positives, or fail when fraud patterns change. Human review, explainability appropriate to the use case, data-quality controls, and documented escalation procedures remain essential. AI should support—not eliminate—professional judgment and accountability.

8. A Risk-Based Control Model

A risk-based model allocates control effort according to exposure rather than applying identical procedures to every payroll event. The following sequence is practical:

1. Define the payroll objective.
2. Identify the event that could prevent its achievement.
3. Assess likelihood, impact, velocity, and detectability.
4. Identify existing preventive and detective controls.
5. Evaluate residual risk.
6. Select additional controls where residual risk exceeds tolerance.
7. Assign an owner, frequency, evidence requirement, and escalation path.
8. Test design and operating effectiveness.
9. Reassess after changes or incidents.

Detectability is important because two risks with similar financial impact may require different controls if one is easily detected and the other can remain hidden for months. Risk appetite should be explicit. For example, an organization may tolerate minor timing differences but have zero tolerance for unauthorized access to bank files or deliberate concealment of payroll changes.

Control testing should examine both samples and system-wide information. Sampling can test whether approvals exist, while data analytics can identify every duplicate account or payment after termination. Neither approach is sufficient alone for all risks.

9. Illustrative Case: The Northbridge Services Payroll Failure

This is a fictional illustrative case designed for educational use.

Background

Northbridge Services employs 1,800 people across three regions. HR enters employee data into a cloud HR system, payroll calculates pay, and treasury uploads a bank file. The payroll manager also has permission to create employee records, approve adjustments, and release payments because the organization reduced staff during a restructuring.

Problem

An internal audit review identified twelve employee records with no current manager, four shared bank accounts, and six payments made after recorded termination dates. The payroll register agreed to the bank statement, so management initially concluded that no loss had occurred. However, the audit trail showed that the payroll manager had created five records and approved adjustments for four of them. The system did not require a second approver for bank-account changes.

Analysis

The reconciliation was incomplete: it confirmed that the amount paid by the bank matched the payment file, but it did not establish that every payment was valid. The principal control weaknesses were:

• incompatible access rights;
• inadequate onboarding evidence;
• no independent review of termination exceptions;
• weak bank-account change controls;
• insufficient monitoring of shared data; and
• overreliance on aggregate reconciliation.

The risk was high because the same user could create a record, alter payment details, approve an adjustment, and release funds. The absence of a variance in total payroll did not reduce the risk of diversion between valid and invalid recipients.

Approach and solution

Northbridge immediately suspended high-risk access, preserved logs, and initiated an independent investigation. It confirmed active employment with managers and HR, reviewed bank-account changes for the previous eighteen months, and contacted the bank and affected employees where appropriate.

The redesigned control model assigned HR responsibility for employee creation, required manager and HR approval for employment status, required dual approval for bank-account changes, and transferred payment release to treasury. Payroll could calculate and review payroll but could not create employees or release funds. A daily exception report identified post-termination payments, shared bank accounts, and records created near cutoff. A monthly reconciliation was expanded to include HR headcount, approved employment actions, bank files, and termination data.

Outcome

The investigation found two invalid records and one misdirected payment. The organization recovered the payment, corrected employee records, and reported the incident through its governance process. More importantly, Northbridge recognized that control effectiveness depends on the complete transaction lifecycle, not merely on whether total payroll reconciles to the bank.

Learning points

1. Aggregate agreement can conceal invalid individual transactions.
2. Access combinations are often more important than individual permissions.
3. Ghost-employee prevention begins with controlled master data.
4. Exception reports require investigation and documented closure.
5. Small teams need compensating controls rather than informal trust.
6. Incident response should preserve evidence before records are changed.

10. Governance, Ethics, and Regulatory Considerations

Payroll controls must protect both organizational assets and employee rights. Payroll data commonly contains identity information, bank details, tax identifiers, compensation, health-related deductions, and family information. Access and retention should therefore comply with applicable privacy and employment laws.

Organizations should collect only information necessary for legitimate payroll and employment purposes, restrict access according to role, protect data during transfer, and provide appropriate transparency to employees. Investigations should respect due process and avoid treating an exception as proof of guilt.

Ethical control design requires fairness. A control that subjects a particular group to excessive surveillance, delays lawful pay, or creates barriers for employees with disabilities may be technically effective but ethically unacceptable. Management should consider proportionality, consistency, accessibility, confidentiality, and the possibility of retaliation against whistleblowers.

Regulatory obligations vary by jurisdiction, but commonly include accurate wage payment, tax withholding, statutory reporting, record retention, minimum wage and overtime compliance, privacy, anti-fraud requirements, and financial-record integrity. Payroll managers must coordinate with legal, tax, information-security, and internal-audit specialists rather than assume that a payroll system automatically ensures compliance.

11. Limitations and Implementation Challenges

No control system eliminates risk. Controls may fail because of collusion, management override, poor data quality, system outages, rushed processing, excessive complexity, or inadequate training. Strong controls also create cost and delay. The objective is reasonable assurance at an acceptable cost, not perfect certainty.

Common implementation challenges include:

• limited staffing in small organizations;
• multiple systems with inconsistent employee identifiers;
• outsourced payroll providers and unclear accountability;
• rapid organizational restructuring;
• remote work and distributed approvals;
• legacy systems with weak audit logs;
• high volumes of temporary or contingent workers; and
• alert fatigue from poorly designed analytics.

Outsourcing does not transfer ultimate accountability. Contracts should define service levels, control responsibilities, data ownership, incident notification, audit rights, access management, retention, subcontracting, and business continuity. Management should obtain and evaluate independent assurance reports where relevant, while recognizing that a service-provider report does not replace organization-specific oversight.

Best-Practice Control Checklist

A mature payroll-control environment should be able to demonstrate that:

• responsibilities and incompatible duties are documented;
• employee creation and compensation changes require authorized evidence;
• payroll and payment release are separated;
• access is least-privilege, unique, reviewed, and promptly removed;
• audit logs are complete and protected;
• payroll, HR, bank, ledger, and statutory records are reconciled;
• exceptions are risk-ranked, investigated, and closed;
• manual and off-cycle payments receive enhanced review;
• privacy, retention, and regulatory requirements are addressed;
• control performance is tested and reported to appropriate governance bodies; and
• incidents lead to root-cause analysis and control improvement.

Chapter Summary

Payroll internal control is a governance system for ensuring that the right people receive the right amounts, that statutory and accounting obligations are met, and that irregularities are prevented or detected promptly. Its foundation is a strong control environment supported by risk assessment, effective control activities, reliable information, communication, and monitoring.

Segregation of duties reduces the opportunity for one person to create, approve, pay, and conceal an invalid transaction. Authorization controls establish evidence-based approval for employee records, compensation, time, deductions, and payment files. Audit trails create accountability by recording who changed what and when. Reconciliations compare independent records, while exception reporting focuses professional attention on unusual or high-risk events.

Ghost employees and unauthorized payments require particular attention to employee master data, bank-account changes, termination processing, access rights, and payment-file release. Technology, analytics, and AI can improve detection, but they require sound data, human oversight, privacy safeguards, and clear accountability. A risk-based model enables organizations to direct resources toward high-impact, difficult-to-detect, and rapidly accumulating threats.

The strategic lesson is that payroll reliability depends on the entire transaction lifecycle. A payroll total that agrees with a bank statement is not sufficient evidence that every payment was valid. Effective control combines prevention, detection, correction, ethical governance, and continuous improvement.

Key Terms

Internal control: Policies and procedures that provide reasonable assurance over objectives such as reliable processing, compliance, and asset protection.

Control environment: The organizational culture, governance, structure, and ethical expectations that influence control behavior.

Risk assessment: The process of identifying, analyzing, prioritizing, and responding to risks.

Residual risk: Risk remaining after existing controls operate.

Segregation of duties: Separation of incompatible responsibilities to reduce error and fraud opportunities.

Authorization control: A control requiring an approved person to validate an action before it is completed.

Employee master file: Core data identifying employees and the conditions under which they are paid.

Audit trail: A chronological record of transactions, changes, users, approvals, and system events.

Reconciliation: Comparison of independent records followed by investigation of differences.

Exception report: A report highlighting unusual, incomplete, or potentially unauthorized activity.

Ghost employee: A fictitious or invalid employee record used to obtain or divert payroll payments.

Least privilege: The principle that users receive only the access necessary for their duties.

Compensating control: An alternative control used when a preferred control, such as full segregation, is impractical.

Preventive control: A control designed to stop an error or irregularity before it occurs.

Detective control: A control designed to identify an error or irregularity after it occurs.

Corrective control: A control that resolves an identified problem and reduces recurrence.

Control owner: The person accountable for operating and evidencing a control.

Management override: Intentional circumvention of established controls by an authorized manager.

Control effectiveness: The extent to which a control is properly designed and operates as intended.

Payroll fraud: Deliberate deception involving payroll data, calculations, approvals, or payments.

Review Questions

Short Answer Questions

1. What are the principal objectives of payroll internal control?
2. Distinguish preventive, detective, and corrective controls.
3. Why is segregation of duties important in payroll administration?
4. What information should a reliable payroll audit trail capture?
5. Why does agreement between a payroll register and a bank statement not prove that every payment is valid?

Long Answer Questions

1. Explain how the five components of an internal-control framework apply to payroll administration.
2. Design a segregation-of-duties matrix for a medium-sized organization with separate HR, payroll, accounting, and treasury functions.
3. Discuss the role of reconciliations and exception reporting in detecting payroll errors and fraud.
4. Evaluate the ethical, privacy, and governance issues associated with employee-existence verification.
5. Explain how a risk-based control model should be implemented and monitored over the payroll lifecycle.

Analytical / Application Questions

1. A payroll officer can create employees, change bank accounts, process payroll, and release payment, but a finance manager reviews the monthly payroll total. Identify the principal risks and propose a proportionate redesign for a small organization.
2. A company discovers several shared bank accounts and payments continuing after termination. Develop an investigation plan that preserves evidence, protects employee rights, and addresses immediate and systemic risk.
3. An AI tool flags employees with unusually high overtime, but most alerts are legitimate because of seasonal work. How should management redesign the monitoring approach while preserving fraud-detection capability?

Multiple Choice Questions with Answers

Question 1

Which arrangement best demonstrates segregation of duties in payroll?

A. One payroll officer creates employees, approves changes, and releases payments

B. HR creates employee records, payroll calculates pay, and treasury releases funds

C. A line manager approves their own overtime and payroll processes it

D. The payroll manager performs the calculation and the same manager reconciles the bank account

Correct Answer: B. HR creates employee records, payroll calculates pay, and treasury releases funds

Question 2

What is the primary purpose of a payroll audit trail?

A. To eliminate the need for approvals

B. To record who changed what, when, and under whose authority

C. To guarantee that fraud cannot occur

D. To replace all payroll reconciliations

Correct Answer: B. To record who changed what, when, and under whose authority

Question 3

Which is the strongest preventive control over a bank-account change?

A. Reviewing the bank statement annually

B. Allowing payroll staff to change accounts without documentation

C. Requiring documented evidence and independent approval before the change takes effect

D. Comparing total payroll with the prior month

Correct Answer: C. Requiring documented evidence and independent approval before the change takes effect

Question 4

A payroll register totals $482,600 and the approved bank file totals $481,900. What should the reviewer do first?

A. Assume the difference is immaterial

B. Process the difference as a general adjustment

C. Identify and document the specific reason for the $700 difference

D. Delete the payroll register

Correct Answer: C. Identify and document the specific reason for the $700 difference

Question 5

Which finding is a potential ghost-employee indicator?

A. An employee has an approved promotion

B. An employee has a documented manager and attendance record

C. A record has no employment documentation and shares a bank account with another record

D. An employee receives a regular salary under an approved contract

Correct Answer: C. A record has no employment documentation and shares a bank account with another record

Question 6

Using the illustrative risk-prioritization model R = L × I, what score results when likelihood is 4 and impact is 5?

A. 9

B. 16

C. 20

D. 25

Correct Answer: C. 20

Question 7

Which principle requires users to receive only the access necessary for their duties?

A. Management override

B. Least privilege

C. Gross-up accounting

D. Open access

Correct Answer: B. Least privilege

Question 8

Why is aggregate agreement between payroll and the bank insufficient by itself?

A. The bank never records payments

B. Invalid payments can be included in a correctly totaled payment file

C. Payroll totals are never used in accounting

D. Reconciliations are always preventive controls

Correct Answer: B. Invalid payments can be included in a correctly totaled payment file

Question 9

Which is an example of a compensating control in a small organization?

A. Allowing shared user accounts

B. Removing all approval requirements

C. Independent owner review of the payroll register and bank statement

D. Permitting one person to conceal changes

Correct Answer: C. Independent owner review of the payroll register and bank statement

Question 10

What is the most appropriate role of AI anomaly detection in payroll control?

A. Replace all human investigation

B. Automatically discipline every employee flagged

C. Support risk-based review while retaining human oversight and governance

D. Remove the need for accurate source data

Correct Answer: C. Support risk-based review while retaining human oversight and governance